coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add verified browser login and human approval HTTP client

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-10 22:05:17 +02:00
parent 4e103f62a0
commit 0e48355b9f
16 changed files with 1365 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

44
SCOPE.md
View file

@ -4,12 +4,13 @@
> direction belongs in `INTENT.md`; the current stage belongs in `GOAL.md`;
> current work and gates belong in `workplans/`.
## Status — 2026-09-09
## Status — 2026-09-10
**Specification, declaration and the domain core are complete. No service is
deployed.**
**The domain core, browser sign-in shell and Approval Engine HTTP adapter
are implemented. The approval surface is not deployed.**
What exists and is tested (87 tests):
What exists and is tested (206 tests, including the explicit real-engine
component suite; 100 were present before browser integration):
- layer and stance declarations — `layer.yaml`, `pep-stance.yaml`,
`informed_decision/stance.py`, with published-equals-shipped asserted;
@ -20,11 +21,20 @@ What exists and is tested (87 tests):
`disposition.py` (the verb vocabulary and guards `G_NOAGENT`, `G_STEP`,
`G_PRES`, `G_ACK`, `G_REASONS`, `G_SEALED`), `provenance.py` (claim routes,
A-16), `evidence.py` (the local outbox and commitment records);
- `approval_client.py` — the seam to `approval-engine` plus a fake carrying its
actual refusal semantics.
- `approval_client.py` — the seam to `approval-engine` plus a fake;
- `oidc.py` and `web.py` — public-client PKCE sign-in, verified human/MFA
profile, bounded server-side sessions, protected cookies and CSRF sign-out;
- `approval_http.py` and `http_transport.py` — get-by-id and human-entry
transport, declared-control checks, real entry correlation, no consume route
or automatic mutation retry. This adapter has no public browser mutation route.
What does not exist: any HTTP surface, any persistence, any UI, any deployment.
The origin `decisions.coulomb.social` is live but serves an nginx placeholder.
Remaining: durable memo/presentation/disposition storage and transactional
evidence outbox, entitlement-before-render integration, L3 review/acknowledgment/
binding UI, independent audit delivery and native deployment proof. The existing
`Outbox` is in memory. Browser sessions are ephemeral, with no approval state.
`/readyz` returns 503 until the protected approval path is connected.
The origin `decisions.coulomb.social` still serves an nginx placeholder.
See [browser-authentication.md](docs/browser-authentication.md).
`INFD-WP-0001-T08` remains open for the live end-to-end proof, which is gated on
`APPROVAL-WP-0002-T01` and a deployed `approval-engine`.
@ -72,7 +82,7 @@ trail.
- The unreachable-engine stance map, built to v0.8 obligation 3, with
published-equals-shipped asserted by test (`tests/test_layer_conformance.py`).
**Specified, not built:**
**Built as domain operations; durable HTTP integration remains:**
- The presentation record: what was rendered, to whom, when, in which locale and
UI release.
@ -82,6 +92,9 @@ trail.
memo-level.
- The browser-facing OIDC client: authorization-code + S256 PKCE against
`key-cape`, scopes `[openid, approval:read, approval:approve]`.
**Specified, not built:**
- An L3 approver surface calling `approval-engine`'s approval-entry mutation.
- The evidence bundle as an offline-verifiable export.
@ -130,12 +143,13 @@ Stated here because a scope file that only lists capabilities overstates them.
## Open
- **The deployed origin** — the one remaining input to `T07`. `client_id` and
the callback URI must name a real origin, since redirects match exactly.
- **`audit-core` registration and cadence** — the payload is ruled
(commitment-only, with the existence assertion); the sender registration and
whether reconciliation-plus-heartbeat suits a mixed-volume source are still
`audit-core`'s to answer. Required before `T08` ships.
- **Native browser registration and human proof** — T07 supplied the real
origin and submitted the contract. T08 retains registration rollout and a real
human login accepted by the deployed Approval Engine.
- **`audit-core` custody and live delivery** — source registration and cadence
have owner returns (`AUDIT-IN-0003`, `AUDIT-WP-0009` T04/T06/T07); native
credentials, independent receipt and reconciliation still require proof before
T08 ships.
*Closed 2026-09-10:* the human token tenant (`GH-DEC-2026-013`, `key-cape`
`329e48f`) and the evidence payload question (`GH-DEC-2026-014`).