coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/WORK-RECORDS.md
tegwick cde77f0097
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Assent to GH-DEC-2026-001 (FLEX-DEC-2026-001), closing FLEX-IN-0001 
flex-auth answers gate-house's assent request on the three items ratified in
GH-DEC-2026-001, following the estate precedent that a boundary is drawn on
review by the other side.

Assent to all three, with one conformance debt flex-auth accepts as its own and
two conditions on the rename:

- Engine framing and sole decision point: assent. flex-auth cannot hold this
  boundary against zone-engine and decline it as a general rule. But standard
  section 6 also binds flex-auth: DecisionProvenance carries no registry
  snapshot digest, so a decision that turned on registry content cannot be
  replayed from its own provenance. Recorded as a known non-conformance rather
  than claimed as conformance.
- access-engine rename: assent to the name, not to execution. Repository
  identity and runtime identity must rename in separate revertible steps —
  since FLEX-WP-0016 the enforcing ops-warden pin binds tokens to the
  protected-system name, so a single-step rename 401s every warden sign,
  including the certificate the ops-bridge tunnels depend on. FLEX-WP prefix
  ownership stays with the repository.
- Authoring/evaluation split: assent, with the section 6 test applied
  symmetrically — a gate-house authority ceiling that determines an outcome
  reaches the decision as an input claim or as a rule in the versioned policy
  package, so its application stays reconstructable from the decision record.

FLEX-WP-0017-T03 stays wait: the design half re-routes to gate-house, the
durable storage half remains unowned and is raised as an engine gap under
section 5.

Decision id follows the canon scheme {PREFIX}-DEC-YYYY-NNN.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012sgN4GH5ZYT8pJVkCR6dcP

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014348@bnt-lap001
Assistant-Session: a993abda-65a0-4ea8-8ccd-0fcd78c92ac0
2026-08-28 21:47:06 +02:00

11 KiB
Raw Blame History

Work Records — flex-auth

Generated by statehub fix-consistency (CUST-WP-0061-T04, work-record stage 3). Do not edit by hand — edit the source file/block listed for each record and re-run fix-consistency to refresh this index. Archived workplans are omitted; closed decisions/intakes/engagements stay listed so recently-resolved work is still visible. [auto]

Kind ID Status Lane Source
workplan FLEX-WP-0001 done — workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md
workplan FLEX-WP-0002 completed — workplans/FLEX-WP-0002-standalone-policy-as-code-core.md
workplan FLEX-WP-0003 completed — workplans/FLEX-WP-0003-markitect-consumer-integration.md
workplan FLEX-WP-0004 completed — workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md
workplan FLEX-WP-0005 done — workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md
workplan FLEX-WP-0006 finished — workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md
workplan FLEX-WP-0007 finished — workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md
workplan FLEX-WP-0008 finished — workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md
workplan FLEX-WP-0009 finished — workplans/FLEX-WP-0009-user-engine-production-policy-service.md
workplan FLEX-WP-0010 finished — workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md
workplan FLEX-WP-0011 finished — workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
workplan FLEX-WP-0012 finished — workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
workplan FLEX-WP-0013 finished — workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md
workplan FLEX-WP-0014 finished — workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md
workplan FLEX-WP-0015 finished — workplans/FLEX-WP-0015-tenancy-posture-conformance.md
workplan FLEX-WP-0016 finished — workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md
workplan FLEX-WP-0017 active — workplans/FLEX-WP-0017-action-bound-authorization-contract.md
workplan FLEX-WP-0018 finished — workplans/FLEX-WP-0018-inbound-auth-corrections.md
task FLEX-WP-0001-T001 done — workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md
task FLEX-WP-0001-T002 done — workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md
task FLEX-WP-0001-T003 done — workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md
task FLEX-WP-0001-T004 done — workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md
task FLEX-WP-0002-T001 done — workplans/FLEX-WP-0002-standalone-policy-as-code-core.md
task FLEX-WP-0002-T002 done — workplans/FLEX-WP-0002-standalone-policy-as-code-core.md
task FLEX-WP-0002-T003 done — workplans/FLEX-WP-0002-standalone-policy-as-code-core.md
task FLEX-WP-0002-T004 done — workplans/FLEX-WP-0002-standalone-policy-as-code-core.md
task FLEX-WP-0002-T005 done — workplans/FLEX-WP-0002-standalone-policy-as-code-core.md
task FLEX-WP-0002-T006 done — workplans/FLEX-WP-0002-standalone-policy-as-code-core.md
task FLEX-WP-0002-T007 done — workplans/FLEX-WP-0002-standalone-policy-as-code-core.md
task FLEX-WP-0002-T008 done — workplans/FLEX-WP-0002-standalone-policy-as-code-core.md
task FLEX-WP-0003-T001 done — workplans/FLEX-WP-0003-markitect-consumer-integration.md
task FLEX-WP-0003-T002 done — workplans/FLEX-WP-0003-markitect-consumer-integration.md
task FLEX-WP-0003-T003 done — workplans/FLEX-WP-0003-markitect-consumer-integration.md
task FLEX-WP-0003-T004 done — workplans/FLEX-WP-0003-markitect-consumer-integration.md
task FLEX-WP-0003-T005 done — workplans/FLEX-WP-0003-markitect-consumer-integration.md
task FLEX-WP-0003-T006 done — workplans/FLEX-WP-0003-markitect-consumer-integration.md
task FLEX-WP-0004-T001 done — workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md
task FLEX-WP-0004-T002 done — workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md
task FLEX-WP-0004-T003 done — workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md
task FLEX-WP-0004-T004 done — workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md
task FLEX-WP-0004-T005 done — workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md
task FLEX-WP-0004-T006 done — workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md
task FLEX-WP-0005-T001 done — workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md
task FLEX-WP-0005-T002 done — workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md
task FLEX-WP-0005-T003 done — workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md
task FLEX-WP-0005-T004 done — workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md
task FLEX-WP-0005-T005 done — workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md
task FLEX-WP-0005-T006 done — workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md
task FLEX-WP-0006-T01 done — workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md
task FLEX-WP-0006-T02 done — workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md
task FLEX-WP-0006-T03 done — workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md
task FLEX-WP-0006-T04 done — workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md
task FLEX-WP-0006-T05 done — workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md
task FLEX-WP-0007-T01 done — workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md
task FLEX-WP-0007-T02 done — workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md
task FLEX-WP-0007-T03 done — workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md
task FLEX-WP-0007-T04 done — workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md
task FLEX-WP-0007-T05 done — workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md
task FLEX-WP-0008-T01 done — workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md
task FLEX-WP-0008-T02 done — workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md
task FLEX-WP-0008-T03 done — workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md
task FLEX-WP-0008-T04 done — workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md
task FLEX-WP-0009-T01 done — workplans/FLEX-WP-0009-user-engine-production-policy-service.md
task FLEX-WP-0009-T02 done — workplans/FLEX-WP-0009-user-engine-production-policy-service.md
task FLEX-WP-0009-T03 done — workplans/FLEX-WP-0009-user-engine-production-policy-service.md
task FLEX-WP-0009-T04 done — workplans/FLEX-WP-0009-user-engine-production-policy-service.md
task FLEX-WP-0010-T01 done — workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md
task FLEX-WP-0010-T02 done — workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md
task FLEX-WP-0010-T03 done — workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md
task FLEX-WP-0010-T04 done — workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md
task FLEX-WP-0011-T01 done — workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
task FLEX-WP-0011-T02 done — workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
task FLEX-WP-0011-T03 done — workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md
task FLEX-WP-0012-T01 done — workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
task FLEX-WP-0012-T02 done — workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
task FLEX-WP-0012-T03 done — workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
task FLEX-WP-0012-T04 done — workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
task FLEX-WP-0013-T01 done — workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md
task FLEX-WP-0013-T02 done — workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md
task FLEX-WP-0013-T03 done — workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md
task FLEX-WP-0014-T01 done — workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md
task FLEX-WP-0014-T02 done — workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md
task FLEX-WP-0014-T03 done — workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md
task FLEX-WP-0014-T04 done — workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md
task FLEX-WP-0015-T01 done — workplans/FLEX-WP-0015-tenancy-posture-conformance.md
task FLEX-WP-0015-T02 done — workplans/FLEX-WP-0015-tenancy-posture-conformance.md
task FLEX-WP-0015-T03 done — workplans/FLEX-WP-0015-tenancy-posture-conformance.md
task FLEX-WP-0015-T04 cancel — workplans/FLEX-WP-0015-tenancy-posture-conformance.md
task FLEX-WP-0015-T05 done — workplans/FLEX-WP-0015-tenancy-posture-conformance.md
task FLEX-WP-0016-T01 done — workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md
task FLEX-WP-0016-T02 done — workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md
task FLEX-WP-0016-T03 done — workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md
task FLEX-WP-0017-T01 done — workplans/FLEX-WP-0017-action-bound-authorization-contract.md
task FLEX-WP-0017-T02 done — workplans/FLEX-WP-0017-action-bound-authorization-contract.md
task FLEX-WP-0017-T03 wait — workplans/FLEX-WP-0017-action-bound-authorization-contract.md
task FLEX-WP-0017-T04 done — workplans/FLEX-WP-0017-action-bound-authorization-contract.md
task FLEX-WP-0017-T05 wait — workplans/FLEX-WP-0017-action-bound-authorization-contract.md
task FLEX-WP-0018-T01 done — workplans/FLEX-WP-0018-inbound-auth-corrections.md
task FLEX-WP-0018-T02 done — workplans/FLEX-WP-0018-inbound-auth-corrections.md
intake FLEX-IN-0001 closed — intakes/intakes.md