tegwick
e8d6d08f79
B1 was found with a shell pipeline and published as a finding. The review it appeared in had already argued that a mechanical check nobody can re-run is an assertion, and §11's entire claim is mechanical checkability — so asserting B1 unmechanically was that defect committed by the repository reporting it. tools/survey_layer_declarations.go reads both §11 forms per repository, reports intra-repository disagreement, and writes a receipt. Run once, it showed the published B1 was wrong: the estate does not spell layer: three ways across repositories. The original pipeline took the first ^layer: match per repository without recording which file it came from, reporting one value where there were two. The corrected finding is stronger. Nine of nine repositories carrying both §11 forms declare a different value in each: INTENT.md says Engine/Staff, layer.yaml says engine/staff. The disagreement is within each repository, between the two forms §11 permits, and it is universal rather than careless — two generators, two conventions. Nobody is inconsistent with anybody else. That relocates the question from casing to precedence: §11 accepts either form and does not say which governs when both exist and disagree, so a conformance run reading INTENT.md and one reading layer.yaml reach different answers for nine repositories while both follow §11. flex-auth is the only declared repository that cannot exhibit this, and only because it never wrote the second file. The correction is recorded in the review rather than edited away: a published review corrected silently is FLEX-DEC-2026-008's defect, and that rule has no exception for the reviewer. Four tests cover the disagreement case, the refusal to fold case, a missing declaration, and the single-form shape that must not read as self-disagreement. The survey checks only the §3 vocabulary and never applies flex-auth's house rules to peers. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 28468@bnt-lap001 Assistant-Session: c76569b2-6056-4dad-aea4-49cd7a018f5d |
||
|---|---|---|
| .claude/rules | ||
| .forgejo/workflows | ||
| .github/workflows | ||
| .repo-manager | ||
| charts/flex-auth | ||
| cmd/flex-auth | ||
| decisions | ||
| deploy | ||
| docs | ||
| examples | ||
| history | ||
| intakes | ||
| internal | ||
| pkg/api | ||
| railiance | ||
| registry | ||
| schemas | ||
| tests | ||
| tools | ||
| values | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .golangci.yml | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| Containerfile | ||
| Containerfile.t03-review | ||
| go.mod | ||
| go.sum | ||
| INTENT.md | ||
| LICENSE | ||
| Makefile | ||
| README.md | ||
| SCOPE.md | ||
| tenancy.yaml | ||
| WORK-RECORDS.md | ||
flex-auth
Policy-as-code authorization registry and control plane for NetKingdom-aligned systems.
The live Forge and State Hub coordinate is still flex-auth (repository UUID
fda8ad85-a7d7-4055-8f21-902a533e59df, Forge ID 42). FLEX-WP-0020 will
rename that coordinate to access-engine and keep the Go module, binary,
FLEX_AUTH_* variables, Helm releases, container package
coulomb/flex-auth, and policy/API vocabulary unchanged. Work-record
frontmatter stays repo: flex-auth until State Hub rebind. Planned clone:
https://forgejo.coulomb.social/coulomb/access-engine.git.
Start with INTENT.md for the project boundary and direction. Research notes and ADRs live in docs/ and docs/adr/.
The product boundary is captured in SCOPE.md, and the current Product Requirements Document is docs/ProductRequirementsDocument.md.
The 2026-05-15 pre-implementation assessment that shapes the current sequencing is in docs/pre-implementation-assessment.md.
The CARING reference-implementation approach is captured in docs/caring-architecture-blueprint.md.
Workplans live in workplans/, with sequencing captured in docs/workplan-planning-map.md.