Admit T03 version-two reviews while preserving current sitting records
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
parent
0d9812993f
commit
f85479c668
5 changed files with 444 additions and 16 deletions
2
Containerfile.t03-review
Normal file
2
Containerfile.t03-review
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
FROM forgejo.coulomb.social/coulomb/flex-auth@sha256:c9f028b49dfcede930a9cc48757ec8371ecc71d20b1bfee2733e55298dffcc7c
|
||||
COPY examples/informed-decision-t03 /opt/flex-auth/examples/informed-decision-t03
|
||||
385
docs/evidence/2026-09-16-t03-renewal-policy-checks.json
Normal file
385
docs/evidence/2026-09-16-t03-renewal-policy-checks.json
Normal file
|
|
@ -0,0 +1,385 @@
|
|||
{
|
||||
"t03": {
|
||||
"scope": "native caller and policy with synthetic subject claims; not real human approval",
|
||||
"checks": [
|
||||
{
|
||||
"action": "apply",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "apply",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "verify",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "verify",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "exec",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "exec",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
}
|
||||
]
|
||||
},
|
||||
"preserved_sitting": {
|
||||
"scope": "native caller and policy with synthetic subject claims; not real human approval",
|
||||
"checks": [
|
||||
{
|
||||
"action": "memo:infd-20260914-c02",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-c02",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-c03",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-c03",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-c04",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-c04",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d01",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d01",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d02",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d02",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d03",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d03",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d04",
|
||||
"case": "admitted-group",
|
||||
"effect": "allow",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
},
|
||||
{
|
||||
"action": "memo:infd-20260914-d04",
|
||||
"case": "unrelated-group",
|
||||
"effect": "deny",
|
||||
"policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400",
|
||||
"caller": "system:serviceaccount:informed-decision:review"
|
||||
}
|
||||
]
|
||||
},
|
||||
"local": {
|
||||
"scope": "local actual evaluator with synthetic identity; no live human approvals",
|
||||
"checks": [
|
||||
{
|
||||
"check": "apply:read",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:acknowledge",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:accept",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:return",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:discuss",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:decline",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "apply:wrong-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:no-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:service",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:stale-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:future-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:no-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:forged-human-route",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:wrong-tenant",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:other-memo",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:changed-version",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:changed-approval",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:changed-digest",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "apply:consume",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:read",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:acknowledge",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:accept",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:return",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:discuss",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:decline",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "verify:wrong-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:no-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:service",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:stale-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:future-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:no-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:forged-human-route",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:wrong-tenant",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:other-memo",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:changed-version",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:changed-approval",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:changed-digest",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "verify:consume",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:read",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:acknowledge",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:accept",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:return",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:discuss",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:decline",
|
||||
"effect": "allow"
|
||||
},
|
||||
{
|
||||
"check": "exec:wrong-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:no-group",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:service",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:stale-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:future-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:no-mfa",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:forged-human-route",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:wrong-tenant",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:other-memo",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:changed-version",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:changed-approval",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:changed-digest",
|
||||
"effect": "deny"
|
||||
},
|
||||
{
|
||||
"check": "exec:consume",
|
||||
"effect": "deny"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -2,7 +2,7 @@
|
|||
id: informed-decision.t03-review
|
||||
name: T03 exact OpenRouter lifecycle human review
|
||||
namespace: informed-decision:decision-memo
|
||||
version: v1
|
||||
version: v2
|
||||
status: ready
|
||||
package: flexauth.informed_decision.t03_review
|
||||
allow_ttl: 30s
|
||||
|
|
@ -19,7 +19,10 @@ activation:
|
|||
# Operator-admitted T03 review mandate
|
||||
|
||||
Operator confirmation on 2026-09-14 grants net-kingdom-admins review/bind
|
||||
permission for only these three exact T03 records. The authenticated
|
||||
permission for only the three exact T03 records. The seven already-admitted
|
||||
compact-sitting records are preserved verbatim at memo version 1 because the
|
||||
shared review service currently serves that mandate. T03 renewals require
|
||||
memo version 2; no existing approval or human entry is copied. The authenticated
|
||||
informed-decision caller imports signed KeyCape groups and MFA facts.
|
||||
No permission follows from memo content or presentation state. The independent
|
||||
caller binding must be enforced by TokenReview before this package is served.
|
||||
|
|
@ -32,16 +35,54 @@ import rego.v1
|
|||
|
||||
records := {
|
||||
"memo:SECRETS-WP-0010-T03-apply": {
|
||||
"approval_id": "09592588-ab15-53e7-89b8-c4e9f29aaacf",
|
||||
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5"
|
||||
"approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb",
|
||||
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
|
||||
"memo_version": 2
|
||||
},
|
||||
"memo:SECRETS-WP-0010-T03-verify": {
|
||||
"approval_id": "9416fa31-fa9e-5603-8289-f35bc9625409",
|
||||
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2"
|
||||
"approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56",
|
||||
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
|
||||
"memo_version": 2
|
||||
},
|
||||
"memo:SECRETS-WP-0010-T03-exec": {
|
||||
"approval_id": "da678b61-35be-598e-8d95-a7aefa2fdc73",
|
||||
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8"
|
||||
"approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68",
|
||||
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
|
||||
"memo_version": 2
|
||||
},
|
||||
"memo:infd-20260914-c02": {
|
||||
"approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
|
||||
"binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a",
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-c03": {
|
||||
"approval_id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f",
|
||||
"binding_digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844",
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-c04": {
|
||||
"approval_id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7",
|
||||
"binding_digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192",
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-d01": {
|
||||
"approval_id": "9f7c3506-68de-4826-86ff-e301f428408d",
|
||||
"binding_digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15",
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-d02": {
|
||||
"approval_id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9",
|
||||
"binding_digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f",
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-d03": {
|
||||
"approval_id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496",
|
||||
"binding_digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425",
|
||||
"memo_version": 1
|
||||
},
|
||||
"memo:infd-20260914-d04": {
|
||||
"approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
|
||||
"binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4",
|
||||
"memo_version": 1
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -68,7 +109,7 @@ decision := {"effect": "allow", "reason": "operator_admitted_t03_review"} if {
|
|||
input.resource.system == "informed-decision"
|
||||
input.resource.type == "decision-memo"
|
||||
record := records[input.resource.id]
|
||||
input.context.memo_version == 1
|
||||
input.context.memo_version == record.memo_version
|
||||
input.context.approval_id == record.approval_id
|
||||
input.context.approval_binding_digest == record.binding_digest
|
||||
input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{
|
||||
"memo:SECRETS-WP-0010-T03-apply": {
|
||||
"approval_id": "09592588-ab15-53e7-89b8-c4e9f29aaacf",
|
||||
"approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb",
|
||||
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
|
||||
"action": "apply",
|
||||
"binding": {
|
||||
|
|
@ -24,10 +24,10 @@
|
|||
}
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
"memo_version": 2
|
||||
},
|
||||
"memo:SECRETS-WP-0010-T03-verify": {
|
||||
"approval_id": "9416fa31-fa9e-5603-8289-f35bc9625409",
|
||||
"approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56",
|
||||
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
|
||||
"action": "verify",
|
||||
"binding": {
|
||||
|
|
@ -53,10 +53,10 @@
|
|||
}
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
"memo_version": 2
|
||||
},
|
||||
"memo:SECRETS-WP-0010-T03-exec": {
|
||||
"approval_id": "da678b61-35be-598e-8d95-a7aefa2fdc73",
|
||||
"approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68",
|
||||
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
|
||||
"action": "exec",
|
||||
"binding": {
|
||||
|
|
@ -82,6 +82,6 @@
|
|||
}
|
||||
}
|
||||
},
|
||||
"memo_version": 1
|
||||
"memo_version": 2
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
name: flex-auth-informed-decision-t03
|
||||
image:
|
||||
repository: forgejo.coulomb.social/coulomb/flex-auth
|
||||
digest: sha256:c9f028b49dfcede930a9cc48757ec8371ecc71d20b1bfee2733e55298dffcc7c
|
||||
digest: sha256:e9ade12f1ee3130b4e8d9796d993b2c7234ef51d4fa38981c949802c1422f824
|
||||
args:
|
||||
- serve
|
||||
- --addr
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue