From e62c0cfc3602cd799d79318046f5676049865a79 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 14 Sep 2026 02:47:31 +0200 Subject: [PATCH] Admit exact T03 human review mandate with caller-bound policy Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6 --- WORK-RECORDS.md | 4 + .../2026-09-14-t03-native-review-policy.json | 47 ++++ .../2026-09-14-t03-review-policy.json | 233 ++++++++++++++++++ examples/informed-decision-t03/fixtures.json | 21 ++ examples/informed-decision-t03/policy.md | 88 +++++++ examples/informed-decision-t03/records.json | 87 +++++++ examples/informed-decision-t03/registry.json | 1 + tools/exercise_t03_review_policy.py | 27 ++ values/informed-decision-t03.yaml | 24 ++ workplans/FLEX-WP-0027-t03-human-review.md | 53 ++++ 10 files changed, 585 insertions(+) create mode 100644 docs/evidence/2026-09-14-t03-native-review-policy.json create mode 100644 docs/evidence/2026-09-14-t03-review-policy.json create mode 100644 examples/informed-decision-t03/fixtures.json create mode 100644 examples/informed-decision-t03/policy.md create mode 100644 examples/informed-decision-t03/records.json create mode 100644 examples/informed-decision-t03/registry.json create mode 100644 tools/exercise_t03_review_policy.py create mode 100644 values/informed-decision-t03.yaml create mode 100644 workplans/FLEX-WP-0027-t03-human-review.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 62c15dd..5d6db20 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -34,6 +34,7 @@ | workplan | FLEX-WP-0024 | active | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md | | workplan | FLEX-WP-0025 | ready | — | workplans/FLEX-WP-0025-fact-versus-assertion.md | | workplan | FLEX-WP-0026 | finished | — | workplans/FLEX-WP-0026-openrouter-native-contract.md | +| workplan | FLEX-WP-0027 | active | — | workplans/FLEX-WP-0027-t03-human-review.md | | task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | | task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | | task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md | @@ -154,6 +155,9 @@ | task | FLEX-WP-0025-T03 | wait | — | workplans/FLEX-WP-0025-fact-versus-assertion.md | | task | FLEX-WP-0026-T01 | done | — | workplans/FLEX-WP-0026-openrouter-native-contract.md | | task | FLEX-WP-0026-T02 | done | — | workplans/FLEX-WP-0026-openrouter-native-contract.md | +| task | FLEX-WP-0027-T01 | done | — | workplans/FLEX-WP-0027-t03-human-review.md | +| task | FLEX-WP-0027-T02 | done | — | workplans/FLEX-WP-0027-t03-human-review.md | +| task | FLEX-WP-0027-T03 | wait | — | workplans/FLEX-WP-0027-t03-human-review.md | | intake | FLEX-IN-0001 | closed | — | intakes/intakes.md | | intake | FLEX-IN-0002 | closed | — | intakes/intakes.md | | decision | FLEX-DEC-2026-001 | resolved | — | decisions/decisions.md | diff --git a/docs/evidence/2026-09-14-t03-native-review-policy.json b/docs/evidence/2026-09-14-t03-native-review-policy.json new file mode 100644 index 0000000..2f2d8db --- /dev/null +++ b/docs/evidence/2026-09-14-t03-native-review-policy.json @@ -0,0 +1,47 @@ +{ + "scope": "native caller and policy with synthetic subject claims; not real human approval", + "checks": [ + { + "action": "apply", + "case": "admitted-group", + "effect": "allow", + "policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "apply", + "case": "unrelated-group", + "effect": "deny", + "policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "verify", + "case": "admitted-group", + "effect": "allow", + "policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "verify", + "case": "unrelated-group", + "effect": "deny", + "policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "exec", + "case": "admitted-group", + "effect": "allow", + "policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "exec", + "case": "unrelated-group", + "effect": "deny", + "policy_package_digest": "sha256:139992f3e0780c7627a52c447df4f9582a180cadb1d71b2b748073f10a42b96e", + "caller": "system:serviceaccount:informed-decision:review" + } + ] +} diff --git a/docs/evidence/2026-09-14-t03-review-policy.json b/docs/evidence/2026-09-14-t03-review-policy.json new file mode 100644 index 0000000..c46d226 --- /dev/null +++ b/docs/evidence/2026-09-14-t03-review-policy.json @@ -0,0 +1,233 @@ +{ + "scope": "local actual evaluator with synthetic identity; no live human approvals", + "checks": [ + { + "check": "apply:read", + "effect": "allow" + }, + { + "check": "apply:acknowledge", + "effect": "allow" + }, + { + "check": "apply:accept", + "effect": "allow" + }, + { + "check": "apply:return", + "effect": "allow" + }, + { + "check": "apply:discuss", + "effect": "allow" + }, + { + "check": "apply:decline", + "effect": "allow" + }, + { + "check": "apply:wrong-group", + "effect": "deny" + }, + { + "check": "apply:no-group", + "effect": "deny" + }, + { + "check": "apply:service", + "effect": "deny" + }, + { + "check": "apply:stale-mfa", + "effect": "deny" + }, + { + "check": "apply:future-mfa", + "effect": "deny" + }, + { + "check": "apply:no-mfa", + "effect": "deny" + }, + { + "check": "apply:forged-human-route", + "effect": "deny" + }, + { + "check": "apply:wrong-tenant", + "effect": "deny" + }, + { + "check": "apply:other-memo", + "effect": "deny" + }, + { + "check": "apply:changed-version", + "effect": "deny" + }, + { + "check": "apply:changed-approval", + "effect": "deny" + }, + { + "check": "apply:changed-digest", + "effect": "deny" + }, + { + "check": "apply:consume", + "effect": "deny" + }, + { + "check": "verify:read", + "effect": "allow" + }, + { + "check": "verify:acknowledge", + "effect": "allow" + }, + { + "check": "verify:accept", + "effect": "allow" + }, + { + "check": "verify:return", + "effect": "allow" + }, + { + "check": "verify:discuss", + "effect": "allow" + }, + { + "check": "verify:decline", + "effect": "allow" + }, + { + "check": "verify:wrong-group", + "effect": "deny" + }, + { + "check": "verify:no-group", + "effect": "deny" + }, + { + "check": "verify:service", + "effect": "deny" + }, + { + "check": "verify:stale-mfa", + "effect": "deny" + }, + { + "check": "verify:future-mfa", + "effect": "deny" + }, + { + "check": "verify:no-mfa", + "effect": "deny" + }, + { + "check": "verify:forged-human-route", + "effect": "deny" + }, + { + "check": "verify:wrong-tenant", + "effect": "deny" + }, + { + "check": "verify:other-memo", + "effect": "deny" + }, + { + "check": "verify:changed-version", + "effect": "deny" + }, + { + "check": "verify:changed-approval", + "effect": "deny" + }, + { + "check": "verify:changed-digest", + "effect": "deny" + }, + { + "check": "verify:consume", + "effect": "deny" + }, + { + "check": "exec:read", + "effect": "allow" + }, + { + "check": "exec:acknowledge", + "effect": "allow" + }, + { + "check": "exec:accept", + "effect": "allow" + }, + { + "check": "exec:return", + "effect": "allow" + }, + { + "check": "exec:discuss", + "effect": "allow" + }, + { + "check": "exec:decline", + "effect": "allow" + }, + { + "check": "exec:wrong-group", + "effect": "deny" + }, + { + "check": "exec:no-group", + "effect": "deny" + }, + { + "check": "exec:service", + "effect": "deny" + }, + { + "check": "exec:stale-mfa", + "effect": "deny" + }, + { + "check": "exec:future-mfa", + "effect": "deny" + }, + { + "check": "exec:no-mfa", + "effect": "deny" + }, + { + "check": "exec:forged-human-route", + "effect": "deny" + }, + { + "check": "exec:wrong-tenant", + "effect": "deny" + }, + { + "check": "exec:other-memo", + "effect": "deny" + }, + { + "check": "exec:changed-version", + "effect": "deny" + }, + { + "check": "exec:changed-approval", + "effect": "deny" + }, + { + "check": "exec:changed-digest", + "effect": "deny" + }, + { + "check": "exec:consume", + "effect": "deny" + } + ] +} diff --git a/examples/informed-decision-t03/fixtures.json b/examples/informed-decision-t03/fixtures.json new file mode 100644 index 0000000..a4b6f93 --- /dev/null +++ b/examples/informed-decision-t03/fixtures.json @@ -0,0 +1,21 @@ +[ + { + "id": "unknown-request-denied", + "request": { + "id": "unknown", + "subject": { + "id": "unknown", + "type": "human" + }, + "action": "accept", + "resource": { + "id": "memo:unrelated", + "type": "decision-memo", + "system": "informed-decision" + } + }, + "expect": { + "effect": "deny" + } + } +] diff --git a/examples/informed-decision-t03/policy.md b/examples/informed-decision-t03/policy.md new file mode 100644 index 0000000..2cefc18 --- /dev/null +++ b/examples/informed-decision-t03/policy.md @@ -0,0 +1,88 @@ +--- +id: informed-decision.t03-review +name: T03 exact OpenRouter lifecycle human review +namespace: informed-decision:decision-memo +version: v1 +status: ready +package: flexauth.informed_decision.t03_review +allow_ttl: 30s +actions: [read, acknowledge, accept, return, discuss, decline] +owner: flex-auth +fixtures: [fixtures.json] +caring: + profile: caring-0.4.0-rc2 + enforce: false +activation: + mode: local +--- + +# Operator-admitted T03 review mandate + +Operator confirmation on 2026-09-14 grants net-kingdom-admins review/bind +permission for only these three exact T03 records. The authenticated +informed-decision caller imports signed KeyCape groups and MFA facts. +No permission follows from memo content or presentation state. The independent +caller binding must be enforced by TokenReview before this package is served. +Membership tenant provenance may follow the explicitly accepted registration +route; it does not assert directory membership in tenant:platform. +Only a real human uses accept. This package neither issues nor consumes approval. + +```rego +import rego.v1 + +records := { + "memo:SECRETS-WP-0010-T03-apply": { + "approval_id": "09592588-ab15-53e7-89b8-c4e9f29aaacf", + "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5" + }, + "memo:SECRETS-WP-0010-T03-verify": { + "approval_id": "9416fa31-fa9e-5603-8289-f35bc9625409", + "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2" + }, + "memo:SECRETS-WP-0010-T03-exec": { + "approval_id": "da678b61-35be-598e-8d95-a7aefa2fdc73", + "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8" + } +} + +decision := {"effect": "allow", "reason": "operator_admitted_t03_review"} if { + input.tenant == "tenant:platform" + input.subject.tenant == "tenant:platform" + input.subject.type == "human" + is_string(input.subject.id) + input.subject.id != "" + input.subject.attributes.principal_type_source == "authentication-derived" + input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"} + "net-kingdom-admins" in input.subject.attributes.groups + assurance := input.subject.attributes.assurance + assurance.level == "aal2" + assurance.mfa == true + assurance.source == "key-cape" + assurance.methods == ["pwd", "otp"] + is_number(assurance.at) + assurance.at > 0 + age := time.now_ns() / 1000000000 - assurance.at + age >= -30 + age <= 900 + input.resource.tenant == "tenant:platform" + input.resource.system == "informed-decision" + input.resource.type == "decision-memo" + record := records[input.resource.id] + input.context.memo_version == 1 + input.context.approval_id == record.approval_id + input.context.approval_binding_digest == record.binding_digest + input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"} +} else := {"effect": "deny", "reason": "t03_review_scope_or_identity_refused"} if { + true +} +``` + +```rego test +package flexauth.informed_decision.t03_review_test +import rego.v1 +import data.flexauth.informed_decision.t03_review + +test_unknown_request_denied if { + t03_review.decision.effect == "deny" with input as {} +} +``` diff --git a/examples/informed-decision-t03/records.json b/examples/informed-decision-t03/records.json new file mode 100644 index 0000000..589991d --- /dev/null +++ b/examples/informed-decision-t03/records.json @@ -0,0 +1,87 @@ +{ + "memo:SECRETS-WP-0010-T03-apply": { + "approval_id": "09592588-ab15-53e7-89b8-c4e9f29aaacf", + "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5", + "action": "apply", + "binding": { + "action": "apply", + "actor": "secrets-engine", + "principal": "secrets-engine", + "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference", + "target": { + "id": "catalog:openrouter-llm-connect", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "attributes": { + "stage": "prod", + "fields": [], + "policy_targets": [ + "se-prod-openrouter-llm-connect" + ], + "auth_targets": [ + "se-prod-openrouter-llm-connect" + ] + } + } + }, + "memo_version": 1 + }, + "memo:SECRETS-WP-0010-T03-verify": { + "approval_id": "9416fa31-fa9e-5603-8289-f35bc9625409", + "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2", + "action": "verify", + "binding": { + "action": "verify", + "actor": "secrets-engine", + "principal": "secrets-engine", + "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference", + "target": { + "id": "catalog:openrouter-llm-connect", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "attributes": { + "stage": "prod", + "fields": [ + "OPENROUTER_API_KEY" + ], + "policy_targets": [ + "se-prod-openrouter-llm-connect" + ], + "auth_targets": [ + "se-prod-openrouter-llm-connect" + ] + } + } + }, + "memo_version": 1 + }, + "memo:SECRETS-WP-0010-T03-exec": { + "approval_id": "da678b61-35be-598e-8d95-a7aefa2fdc73", + "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8", + "action": "exec", + "binding": { + "action": "exec", + "actor": "secrets-engine", + "principal": "secrets-engine", + "purpose": "IR-WP-0004 read-only OpenRouter key authentication check; no inference", + "target": { + "id": "catalog:openrouter-llm-connect", + "type": "secret-catalog-lane", + "system": "secrets-engine", + "attributes": { + "stage": "prod", + "fields": [ + "OPENROUTER_API_KEY" + ], + "policy_targets": [ + "se-prod-openrouter-llm-connect" + ], + "auth_targets": [ + "se-prod-openrouter-llm-connect" + ] + } + } + }, + "memo_version": 1 + } +} diff --git a/examples/informed-decision-t03/registry.json b/examples/informed-decision-t03/registry.json new file mode 100644 index 0000000..0a58cc8 --- /dev/null +++ b/examples/informed-decision-t03/registry.json @@ -0,0 +1 @@ +{"subjects": [], "resources": []} diff --git a/tools/exercise_t03_review_policy.py b/tools/exercise_t03_review_policy.py new file mode 100644 index 0000000..fd3cd0f --- /dev/null +++ b/tools/exercise_t03_review_policy.py @@ -0,0 +1,27 @@ +import json,time,copy,subprocess,tempfile +from pathlib import Path +import argparse +p=argparse.ArgumentParser();p.add_argument('--binary',required=True);p.add_argument('--receipt',type=Path,required=True);args=p.parse_args() +r=Path(__file__).resolve().parents[1]/'examples/informed-decision-t03' +records=json.loads((r/'records.json').read_text()) +results=[] +with tempfile.TemporaryDirectory() as temp: + request_path=Path(temp)/'request.json' + def check(name,request,expected): + request_path.write_text(json.dumps(request)) + result=subprocess.run([args.binary,'check','--registry',str(r/'registry.json'),'--policy',str(r/'policy.md'),'--request',str(request_path)],capture_output=True,text=True,check=True) + d=json.loads(result.stdout) + assert d['effect']==expected,(name,d) + results.append({'check':name,'effect':d['effect']}) + return d + for memo,record in records.items(): + request={'id':'local-regression','tenant':'tenant:platform','subject':{'id':'synthetic-reviewer','type':'human','tenant':'tenant:platform','attributes':{'groups':['net-kingdom-admins'],'roles':[],'tenant_source':'registration-supplied','principal_type_source':'authentication-derived','assurance':{'level':'aal2','mfa':True,'methods':['pwd','otp'],'source':'key-cape','at':int(time.time())}}},'resource':{'id':memo,'type':'decision-memo','system':'informed-decision','tenant':'tenant:platform'},'action':'accept','context':{'memo_version':1,'approval_id':record['approval_id'],'approval_binding_digest':record['binding_digest']},'policy_version':'v1'} + for action in ['read','acknowledge','accept','return','discuss','decline']: + d=check(record['action']+':'+action,request|{'action':action},'allow') + for name,path,value in [('wrong-group',['subject','attributes','groups'],['net-kingdom-users']),('no-group',['subject','attributes','groups'],[]),('service',['subject','type'],'service'),('stale-mfa',['subject','attributes','assurance','at'],int(time.time())-901),('future-mfa',['subject','attributes','assurance','at'],int(time.time())+300),('no-mfa',['subject','attributes','assurance','mfa'],False),('forged-human-route',['subject','attributes','principal_type_source'],'registration-supplied'),('wrong-tenant',['subject','tenant'],'tenant:other'),('other-memo',['resource','id'],'memo:other'),('changed-version',['context','memo_version'],2),('changed-approval',['context','approval_id'],'other'),('changed-digest',['context','approval_binding_digest'],'sha256:'+'0'*64),('consume',['action'],'consume')]: + candidate=copy.deepcopy(request); target=candidate + for key in path[:-1]:target=target[key] + target[path[-1]]=value + check(record['action']+':'+name,candidate,'deny') +args.receipt.write_text(json.dumps({'scope':'local actual evaluator with synthetic identity; no live human approvals','checks':results},indent=2)+'\n') +print(len(results),'policy checks passed') diff --git a/values/informed-decision-t03.yaml b/values/informed-decision-t03.yaml new file mode 100644 index 0000000..18fa7cf --- /dev/null +++ b/values/informed-decision-t03.yaml @@ -0,0 +1,24 @@ +# Operator-admitted exact T03 human review, SECRETS-WP-0010-T03. +name: flex-auth-informed-decision-t03 +image: + repository: forgejo.coulomb.social/coulomb/flex-auth + digest: sha256:c9f028b49dfcede930a9cc48757ec8371ecc71d20b1bfee2733e55298dffcc7c +args: + - serve + - --addr + - 0.0.0.0:8080 + - --registry + - /opt/flex-auth/examples/informed-decision-t03/registry.json + - --policy + - /opt/flex-auth/examples/informed-decision-t03/policy.md +callerAuth: + mode: enforce + kubernetesURL: https://10.43.0.1 + binding: informed-decision=system:serviceaccount:informed-decision:review +consumer: + isolated: false + namespace: informed-decision + podName: informed-decision +resources: + requests: {cpu: 5m, memory: 32Mi} + limits: {cpu: 300m, memory: 192Mi} diff --git a/workplans/FLEX-WP-0027-t03-human-review.md b/workplans/FLEX-WP-0027-t03-human-review.md new file mode 100644 index 0000000..be08b7e --- /dev/null +++ b/workplans/FLEX-WP-0027-t03-human-review.md @@ -0,0 +1,53 @@ +--- +id: FLEX-WP-0027 +type: workplan +title: "Admit scoped human review for the three T03 actions" +domain: infotech +repo: flex-auth +status: active +owner: codex +topic_slug: netkingdom +created: "2026-09-14" +updated: "2026-09-14" +state_hub_workstream_id: "954635b2-8377-5227-ab4f-10607b2a02c6" +--- + +## Implement the explicit group and exact-record mandate + +```task +id: FLEX-WP-0027-T01 +status: done +priority: high +state_hub_task_id: "7b5af88b-2630-5f94-a085-78180690e08c" +``` + +The operator admitted net-kingdom-admins for the three T03 reviews only. +`examples/informed-decision-t03` pins record IDs, versions and native bindings. +Fresh verified KeyCape MFA and groups are mandatory. 57 evaluator checks pass. +Reproduce with `python3 tools/exercise_t03_review_policy.py --binary /path/to/flex-auth --receipt /tmp/t03-checks.json`. + +## Deploy the isolated caller-bound policy + +```task +id: FLEX-WP-0027-T02 +status: done +priority: high +state_hub_task_id: "129568a0-cb1c-5f7b-8f5d-f44f1d2bcfff" +``` + +`values/informed-decision-t03.yaml` pins the live image and policy. TokenReview +admits only system:serviceaccount:informed-decision:review. Six native caller +checks pass with synthetic identities; evidence is retained in docs/evidence. + +## Verify actual human review through the native service + +```task +id: FLEX-WP-0027-T03 +status: wait +priority: high +state_hub_task_id: "9417d64a-308c-566f-af29-217c5c45d294" +``` + +Wait for the operator's exact signed-in account, then address the three memos +and verify actual human acknowledgements/entries. Synthetic policy checks are +not acceptance evidence. SECRETS-WP-0010-T03 retains live consume and execution.