coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/WORK-RECORDS.md
tegwick 0e2efa8fcf
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Align INTENT and SCOPE to security layer model v0.7; plan conformance work 
The standard was accepted at v0.7 on 2026-08-29. Four of flex-auth's review
findings are in the accepted text: 9.3's two-owner split, 6.4.2 scoped to the
decision's own binding with our canonical request digest as its mechanical test,
9.7.2 split by role, and 17 moving the decision-record schema to access-engine.

INTENT.md
- Machine-readable layer declaration in frontmatter (layer: Engine, role: PDP),
  which section 11 requires and we did not have. audit-core noted our
  declaration was legible only by following the decision trail.
- PDP failure semantics stated: our outage is consumer residue, not input
  degradation; fail-open is not expressible by a PDP at all.
- Four owned obligations added: the decision-record schema as our contract, the
  request digest as the published replay test, a lifetime on every allow, and
  visibility deadlines per input class.
- A Layer Conformance section stating the state honestly: conforming with one
  declared gap, no Tooling client, not PEP-shaped.
- Vocabulary correction: earlier text dropped "control plane" as Staff
  vocabulary. Section 8 binds it to the Engine layer, which is why kings-guard
  was asked to release it. The term is ours; we prefer "decision engine" for
  precision, not boundary.

SCOPE.md
- Layer and role in the one-liner; the four obligations In Scope; five
  boundaries established in review but never written down Out of Scope.
- Three capability blocks marked planned for workplans completed in May are now
  current; two blocks added.
- Superseded ADR-0006 citation corrected to ADR-0009, which retires the global
  flag outright rather than deferring it.

history/2026-08-29-layer-model-v0.7-alignment-review.md checks each obligation
against the code and finds six gaps. FLEX-WP-0019 closes them, with T02 before
T04 because a visibility deadline for registry-borne facts is unfalsifiable
until provenance can identify the snapshot a decision read.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012sgN4GH5ZYT8pJVkCR6dcP

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014348@bnt-lap001
Assistant-Session: a993abda-65a0-4ea8-8ccd-0fcd78c92ac0
2026-08-29 14:43:49 +02:00

114 lines
11 KiB
Markdown
Raw Blame History

# Work Records — flex-auth
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
> stage 3). Do not edit by hand — edit the source file/block listed for
> each record and re-run fix-consistency to refresh this index. Archived
> workplans are omitted; closed decisions/intakes/engagements stay listed
> so recently-resolved work is still visible. [auto]
| Kind | ID | Status | Lane | Source |
| --- | --- | --- | --- | --- |
| workplan | FLEX-WP-0001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
| workplan | FLEX-WP-0002 | completed | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
| workplan | FLEX-WP-0003 | completed | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
| workplan | FLEX-WP-0004 | completed | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
| workplan | FLEX-WP-0005 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
| workplan | FLEX-WP-0006 | finished | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
| workplan | FLEX-WP-0007 | finished | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
| workplan | FLEX-WP-0008 | finished | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
| workplan | FLEX-WP-0009 | finished | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
| workplan | FLEX-WP-0010 | finished | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
| workplan | FLEX-WP-0011 | finished | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
| workplan | FLEX-WP-0012 | finished | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| workplan | FLEX-WP-0013 | finished | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
| workplan | FLEX-WP-0014 | finished | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md |
| workplan | FLEX-WP-0015 | finished | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
| workplan | FLEX-WP-0016 | finished | — | workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md |
| workplan | FLEX-WP-0017 | active | — | workplans/FLEX-WP-0017-action-bound-authorization-contract.md |
| workplan | FLEX-WP-0018 | finished | — | workplans/FLEX-WP-0018-inbound-auth-corrections.md |
| task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
| task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
| task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
| task | FLEX-WP-0001-T004 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
| task | FLEX-WP-0002-T001 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
| task | FLEX-WP-0002-T002 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
| task | FLEX-WP-0002-T003 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
| task | FLEX-WP-0002-T004 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
| task | FLEX-WP-0002-T005 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
| task | FLEX-WP-0002-T006 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
| task | FLEX-WP-0002-T007 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
| task | FLEX-WP-0002-T008 | done | — | workplans/FLEX-WP-0002-standalone-policy-as-code-core.md |
| task | FLEX-WP-0003-T001 | done | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
| task | FLEX-WP-0003-T002 | done | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
| task | FLEX-WP-0003-T003 | done | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
| task | FLEX-WP-0003-T004 | done | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
| task | FLEX-WP-0003-T005 | done | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
| task | FLEX-WP-0003-T006 | done | — | workplans/FLEX-WP-0003-markitect-consumer-integration.md |
| task | FLEX-WP-0004-T001 | done | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
| task | FLEX-WP-0004-T002 | done | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
| task | FLEX-WP-0004-T003 | done | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
| task | FLEX-WP-0004-T004 | done | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
| task | FLEX-WP-0004-T005 | done | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
| task | FLEX-WP-0004-T006 | done | — | workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md |
| task | FLEX-WP-0005-T001 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
| task | FLEX-WP-0005-T002 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
| task | FLEX-WP-0005-T003 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
| task | FLEX-WP-0005-T004 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
| task | FLEX-WP-0005-T005 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
| task | FLEX-WP-0005-T006 | done | — | workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md |
| task | FLEX-WP-0006-T01 | done | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
| task | FLEX-WP-0006-T02 | done | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
| task | FLEX-WP-0006-T03 | done | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
| task | FLEX-WP-0006-T04 | done | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
| task | FLEX-WP-0006-T05 | done | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
| task | FLEX-WP-0007-T01 | done | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
| task | FLEX-WP-0007-T02 | done | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
| task | FLEX-WP-0007-T03 | done | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
| task | FLEX-WP-0007-T04 | done | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
| task | FLEX-WP-0007-T05 | done | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
| task | FLEX-WP-0008-T01 | done | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
| task | FLEX-WP-0008-T02 | done | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
| task | FLEX-WP-0008-T03 | done | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
| task | FLEX-WP-0008-T04 | done | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
| task | FLEX-WP-0009-T01 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
| task | FLEX-WP-0009-T02 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
| task | FLEX-WP-0009-T03 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
| task | FLEX-WP-0009-T04 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
| task | FLEX-WP-0010-T01 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
| task | FLEX-WP-0010-T02 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
| task | FLEX-WP-0010-T03 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
| task | FLEX-WP-0010-T04 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
| task | FLEX-WP-0011-T01 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
| task | FLEX-WP-0011-T02 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
| task | FLEX-WP-0011-T03 | done | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
| task | FLEX-WP-0012-T01 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| task | FLEX-WP-0012-T02 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| task | FLEX-WP-0012-T03 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| task | FLEX-WP-0012-T04 | done | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
| task | FLEX-WP-0013-T01 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
| task | FLEX-WP-0013-T02 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
| task | FLEX-WP-0013-T03 | done | — | workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md |
| task | FLEX-WP-0014-T01 | done | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md |
| task | FLEX-WP-0014-T02 | done | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md |
| task | FLEX-WP-0014-T03 | done | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md |
| task | FLEX-WP-0014-T04 | done | — | workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md |
| task | FLEX-WP-0015-T01 | done | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
| task | FLEX-WP-0015-T02 | done | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
| task | FLEX-WP-0015-T03 | done | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
| task | FLEX-WP-0015-T04 | cancel | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
| task | FLEX-WP-0015-T05 | done | — | workplans/FLEX-WP-0015-tenancy-posture-conformance.md |
| task | FLEX-WP-0016-T01 | done | — | workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md |
| task | FLEX-WP-0016-T02 | done | — | workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md |
| task | FLEX-WP-0016-T03 | done | — | workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md |
| task | FLEX-WP-0017-T01 | done | — | workplans/FLEX-WP-0017-action-bound-authorization-contract.md |
| task | FLEX-WP-0017-T02 | done | — | workplans/FLEX-WP-0017-action-bound-authorization-contract.md |
| task | FLEX-WP-0017-T03 | wait | — | workplans/FLEX-WP-0017-action-bound-authorization-contract.md |
| task | FLEX-WP-0017-T04 | done | — | workplans/FLEX-WP-0017-action-bound-authorization-contract.md |
| task | FLEX-WP-0017-T05 | wait | — | workplans/FLEX-WP-0017-action-bound-authorization-contract.md |
| task | FLEX-WP-0018-T01 | done | — | workplans/FLEX-WP-0018-inbound-auth-corrections.md |
| task | FLEX-WP-0018-T02 | done | — | workplans/FLEX-WP-0018-inbound-auth-corrections.md |
| intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |
| intake | FLEX-IN-0002 | closed | — | intakes/intakes.md |
| decision | FLEX-DEC-2026-001 | resolved | — | decisions/decisions.md |
| decision | FLEX-DEC-2026-002 | resolved | — | decisions/decisions.md |
| decision | FLEX-DEC-2026-003 | resolved | — | decisions/decisions.md |
Reference in a new issue View git blame Copy permalink