flex-auth/docs
tegwick e8d6d08f79
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Build and Publish Container Image / build-and-push (push) Successful in 1m4s
Make the B1 survey a command, which immediately falsified B1.
B1 was found with a shell pipeline and published as a finding. The review it
appeared in had already argued that a mechanical check nobody can re-run is an
assertion, and §11's entire claim is mechanical checkability — so asserting B1
unmechanically was that defect committed by the repository reporting it.

tools/survey_layer_declarations.go reads both §11 forms per repository, reports
intra-repository disagreement, and writes a receipt. Run once, it showed the
published B1 was wrong: the estate does not spell layer: three ways across
repositories. The original pipeline took the first ^layer: match per repository
without recording which file it came from, reporting one value where there were
two.

The corrected finding is stronger. Nine of nine repositories carrying both §11
forms declare a different value in each: INTENT.md says Engine/Staff, layer.yaml
says engine/staff. The disagreement is within each repository, between the two
forms §11 permits, and it is universal rather than careless — two generators, two
conventions. Nobody is inconsistent with anybody else.

That relocates the question from casing to precedence: §11 accepts either form
and does not say which governs when both exist and disagree, so a conformance run
reading INTENT.md and one reading layer.yaml reach different answers for nine
repositories while both follow §11. flex-auth is the only declared repository
that cannot exhibit this, and only because it never wrote the second file.

The correction is recorded in the review rather than edited away: a published
review corrected silently is FLEX-DEC-2026-008's defect, and that rule has no
exception for the reviewer.

Four tests cover the disagreement case, the refusal to fold case, a missing
declaration, and the single-form shape that must not read as self-disagreement.
The survey checks only the §3 vocabulary and never applies flex-auth's house
rules to peers.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 28468@bnt-lap001
Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d
2026-09-21 01:24:15 +02:00
..
adr Finish FLEX-WP-0015: both pins enforce, live A2 probes, AuthZEN deferred 2026-08-19 14:35:27 +02:00
conformance Make the B1 survey a command, which immediately falsified B1. 2026-09-21 01:24:15 +02:00
evidence Make the B1 survey a command, which immediately falsified B1. 2026-09-21 01:24:15 +02:00
action-bound-authorization-contract.md Accept ActionAuthorization deferral; fix the state-hub authority constant 2026-09-06 01:30:04 +02:00
canonical-request-digest.md fix(decision): registry facts win over caller-supplied attributes 2026-09-07 13:43:33 +02:00
caring-architecture-blueprint.md Refine workplans for CARING profile 2026-05-17 04:15:38 +02:00
decision-envelope-signature.md Sign decision envelopes and close FLEX-WP-0024. 2026-09-14 09:57:50 +02:00
decision-input-freshness.md Answer ops-warden and secrets-engine; open FLEX-WP-0021 2026-09-06 01:12:50 +02:00
decision-record-contract.md Sign decision envelopes and close FLEX-WP-0024. 2026-09-14 09:57:50 +02:00
delegated-mode-operations.md Document delegated mode operations 2026-05-17 07:27:45 +02:00
directory-group-resolver-adapters.md Add directory group resolver adapters 2026-05-17 07:24:50 +02:00
flex-auth-authorization-registry-research.md Established INTENT.md 2026-05-04 17:52:29 +02:00
iam-profile-consumption.md Align IAM Profile consumption with v0.2 2026-05-22 14:35:30 +02:00
keycloak-authz-adapter-path.md Add Keycloak authorization adapter path 2026-05-17 07:18:45 +02:00
markitect-action-vocabulary.md Define Markitect action vocabulary 2026-05-17 06:26:13 +02:00
markitect-integration-flow.md Document Markitect integration flow 2026-05-17 06:41:07 +02:00
markitect-resource-namespace.md Define Markitect resource namespace 2026-05-17 06:14:04 +02:00
openrouter-native-access.md Resolve OpenRouter native contract and promote secrets-engine PDP 2026-09-14 00:54:56 +02:00
operator-caller-access-path.md Enforce verified secrets-engine operator caller identity 2026-09-06 23:38:36 +02:00
ops-warden-policy-gate-handoff.md Close ops-warden policy gate deployment 2026-06-30 00:52:56 +02:00
ops-warden-registry-sync.md FLEX-WP-0007: production registry fixture, tests, and sync runbook 2026-06-24 14:52:35 +02:00
pre-implementation-assessment.md Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton 2026-05-16 01:54:44 +02:00
ProductRequirementsDocument.md feat(authz): bind decisions to exact actions 2026-08-23 13:18:26 +02:00
railiance-platform-action-vocabulary.md feat(policy): add credential grant authorization package 2026-08-23 13:59:03 +02:00
relationship-pdp-adapter-boundary.md Add relationship PDP adapter boundary 2026-05-17 07:06:14 +02:00
request-enrichment.md Admit the compact sitting review package on a dedicated pin. 2026-09-15 22:50:24 +02:00
rule-pdp-adapter-boundary.md Add rule PDP adapter boundary 2026-05-17 07:13:27 +02:00
secrets-engine-action-vocabulary.md Add schemaguard; correct check_request subject.type against shipped reality 2026-09-06 14:21:28 +02:00
stance-register-review.md Review the stance register's second row; record why T04 cannot proceed 2026-09-06 09:31:40 +02:00
tenancy-posture-review.md Record zone-engine compilation invariant; drop uncommitted policy leftovers 2026-08-19 21:36:22 +02:00
tenant-engine-action-vocabulary.md Authorize tenant-engine guardrail read and set actions 2026-08-16 02:46:25 +02:00
tenant-engine-resource-namespace.md Authorize tenant-engine guardrail read and set actions 2026-08-16 02:46:25 +02:00
topaz-adapter-operations.md Implement Topaz adapter 2026-05-17 06:58:04 +02:00
topaz-mapping-spike.md Topaz alignment spike — mapping doc + green e2e example 2026-05-16 09:04:42 +02:00
workplan-planning-map.md Enforce caller-auth on flex-auth-ops-warden (FLEX-WP-0016-T03) 2026-08-19 20:10:31 +02:00