coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Admit T03 version-two reviews while preserving current sitting records
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 1m13s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-16 01:08:56 +02:00
parent 0d9812993f
commit f85479c668
5 changed files with 444 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

59
examples/informed-decision-t03/policy.md
View file

@ -2,7 +2,7 @@
id: informed-decision.t03-review
name: T03 exact OpenRouter lifecycle human review
namespace: informed-decision:decision-memo
version: v1
version: v2
status: ready
package: flexauth.informed_decision.t03_review
allow_ttl: 30s
@ -19,7 +19,10 @@ activation:
# Operator-admitted T03 review mandate
Operator confirmation on 2026-09-14 grants net-kingdom-admins review/bind
permission for only these three exact T03 records. The authenticated
permission for only the three exact T03 records. The seven already-admitted
compact-sitting records are preserved verbatim at memo version 1 because the
shared review service currently serves that mandate. T03 renewals require
memo version 2; no existing approval or human entry is copied. The authenticated
informed-decision caller imports signed KeyCape groups and MFA facts.
No permission follows from memo content or presentation state. The independent
caller binding must be enforced by TokenReview before this package is served.
@ -32,16 +35,54 @@ import rego.v1
records := {
"memo:SECRETS-WP-0010-T03-apply": {
"approval_id": "09592588-ab15-53e7-89b8-c4e9f29aaacf",
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5"
"approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb",
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
"memo_version": 2
},
"memo:SECRETS-WP-0010-T03-verify": {
"approval_id": "9416fa31-fa9e-5603-8289-f35bc9625409",
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2"
"approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56",
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
"memo_version": 2
},
"memo:SECRETS-WP-0010-T03-exec": {
"approval_id": "da678b61-35be-598e-8d95-a7aefa2fdc73",
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8"
"approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68",
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
"memo_version": 2
},
"memo:infd-20260914-c02": {
"approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
"binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a",
"memo_version": 1
},
"memo:infd-20260914-c03": {
"approval_id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f",
"binding_digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844",
"memo_version": 1
},
"memo:infd-20260914-c04": {
"approval_id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7",
"binding_digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192",
"memo_version": 1
},
"memo:infd-20260914-d01": {
"approval_id": "9f7c3506-68de-4826-86ff-e301f428408d",
"binding_digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15",
"memo_version": 1
},
"memo:infd-20260914-d02": {
"approval_id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9",
"binding_digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f",
"memo_version": 1
},
"memo:infd-20260914-d03": {
"approval_id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496",
"binding_digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425",
"memo_version": 1
},
"memo:infd-20260914-d04": {
"approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
"binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4",
"memo_version": 1
}
}
@ -68,7 +109,7 @@ decision := {"effect": "allow", "reason": "operator_admitted_t03_review"} if {
input.resource.system == "informed-decision"
input.resource.type == "decision-memo"
record := records[input.resource.id]
input.context.memo_version == 1
input.context.memo_version == record.memo_version
input.context.approval_id == record.approval_id
input.context.approval_binding_digest == record.binding_digest
input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}

12
examples/informed-decision-t03/records.json
View file

@ -1,6 +1,6 @@
{
"memo:SECRETS-WP-0010-T03-apply": {
"approval_id": "09592588-ab15-53e7-89b8-c4e9f29aaacf",
"approval_id": "9935335c-8e9a-566e-a48e-6a5b5f4882eb",
"binding_digest": "sha256:03cc5b37437f14e86b686ce4054f976556334eff3fa260b03e8014ed3d9217e5",
"action": "apply",
"binding": {
@ -24,10 +24,10 @@
}
}
},
"memo_version": 1
"memo_version": 2
},
"memo:SECRETS-WP-0010-T03-verify": {
"approval_id": "9416fa31-fa9e-5603-8289-f35bc9625409",
"approval_id": "273d6882-6253-5dc9-ac54-544f92ef5e56",
"binding_digest": "sha256:72d9267d038c17107c880ffc9009793ce9c70defbddfe2219628854b811a04b2",
"action": "verify",
"binding": {
@ -53,10 +53,10 @@
}
}
},
"memo_version": 1
"memo_version": 2
},
"memo:SECRETS-WP-0010-T03-exec": {
"approval_id": "da678b61-35be-598e-8d95-a7aefa2fdc73",
"approval_id": "7ba0c13b-68cd-5b3e-9481-42ba9e385e68",
"binding_digest": "sha256:f2cf0fb53b740900756ccde5587c3578fcff44beef2f1edab17b9a198a4033d8",
"action": "exec",
"binding": {
@ -82,6 +82,6 @@
}
}
},
"memo_version": 1
"memo_version": 2
}
}