coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
flex-auth/.repo-manager/index.json
tegwick cde77f0097
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Assent to GH-DEC-2026-001 (FLEX-DEC-2026-001), closing FLEX-IN-0001 
flex-auth answers gate-house's assent request on the three items ratified in
GH-DEC-2026-001, following the estate precedent that a boundary is drawn on
review by the other side.

Assent to all three, with one conformance debt flex-auth accepts as its own and
two conditions on the rename:

- Engine framing and sole decision point: assent. flex-auth cannot hold this
  boundary against zone-engine and decline it as a general rule. But standard
  section 6 also binds flex-auth: DecisionProvenance carries no registry
  snapshot digest, so a decision that turned on registry content cannot be
  replayed from its own provenance. Recorded as a known non-conformance rather
  than claimed as conformance.
- access-engine rename: assent to the name, not to execution. Repository
  identity and runtime identity must rename in separate revertible steps —
  since FLEX-WP-0016 the enforcing ops-warden pin binds tokens to the
  protected-system name, so a single-step rename 401s every warden sign,
  including the certificate the ops-bridge tunnels depend on. FLEX-WP prefix
  ownership stays with the repository.
- Authoring/evaluation split: assent, with the section 6 test applied
  symmetrically — a gate-house authority ceiling that determines an outcome
  reaches the decision as an input claim or as a rule in the versioned policy
  package, so its application stays reconstructable from the decision record.

FLEX-WP-0017-T03 stays wait: the design half re-routes to gate-house, the
durable storage half remains unowned and is raised as an engine gap under
section 5.

Decision id follows the canon scheme {PREFIX}-DEC-YYYY-NNN.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012sgN4GH5ZYT8pJVkCR6dcP

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 4014348@bnt-lap001
Assistant-Session: a993abda-65a0-4ea8-8ccd-0fcd78c92ac0
2026-08-28 21:47:06 +02:00

1112 lines
40 KiB
JSON
Raw Blame History

{
"schema": "repo_manager.index.v1",
"slug": "flex-auth",
"repo_root": "/home/worsch/flex-auth",
"head_sha": "8f815bb304799f81377b66d92733848dc5521bc9",
"observed_at": "2026-08-28T19:45:14.006414Z",
"source_fingerprint": "fb09ffb68b552d10f3ed4d8d60cade2e57b321d1f3c0567775bfe957ebc82128",
"source_files": [
".repo-classification.yaml",
"INTENT.md",
"decisions/decisions.md",
"intakes/intakes.md",
"workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md",
"workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md",
"workplans/FLEX-WP-0009-user-engine-production-policy-service.md",
"workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md",
"workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md",
"workplans/FLEX-WP-0012-credential-grant-authorization-surface.md",
"workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md",
"workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md",
"workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md",
"workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"workplans/FLEX-WP-0018-inbound-auth-corrections.md"
],
"work_records": [
{
"kind": "workplan",
"id": "FLEX-WP-0001",
"status": "done",
"title": "Repo Intent and Authorization Architecture Baseline",
"source_path": "workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md",
"uuid": "4dbefd19-bb7d-405c-9a50-e7dbd11cf4d9",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0001-T001",
"status": "done",
"title": "P1.1 - Define project intent",
"source_path": "workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md",
"uuid": "5af30b01-ea72-4f87-b74e-a595fd3a5bd7",
"parent_id": "FLEX-WP-0001",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0001-T002",
"status": "done",
"title": "P1.2 - Define responsibility boundaries",
"source_path": "workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md",
"uuid": "145ec0ec-130a-4209-9028-1ae06e3664e3",
"parent_id": "FLEX-WP-0001",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0001-T003",
"status": "done",
"title": "P1.3 - Capture open-source and enterprise landscape",
"source_path": "workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md",
"uuid": "c52a9e3e-e264-418d-b462-d5a9d6e22b30",
"parent_id": "FLEX-WP-0001",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0001-T004",
"status": "done",
"title": "P1.4 - Establish first-consumer architecture",
"source_path": "workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md",
"uuid": "7756c4c5-598a-4894-9352-6e7145cb3522",
"parent_id": "FLEX-WP-0001",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0002",
"status": "completed",
"title": "Standalone Policy-as-Code Core",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "aa60e183-9a87-4e03-99b0-15786bfa11ae",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T001",
"status": "done",
"title": "P2.1 - Define canonical schemas",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "534e5251-8529-48fe-8cf8-b3b6bc4ec1f4",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T002",
"status": "done",
"title": "P2.2 - Implement local registry store",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "d8045124-f0ae-495d-87b5-24fd9528ef93",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T003",
"status": "done",
"title": "P2.3 - Implement policy package loader and validator",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "09be0f25-e5ba-42b5-8b2f-36fd0ef2fe6b",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T004",
"status": "done",
"title": "P2.4 - Implement deterministic check and batch_check APIs",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "f6427575-00af-4f3e-ab30-5b9a158343ef",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T005",
"status": "done",
"title": "P2.5 - Implement list_allowed and explain",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "e8fcbabd-4eb6-41d2-a4d5-6f40cc245a7e",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T006",
"status": "done",
"title": "P2.6 - Add local decision log",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "2def10c1-4b5f-44a8-8e6b-4c8592fffd43",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T007",
"status": "done",
"title": "P2.7 - Add CLI and service skeleton",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "ee9ae6dd-c31f-4d4e-b238-533a2b8040d4",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0002-T008",
"status": "done",
"title": "P2.8 - Add tests and examples",
"source_path": "workplans/FLEX-WP-0002-standalone-policy-as-code-core.md",
"uuid": "6cbe572a-2877-4936-8ef3-63b79900fae2",
"parent_id": "FLEX-WP-0002",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0003",
"status": "completed",
"title": "Markitect Consumer Integration",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "c0a6c9f6-bb6b-416d-b537-f30504c63d75",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0003-T001",
"status": "done",
"title": "P3.1 - Define Markitect resource namespace",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "53f2fa67-780b-4e40-bbda-e669e4cecc32",
"parent_id": "FLEX-WP-0003",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0003-T002",
"status": "done",
"title": "P3.2 - Import Markitect resource manifests",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "90082eaf-37f5-492f-a884-ff8eec0eccaa",
"parent_id": "FLEX-WP-0003",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0003-T003",
"status": "done",
"title": "P3.3 - Define Markitect action vocabulary",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "cfc78bbb-5425-4780-a860-9109df62ea37",
"parent_id": "FLEX-WP-0003",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0003-T004",
"status": "done",
"title": "P3.4 - Implement Markitect check fixtures",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "1d5de3b2-c581-4ca3-9107-93211eb02c6b",
"parent_id": "FLEX-WP-0003",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0003-T005",
"status": "done",
"title": "P3.5 - Add Markitect adapter contract tests",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "f9297b0d-69dc-495c-a650-ca671f2c59c7",
"parent_id": "FLEX-WP-0003",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0003-T006",
"status": "done",
"title": "P3.6 - Document integration flow",
"source_path": "workplans/FLEX-WP-0003-markitect-consumer-integration.md",
"uuid": "e34b0303-4416-40a3-8b34-e0e80d644aea",
"parent_id": "FLEX-WP-0003",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0004",
"status": "completed",
"title": "Delegated PDP and Directory Adapters",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "99a82976-d376-42b0-89cc-c44e01c0bec6",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0004-T001",
"status": "done",
"title": "P4.1 - Implement Topaz adapter",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "9046418c-2b78-42c6-8bfa-76d6ed0050dd",
"parent_id": "FLEX-WP-0004",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0004-T002",
"status": "done",
"title": "P4.2 - Add relationship PDP adapter boundary",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "b77a0b70-b492-46ba-badf-8c2eebe006aa",
"parent_id": "FLEX-WP-0004",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0004-T003",
"status": "done",
"title": "P4.3 - Add rule PDP adapter boundary",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "4e4e5e45-c05a-4a31-8126-f0c7676b1e6c",
"parent_id": "FLEX-WP-0004",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0004-T004",
"status": "done",
"title": "P4.4 - Add Keycloak Authorization Services adapter path",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "8d3bbc28-985b-4dd7-9fb8-f9a858eb5a6b",
"parent_id": "FLEX-WP-0004",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0004-T005",
"status": "done",
"title": "P4.5 - Add Entra/Graph and SCIM group resolver adapters",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "4fc3fb91-8763-453e-8e54-36178cb11efd",
"parent_id": "FLEX-WP-0004",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0004-T006",
"status": "done",
"title": "P4.6 - Add delegated-mode operations docs",
"source_path": "workplans/FLEX-WP-0004-delegated-pdp-and-directory-adapters.md",
"uuid": "491260f9-b4d7-46fe-8220-d358597db33a",
"parent_id": "FLEX-WP-0004",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0005",
"status": "done",
"title": "Foundations and Topaz Alignment",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "e37d42a9-0018-4a67-a672-ff4e9716b338",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0005-T001",
"status": "done",
"title": "P5.1 - Record ADR-001 / ADR-002 / ADR-003",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "8193a278-a044-4397-a4a8-232104374cdc",
"parent_id": "FLEX-WP-0005",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0005-T002",
"status": "done",
"title": "P5.2 - Land Go project skeleton",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "8ac73c33-6d36-4963-990d-28b0d1d60947",
"parent_id": "FLEX-WP-0005",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0005-T003",
"status": "done",
"title": "P5.3 - Pin FlexAuthResourceManifest schema",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "80285e1e-16ec-4f4e-b491-1e79f200219f",
"parent_id": "FLEX-WP-0005",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0005-T004",
"status": "done",
"title": "P5.4 - Topaz alignment spike",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "b8a314c3-e98e-4093-bb11-ab8546b8d79b",
"parent_id": "FLEX-WP-0005",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0005-T005",
"status": "done",
"title": "P5.5 - Cite NetKingdom IAM Profile and pin claim consumption",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "b31dab7b-e72c-4abe-b6d5-f5875fd0c25a",
"parent_id": "FLEX-WP-0005",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0005-T006",
"status": "done",
"title": "P5.6 - Confirm ops-warden boundary",
"source_path": "workplans/FLEX-WP-0005-foundations-and-topaz-alignment.md",
"uuid": "dcd45a14-20fc-49d0-b869-08cda85fcbc5",
"parent_id": "FLEX-WP-0005",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0006",
"status": "finished",
"title": "Ops-Warden SSH Signing Policy Gate",
"source_path": "workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"uuid": "bbea4049-8acc-4d7c-8cf5-3106c6b93f7f",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0006-T01",
"status": "done",
"title": "T1 - Pin the ops-warden protected-system contract",
"source_path": "workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"uuid": "8831b904-dbef-4d55-8eb5-053c939c86b3",
"parent_id": "FLEX-WP-0006",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0006-T02",
"status": "done",
"title": "T2 - Author the ssh-certificate sign policy package",
"source_path": "workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"uuid": "9ea206fa-f93d-46b6-8b8e-e8669dd502d4",
"parent_id": "FLEX-WP-0006",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0006-T03",
"status": "done",
"title": "T3 - Add allow and deny fixtures",
"source_path": "workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"uuid": "6bf5cb9b-d46c-49cf-aec0-12f6e864a1f8",
"parent_id": "FLEX-WP-0006",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0006-T04",
"status": "done",
"title": "T4 - Verify the `/v1/check` service contract",
"source_path": "workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"uuid": "077d29db-30e0-4447-90fd-620c0884306c",
"parent_id": "FLEX-WP-0006",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0006-T05",
"status": "done",
"title": "T5 - Hand off production-readiness evidence to ops-warden",
"source_path": "workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md",
"uuid": "06cac0b1-51c0-4ae0-b605-c940f7821ac7",
"parent_id": "FLEX-WP-0006",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0007",
"status": "finished",
"title": "Ops-Warden Policy Gate Production Deployment",
"source_path": "workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"uuid": "358ce697-2611-4fe9-89ab-63e86ceb00fa",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0007-T01",
"status": "done",
"title": "T1 - Deploy production flex-auth runtime",
"source_path": "workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"uuid": "727573fc-86a3-4f5a-abd7-40b0ccb01e68",
"parent_id": "FLEX-WP-0007",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0007-T02",
"status": "done",
"title": "T2 - Load production registry and verify real actors",
"source_path": "workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"uuid": "6ec1e00c-4a3a-475b-aefb-af3961de7070",
"parent_id": "FLEX-WP-0007",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0007-T03",
"status": "done",
"title": "T3 - Publish registry sync contract with ops-warden",
"source_path": "workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"uuid": "afa09ec3-516c-433d-87a7-330cb79845a8",
"parent_id": "FLEX-WP-0007",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0007-T04",
"status": "done",
"title": "T4 - Joint OpenBao + policy gate production smoke",
"source_path": "workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"uuid": "32a96f1c-e0e8-4e27-baa6-7b8c445cf7a1",
"parent_id": "FLEX-WP-0007",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0007-T05",
"status": "done",
"title": "T5 - IAM subject binding for production",
"source_path": "workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md",
"uuid": "65dc3c59-1e4b-4335-b6a0-db492ea9b2b5",
"parent_id": "FLEX-WP-0007",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0008",
"status": "finished",
"title": "tenant-engine Consumer Integration",
"source_path": "workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md",
"uuid": "1358db95-967c-5a03-8b8c-4816dc106594",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0008-T01",
"status": "done",
"title": "Task: Define tenant-engine resource and action vocabulary",
"source_path": "workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md",
"uuid": "5606408f-f94c-5d79-ba41-ed23fadac480",
"parent_id": "FLEX-WP-0008",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0008-T02",
"status": "done",
"title": "Task: Author and register the tenant-engine policy package",
"source_path": "workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md",
"uuid": "bbe1a8f4-dcd9-58bb-8d82-386ee0c11a51",
"parent_id": "FLEX-WP-0008",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0008-T03",
"status": "done",
"title": "Task: tenant-engine live-lookup context adapter",
"source_path": "workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md",
"uuid": "e27d24b3-0aef-5bd4-b7e3-81532cd7aa9c",
"parent_id": "FLEX-WP-0008",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0008-T04",
"status": "done",
"title": "Task: Closure review",
"source_path": "workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md",
"uuid": "0f319a2f-e4bb-5ba8-92de-b693ae9a2aa3",
"parent_id": "FLEX-WP-0008",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0009",
"status": "finished",
"title": "Provide production authorization for user-engine",
"source_path": "workplans/FLEX-WP-0009-user-engine-production-policy-service.md",
"uuid": "390da58d-3c58-5102-bd3c-7133956c810e",
"parent_id": null,
"extra": {
"depends_on": [
"NK-WP-0024"
]
}
},
{
"kind": "task",
"id": "FLEX-WP-0009-T01",
"status": "done",
"title": "T01 - Pin the protected-system vocabulary",
"source_path": "workplans/FLEX-WP-0009-user-engine-production-policy-service.md",
"uuid": "4607222e-3407-59c4-b388-aa7c88f7e3ef",
"parent_id": "FLEX-WP-0009",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0009-T02",
"status": "done",
"title": "T02 - Implement and verify the policy package",
"source_path": "workplans/FLEX-WP-0009-user-engine-production-policy-service.md",
"uuid": "7ae9de35-4f71-54d8-aabb-858c1202c833",
"parent_id": "FLEX-WP-0009",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0009-T03",
"status": "done",
"title": "T03 - Deploy the cluster-local service",
"source_path": "workplans/FLEX-WP-0009-user-engine-production-policy-service.md",
"uuid": "9a1ea146-0735-5d6f-bd75-96eb78e9bd2b",
"parent_id": "FLEX-WP-0009",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0009-T04",
"status": "done",
"title": "T04 - Hand back production evidence",
"source_path": "workplans/FLEX-WP-0009-user-engine-production-policy-service.md",
"uuid": "9639adbe-4392-5f6c-a924-3771f71ab94c",
"parent_id": "FLEX-WP-0009",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0010",
"status": "finished",
"title": "Authorize tenant-engine lifecycle actions",
"source_path": "workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md",
"uuid": "fdabae84-dc9e-5ccd-81df-8ae7e66b90b8",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0010-T01",
"status": "done",
"title": "T01 - Extend the policy package with the lifecycle actions",
"source_path": "workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md",
"uuid": "8deb9564-658e-5eff-8ef7-94838bee05cc",
"parent_id": "FLEX-WP-0010",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0010-T02",
"status": "done",
"title": "T02 - Decide whether retirement warrants stricter authorization",
"source_path": "workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md",
"uuid": "82d13a89-a344-5797-b10f-390d17b11b73",
"parent_id": "FLEX-WP-0010",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0010-T03",
"status": "done",
"title": "T03 - Fixtures and verification",
"source_path": "workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md",
"uuid": "2fbceaf5-514b-5ded-adb1-f4e63ce96160",
"parent_id": "FLEX-WP-0010",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0010-T04",
"status": "done",
"title": "T04 - Closure and handoff",
"source_path": "workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md",
"uuid": "eb2579cb-b54f-5834-abcc-81954ac34889",
"parent_id": "FLEX-WP-0010",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0011",
"status": "finished",
"title": "Bring flex-auth under the railiance staged-promotion contract",
"source_path": "workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md",
"uuid": "deda35b4-f41d-559e-954e-a75f29237f68",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0011-T01",
"status": "done",
"title": "T01 - Author the railiance overlay",
"source_path": "workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md",
"uuid": "75748946-68c0-5f33-abe1-810fcd55e93f",
"parent_id": "FLEX-WP-0011",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0011-T02",
"status": "done",
"title": "T02 - Prove the stage commands",
"source_path": "workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md",
"uuid": "4becc09f-2331-5487-a794-643c748dd1bd",
"parent_id": "FLEX-WP-0011",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0011-T03",
"status": "done",
"title": "T03 - Correct the stale drain-plan row",
"source_path": "workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md",
"uuid": "abb788fe-22a5-5226-9f08-a43e20a47ce9",
"parent_id": "FLEX-WP-0011",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0012",
"status": "finished",
"title": "Authorize railiance-platform credential-grant requests",
"source_path": "workplans/FLEX-WP-0012-credential-grant-authorization-surface.md",
"uuid": "2a6b5764-1831-5305-b46e-0991d02675df",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0012-T01",
"status": "done",
"title": "T01 - Decide where the translation lives",
"source_path": "workplans/FLEX-WP-0012-credential-grant-authorization-surface.md",
"uuid": "f8491771-be1a-5c70-a4aa-059e48536630",
"parent_id": "FLEX-WP-0012",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0012-T02",
"status": "done",
"title": "T02 - Credential-grant policy package and fixtures",
"source_path": "workplans/FLEX-WP-0012-credential-grant-authorization-surface.md",
"uuid": "685f3d70-7c50-5664-95ae-1e8c93b14073",
"parent_id": "FLEX-WP-0012",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0012-T03",
"status": "done",
"title": "T03 - Implement the decided integration and prove it end to end",
"source_path": "workplans/FLEX-WP-0012-credential-grant-authorization-surface.md",
"uuid": "045ec743-4411-5b42-b9e8-df25b0c07984",
"parent_id": "FLEX-WP-0012",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0012-T04",
"status": "done",
"title": "T04 - Closure and handoff",
"source_path": "workplans/FLEX-WP-0012-credential-grant-authorization-surface.md",
"uuid": "0dcf2e1f-baa2-5fea-9e3e-9a73795af11f",
"parent_id": "FLEX-WP-0012",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0013",
"status": "finished",
"title": "Restore the seven-action tenant-engine policy pin",
"source_path": "workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md",
"uuid": "6f22ded6-a69c-531b-bfa6-2f8d5c886979",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0013-T01",
"status": "done",
"title": "T01 - Re-pin the overlay and emergency manifests",
"source_path": "workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md",
"uuid": "f84b0f20-f374-5d61-aa43-d1f886ea86c3",
"parent_id": "FLEX-WP-0013",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0013-T02",
"status": "done",
"title": "T02 - Apply and prove the seven actions live",
"source_path": "workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md",
"uuid": "a77ff4bb-8927-5317-a0eb-903cfeef0de5",
"parent_id": "FLEX-WP-0013",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0013-T03",
"status": "done",
"title": "T03 - Handoff and close",
"source_path": "workplans/FLEX-WP-0013-restore-seven-action-tenant-engine-pin.md",
"uuid": "832ba42f-4247-58a9-bc1b-f99648c2c188",
"parent_id": "FLEX-WP-0013",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0014",
"status": "finished",
"title": "Authorize tenant-engine guardrail actions",
"source_path": "workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md",
"uuid": "7de17bd2-5e7c-5355-ba1d-40a051a67746",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0014-T01",
"status": "done",
"title": "T01 - Extend the policy package with the guardrail actions",
"source_path": "workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md",
"uuid": "34fb239a-7f06-5e96-9f10-a6bbb85bf4c3",
"parent_id": "FLEX-WP-0014",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0014-T02",
"status": "done",
"title": "T02 - Decide how the read/write split is used today",
"source_path": "workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md",
"uuid": "8ea87d5f-883a-5d63-89bb-33a3d0963472",
"parent_id": "FLEX-WP-0014",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0014-T03",
"status": "done",
"title": "T03 - Fixtures and verification",
"source_path": "workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md",
"uuid": "1029d2ce-bb37-530e-91ef-ded86f6f5be8",
"parent_id": "FLEX-WP-0014",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0014-T04",
"status": "done",
"title": "T04 - Closure and handoff",
"source_path": "workplans/FLEX-WP-0014-tenant-guardrail-policy-actions.md",
"uuid": "b2b44215-ef08-5c50-b466-190156a88ef3",
"parent_id": "FLEX-WP-0014",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0015",
"status": "finished",
"title": "Tenancy posture declaration and inbound caller authentication",
"source_path": "workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"uuid": "43fe348c-02b9-5d5d-af37-a2d80cfc6e1d",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0015-T01",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"uuid": "ee587988-d29c-5dd8-9417-8af73f627817",
"parent_id": "FLEX-WP-0015",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0015-T02",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"uuid": "7c906ab5-0b3f-5a73-8561-b29d94f4e634",
"parent_id": "FLEX-WP-0015",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0015-T03",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"uuid": "4f885922-56c9-5d89-b7ab-e61c8d69d67a",
"parent_id": "FLEX-WP-0015",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0015-T04",
"status": "cancel",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"uuid": "1c05032a-bcae-5a4c-8f4a-c51b30a48807",
"parent_id": "FLEX-WP-0015",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0015-T05",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0015-tenancy-posture-conformance.md",
"uuid": "702e55bf-b87a-547d-9a2d-bc2ccfee9341",
"parent_id": "FLEX-WP-0015",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0016",
"status": "finished",
"title": "In-cluster ops-warden policy pin so policy.enabled can flip",
"source_path": "workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md",
"uuid": "f29f159c-c79e-5c78-b1e8-569a5b63d231",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0016-T01",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md",
"uuid": "b2f8052e-3686-593f-9359-dfd08d530a26",
"parent_id": "FLEX-WP-0016",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0016-T02",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md",
"uuid": "aa65f534-7401-5231-ae82-ea6e3d09b40c",
"parent_id": "FLEX-WP-0016",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0016-T03",
"status": "done",
"title": "Tasks",
"source_path": "workplans/FLEX-WP-0016-ops-warden-incluster-policy-pin.md",
"uuid": "351f502f-f0cf-5a70-86da-10b1fbe39dae",
"parent_id": "FLEX-WP-0016",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0017",
"status": "active",
"title": "Action-bound authorization and durable approval contract",
"source_path": "workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"uuid": "d75b7256-8b3d-5797-911c-96c3199b8baa",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0017-T01",
"status": "done",
"title": "Bind execute-time decisions to the evaluated request",
"source_path": "workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"uuid": "e7b47e1d-58e8-503c-be89-e8f2050215b1",
"parent_id": "FLEX-WP-0017",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0017-T02",
"status": "done",
"title": "Define the durable authorization object and semantics",
"source_path": "workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"uuid": "df7984fb-c31f-5b26-bf42-193e4c3cbb9f",
"parent_id": "FLEX-WP-0017",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0017-T03",
"status": "wait",
"title": "Add durable storage and authenticated approval evidence",
"source_path": "workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"uuid": "82d39961-8140-5a7f-9bd8-5164dd1742e5",
"parent_id": "FLEX-WP-0017",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0017-T04",
"status": "done",
"title": "Propagate bindings through delegated evaluators",
"source_path": "workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"uuid": "d85089ee-ad8c-502b-ba1b-be4ad23aec46",
"parent_id": "FLEX-WP-0017",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0017-T05",
"status": "wait",
"title": "Consumer handoff and live destructive-action proof",
"source_path": "workplans/FLEX-WP-0017-action-bound-authorization-contract.md",
"uuid": "8c3fc0a2-0855-5ac9-afa5-d03b8b1f0bf9",
"parent_id": "FLEX-WP-0017",
"extra": {}
},
{
"kind": "workplan",
"id": "FLEX-WP-0018",
"status": "finished",
"title": "Inbound caller-auth and deployment documentation corrections",
"source_path": "workplans/FLEX-WP-0018-inbound-auth-corrections.md",
"uuid": "8f301c7c-e3e2-5bd0-a6f2-0cb92c1d782f",
"parent_id": null,
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0018-T01",
"status": "done",
"title": "Classify rejected TokenReview credentials as unauthenticated",
"source_path": "workplans/FLEX-WP-0018-inbound-auth-corrections.md",
"uuid": "4a85c91f-6f34-5224-99b0-23b8eaa3bf7b",
"parent_id": "FLEX-WP-0018",
"extra": {}
},
{
"kind": "task",
"id": "FLEX-WP-0018-T02",
"status": "done",
"title": "Correct NetworkPolicy egress documentation",
"source_path": "workplans/FLEX-WP-0018-inbound-auth-corrections.md",
"uuid": "5613aeb1-ad09-50e5-9933-ced39593dc54",
"parent_id": "FLEX-WP-0018",
"extra": {}
},
{
"kind": "decision",
"id": "FLEX-DEC-2026-001",
"status": "resolved",
"title": "Assent to GH-DEC-2026-001: Engine framing, access-engine rename, authoring/evaluation split",
"source_path": "decisions/decisions.md",
"uuid": null,
"parent_id": null,
"extra": {
"record": {
"id": "FLEX-DEC-2026-001",
"kind": "decision",
"title": "Assent to GH-DEC-2026-001: Engine framing, access-engine rename, authoring/evaluation split",
"status": "resolved",
"origin": "cross-repo",
"origin_ref": "gate-house GH-DEC-2026-001",
"standard": "net-kingdom/canon/standards/security-layer-model_v0.1.md",
"intake_ref": "FLEX-IN-0001",
"owner": "flex-auth",
"affects": [
"flex-auth",
"gate-house",
"net-kingdom",
"ops-warden",
"secrets-engine",
"zone-engine"
],
"requested_dispositions": [
"assent",
"revise",
"reject"
],
"created": "2026-08-28T19:43:38.443788Z",
"updated": "2026-08-28T19:44:29.505314Z",
"rationale": "Assent to all three items of GH-DEC-2026-001. Item 1: flex-auth is Engine-layer and the sole decision point; the INTENT reframe at fe46122 stands. flex-auth accepts one conformance debt of its own \u2014 DecisionProvenance carries no registry snapshot digest, so a decision turning on registry content is not replayable from its own provenance (standard section 6). Item 2: access-engine is the right name; execution is a separate governed migration, conditioned on renaming repository identity and runtime identity in separate revertible steps (the enforcing ops-warden pin binds tokens to the protected-system name flex-auth, and a single-step rename would 401 every warden sign) and on FLEX-WP prefix ownership staying with the repository. Item 3: the authoring/evaluation split is accepted; gate-house authority ceilings must reach the decision as input claims or as rules in the versioned policy package so their application is reconstructable from the decision record \u2014 the same section 6 test flex-auth applied to zone-engine and now to itself. FLEX-WP-0017-T03/T05 stay wait: the design half is re-routed to gate-house, the durable storage half remains unowned and is raised as an engine gap.",
"decided_by": "flex-auth (reviewing side)",
"decided_at": "2026-08-28T19:44:29.505314Z"
}
}
},
{
"kind": "intake",
"id": "FLEX-IN-0001",
"status": "closed",
"title": "Assent requested: Engine framing, access-engine rename, and the authoring/evaluation split",
"source_path": "intakes/intakes.md",
"uuid": null,
"parent_id": null,
"extra": {
"record": {
"id": "FLEX-IN-0001",
"kind": "intake",
"title": "Assent requested: Engine framing, access-engine rename, and the authoring/evaluation split",
"status": "closed",
"origin": "cross-repo",
"origin_ref": "gate-house GH-DEC-2026-001",
"priority": "high",
"owner": "flex-auth",
"requested_by": "gate-house",
"standard": "net-kingdom/canon/standards/security-layer-model_v0.1.md",
"description": "gate-house asks flex-auth to assent to three items ratified in GH-DEC-2026-001, following the estate precedent that a boundary is drawn on review by the other side rather than asserted \u2014 as flex-auth itself did to zone-engine. (1) flex-auth is Engine-layer and is NetKingdom\u2019s only policy decision point; the INTENT reframe is already applied (commit fe46122) and can be revised or reverted if wrong. (2) The ruled rename flex-auth -> access-engine, NOT yet authorized to execute: it is a separate governed migration touching FLEX-WP prefix ownership, State Hub identifiers, ops-warden routing tables, zone-engine boundary text, and secrets-engine integrations. auth-engine was rejected because key-cape owns authentication. (3) The split: flex-auth owns evaluation exclusively plus the policy-as-code mechanism; gate-house owns doctrine, invariants, authority ceilings, operating modes, and the authority context consumed as input claims; policy content stays with the protected system owner. This resolves the FLEX-WP-0017 overlap \u2014 gate-house designs the approval contract, flex-auth validates approvals at decision time. Assent, revision, or rejection all acceptable; the standard stays proposed until this is answered.",
"created": "2026-08-28T19:30:03.602578Z",
"updated": "2026-08-28T19:45:06.001794Z",
"notes": [
{
"content": "Answered by FLEX-DEC-2026-001 (decisions/decisions.md): assent to all three items, with one accepted flex-auth conformance debt (registry snapshot absent from DecisionProvenance) and two conditions on the rename migration.",
"author": "flex-auth",
"created": "2026-08-28T19:45:04.030513Z"
}
],
"closed_at": "2026-08-28T19:45:06.001794Z",
"outcome": "assented \u2014 see FLEX-DEC-2026-001"
}
}
}
],
"events": [
{
"type": "repo.reconciled",
"workplan_count": 18,
"task_count": 81,
"source": "repo-manager",
"emitted_at": "2026-08-28T19:45:14.006530Z"
}
]
}
Reference in a new issue View git blame Copy permalink