History

tegwick 9e10d1cec1 All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 1s Details Build and Publish Container Image / build-and-push (push) Successful in 37s Details Emit T03 replay fixtures from the published package Two real DecisionEnvelopes in examples/secrets-engine/replay/ for secrets-engine to verify its digest join unchanged: a plain allow (rotate, empty context) and the dual-control allow (destroy with a valid approval-claim). Both are included deliberately. input_claim_digests.context appears only when the request carries a non-empty context, so a consumer asserting the field is always present would pass on destroy and fail on rotate. One fixture would have hidden that. request_digest, policy_package_digest, registry_snapshot_digest and the context claim digest are verified identical across two runs and are the fields to pin. id, decision_time and the lifetime bounds move with the clock; the README says so rather than leaving a consumer to discover it by flake. lifetime.ttl is 15m from the package allow_ttl. Emitted from flex-auth/local in standalone mode, not from a cluster pin. T03 is progress, not done -- it closes when secrets-engine confirms their validator accepts the records unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JTbVXpEiXA7mNJVpDnEPcB Assistant: claude-code Assistant-Model: opus Assistant-Process: 412054@bnt-lap001 Assistant-Session: 3968fae1-8d59-4209-9bd6-c22594b8ab19		2026-09-06 08:14:14 +02:00
..
caring	Fix the destroy rule: it was written against an invented claim shape	2026-09-06 08:11:14 +02:00
claims	Align IAM Profile consumption with v0.2	2026-05-22 14:35:30 +02:00
markitect	Add Markitect check fixtures	2026-05-17 06:32:05 +02:00
ops-warden	feat(policy): adopt security zone stances	2026-08-22 15:17:13 +02:00
qonto-assistant	Register qonto-assistant as a protected system (finance.qonto.read)	2026-07-24 00:19:26 +02:00
railiance-platform	feat(policy): add credential grant authorization package	2026-08-23 13:59:03 +02:00
secrets-engine	Emit T03 replay fixtures from the published package	2026-09-06 08:14:14 +02:00
tenant-engine	Record tenant-engine guardrail pin and handoff caveats	2026-08-16 10:07:31 +02:00
topaz	Implement Topaz adapter	2026-05-17 06:58:04 +02:00
user-engine	Close FLEX-WP-0009 with live user-engine policy evidence	2026-08-16 01:16:23 +02:00
README.md	FLEX-WP-0006: implement ops-warden signing gate policy	2026-06-23 21:17:42 +02:00

README.md

examples/

Runnable examples used both as documentation and as test fixtures.

Expected layout (filled in across FLEX-WP-0002 / FLEX-WP-0003 / FLEX-WP-0005):

examples/
  claims/                  # key-cape lightweight-mode and Keycloak heavy-mode
                           # claim envelopes (P5.5)
  caring/                  # executable CARING descriptor, request,
                           # decision, registry, and audit fixtures (P2.1)
  markitect/               # FlexAuthResourceManifest fixtures, decision
                           # fixtures, and Rego-in-Markdown policy packages
  ops-warden/              # SSH certificate signing policy-gate fixtures
                           # for ops-warden policy.enabled smoke checks
  topaz/                   # docker-compose + sample directory and policy
                           # for the Topaz alignment spike (P5.4)
  policies/                # generic Rego-in-Markdown packages used by
                           # the standalone core tests