tegwick
d97e8efa6e
Four findings returned so far, all from access-engine and approval-engine. F1 is the serious one: GH-DEC-2026-008 as written mandated a comparison that could never pass, because a claim travelling inside a hashed request cannot name the digest of the request containing it. A fail-closed consumer obeying it would have denied destroy permanently — the ruling and its own fail-closed requirement compounded rather than cancelled. Ruling and its four obligations stand; the comparison target is corrected to the PDP's published exclusion-scoped digest, verified in flex-auth's schema and canonical.go before amending. A consumer must not guess the exclusion rule, and until a PDP publishes one the path is fail-closed rather than complete. F2 adds the general property access-engine flagged as a near miss it was not asking to have written: an evidence-bearing input may be excluded from a correspondence digest but never from the replay identity. The round record notes what this says about the process. GH-DEC-2026-008 was correct in substance, argued from doctrine, and verified against another repository's schema before issue — and none of that caught a defect three repositories found within hours of building on it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ Assistant: claude-code Assistant-Model: opus Assistant-Process: 425128@bnt-lap001 Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63 |
||
|---|---|---|
| .. | ||
| adr | ||
| amendments | ||
| assurance | ||
| conformance | ||
| contracts | ||