tegwick
ad7b7f536a
list is a separate rule with exact-record scope over the union of the eight
sitting records and the three T03 records, each pinned by approval id, digest and
its own memo version, with a 12-hour MFA window. read and the five acts keep the
v2 rule unchanged — same eight records, same 900-second window — so a list allow
satisfies nothing else.
The operator chose exact-record scope over the consumer's preferred type-wide
scope: the PDP checks no recipient, so type-wide scope with a relaxed window would
have left the consumer's structural match — which the consumer itself says is
not an entitlement — as the only scope. The 12-hour bound replaces the requested
"no bound" so the PDP still states one. The KeyCape stale-timestamp defect is not
worked around; read stays strict.
417 evaluator checks: 168 v2 unchanged, 231 list, 18 proving no act widens to the
T03 records. Also fixes tools/exercise_t03_review_policy.py, which had been
failing since
|
||
|---|---|---|
| .. | ||
| caring | ||
| claims | ||
| informed-decision-sitting | ||
| informed-decision-t03 | ||
| markitect | ||
| ops-warden | ||
| qonto-assistant | ||
| railiance-platform | ||
| secrets-engine | ||
| tenant-engine | ||
| topaz | ||
| user-engine | ||
| README.md | ||
examples/
Runnable examples used both as documentation and as test fixtures.
Expected layout (filled in across FLEX-WP-0002 / FLEX-WP-0003 / FLEX-WP-0005):
examples/
claims/ # key-cape lightweight-mode and Keycloak heavy-mode
# claim envelopes (P5.5)
caring/ # executable CARING descriptor, request,
# decision, registry, and audit fixtures (P2.1)
markitect/ # FlexAuthResourceManifest fixtures, decision
# fixtures, and Rego-in-Markdown policy packages
ops-warden/ # SSH certificate signing policy-gate fixtures
# for ops-warden policy.enabled smoke checks
topaz/ # docker-compose + sample directory and policy
# for the Topaz alignment spike (P5.4)
policies/ # generic Rego-in-Markdown packages used by
# the standalone core tests