From f85479c668876b8cb1c6a4e41388a35e46923fb6 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 16 Sep 2026 01:08:56 +0200 Subject: [PATCH] Admit T03 version-two reviews while preserving current sitting records Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6 --- Containerfile.t03-review | 2 + .../2026-09-16-t03-renewal-policy-checks.json | 385 ++++++++++++++++++ examples/informed-decision-t03/policy.md | 59 ++- examples/informed-decision-t03/records.json | 12 +- values/informed-decision-t03.yaml | 2 +- 5 files changed, 444 insertions(+), 16 deletions(-) create mode 100644 Containerfile.t03-review create mode 100644 docs/evidence/2026-09-16-t03-renewal-policy-checks.json diff --git a/Containerfile.t03-review b/Containerfile.t03-review new file mode 100644 index 0000000..d257703 --- /dev/null +++ b/Containerfile.t03-review @@ -0,0 +1,2 @@ +FROM forgejo.coulomb.social/coulomb/flex-auth@sha256:c9f028b49dfcede930a9cc48757ec8371ecc71d20b1bfee2733e55298dffcc7c +COPY examples/informed-decision-t03 /opt/flex-auth/examples/informed-decision-t03 diff --git a/docs/evidence/2026-09-16-t03-renewal-policy-checks.json b/docs/evidence/2026-09-16-t03-renewal-policy-checks.json new file mode 100644 index 0000000..b7704f4 --- /dev/null +++ b/docs/evidence/2026-09-16-t03-renewal-policy-checks.json @@ -0,0 +1,385 @@ +{ + "t03": { + "scope": "native caller and policy with synthetic subject claims; not real human approval", + "checks": [ + { + "action": "apply", + "case": "admitted-group", + "effect": "allow", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "apply", + "case": "unrelated-group", + "effect": "deny", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "verify", + "case": "admitted-group", + "effect": "allow", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "verify", + "case": "unrelated-group", + "effect": "deny", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "exec", + "case": "admitted-group", + "effect": "allow", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "exec", + "case": "unrelated-group", + "effect": "deny", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + } + ] + }, + "preserved_sitting": { + "scope": "native caller and policy with synthetic subject claims; not real human approval", + "checks": [ + { + "action": "memo:infd-20260914-c02", + "case": "admitted-group", + "effect": "allow", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "memo:infd-20260914-c02", + "case": "unrelated-group", + "effect": "deny", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "memo:infd-20260914-c03", + "case": "admitted-group", + "effect": "allow", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "memo:infd-20260914-c03", + "case": "unrelated-group", + "effect": "deny", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "memo:infd-20260914-c04", + "case": "admitted-group", + "effect": "allow", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "memo:infd-20260914-c04", + "case": "unrelated-group", + "effect": "deny", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "memo:infd-20260914-d01", + "case": "admitted-group", + "effect": "allow", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "memo:infd-20260914-d01", + "case": "unrelated-group", + "effect": "deny", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "memo:infd-20260914-d02", + "case": "admitted-group", + "effect": "allow", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "memo:infd-20260914-d02", + "case": "unrelated-group", + "effect": "deny", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "memo:infd-20260914-d03", + "case": "admitted-group", + "effect": "allow", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "memo:infd-20260914-d03", + "case": "unrelated-group", + "effect": "deny", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "memo:infd-20260914-d04", + "case": "admitted-group", + "effect": "allow", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + }, + { + "action": "memo:infd-20260914-d04", + "case": "unrelated-group", + "effect": "deny", + "policy_package_digest": "sha256:c47899cb3044fe705a34bb93147c060cc3885967983ade5a52a3c93cda7aa400", + "caller": "system:serviceaccount:informed-decision:review" + } + ] + }, + "local": { + "scope": "local actual evaluator with synthetic identity; no live human approvals", + "checks": [ + { + "check": "apply:read", + "effect": "allow" + }, + { + "check": "apply:acknowledge", + "effect": "allow" + }, + { + "check": "apply:accept", + "effect": "allow" + }, + { + "check": "apply:return", + "effect": "allow" + }, + { + "check": "apply:discuss", + "effect": "allow" + }, + { + "check": "apply:decline", + "effect": "allow" + }, + { + "check": "apply:wrong-group", + "effect": "deny" + }, + { + "check": "apply:no-group", + "effect": "deny" + }, + { + "check": "apply:service", + "effect": "deny" + }, + { + "check": "apply:stale-mfa", + "effect": "deny" + }, + { + "check": "apply:future-mfa", + "effect": "deny" + }, + { + "check": "apply:no-mfa", + "effect": "deny" + }, + { + "check": "apply:forged-human-route", + "effect": "deny" + }, + { + "check": "apply:wrong-tenant", + "effect": "deny" + }, + { + "check": "apply:other-memo", + "effect": "deny" + }, + { + "check": "apply:changed-version", + "effect": "deny" + }, + { + "check": "apply:changed-approval", + "effect": "deny" + }, + { + "check": "apply:changed-digest", + "effect": "deny" + }, + { + "check": "apply:consume", + "effect": "deny" + }, + { + "check": "verify:read", + "effect": "allow" + }, + { + "check": "verify:acknowledge", + "effect": "allow" + }, + { + "check": "verify:accept", + "effect": "allow" + }, + { + "check": "verify:return", + "effect": "allow" + }, + { + "check": "verify:discuss", + "effect": "allow" + }, + { + "check": "verify:decline", + "effect": "allow" + }, + { + "check": "verify:wrong-group", + "effect": "deny" + }, + { + "check": "verify:no-group", + "effect": "deny" + }, + { + "check": "verify:service", + "effect": "deny" + }, + { + "check": "verify:stale-mfa", + "effect": "deny" + }, + { + "check": "verify:future-mfa", + "effect": "deny" + }, + { + "check": "verify:no-mfa", + "effect": "deny" + }, + { + "check": "verify:forged-human-route", + "effect": "deny" + }, + { + "check": "verify:wrong-tenant", + "effect": "deny" + }, + { + "check": "verify:other-memo", + "effect": "deny" + }, + { + "check": "verify:changed-version", + "effect": "deny" + }, + { + "check": "verify:changed-approval", + "effect": "deny" + }, + { + "check": "verify:changed-digest", + "effect": "deny" + }, + { + "check": "verify:consume", + "effect": "deny" + }, + { + "check": "exec:read", + "effect": "allow" + }, + { + "check": "exec:acknowledge", + "effect": "allow" + }, + { + "check": "exec:accept", + "effect": "allow" + }, + { + "check": "exec:return", + "effect": "allow" + }, + { + "check": "exec:discuss", + "effect": "allow" + }, + { + "check": "exec:decline", + "effect": "allow" + }, + { + "check": "exec:wrong-group", + "effect": "deny" + }, + { + "check": "exec:no-group", + "effect": "deny" + }, + { + "check": "exec:service", + "effect": "deny" + }, + { + "check": "exec:stale-mfa", + "effect": "deny" + }, + { + "check": "exec:future-mfa", + "effect": "deny" + }, + { + "check": "exec:no-mfa", + "effect": "deny" + }, + { + "check": "exec:forged-human-route", + "effect": "deny" + }, + { + "check": "exec:wrong-tenant", + "effect": "deny" + }, + { + "check": "exec:other-memo", + "effect": "deny" + }, + { + "check": "exec:changed-version", + "effect": "deny" + }, + { + "check": "exec:changed-approval", + "effect": "deny" + }, + { + "check": "exec:changed-digest", + "effect": "deny" + }, + { + "check": "exec:consume", + "effect": "deny" + } + ] + } +} diff --git a/examples/informed-decision-t03/policy.md b/examples/informed-decision-t03/policy.md index 2cefc18..915350a 100644 --- a/examples/informed-decision-t03/policy.md +++ b/examples/informed-decision-t03/policy.md @@ -2,7 +2,7 @@ id: informed-decision.t03-review name: T03 exact OpenRouter lifecycle human review namespace: informed-decision:decision-memo -version: v1 +version: v2 status: ready package: flexauth.informed_decision.t03_review allow_ttl: 30s @@ -19,7 +19,10 @@ activation: # Operator-admitted T03 review mandate Operator confirmation on 2026-09-14 grants net-kingdom-admins review/bind -permission for only these three exact T03 records. The authenticated +permission for only the three exact T03 records. The seven already-admitted +compact-sitting records are preserved verbatim at memo version 1 because the +shared review service currently serves that mandate. T03 renewals require +memo version 2; no existing approval or human entry is copied. The authenticated informed-decision caller imports signed KeyCape groups and MFA facts. No permission follows from memo content or presentation state. The independent caller binding must be enforced by TokenReview before this package is served. @@ -32,16 +35,54 @@ import rego.v1 records := { "memo:SECRETS-WP-0010-T03-apply": { - "approval_id": "09592588-ab15-53e7-89b8-c4e9f29aaacf", - "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5" + "approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb", + "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5", + "memo_version": 2 }, "memo:SECRETS-WP-0010-T03-verify": { - "approval_id": "9416fa31-fa9e-5603-8289-f35bc9625409", - "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2" + "approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56", + "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2", + "memo_version": 2 }, "memo:SECRETS-WP-0010-T03-exec": { - "approval_id": "da678b61-35be-598e-8d95-a7aefa2fdc73", - "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8" + "approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68", + "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8", + "memo_version": 2 + }, + "memo:infd-20260914-c02": { + "approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1", + "binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a", + "memo_version": 1 + }, + "memo:infd-20260914-c03": { + "approval_id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f", + "binding_digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844", + "memo_version": 1 + }, + "memo:infd-20260914-c04": { + "approval_id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7", + "binding_digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192", + "memo_version": 1 + }, + "memo:infd-20260914-d01": { + "approval_id": "9f7c3506-68de-4826-86ff-e301f428408d", + "binding_digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15", + "memo_version": 1 + }, + "memo:infd-20260914-d02": { + "approval_id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9", + "binding_digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f", + "memo_version": 1 + }, + "memo:infd-20260914-d03": { + "approval_id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496", + "binding_digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425", + "memo_version": 1 + }, + "memo:infd-20260914-d04": { + "approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5", + "binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4", + "memo_version": 1 } } @@ -68,7 +109,7 @@ decision := {"effect": "allow", "reason": "operator_admitted_t03_review"} if { input.resource.system == "informed-decision" input.resource.type == "decision-memo" record := records[input.resource.id] - input.context.memo_version == 1 + input.context.memo_version == record.memo_version input.context.approval_id == record.approval_id input.context.approval_binding_digest == record.binding_digest input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"} diff --git a/examples/informed-decision-t03/records.json b/examples/informed-decision-t03/records.json index 589991d..93cd574 100644 --- a/examples/informed-decision-t03/records.json +++ b/examples/informed-decision-t03/records.json @@ -1,6 +1,6 @@ { "memo:SECRETS-WP-0010-T03-apply": { - "approval_id": "09592588-ab15-53e7-89b8-c4e9f29aaacf", + "approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb", "binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5", "action": "apply", "binding": { @@ -24,10 +24,10 @@ } } }, - "memo_version": 1 + "memo_version": 2 }, "memo:SECRETS-WP-0010-T03-verify": { - "approval_id": "9416fa31-fa9e-5603-8289-f35bc9625409", + "approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56", "binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2", "action": "verify", "binding": { @@ -53,10 +53,10 @@ } } }, - "memo_version": 1 + "memo_version": 2 }, "memo:SECRETS-WP-0010-T03-exec": { - "approval_id": "da678b61-35be-598e-8d95-a7aefa2fdc73", + "approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68", "binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8", "action": "exec", "binding": { @@ -82,6 +82,6 @@ } } }, - "memo_version": 1 + "memo_version": 2 } } diff --git a/values/informed-decision-t03.yaml b/values/informed-decision-t03.yaml index 18fa7cf..5b88c31 100644 --- a/values/informed-decision-t03.yaml +++ b/values/informed-decision-t03.yaml @@ -2,7 +2,7 @@ name: flex-auth-informed-decision-t03 image: repository: forgejo.coulomb.social/coulomb/flex-auth - digest: sha256:c9f028b49dfcede930a9cc48757ec8371ecc71d20b1bfee2733e55298dffcc7c + digest: sha256:e9ade12f1ee3130b4e8d9796d993b2c7234ef51d4fa38981c949802c1422f824 args: - serve - --addr