coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/.repo-manager/index.json
tegwick 0e2efa8fcf
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Align INTENT and SCOPE to security layer model v0.7; plan conformance work 
The standard was accepted at v0.7 on 2026-08-29. Four of flex-auth's review
findings are in the accepted text: 9.3's two-owner split, 6.4.2 scoped to the
decision's own binding with our canonical request digest as its mechanical test,
9.7.2 split by role, and 17 moving the decision-record schema to access-engine.

INTENT.md
- Machine-readable layer declaration in frontmatter (layer: Engine, role: PDP),
  which section 11 requires and we did not have. audit-core noted our
  declaration was legible only by following the decision trail.
- PDP failure semantics stated: our outage is consumer residue, not input
  degradation; fail-open is not expressible by a PDP at all.
- Four owned obligations added: the decision-record schema as our contract, the
  request digest as the published replay test, a lifetime on every allow, and
  visibility deadlines per input class.
- A Layer Conformance section stating the state honestly: conforming with one
  declared gap, no Tooling client, not PEP-shaped.
- Vocabulary correction: earlier text dropped "control plane" as Staff
  vocabulary. Section 8 binds it to the Engine layer, which is why kings-guard
  was asked to release it. The term is ours; we prefer "decision engine" for
  precision, not boundary.

SCOPE.md
- Layer and role in the one-liner; the four obligations In Scope; five
  boundaries established in review but never written down Out of Scope.
- Three capability blocks marked planned for workplans completed in May are now
  current; two blocks added.
- Superseded ADR-0006 citation corrected to ADR-0009, which retires the global
  flag outright rather than deferring it.

history/2026-08-29-layer-model-v0.7-alignment-review.md checks each obligation
against the code and finds six gaps. FLEX-WP-0019 closes them, with T02 before
T04 because a visibility deadline for registry-borne facts is unfalsifiable
until provenance can identify the snapshot a decision read.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012sgN4GH5ZYT8pJVkCR6dcP

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014348@bnt-lap001
Assistant-Session: a993abda-65a0-4ea8-8ccd-0fcd78c92ac0
2026-08-29 14:43:49 +02:00

1236 lines
48 KiB
JSON
Raw Blame History

{
"schema": "repo_manager.index.v1",
"slug": "flex-auth",
"repo_root": "/home/worsch/flex-auth",
"head_sha": "5753b47ccb72f96689df9ec5eeb7be100f6817cd",
"observed_at": "2026-08-29T08:19:42.754823Z",
"source_fingerprint": "2d3773fc38408c64d1a9a4efc7335ed792f361cdf6464f04389615c9b443fa53",
"source_files": [
".repo-classification.yaml",
"INTENT.md",
"decisions/decisions.md",
"intakes/intakes.md",
"workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md",
"workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md",
"workplans/FLEX-WP-0009-user-engine-production-policy-service.md",
"workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md",
"workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md",
"workplans/FLEX-WP-0012-credential-grant-authorization-surface.md",
"workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md",
"workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md",
"workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md",
"workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"workplans/FLEX-WP-0018-inbound-auth-corrections.md"
],
"work_records": [
{
"kind": "workplan",
"id": "FLEX-WP-0001",
"status": "done",
"title": "Repo Intent and Authorization Architecture Baseline",
"source_path": "workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md",
"uuid": "4dbefd19-bb7d-405c-9a50-e7dbd11cf4d9",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0001-T001",
"status": "done",
"title": "P1.1 - Define project intent",
"source_path": "workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md",
"uuid": "5af30b01-ea72-4f87-b74e-a595fd3a5bd7",
"parent_id": "FLEX-WP-0001",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0001-T002",
"status": "done",
"title": "P1.2 - Define responsibility boundaries",
"source_path": "workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md",
"uuid": "145ec0ec-130a-4209-9028-1ae06e3664e3",
"parent_id": "FLEX-WP-0001",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0001-T003",
"status": "done",
"title": "P1.3 - Capture open-source and enterprise landscape",
"source_path": "workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md",
"uuid": "c52a9e3e-e264-418d-b462-d5a9d6e22b30",
"parent_id": "FLEX-WP-0001",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0001-T004",
"status": "done",
"title": "P1.4 - Establish first-consumer architecture",
"source_path": "workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md",
"uuid": "7756c4c5-598a-4894-9352-6e7145cb3522",
"parent_id": "FLEX-WP-0001",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0002",
"status": "completed",
"title": "Standalone Policy-as-Code Core",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "aa60e183-9a87-4e03-99b0-15786bfa11ae",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T001",
"status": "done",
"title": "P2.1 - Define canonical schemas",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "534e5251-8529-48fe-8cf8-b3b6bc4ec1f4",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T002",
"status": "done",
"title": "P2.2 - Implement local registry store",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "d8045124-f0ae-495d-87b5-24fd9528ef93",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T003",
"status": "done",
"title": "P2.3 - Implement policy package loader and validator",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "09be0f25-e5ba-42b5-8b2f-36fd0ef2fe6b",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T004",
"status": "done",
"title": "P2.4 - Implement deterministic check and batch_check APIs",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "f6427575-00af-4f3e-ab30-5b9a158343ef",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T005",
"status": "done",
"title": "P2.5 - Implement list_allowed and explain",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "e8fcbabd-4eb6-41d2-a4d5-6f40cc245a7e",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T006",
"status": "done",
"title": "P2.6 - Add local decision log",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "2def10c1-4b5f-44a8-8e6b-4c8592fffd43",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T007",
"status": "done",
"title": "P2.7 - Add CLI and service skeleton",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "ee9ae6dd-c31f-4d4e-b238-533a2b8040d4",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T008",
"status": "done",
"title": "P2.8 - Add tests and examples",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "6cbe572a-2877-4936-8ef3-63b79900fae2",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0003",
"status": "completed",
"title": "Markitect Consumer Integration",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "c0a6c9f6-bb6b-416d-b537-f30504c63d75",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0003-T001",
"status": "done",
"title": "P3.1 - Define Markitect resource namespace",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "53f2fa67-780b-4e40-bbda-e669e4cecc32",
"parent_id": "FLEX-WP-0003",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0003-T002",
"status": "done",
"title": "P3.2 - Import Markitect resource manifests",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "90082eaf-37f5-492f-a884-ff8eec0eccaa",
"parent_id": "FLEX-WP-0003",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0003-T003",
"status": "done",
"title": "P3.3 - Define Markitect action vocabulary",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "cfc78bbb-5425-4780-a860-9109df62ea37",
"parent_id": "FLEX-WP-0003",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0003-T004",
"status": "done",
"title": "P3.4 - Implement Markitect check fixtures",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "1d5de3b2-c581-4ca3-9107-93211eb02c6b",
"parent_id": "FLEX-WP-0003",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0003-T005",
"status": "done",
"title": "P3.5 - Add Markitect adapter contract tests",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "f9297b0d-69dc-495c-a650-ca671f2c59c7",
"parent_id": "FLEX-WP-0003",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0003-T006",
"status": "done",
"title": "P3.6 - Document integration flow",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "e34b0303-4416-40a3-8b34-e0e80d644aea",
"parent_id": "FLEX-WP-0003",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0004",
"status": "completed",
"title": "Delegated PDP and Directory Adapters",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "99a82976-d376-42b0-89cc-c44e01c0bec6",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0004-T001",
"status": "done",
"title": "P4.1 - Implement Topaz adapter",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "9046418c-2b78-42c6-8bfa-76d6ed0050dd",
"parent_id": "FLEX-WP-0004",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0004-T002",
"status": "done",
"title": "P4.2 - Add relationship PDP adapter boundary",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "b77a0b70-b492-46ba-badf-8c2eebe006aa",
"parent_id": "FLEX-WP-0004",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0004-T003",
"status": "done",
"title": "P4.3 - Add rule PDP adapter boundary",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "4e4e5e45-c05a-4a31-8126-f0c7676b1e6c",
"parent_id": "FLEX-WP-0004",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0004-T004",
"status": "done",
"title": "P4.4 - Add Keycloak Authorization Services adapter path",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "8d3bbc28-985b-4dd7-9fb8-f9a858eb5a6b",
"parent_id": "FLEX-WP-0004",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0004-T005",
"status": "done",
"title": "P4.5 - Add Entra/Graph and SCIM group resolver adapters",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "4fc3fb91-8763-453e-8e54-36178cb11efd",
"parent_id": "FLEX-WP-0004",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0004-T006",
"status": "done",
"title": "P4.6 - Add delegated-mode operations docs",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "491260f9-b4d7-46fe-8220-d358597db33a",
"parent_id": "FLEX-WP-0004",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0005",
"status": "done",
"title": "Foundations and Topaz Alignment",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "e37d42a9-0018-4a67-a672-ff4e9716b338",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0005-T001",
"status": "done",
"title": "P5.1 - Record ADR-001 / ADR-002 / ADR-003",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "8193a278-a044-4397-a4a8-232104374cdc",
"parent_id": "FLEX-WP-0005",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0005-T002",
"status": "done",
"title": "P5.2 - Land Go project skeleton",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "8ac73c33-6d36-4963-990d-28b0d1d60947",
"parent_id": "FLEX-WP-0005",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0005-T003",
"status": "done",
"title": "P5.3 - Pin FlexAuthResourceManifest schema",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "80285e1e-16ec-4f4e-b491-1e79f200219f",
"parent_id": "FLEX-WP-0005",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0005-T004",
"status": "done",
"title": "P5.4 - Topaz alignment spike",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "b8a314c3-e98e-4093-bb11-ab8546b8d79b",
"parent_id": "FLEX-WP-0005",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0005-T005",
"status": "done",
"title": "P5.5 - Cite NetKingdom IAM Profile and pin claim consumption",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "b31dab7b-e72c-4abe-b6d5-f5875fd0c25a",
"parent_id": "FLEX-WP-0005",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0005-T006",
"status": "done",
"title": "P5.6 - Confirm ops-warden boundary",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "dcd45a14-20fc-49d0-b869-08cda85fcbc5",
"parent_id": "FLEX-WP-0005",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0006",
"status": "finished",
"title": "Ops-Warden SSH Signing Policy Gate",
"source_path": "workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"uuid": "bbea4049-8acc-4d7c-8cf5-3106c6b93f7f",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0006-T01",
"status": "done",
"title": "T1 - Pin the ops-warden protected-system contract",
"source_path": "workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"uuid": "8831b904-dbef-4d55-8eb5-053c939c86b3",
"parent_id": "FLEX-WP-0006",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0006-T02",
"status": "done",
"title": "T2 - Author the ssh-certificate sign policy package",
"source_path": "workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"uuid": "9ea206fa-f93d-46b6-8b8e-e8669dd502d4",
"parent_id": "FLEX-WP-0006",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0006-T03",
"status": "done",
"title": "T3 - Add allow and deny fixtures",
"source_path": "workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"uuid": "6bf5cb9b-d46c-49cf-aec0-12f6e864a1f8",
"parent_id": "FLEX-WP-0006",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0006-T04",
"status": "done",
"title": "T4 - Verify the `/v1/check` service contract",
"source_path": "workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"uuid": "077d29db-30e0-4447-90fd-620c0884306c",
"parent_id": "FLEX-WP-0006",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0006-T05",
"status": "done",
"title": "T5 - Hand off production-readiness evidence to ops-warden",
"source_path": "workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"uuid": "06cac0b1-51c0-4ae0-b605-c940f7821ac7",
"parent_id": "FLEX-WP-0006",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0007",
"status": "finished",
"title": "Ops-Warden Policy Gate Production Deployment",
"source_path": "workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"uuid": "358ce697-2611-4fe9-89ab-63e86ceb00fa",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0007-T01",
"status": "done",
"title": "T1 - Deploy production flex-auth runtime",
"source_path": "workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"uuid": "727573fc-86a3-4f5a-abd7-40b0ccb01e68",
"parent_id": "FLEX-WP-0007",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0007-T02",
"status": "done",
"title": "T2 - Load production registry and verify real actors",
"source_path": "workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"uuid": "6ec1e00c-4a3a-475b-aefb-af3961de7070",
"parent_id": "FLEX-WP-0007",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0007-T03",
"status": "done",
"title": "T3 - Publish registry sync contract with ops-warden",
"source_path": "workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"uuid": "afa09ec3-516c-433d-87a7-330cb79845a8",
"parent_id": "FLEX-WP-0007",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0007-T04",
"status": "done",
"title": "T4 - Joint OpenBao + policy gate production smoke",
"source_path": "workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"uuid": "32a96f1c-e0e8-4e27-baa6-7b8c445cf7a1",
"parent_id": "FLEX-WP-0007",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0007-T05",
"status": "done",
"title": "T5 - IAM subject binding for production",
"source_path": "workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"uuid": "65dc3c59-1e4b-4335-b6a0-db492ea9b2b5",
"parent_id": "FLEX-WP-0007",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0008",
"status": "finished",
"title": "tenant-engine Consumer Integration",
"source_path": "workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md",
"uuid": "1358db95-967c-5a03-8b8c-4816dc106594",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0008-T01",
"status": "done",
"title": "Task: Define tenant-engine resource and action vocabulary",
"source_path": "workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md",
"uuid": "5606408f-f94c-5d79-ba41-ed23fadac480",
"parent_id": "FLEX-WP-0008",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0008-T02",
"status": "done",
"title": "Task: Author and register the tenant-engine policy package",
"source_path": "workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md",
"uuid": "bbe1a8f4-dcd9-58bb-8d82-386ee0c11a51",
"parent_id": "FLEX-WP-0008",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0008-T03",
"status": "done",
"title": "Task: tenant-engine live-lookup context adapter",
"source_path": "workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md",
"uuid": "e27d24b3-0aef-5bd4-b7e3-81532cd7aa9c",
"parent_id": "FLEX-WP-0008",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0008-T04",
"status": "done",
"title": "Task: Closure review",
"source_path": "workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md",
"uuid": "0f319a2f-e4bb-5ba8-92de-b693ae9a2aa3",
"parent_id": "FLEX-WP-0008",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0009",
"status": "finished",
"title": "Provide production authorization for user-engine",
"source_path": "workplans/FLEX-WP-0009-user-engine-production-policy-service.md",
"uuid": "390da58d-3c58-5102-bd3c-7133956c810e",
"parent_id": null,
"extra": {
"depends_on": [
"NK-WP-0024"
]
}
},
{
"kind": "task",
"id": "FLEX-WP-0009-T01",
"status": "done",
"title": "T01 - Pin the protected-system vocabulary",
"source_path": "workplans/FLEX-WP-0009-user-engine-production-policy-service.md",
"uuid": "4607222e-3407-59c4-b388-aa7c88f7e3ef",
"parent_id": "FLEX-WP-0009",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0009-T02",
"status": "done",
"title": "T02 - Implement and verify the policy package",
"source_path": "workplans/FLEX-WP-0009-user-engine-production-policy-service.md",
"uuid": "7ae9de35-4f71-54d8-aabb-858c1202c833",
"parent_id": "FLEX-WP-0009",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0009-T03",
"status": "done",
"title": "T03 - Deploy the cluster-local service",
"source_path": "workplans/FLEX-WP-0009-user-engine-production-policy-service.md",
"uuid": "9a1ea146-0735-5d6f-bd75-96eb78e9bd2b",
"parent_id": "FLEX-WP-0009",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0009-T04",
"status": "done",
"title": "T04 - Hand back production evidence",
"source_path": "workplans/FLEX-WP-0009-user-engine-production-policy-service.md",
"uuid": "9639adbe-4392-5f6c-a924-3771f71ab94c",
"parent_id": "FLEX-WP-0009",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0010",
"status": "finished",
"title": "Authorize tenant-engine lifecycle actions",
"source_path": "workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md",
"uuid": "fdabae84-dc9e-5ccd-81df-8ae7e66b90b8",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0010-T01",
"status": "done",
"title": "T01 - Extend the policy package with the lifecycle actions",
"source_path": "workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md",
"uuid": "8deb9564-658e-5eff-8ef7-94838bee05cc",
"parent_id": "FLEX-WP-0010",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0010-T02",
"status": "done",
"title": "T02 - Decide whether retirement warrants stricter authorization",
"source_path": "workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md",
"uuid": "82d13a89-a344-5797-b10f-390d17b11b73",
"parent_id": "FLEX-WP-0010",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0010-T03",
"status": "done",
"title": "T03 - Fixtures and verification",
"source_path": "workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md",
"uuid": "2fbceaf5-514b-5ded-adb1-f4e63ce96160",
"parent_id": "FLEX-WP-0010",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0010-T04",
"status": "done",
"title": "T04 - Closure and handoff",
"source_path": "workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md",
"uuid": "eb2579cb-b54f-5834-abcc-81954ac34889",
"parent_id": "FLEX-WP-0010",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0011",
"status": "finished",
"title": "Bring flex-auth under the railiance staged-promotion contract",
"source_path": "workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md",
"uuid": "deda35b4-f41d-559e-954e-a75f29237f68",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0011-T01",
"status": "done",
"title": "T01 - Author the railiance overlay",
"source_path": "workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md",
"uuid": "75748946-68c0-5f33-abe1-810fcd55e93f",
"parent_id": "FLEX-WP-0011",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0011-T02",
"status": "done",
"title": "T02 - Prove the stage commands",
"source_path": "workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md",
"uuid": "4becc09f-2331-5487-a794-643c748dd1bd",
"parent_id": "FLEX-WP-0011",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0011-T03",
"status": "done",
"title": "T03 - Correct the stale drain-plan row",
"source_path": "workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md",
"uuid": "abb788fe-22a5-5226-9f08-a43e20a47ce9",
"parent_id": "FLEX-WP-0011",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0012",
"status": "finished",
"title": "Authorize railiance-platform credential-grant requests",
"source_path": "workplans/FLEX-WP-0012-credential-grant-authorization-surface.md",
"uuid": "2a6b5764-1831-5305-b46e-0991d02675df",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0012-T01",
"status": "done",
"title": "T01 - Decide where the translation lives",
"source_path": "workplans/FLEX-WP-0012-credential-grant-authorization-surface.md",
"uuid": "f8491771-be1a-5c70-a4aa-059e48536630",
"parent_id": "FLEX-WP-0012",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0012-T02",
"status": "done",
"title": "T02 - Credential-grant policy package and fixtures",
"source_path": "workplans/FLEX-WP-0012-credential-grant-authorization-surface.md",
"uuid": "685f3d70-7c50-5664-95ae-1e8c93b14073",
"parent_id": "FLEX-WP-0012",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0012-T03",
"status": "done",
"title": "T03 - Implement the decided integration and prove it end to end",
"source_path": "workplans/FLEX-WP-0012-credential-grant-authorization-surface.md",
"uuid": "045ec743-4411-5b42-b9e8-df25b0c07984",
"parent_id": "FLEX-WP-0012",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0012-T04",
"status": "done",
"title": "T04 - Closure and handoff",
"source_path": "workplans/FLEX-WP-0012-credential-grant-authorization-surface.md",
"uuid": "0dcf2e1f-baa2-5fea-9e3e-9a73795af11f",
"parent_id": "FLEX-WP-0012",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0013",
"status": "finished",
"title": "Restore the seven-action tenant-engine policy pin",
"source_path": "workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md",
"uuid": "6f22ded6-a69c-531b-bfa6-2f8d5c886979",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0013-T01",
"status": "done",
"title": "T01 - Re-pin the overlay and emergency manifests",
"source_path": "workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md",
"uuid": "f84b0f20-f374-5d61-aa43-d1f886ea86c3",
"parent_id": "FLEX-WP-0013",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0013-T02",
"status": "done",
"title": "T02 - Apply and prove the seven actions live",
"source_path": "workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md",
"uuid": "a77ff4bb-8927-5317-a0eb-903cfeef0de5",
"parent_id": "FLEX-WP-0013",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0013-T03",
"status": "done",
"title": "T03 - Handoff and close",
"source_path": "workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md",
"uuid": "832ba42f-4247-58a9-bc1b-f99648c2c188",
"parent_id": "FLEX-WP-0013",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0014",
"status": "finished",
"title": "Authorize tenant-engine guardrail actions",
"source_path": "workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md",
"uuid": "7de17bd2-5e7c-5355-ba1d-40a051a67746",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0014-T01",
"status": "done",
"title": "T01 - Extend the policy package with the guardrail actions",
"source_path": "workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md",
"uuid": "34fb239a-7f06-5e96-9f10-a6bbb85bf4c3",
"parent_id": "FLEX-WP-0014",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0014-T02",
"status": "done",
"title": "T02 - Decide how the read/write split is used today",
"source_path": "workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md",
"uuid": "8ea87d5f-883a-5d63-89bb-33a3d0963472",
"parent_id": "FLEX-WP-0014",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0014-T03",
"status": "done",
"title": "T03 - Fixtures and verification",
"source_path": "workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md",
"uuid": "1029d2ce-bb37-530e-91ef-ded86f6f5be8",
"parent_id": "FLEX-WP-0014",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0014-T04",
"status": "done",
"title": "T04 - Closure and handoff",
"source_path": "workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md",
"uuid": "b2b44215-ef08-5c50-b466-190156a88ef3",
"parent_id": "FLEX-WP-0014",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0015",
"status": "finished",
"title": "Tenancy posture declaration and inbound caller authentication",
"source_path": "workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"uuid": "43fe348c-02b9-5d5d-af37-a2d80cfc6e1d",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0015-T01",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"uuid": "ee587988-d29c-5dd8-9417-8af73f627817",
"parent_id": "FLEX-WP-0015",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0015-T02",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"uuid": "7c906ab5-0b3f-5a73-8561-b29d94f4e634",
"parent_id": "FLEX-WP-0015",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0015-T03",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"uuid": "4f885922-56c9-5d89-b7ab-e61c8d69d67a",
"parent_id": "FLEX-WP-0015",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0015-T04",
"status": "cancel",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"uuid": "1c05032a-bcae-5a4c-8f4a-c51b30a48807",
"parent_id": "FLEX-WP-0015",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0015-T05",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"uuid": "702e55bf-b87a-547d-9a2d-bc2ccfee9341",
"parent_id": "FLEX-WP-0015",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0016",
"status": "finished",
"title": "In-cluster ops-warden policy pin so policy.enabled can flip",
"source_path": "workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md",
"uuid": "f29f159c-c79e-5c78-b1e8-569a5b63d231",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0016-T01",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md",
"uuid": "b2f8052e-3686-593f-9359-dfd08d530a26",
"parent_id": "FLEX-WP-0016",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0016-T02",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md",
"uuid": "aa65f534-7401-5231-ae82-ea6e3d09b40c",
"parent_id": "FLEX-WP-0016",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0016-T03",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md",
"uuid": "351f502f-f0cf-5a70-86da-10b1fbe39dae",
"parent_id": "FLEX-WP-0016",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0017",
"status": "active",
"title": "Action-bound authorization and durable approval contract",
"source_path": "workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"uuid": "d75b7256-8b3d-5797-911c-96c3199b8baa",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0017-T01",
"status": "done",
"title": "Bind execute-time decisions to the evaluated request",
"source_path": "workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"uuid": "e7b47e1d-58e8-503c-be89-e8f2050215b1",
"parent_id": "FLEX-WP-0017",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0017-T02",
"status": "done",
"title": "Define the durable authorization object and semantics",
"source_path": "workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"uuid": "df7984fb-c31f-5b26-bf42-193e4c3cbb9f",
"parent_id": "FLEX-WP-0017",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0017-T03",
"status": "wait",
"title": "Add durable storage and authenticated approval evidence",
"source_path": "workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"uuid": "82d39961-8140-5a7f-9bd8-5164dd1742e5",
"parent_id": "FLEX-WP-0017",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0017-T04",
"status": "done",
"title": "Propagate bindings through delegated evaluators",
"source_path": "workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"uuid": "d85089ee-ad8c-502b-ba1b-be4ad23aec46",
"parent_id": "FLEX-WP-0017",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0017-T05",
"status": "wait",
"title": "Consumer handoff and live destructive-action proof",
"source_path": "workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"uuid": "8c3fc0a2-0855-5ac9-afa5-d03b8b1f0bf9",
"parent_id": "FLEX-WP-0017",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0018",
"status": "finished",
"title": "Inbound caller-auth and deployment documentation corrections",
"source_path": "workplans/FLEX-WP-0018-inbound-auth-corrections.md",
"uuid": "8f301c7c-e3e2-5bd0-a6f2-0cb92c1d782f",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0018-T01",
"status": "done",
"title": "Classify rejected TokenReview credentials as unauthenticated",
"source_path": "workplans/FLEX-WP-0018-inbound-auth-corrections.md",
"uuid": "4a85c91f-6f34-5224-99b0-23b8eaa3bf7b",
"parent_id": "FLEX-WP-0018",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0018-T02",
"status": "done",
"title": "Correct NetworkPolicy egress documentation",
"source_path": "workplans/FLEX-WP-0018-inbound-auth-corrections.md",
"uuid": "5613aeb1-ad09-50e5-9933-ced39593dc54",
"parent_id": "FLEX-WP-0018",
"extra": {}
},
{
"kind": "decision",
"id": "FLEX-DEC-2026-001",
"status": "resolved",
"title": "Assent to GH-DEC-2026-001: Engine framing, access-engine rename, authoring/evaluation split",
"source_path": "decisions/decisions.md",
"uuid": "c990e442-77c2-4556-a40b-61f65eded10b",
"parent_id": null,
"extra": {
"record": {
"id": "FLEX-DEC-2026-001",
"kind": "decision",
"title": "Assent to GH-DEC-2026-001: Engine framing, access-engine rename, authoring/evaluation split",
"status": "resolved",
"origin": "cross-repo",
"origin_ref": "gate-house GH-DEC-2026-001",
"standard": "net-kingdom/canon/standards/security-layer-model_v0.1.md",
"intake_ref": "FLEX-IN-0001",
"owner": "flex-auth",
"affects": [
"flex-auth",
"gate-house",
"net-kingdom",
"ops-warden",
"secrets-engine",
"zone-engine"
],
"requested_dispositions": [
"assent",
"revise",
"reject"
],
"created": "2026-08-28T19:43:38.443788Z",
"updated": "2026-08-28T19:44:29.505314Z",
"rationale": "Assent to all three items of GH-DEC-2026-001. Item 1: flex-auth is Engine-layer and the sole decision point; the INTENT reframe at fe46122 stands. flex-auth accepts one conformance debt of its own \u2014 DecisionProvenance carries no registry snapshot digest, so a decision turning on registry content is not replayable from its own provenance (standard section 6). Item 2: access-engine is the right name; execution is a separate governed migration, conditioned on renaming repository identity and runtime identity in separate revertible steps (the enforcing ops-warden pin binds tokens to the protected-system name flex-auth, and a single-step rename would 401 every warden sign) and on FLEX-WP prefix ownership staying with the repository. Item 3: the authoring/evaluation split is accepted; gate-house authority ceilings must reach the decision as input claims or as rules in the versioned policy package so their application is reconstructable from the decision record \u2014 the same section 6 test flex-auth applied to zone-engine and now to itself. FLEX-WP-0017-T03/T05 stay wait: the design half is re-routed to gate-house, the durable storage half remains unowned and is raised as an engine gap.",
"decided_by": "flex-auth (reviewing side)",
"decided_at": "2026-08-28T19:44:29.505314Z",
"state_hub_decision_id": "c990e442-77c2-4556-a40b-61f65eded10b"
}
}
},
{
"kind": "decision",
"id": "FLEX-DEC-2026-002",
"status": "resolved",
"title": "Review of security layer model v0.4: assent with findings, one rule contested",
"source_path": "decisions/decisions.md",
"uuid": "2e96321d-c7bf-4127-9c30-f3def32e5bee",
"parent_id": null,
"extra": {
"record": {
"id": "FLEX-DEC-2026-002",
"kind": "decision",
"title": "Review of security layer model v0.4: assent with findings, one rule contested",
"status": "resolved",
"origin": "cross-repo",
"origin_ref": "net-kingdom security-layer-model_v0.4",
"standard": "net-kingdom/canon/standards/security-layer-model_v0.4.md",
"intake_ref": "FLEX-IN-0002",
"owner": "flex-auth",
"affects": [
"flex-auth",
"gate-house",
"net-kingdom",
"ops-warden",
"approval-engine",
"maturity-engine"
],
"requested_dispositions": [
"assent",
"revise",
"reject"
],
"created": "2026-08-29T00:41:21.171665Z",
"updated": "2026-08-29T00:42:13.009799Z",
"rationale": "Assent to security-layer-model v0.4, with one rule contested and two capability assignments not accepted as assented. Section 9.3 conflicts with shipped assented behavior: it rules engine-unreachability fallback into the engine, where it cannot live, and collides with ops-warden ADR-0009's per-zone consumer PEP map. Section 13 names access-engine as intended owner of containment (accept as proposed owner only, pending per 9.2) and of authentication/assurance evidence (declined as stated; the identity layer and audit-core own that). Three consistency defects: frontmatter status proposed contradicts section 14 'accepted'; the adoption count reads seven of fifteen with remaining eight against sixteen estate-authored repositories and nine listed; section 14 says three repositories above a table of four. FLEX-IN-0002 answered: the approval boundary unblocks T03 design, T05 additionally needs the approval claim bound to the NewDecisionBinding request digest and a named owner and ordering for single consumption; the maturity claim route is practical as a request claim but not as registry content until the self-declared provenance digest gap closes.",
"decided_by": "flex-auth (reviewing side)",
"decided_at": "2026-08-29T00:42:13.009799Z",
"state_hub_decision_id": "2e96321d-c7bf-4127-9c30-f3def32e5bee"
}
}
},
{
"kind": "decision",
"id": "FLEX-DEC-2026-003",
"status": "resolved",
"title": "Review of security layer model v0.6 and companion v0.1: assent, two answers, five findings",
"source_path": "decisions/decisions.md",
"uuid": null,
"parent_id": null,
"extra": {
"record": {
"id": "FLEX-DEC-2026-003",
"kind": "decision",
"title": "Review of security layer model v0.6 and companion v0.1: assent, two answers, five findings",
"status": "resolved",
"origin": "cross-repo",
"origin_ref": "net-kingdom security-layer-model_v0.6 + companion_v0.1",
"standard": "net-kingdom/canon/standards/security-layer-model_v0.6.md",
"owner": "flex-auth",
"affects": [
"flex-auth",
"gate-house",
"net-kingdom",
"info-tech-canon",
"ops-warden",
"approval-engine"
],
"requested_dispositions": [
"assent",
"revise",
"reject"
],
"created": "2026-08-29T08:18:39.602701Z",
"updated": "2026-08-29T08:19:41.832549Z",
"rationale": "Assent to v0.6 and companion v0.1, with two answers and five findings, none blocking. Q1: section 6.4.2 is right but collides with 9.7.1's session-bound allow, needs the request digest as its mechanical replay test, and should rule explicitly on deny-caching. Q2: the visibility deadline does land on a PDP and harder than at a PEP, but must be per input class rather than one number, and it makes flex-auth's registry-provenance gap load-bearing rather than untidy. Findings: 6.4's stance-map register does not exist in section 13 and neither document says where a map is published; the companion omits it too, which is the sufficiency gap gate-house asked for; section 17 puts the decision-record schema in Taxonomy when it is the PDP's output artifact, inverting the section 2 rule flex-auth used to decline authentication evidence; sections 17-19 are H1 outside the hierarchy; section 19 grades the document it lives in and will age.",
"decided_by": "flex-auth (reviewing side)",
"decided_at": "2026-08-29T08:19:41.832549Z"
}
}
},
{
"kind": "intake",
"id": "FLEX-IN-0001",
"status": "closed",
"title": "Assent requested: Engine framing, access-engine rename, and the authoring/evaluation split",
"source_path": "intakes/intakes.md",
"uuid": "01a049eb-812c-7641-8e46-8dd63b12b2a8",
"parent_id": null,
"extra": {
"record": {
"id": "FLEX-IN-0001",
"kind": "intake",
"title": "Assent requested: Engine framing, access-engine rename, and the authoring/evaluation split",
"status": "closed",
"origin": "cross-repo",
"origin_ref": "gate-house GH-DEC-2026-001",
"priority": "high",
"owner": "flex-auth",
"requested_by": "gate-house",
"standard": "net-kingdom/canon/standards/security-layer-model_v0.1.md",
"description": "gate-house asks flex-auth to assent to three items ratified in GH-DEC-2026-001, following the estate precedent that a boundary is drawn on review by the other side rather than asserted \u2014 as flex-auth itself did to zone-engine. (1) flex-auth is Engine-layer and is NetKingdom\u2019s only policy decision point; the INTENT reframe is already applied (commit fe46122) and can be revised or reverted if wrong. (2) The ruled rename flex-auth -> access-engine, NOT yet authorized to execute: it is a separate governed migration touching FLEX-WP prefix ownership, State Hub identifiers, ops-warden routing tables, zone-engine boundary text, and secrets-engine integrations. auth-engine was rejected because key-cape owns authentication. (3) The split: flex-auth owns evaluation exclusively plus the policy-as-code mechanism; gate-house owns doctrine, invariants, authority ceilings, operating modes, and the authority context consumed as input claims; policy content stays with the protected system owner. This resolves the FLEX-WP-0017 overlap \u2014 gate-house designs the approval contract, flex-auth validates approvals at decision time. Assent, revision, or rejection all acceptable; the standard stays proposed until this is answered.",
"created": "2026-08-28T19:30:03.602578Z",
"updated": "2026-08-28T19:45:06.001794Z",
"notes": [
{
"content": "Answered by FLEX-DEC-2026-001 (decisions/decisions.md): assent to all three items, with one accepted flex-auth conformance debt (registry snapshot absent from DecisionProvenance) and two conditions on the rename migration.",
"author": "flex-auth",
"created": "2026-08-28T19:45:04.030513Z"
}
],
"closed_at": "2026-08-28T19:45:06.001794Z",
"outcome": "assented \u2014 see FLEX-DEC-2026-001",
"state_hub_intake_id": "01a049eb-812c-7641-8e46-8dd63b12b2a8"
}
}
},
{
"kind": "intake",
"id": "FLEX-IN-0002",
"status": "closed",
"title": "Review requested: security layer model v0.3 (approval-engine, maturity-engine)",
"source_path": "intakes/intakes.md",
"uuid": "01a04afa-307b-7e9e-b210-261badabcec7",
"parent_id": null,
"extra": {
"record": {
"id": "FLEX-IN-0002",
"kind": "intake",
"title": "Review requested: security layer model v0.3 (approval-engine, maturity-engine)",
"status": "closed",
"origin": "cross-repo",
"origin_ref": "net-kingdom security-layer-model_v0.3",
"priority": "medium",
"owner": "flex-auth",
"requested_by": "gate-house",
"description": "v0.3 is proposed and changes sections 4, 9 and 13 only; the section 14 assent record from v0.2 stands. Two additions concern flex-auth. (1) Section 9.4 assigns the approval object to a new approval-engine \u2014 the gap FLEX-DEC-2026-001 raised. Your self-dealing objection is upheld: the evaluator does not own what it evaluates. access-engine consumes approvals as input claims under section 6.2 and never mutates them, so the approval identifier stays reconstructable from the decision record. Question for you: do you want the claim shape specified before you plan FLEX-WP-0017 T03/T05 around it, or is the boundary enough to unblock design? (2) Section 9.5 assigns graded progression to a new maturity-engine, carrying the guardrail that a maturity level must never gate a decision directly \u2014 if a level determines an outcome it reaches access-engine as an input claim or a versioned policy rule. That guardrail is section 6.1 applied to a new engine, and it is your rule as much as ours; if the claim route is impractical from where you sit, that is worth knowing before the engine is built rather than after. Assent, revision, or rejection acceptable.",
"created": "2026-08-28T20:40:00.263659Z",
"updated": "2026-08-29T00:42:14.888434Z",
"notes": [
{
"content": "Answered by FLEX-DEC-2026-002, reviewing v0.4 (which supersedes the v0.3 this intake asked about): assent with findings, section 9.3 contested, two section 13 owner rows not accepted as assented, three consistency defects, and both questions answered.",
"author": "flex-auth",
"created": "2026-08-29T00:42:14.005210Z"
}
],
"closed_at": "2026-08-29T00:42:14.888434Z",
"outcome": "assented with findings \u2014 see FLEX-DEC-2026-002",
"state_hub_intake_id": "01a04afa-307b-7e9e-b210-261badabcec7"
}
}
}
],
"events": [
{
"type": "repo.command.applied",
"command": "repo.work.resolve_decision",
"operation": "resolve",
"correlation_id": "fe430c1e-83bb-4dba-b6fc-337baa1a0059",
"kind": "decision",
"id": "FLEX-DEC-2026-003",
"git_sha": "5753b47ccb72f96689df9ec5eeb7be100f6817cd",
"files_touched": [
"decisions/decisions.md"
],
"source": "repo-manager",
"emitted_at": "2026-08-29T08:19:42.754925Z"
}
]
}
Reference in a new issue View git blame Copy permalink