coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
A policy-as-code capable authorization registry/control-plane service.
171 commits 1 branch 0 tags 1.3 MiB
Find a file
tegwick fe46122940 Reframe INTENT as an Engine and the sole decision point 
Per gate-house GH-DEC-2026-001 and net-kingdom canon
security-layer-model_v0.1. The rename to access-engine is NOT part of this
change; it remains a separate governed migration.

- Drop the "control plane" self-description: that is Staff-layer vocabulary,
  and flex-auth is an Engine — a deterministic API where the same
  authoritative input state yields the same result.
- State the exclusive role: flex-auth is the only policy decision point in
  NetKingdom. No other repository, in any layer, renders or caches a decision.
- Split authoring from evaluation. flex-auth owns evaluation exclusively plus
  the policy-as-code mechanism; gate-house owns the doctrine, invariants,
  authority ceilings, operating modes, and the authority context consumed as
  input claims; policy content stays with the protected system's owner.
- Record the access lane/rule demarcation: ops-warden and ops-mason own lanes
  (how a worker reaches a host), flex-auth owns rules (whether they may).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2564823@bnt-lap001
Assistant-Session: 2a7ed827-4928-4b9f-8613-9135c9cadfe9
2026-08-28 21:21:00 +02:00
.claude/rules docs: workplan-first agent guidance prose (CUST-WP-0055 T04 batch 2) 2026-07-08 16:41:17 +02:00
.forgejo/workflows Publish images via CI; file staged-promotion overlay debt 2026-08-11 10:35:34 +02:00
.github/workflows Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton 2026-05-16 01:54:44 +02:00
charts/flex-auth Enforce caller-auth on flex-auth-user-engine and record the live A2 probe 2026-08-19 14:00:53 +02:00
cmd/flex-auth feat(policy): add credential grant authorization package 2026-08-23 13:59:03 +02:00
deploy feat(authz): bind decisions to exact actions 2026-08-23 13:18:26 +02:00
docs feat(policy): add credential grant authorization package 2026-08-23 13:59:03 +02:00
examples fix(contract): pin action authorization digest 2026-08-23 14:24:24 +02:00
internal feat(authz): bind decisions to exact actions 2026-08-23 13:18:26 +02:00
pkg/api fix(contract): pin action authorization digest 2026-08-23 14:24:24 +02:00
railiance Add isolated ops-warden warn pin (FLEX-WP-0016); FLEX-WP-0007 stays finished 2026-08-19 14:50:04 +02:00
registry Add capability registry with seed entry from reuse-surface 2026-06-16 01:46:54 +02:00
schemas fix(schema): require durable decision binding 2026-08-23 13:22:25 +02:00
tests Enforce caller-auth on flex-auth-ops-warden (FLEX-WP-0016-T03) 2026-08-19 20:10:31 +02:00
tools Pin caller-auth digest in warn on independently rollable overlay pins 2026-08-19 12:31:08 +02:00
values Enforce caller-auth on flex-auth-ops-warden (FLEX-WP-0016-T03) 2026-08-19 20:10:31 +02:00
workplans fix(workplans): adopt ADR-007 derived identifiers for unregistered records 2026-08-25 20:10:35 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-08-23 14:17:58 +02:00
.gitignore Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton 2026-05-16 01:54:44 +02:00
.golangci.yml Land foundations: assessment, ADR-001/002/003, FLEX-WP-0005, Go skeleton 2026-05-16 01:54:44 +02:00
.repo-classification.yaml Human-review .repo-classification.yaml (CUST-WP-0050 follow-up) 2026-06-22 17:56:17 +02:00
AGENTS.md docs(agents): repoint remote State Hub URL to the in-cluster address 2026-08-25 00:21:00 +02:00
CLAUDE.md Add credential routing instructions for all agent runtimes 2026-06-18 22:48:37 +02:00
Containerfile Package flex-auth policy service 2026-08-09 01:35:30 +02:00
go.mod Implement policy package loader 2026-05-17 05:30:40 +02:00
go.sum Implement policy package loader 2026-05-17 05:30:40 +02:00
INTENT.md Reframe INTENT as an Engine and the sole decision point 2026-08-28 21:21:00 +02:00
LICENSE Adopt Target Revenue Source License V1C1 (org-wide preliminary rollout) 2026-07-30 00:16:31 +02:00
Makefile Implement inbound caller authentication (ADR 0004); close T03 and T05 2026-08-18 15:22:52 +02:00
README.md Refine workplans for CARING profile 2026-05-17 04:15:38 +02:00
SCOPE.md feat(authz): bind decisions to exact actions 2026-08-23 13:18:26 +02:00
tenancy.yaml fix(posture): remove redundant implemented level 2026-08-22 15:22:33 +02:00
WORK-RECORDS.md docs(workplan): close credential grant integration 2026-08-23 14:19:53 +02:00

README.md

flex-auth

Policy-as-code authorization registry and control plane for NetKingdom-aligned systems.

Start with INTENT.md for the project boundary and direction. Research notes and ADRs live in docs/ and docs/adr/.

The product boundary is captured in SCOPE.md, and the current Product Requirements Document is docs/ProductRequirementsDocument.md.

The 2026-05-15 pre-implementation assessment that shapes the current sequencing is in docs/pre-implementation-assessment.md.

The CARING reference-implementation approach is captured in docs/caring-architecture-blueprint.md.

Workplans live in workplans/, with sequencing captured in docs/workplan-planning-map.md.