flex-auth/docs
tegwick 80ffe729d4
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
CI Smoke / container-smoke (push) Successful in 5s
Build and Publish Container Image / build-and-push (push) Successful in 1m11s
Apply gate-house's section 11 rulings: four-token validator, emission guarantee, resource.system.
GH-DEC-2026-017: the validator admitted {Staff, Engine, Tooling}, built from
section 4's catalog rows, and rejected Taxonomy, which section 3.1 defines.
railiance-master was conforming; the validator was the divergent artifact.
Now four tokens, ASCII case folded, section 4's spelling canonical, INTENT.md
governing while form disagreements are still reported, and every run states
its scope (section 11 binds section 4; volunteers are not non-conformances).
Also fixes the survey silently dropping audit-core's layer.yaml by decoding
peers into flex-auth's own struct.

GH-DEC-2026-018: flex-auth is a section 4 source of evidence. G2 closes as a
question and reopens as a dated gap (review 2026-10-19). cadence.yaml
publishes the per-event-class inventory: deny, redact, not_applicable and
audit_only rare load-bearing (heartbeat and reconciliation, rate forbidden);
allow volume load-bearing (expected-rate and reconciliation). INTENT.md
declares source_of_evidence and names it; tests assert both. Delivery is
FLEX-WP-0031.

FLEX-DEC-2026-015: resource.system follows the runtime, not the repository,
answering ops-warden's WARDEN-IN-0003.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
2026-09-21 06:35:30 +02:00
..
adr Finish FLEX-WP-0015: both pins enforce, live A2 probes, AuthZEN deferred 2026-08-19 14:35:27 +02:00
conformance Apply gate-house's section 11 rulings: four-token validator, emission guarantee, resource.system. 2026-09-21 06:35:30 +02:00
evidence Apply gate-house's section 11 rulings: four-token validator, emission guarantee, resource.system. 2026-09-21 06:35:30 +02:00
action-bound-authorization-contract.md Accept ActionAuthorization deferral; fix the state-hub authority constant 2026-09-06 01:30:04 +02:00
canonical-request-digest.md fix(decision): registry facts win over caller-supplied attributes 2026-09-07 13:43:33 +02:00
caring-architecture-blueprint.md Refine workplans for CARING profile 2026-05-17 04:15:38 +02:00
decision-envelope-signature.md Sign decision envelopes and close FLEX-WP-0024. 2026-09-14 09:57:50 +02:00
decision-input-freshness.md Answer ops-warden and secrets-engine; open FLEX-WP-0021 2026-09-06 01:12:50 +02:00
decision-record-contract.md Sign decision envelopes and close FLEX-WP-0024. 2026-09-14 09:57:50 +02:00
delegated-mode-operations.md Document delegated mode operations 2026-05-17 07:27:45 +02:00
directory-group-resolver-adapters.md Add directory group resolver adapters 2026-05-17 07:24:50 +02:00
flex-auth-authorization-registry-research.md Established INTENT.md 2026-05-04 17:52:29 +02:00
iam-profile-consumption.md Align IAM Profile consumption with v0.2 2026-05-22 14:35:30 +02:00
keycloak-authz-adapter-path.md Add Keycloak authorization adapter path 2026-05-17 07:18:45 +02:00
markitect-action-vocabulary.md Define Markitect action vocabulary 2026-05-17 06:26:13 +02:00
markitect-integration-flow.md Document Markitect integration flow 2026-05-17 06:41:07 +02:00
markitect-resource-namespace.md Define Markitect resource namespace 2026-05-17 06:14:04 +02:00
openrouter-native-access.md Resolve OpenRouter native contract and promote secrets-engine PDP 2026-09-14 00:54:56 +02:00
operator-caller-access-path.md Enforce verified secrets-engine operator caller identity 2026-09-06 23:38:36 +02:00
ops-warden-policy-gate-handoff.md Close ops-warden policy gate deployment 2026-06-30 00:52:56 +02:00
ops-warden-registry-sync.md FLEX-WP-0007: production registry fixture, tests, and sync runbook 2026-06-24 14:52:35 +02:00
pre-implementation-assessment.md Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton 2026-05-16 01:54:44 +02:00
ProductRequirementsDocument.md feat(authz): bind decisions to exact actions 2026-08-23 13:18:26 +02:00
railiance-platform-action-vocabulary.md feat(policy): add credential grant authorization package 2026-08-23 13:59:03 +02:00
relationship-pdp-adapter-boundary.md Add relationship PDP adapter boundary 2026-05-17 07:06:14 +02:00
request-enrichment.md Admit the compact sitting review package on a dedicated pin. 2026-09-15 22:50:24 +02:00
rule-pdp-adapter-boundary.md Add rule PDP adapter boundary 2026-05-17 07:13:27 +02:00
secrets-engine-action-vocabulary.md Add schemaguard; correct check_request subject.type against shipped reality 2026-09-06 14:21:28 +02:00
stance-register-review.md Review the stance register's second row; record why T04 cannot proceed 2026-09-06 09:31:40 +02:00
tenancy-posture-review.md Record zone-engine compilation invariant; drop uncommitted policy leftovers 2026-08-19 21:36:22 +02:00
tenant-engine-action-vocabulary.md Authorize tenant-engine guardrail read and set actions 2026-08-16 02:46:25 +02:00
tenant-engine-resource-namespace.md Authorize tenant-engine guardrail read and set actions 2026-08-16 02:46:25 +02:00
topaz-adapter-operations.md Implement Topaz adapter 2026-05-17 06:58:04 +02:00
topaz-mapping-spike.md Topaz alignment spike — mapping doc + green e2e example 2026-05-16 09:04:42 +02:00
workplan-planning-map.md Enforce caller-auth on flex-auth-ops-warden (FLEX-WP-0016-T03) 2026-08-19 20:10:31 +02:00