tegwick
4f66c4d6cf
v2 adds exactly memo:infd-20260921-b01 (SECRETS-WP-0009-T03 spend envelope) with native pins from the sitting-create receipt; the seven v1 records and the identity bar are unchanged. The exercise reads the policy version from the package. 168 local evaluator checks pass (147 prior + 21). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 272244@bnt-lap001 Assistant-Session: c8962fa7-b290-47df-865f-403ddb6c77e9
677 lines
11 KiB
JSON
677 lines
11 KiB
JSON
{
|
|
"scope": "local actual evaluator with synthetic identity; no live human approvals; T03 package untouched",
|
|
"checks": [
|
|
{
|
|
"check": "c02:read",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c02:acknowledge",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c02:accept",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c02:return",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c02:discuss",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c02:decline",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c02:wrong-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:no-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:service",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:stale-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:future-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:no-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:forged-human-route",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:wrong-tenant",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:other-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:omitted-c01",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:t03-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:changed-version",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:changed-approval",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:changed-digest",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c02:consume",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:read",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c03:acknowledge",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c03:accept",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c03:return",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c03:discuss",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c03:decline",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c03:wrong-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:no-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:service",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:stale-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:future-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:no-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:forged-human-route",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:wrong-tenant",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:other-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:omitted-c01",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:t03-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:changed-version",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:changed-approval",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:changed-digest",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c03:consume",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:read",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c04:acknowledge",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c04:accept",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c04:return",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c04:discuss",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c04:decline",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "c04:wrong-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:no-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:service",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:stale-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:future-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:no-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:forged-human-route",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:wrong-tenant",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:other-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:omitted-c01",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:t03-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:changed-version",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:changed-approval",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:changed-digest",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "c04:consume",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:read",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d01:acknowledge",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d01:accept",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d01:return",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d01:discuss",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d01:decline",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d01:wrong-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:no-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:service",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:stale-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:future-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:no-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:forged-human-route",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:wrong-tenant",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:other-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:omitted-c01",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:t03-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:changed-version",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:changed-approval",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:changed-digest",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d01:consume",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:read",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d02:acknowledge",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d02:accept",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d02:return",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d02:discuss",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d02:decline",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d02:wrong-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:no-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:service",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:stale-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:future-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:no-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:forged-human-route",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:wrong-tenant",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:other-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:omitted-c01",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:t03-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:changed-version",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:changed-approval",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:changed-digest",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d02:consume",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:read",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d03:acknowledge",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d03:accept",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d03:return",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d03:discuss",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d03:decline",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d03:wrong-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:no-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:service",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:stale-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:future-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:no-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:forged-human-route",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:wrong-tenant",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:other-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:omitted-c01",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:t03-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:changed-version",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:changed-approval",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:changed-digest",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d03:consume",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:read",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d04:acknowledge",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d04:accept",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d04:return",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d04:discuss",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d04:decline",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "d04:wrong-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:no-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:service",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:stale-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:future-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:no-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:forged-human-route",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:wrong-tenant",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:other-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:omitted-c01",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:t03-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:changed-version",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:changed-approval",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:changed-digest",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "d04:consume",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:read",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "b01:acknowledge",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "b01:accept",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "b01:return",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "b01:discuss",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "b01:decline",
|
|
"effect": "allow"
|
|
},
|
|
{
|
|
"check": "b01:wrong-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:no-group",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:service",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:stale-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:future-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:no-mfa",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:forged-human-route",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:wrong-tenant",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:other-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:omitted-c01",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:t03-memo",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:changed-version",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:changed-approval",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:changed-digest",
|
|
"effect": "deny"
|
|
},
|
|
{
|
|
"check": "b01:consume",
|
|
"effect": "deny"
|
|
}
|
|
]
|
|
}
|