tegwick
0bc624ba62
secrets-engine's first live request rejected our allow: binding. request_digest is computed over material they never sent, because we enrich subject and resource from the registry before hashing. Answering that meant reading the enrichment path, which had a worse defect in it. Enrichment was additive-if-absent — addAttribute wrote a registry value only where the request had no value for that key. So where a caller supplied a key, the caller's value won and the registry's never applied. Every registry ceiling and allowlist was advisory. Verified against the shipped ops-warden package, each one added key on an otherwise-denied request: max_ttl_hours: 99 registry says 8 -> allowed a 12h certificate allowed_principals registry allowlist -> disallowed_principal bypassed allowed_subjects registry allowlist -> unknown_subject bypassed The third is the one to read twice: a subject the registry does not know authorized itself by naming itself in the allowlist it was being checked against. Not remotely reachable today — the PEP builds the CheckRequest, ops-warden sends no resource.attributes, and enforce admits one identity. It is a defence-in-depth failure: any path that lets attacker-influenced data into a CheckRequest field became a full policy bypass rather than a bounded input problem. Callers sending resource.attributes is not hypothetical; secrets-engine does it on every request. Registry facts now win, and diagnostics.registry_overrode names every displaced key, because a registry that silently discards a contradicting claim hides that a caller asserted authority it did not have. subject.type is carved out, and the reason is a finding of its own. Making the registry win there denied every secrets-engine allow: the registry's type is CARING vocabulary (Human, Agent, Automation, Service) and the request's is the protected system's actor vocabulary (service, adm, agt, atm). Two fields sharing a name; substituting one for the other is translation rather than identity, which GH-DEC-2026-008 ruled against. Note what surfaced it — the registry's type had been dead data since the field existed, because the caller's value always won. Also publishes binding.submitted_request_digest, over the request exactly as sent. request_digest was published as the consumer replay test and cannot be one. Nothing is lost hashing the pre-enrichment form: enrichment is a function of the request and the snapshot, and registry_snapshot_digest already pins the snapshot. Existing pins do not move. All three replay fixtures' request_digest and approval_binding_digest values are byte-identical — those requests contradict no registry fact. A field to add, not a value to correct. Regression tests verified failing against the old behaviour before being kept. FLEX-DEC-2026-012; FLEX-WP-0025 carries the residual, that a policy still cannot tell a fact from an assertion. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014aQMM1dPXaPiXVn6DwwtLd Assistant: claude-code Assistant-Model: opus Assistant-Process: 715613@bnt-lap001 Assistant-Session: fabd95c1-4c9e-4080-8849-8707ae025f80 |
||
|---|---|---|
| .. | ||
| action_authorization.schema.json | ||
| audit_event.schema.json | ||
| caring_access_descriptor.schema.json | ||
| caring_profile.schema.json | ||
| check_request.schema.json | ||
| decision_envelope.schema.json | ||
| policy_fixture.schema.json | ||
| policy_package.schema.json | ||
| protected_system_manifest.schema.json | ||
| README.md | ||
| relationship_fact.schema.json | ||
| resource_manifest.schema.json | ||
| subject_manifest.schema.json | ||
schemas/
JSON Schema definitions for flex-auth's canonical artefacts:
resource_manifest.schema.json(pinned inFLEX-WP-0005 P5.3)protected_system_manifest.schema.jsonsubject_manifest.schema.jsonrelationship_fact.schema.jsoncaring_profile.schema.jsoncaring_access_descriptor.schema.jsonpolicy_package.schema.jsonpolicy_fixture.schema.jsoncheck_request.schema.jsondecision_envelope.schema.json— published decision-record contract (flex-auth.decision-record.v1; seedocs/decision-record-contract.md)action_authorization.schema.jsonaudit_event.schema.json
Schemas are pinned in FLEX-WP-0002 P2.1 and validated against Go
types in pkg/api/.