A policy-as-code capable authorization registry/control-plane service.
tegwick
693136edbc
Opens the State Hub capability request 893ff109, unanswered since 2026-07-02. Drafted as proposed/P3 rather than as the blocker it was filed as, because two of its premises no longer hold: - It is not blocking anyone. railiance-platform re-scoped and closed RAILIANCE-WP-0005-T07 the same day it filed the request; WP-0005 is finished and their grant catalog already enforces TTL, actor-type, purpose and delivery-mode bounds locally. This buys defence in depth and central decision records, not unblocking. - The stated technical blocker is wrong. The request says the CARING /v1/check schema cannot express TTL, purpose or delivery mode; the ops-warden package in this repo already denies ttl_out_of_bounds by reading input.context.ttl_hours against resource.attributes. CARING constrains descriptor vocabulary, not the request payload. The real gap is narrower: no credential-grant policy package exists, and the helper's flat payload/response shape differs from CheckRequest. Its endpoint path is configurable, so no bespoke endpoint is strictly required. T01 makes the adapter-vs-consumer-mapping call an explicit, jointly-agreed decision rather than a default. Flags two things worth knowing before anyone implements: the helper sends requested_ttl as a duration string while the ops-warden precedent compares numeric hours (mis-parsing it would fail open on the check that matters most), and without --require-flex-auth the helper continues by local preauthorization when flex-auth is unreachable -- a different posture from the tenant-engine and ops-warden gates. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> |
||
|---|---|---|
| .claude/rules | ||
| .forgejo/workflows | ||
| .github/workflows | ||
| cmd/flex-auth | ||
| deploy | ||
| docs | ||
| examples | ||
| internal | ||
| pkg/api | ||
| registry | ||
| schemas | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .golangci.yml | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| Containerfile | ||
| go.mod | ||
| go.sum | ||
| INTENT.md | ||
| LICENSE | ||
| Makefile | ||
| README.md | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||
flex-auth
Policy-as-code authorization registry and control plane for NetKingdom-aligned systems.
Start with INTENT.md for the project boundary and direction. Research notes and ADRs live in docs/ and docs/adr/.
The product boundary is captured in SCOPE.md, and the current Product Requirements Document is docs/ProductRequirementsDocument.md.
The 2026-05-15 pre-implementation assessment that shapes the current sequencing is in docs/pre-implementation-assessment.md.
The CARING reference-implementation approach is captured in docs/caring-architecture-blueprint.md.
Workplans live in workplans/, with sequencing captured in docs/workplan-planning-map.md.