Record seven created sitting approvals; silence attended stdout.
Warden failed closed on leftover JSON after a successful create. Objects are requested, no entries. Flex Auth package draft pins the seven ids; c01 skipped. No human bind. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
parent
a911eaf816
commit
ca563504c4
9 changed files with 360 additions and 25 deletions
|
|
@ -1,8 +1,9 @@
|
|||
{
|
||||
"kind": "informed-decision-approval-create-intents",
|
||||
"sitting_id": "infd-sitting-2026-09-14",
|
||||
"status": "draft-not-posted",
|
||||
"posted": false,
|
||||
"status": "created-unapproved",
|
||||
"posted": true,
|
||||
"receipt": "docs/evidence/2026-09-15-sitting-approval-creates.json",
|
||||
"requester_client": "informed-decision-sitting-requester",
|
||||
"human_control": true,
|
||||
"pdp_path": false,
|
||||
|
|
|
|||
73
docs/batches/2026-09-14/policy-package.md
Normal file
73
docs/batches/2026-09-14/policy-package.md
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
# Flex Auth package draft — compact sitting (seven records)
|
||||
|
||||
**Not admitted. Not served. Not an expansion of FLEX-WP-0027.**
|
||||
Owner: flex-auth. Source pins: `docs/evidence/2026-09-15-sitting-approval-creates.json`.
|
||||
`c01` is absent (create-client still undecided).
|
||||
|
||||
Same identity bar as `examples/informed-decision-t03`. Deny every other
|
||||
resource id. No consume.
|
||||
|
||||
```rego
|
||||
import rego.v1
|
||||
|
||||
records := {
|
||||
"memo:infd-20260914-c02": {
|
||||
"approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
|
||||
"binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a"
|
||||
},
|
||||
"memo:infd-20260914-c03": {
|
||||
"approval_id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f",
|
||||
"binding_digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844"
|
||||
},
|
||||
"memo:infd-20260914-c04": {
|
||||
"approval_id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7",
|
||||
"binding_digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192"
|
||||
},
|
||||
"memo:infd-20260914-d01": {
|
||||
"approval_id": "9f7c3506-68de-4826-86ff-e301f428408d",
|
||||
"binding_digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15"
|
||||
},
|
||||
"memo:infd-20260914-d02": {
|
||||
"approval_id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9",
|
||||
"binding_digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f"
|
||||
},
|
||||
"memo:infd-20260914-d03": {
|
||||
"approval_id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496",
|
||||
"binding_digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425"
|
||||
},
|
||||
"memo:infd-20260914-d04": {
|
||||
"approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
|
||||
"binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4"
|
||||
}
|
||||
}
|
||||
|
||||
decision := {"effect": "allow", "reason": "operator_admitted_compact_sitting"} if {
|
||||
input.tenant == "tenant:platform"
|
||||
input.subject.tenant == "tenant:platform"
|
||||
input.subject.type == "human"
|
||||
is_string(input.subject.id)
|
||||
input.subject.id != ""
|
||||
input.subject.attributes.principal_type_source == "authentication-derived"
|
||||
input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"}
|
||||
"net-kingdom-admins" in input.subject.attributes.groups
|
||||
assurance := input.subject.attributes.assurance
|
||||
assurance.level == "aal2"
|
||||
assurance.mfa == true
|
||||
assurance.source == "key-cape"
|
||||
assurance.methods == ["pwd", "otp"]
|
||||
is_number(assurance.at)
|
||||
age := time.now_ns() / 1000000000 - assurance.at
|
||||
age >= -30
|
||||
age <= 900
|
||||
input.resource.tenant == "tenant:platform"
|
||||
input.resource.system == "informed-decision"
|
||||
input.resource.type == "decision-memo"
|
||||
record := records[input.resource.id]
|
||||
input.context.memo_version == 1
|
||||
input.context.approval_id == record.approval_id
|
||||
input.context.approval_binding_digest == record.binding_digest
|
||||
input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}
|
||||
} else := {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"} if {
|
||||
true
|
||||
}
|
||||
```
|
||||
|
|
@ -3,10 +3,8 @@
|
|||
Not admitted. Not a local allow. Not an expansion of the T03 three-record
|
||||
mandate (`FLEX-WP-0027`, `examples/informed-decision-t03`).
|
||||
|
||||
`net-kingdom-admins` may review these eight Decision Memos **only after**
|
||||
the operator admits a new package that pins exact `memo_id`, `approval_id`
|
||||
and native `binding.digest`. Until those approval objects exist, this file
|
||||
is a request shape, not a compilable package.
|
||||
Native objects exist for seven memos (2026-09-15T20:35Z). Compilable draft:
|
||||
`policy-package.md`. `c01` is still omitted.
|
||||
|
||||
## Intended allow (same identity bar as T03)
|
||||
|
||||
|
|
@ -17,21 +15,18 @@ is a request shape, not a compilable package.
|
|||
- deny every other resource id
|
||||
- no consume, no approval create, no presentation claim as policy input
|
||||
|
||||
## Exact resource ids (approval ids still unknown)
|
||||
## Exact pins (from sitting-create receipt)
|
||||
|
||||
| resource.id | Blocking record |
|
||||
| --- | --- |
|
||||
| `memo:infd-20260914-c01` | SECRETS-WP-0010 native delivery |
|
||||
| `memo:infd-20260914-c02` | RPF-WP-0035-T02 |
|
||||
| `memo:infd-20260914-c03` | NK-WP-0032-T03 |
|
||||
| `memo:infd-20260914-c04` | WARDEN-WP-0027-T02 |
|
||||
| `memo:infd-20260914-d01` | CUST-WP-0038-T08 |
|
||||
| `memo:infd-20260914-d02` | HFACT-WP-0001-T03 |
|
||||
| `memo:infd-20260914-d03` | MASON-WP-0005 plan |
|
||||
| `memo:infd-20260914-d04` | RCLK-WP-0002-T01 |
|
||||
| resource.id | approval_id | Blocking record |
|
||||
| --- | --- | --- |
|
||||
| `memo:infd-20260914-c02` | `ccfd8007-2061-48fd-9356-99b16279dac1` | RPF-WP-0035-T02 |
|
||||
| `memo:infd-20260914-c03` | `a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f` | NK-WP-0032-T03 |
|
||||
| `memo:infd-20260914-c04` | `22ac6df3-e6a9-472b-a68e-c8caca4289a7` | WARDEN-WP-0027-T02 |
|
||||
| `memo:infd-20260914-d01` | `9f7c3506-68de-4826-86ff-e301f428408d` | CUST-WP-0038-T08 |
|
||||
| `memo:infd-20260914-d02` | `b3ce2c01-0a3b-401e-b4ed-c1954af169c9` | HFACT-WP-0001-T03 |
|
||||
| `memo:infd-20260914-d03` | `3b483e6b-0b92-45ff-83b6-bc5057c0a496` | MASON-WP-0005 plan |
|
||||
| `memo:infd-20260914-d04` | `356e67a3-5539-46a1-922a-f5591fd38ee5` | RCLK-WP-0002-T01 |
|
||||
|
||||
Do not copy T03 approval ids into this table. Do not serve this list as
|
||||
policy until a created-receipt supplies `approval_id` and `binding.digest`
|
||||
for every row.
|
||||
`memo:infd-20260914-c01` is not in this package.
|
||||
|
||||
Owner: flex-auth. This repository drafts; it does not evaluate authorization.
|
||||
|
|
|
|||
|
|
@ -8,6 +8,6 @@
|
|||
"infd-batch-2026-09-14-decisions"
|
||||
],
|
||||
"memo_count": 8,
|
||||
"bind_path": "live accept open; sitting-requester live; attended create not yet run",
|
||||
"note": "Unsigned drafts. CCR-2026-0026/0027 applied and create-only exchange proof verified 2026-09-15. Next: attended tools/create_sitting_approvals.py (skips c01), then Flex Auth package, then human sitting."
|
||||
"bind_path": "seven native objects requested 2026-09-15T20:35Z; human bind and Flex Auth admission remaining",
|
||||
"note": "Create succeeded. Warden then failed closed on child stdout (now silenced). c01 skipped. No human entries. Next: flex-auth admits policy-package.md, attach live KeyCape sub, load store, sit."
|
||||
}
|
||||
|
|
|
|||
229
docs/evidence/2026-09-15-sitting-approval-creates.json
Normal file
229
docs/evidence/2026-09-15-sitting-approval-creates.json
Normal file
|
|
@ -0,0 +1,229 @@
|
|||
{
|
||||
"observed_at": "2026-09-15T20:35:14.412859+00:00",
|
||||
"status": "created",
|
||||
"phase": "seven_unapproved_requests_created",
|
||||
"requests": [
|
||||
{
|
||||
"memo_id": "infd-20260914-c02",
|
||||
"approval": {
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a",
|
||||
"human_control": true,
|
||||
"pdp_digest": null,
|
||||
"pdp_path": false,
|
||||
"principal": "railiance-platform",
|
||||
"purpose": "Accept provisioning of the secrets-engine service JWT login on the reviewed credential lane",
|
||||
"target": {
|
||||
"id": "rpf-wp-0035-t02",
|
||||
"system": "railiance-platform",
|
||||
"type": "credential-lane"
|
||||
}
|
||||
},
|
||||
"created_at": "2026-09-15T20:35:16+00:00",
|
||||
"entries": [],
|
||||
"id": "ccfd8007-2061-48fd-9356-99b16279dac1",
|
||||
"required_count": 1,
|
||||
"status": "requested",
|
||||
"superseded_by": null,
|
||||
"updated_at": "2026-09-15T20:35:16+00:00",
|
||||
"validity": {
|
||||
"expires_at": "2026-09-16T20:35:16.122938+00:00",
|
||||
"not_before": "2026-09-15T20:35:16.122938+00:00"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"memo_id": "infd-20260914-c03",
|
||||
"approval": {
|
||||
"binding": {
|
||||
"action": "apply",
|
||||
"actor": "informed-decision",
|
||||
"digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844",
|
||||
"human_control": true,
|
||||
"pdp_digest": null,
|
||||
"pdp_path": false,
|
||||
"principal": "netkingdom",
|
||||
"purpose": "Apply the live OpenBao role addition already specified for the operator-tunneled browser callback",
|
||||
"target": {
|
||||
"id": "nk-wp-0032-t03",
|
||||
"system": "netkingdom",
|
||||
"type": "openbao-role"
|
||||
}
|
||||
},
|
||||
"created_at": "2026-09-15T20:35:16+00:00",
|
||||
"entries": [],
|
||||
"id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f",
|
||||
"required_count": 1,
|
||||
"status": "requested",
|
||||
"superseded_by": null,
|
||||
"updated_at": "2026-09-15T20:35:16+00:00",
|
||||
"validity": {
|
||||
"expires_at": "2026-09-16T20:35:16.122938+00:00",
|
||||
"not_before": "2026-09-15T20:35:16.122938+00:00"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"memo_id": "infd-20260914-c04",
|
||||
"approval": {
|
||||
"binding": {
|
||||
"action": "attend",
|
||||
"actor": "informed-decision",
|
||||
"digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192",
|
||||
"human_control": true,
|
||||
"pdp_digest": null,
|
||||
"pdp_path": false,
|
||||
"principal": "ops-warden",
|
||||
"purpose": "Attend the graded lockdown / break-glass seal for ops-warden trust-root work",
|
||||
"target": {
|
||||
"id": "warden-wp-0027-t02",
|
||||
"system": "ops-warden",
|
||||
"type": "trust-root"
|
||||
}
|
||||
},
|
||||
"created_at": "2026-09-15T20:35:17+00:00",
|
||||
"entries": [],
|
||||
"id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7",
|
||||
"required_count": 1,
|
||||
"status": "requested",
|
||||
"superseded_by": null,
|
||||
"updated_at": "2026-09-15T20:35:17+00:00",
|
||||
"validity": {
|
||||
"expires_at": "2026-09-16T20:35:16.122938+00:00",
|
||||
"not_before": "2026-09-15T20:35:16.122938+00:00"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"memo_id": "infd-20260914-d01",
|
||||
"approval": {
|
||||
"binding": {
|
||||
"action": "retire",
|
||||
"actor": "informed-decision",
|
||||
"digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15",
|
||||
"human_control": true,
|
||||
"pdp_digest": null,
|
||||
"pdp_path": false,
|
||||
"principal": "the-custodian",
|
||||
"purpose": "After HA failover and restore drills pass, retire WSL2 as a State Hub fallback",
|
||||
"target": {
|
||||
"id": "cust-wp-0038-t08",
|
||||
"system": "the-custodian",
|
||||
"type": "operating-model"
|
||||
}
|
||||
},
|
||||
"created_at": "2026-09-15T20:35:17+00:00",
|
||||
"entries": [],
|
||||
"id": "9f7c3506-68de-4826-86ff-e301f428408d",
|
||||
"required_count": 1,
|
||||
"status": "requested",
|
||||
"superseded_by": null,
|
||||
"updated_at": "2026-09-15T20:35:17+00:00",
|
||||
"validity": {
|
||||
"expires_at": "2026-09-16T20:35:16.122938+00:00",
|
||||
"not_before": "2026-09-15T20:35:16.122938+00:00"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"memo_id": "infd-20260914-d02",
|
||||
"approval": {
|
||||
"binding": {
|
||||
"action": "confirm",
|
||||
"actor": "informed-decision",
|
||||
"digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f",
|
||||
"human_control": true,
|
||||
"pdp_digest": null,
|
||||
"pdp_path": false,
|
||||
"principal": "helixforge-factory",
|
||||
"purpose": "Confirm the existing operator-group claim for CCR-2026-0019 as required by the factory identity/audit/approval path",
|
||||
"target": {
|
||||
"id": "ccr-2026-0019",
|
||||
"system": "helixforge-factory",
|
||||
"type": "ccr"
|
||||
}
|
||||
},
|
||||
"created_at": "2026-09-15T20:35:17+00:00",
|
||||
"entries": [],
|
||||
"id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9",
|
||||
"required_count": 1,
|
||||
"status": "requested",
|
||||
"superseded_by": null,
|
||||
"updated_at": "2026-09-15T20:35:17+00:00",
|
||||
"validity": {
|
||||
"expires_at": "2026-09-16T20:35:16.122938+00:00",
|
||||
"not_before": "2026-09-15T20:35:16.122938+00:00"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"memo_id": "infd-20260914-d03",
|
||||
"approval": {
|
||||
"binding": {
|
||||
"action": "accept",
|
||||
"actor": "informed-decision",
|
||||
"digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425",
|
||||
"human_control": true,
|
||||
"pdp_digest": null,
|
||||
"pdp_path": false,
|
||||
"principal": "mason",
|
||||
"purpose": "Accept the fluid-telegram operator credential lane plan so construction may proceed",
|
||||
"target": {
|
||||
"id": "mason-wp-0005",
|
||||
"system": "mason",
|
||||
"type": "workplan"
|
||||
}
|
||||
},
|
||||
"created_at": "2026-09-15T20:35:17+00:00",
|
||||
"entries": [],
|
||||
"id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496",
|
||||
"required_count": 1,
|
||||
"status": "requested",
|
||||
"superseded_by": null,
|
||||
"updated_at": "2026-09-15T20:35:17+00:00",
|
||||
"validity": {
|
||||
"expires_at": "2026-09-16T20:35:16.122938+00:00",
|
||||
"not_before": "2026-09-15T20:35:16.122938+00:00"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"memo_id": "infd-20260914-d04",
|
||||
"approval": {
|
||||
"binding": {
|
||||
"action": "confirm",
|
||||
"actor": "informed-decision",
|
||||
"digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4",
|
||||
"human_control": true,
|
||||
"pdp_digest": null,
|
||||
"pdp_path": false,
|
||||
"principal": "railiance-clock",
|
||||
"purpose": "Confirm ecosystem ownership and the security role for Railiance Clock as specified",
|
||||
"target": {
|
||||
"id": "rclk-wp-0002-t01",
|
||||
"system": "railiance-clock",
|
||||
"type": "workplan"
|
||||
}
|
||||
},
|
||||
"created_at": "2026-09-15T20:35:17+00:00",
|
||||
"entries": [],
|
||||
"id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
|
||||
"required_count": 1,
|
||||
"status": "requested",
|
||||
"superseded_by": null,
|
||||
"updated_at": "2026-09-15T20:35:17+00:00",
|
||||
"validity": {
|
||||
"expires_at": "2026-09-16T20:35:16.122938+00:00",
|
||||
"not_before": "2026-09-15T20:35:16.122938+00:00"
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"credential_values_emitted": false,
|
||||
"human_entries_created": false,
|
||||
"skipped": [
|
||||
"infd-20260914-c01"
|
||||
]
|
||||
}
|
||||
|
|
@ -1,4 +1,5 @@
|
|||
import importlib.util
|
||||
import json
|
||||
from pathlib import Path
|
||||
|
||||
import pytest
|
||||
|
|
@ -26,6 +27,32 @@ def test_require_attended_refuses_this_shell():
|
|||
create.require_attended()
|
||||
|
||||
|
||||
def test_created_receipt_has_seven_requested_and_no_entries():
|
||||
receipt = json.loads((Path(__file__).resolve().parents[1] / "docs" / "evidence" / "2026-09-15-sitting-approval-creates.json").read_text())
|
||||
assert receipt["status"] == "created"
|
||||
assert receipt["human_entries_created"] is False
|
||||
assert receipt["credential_values_emitted"] is False
|
||||
assert len(receipt["requests"]) == 7
|
||||
assert receipt["skipped"] == ["infd-20260914-c01"]
|
||||
for row in receipt["requests"]:
|
||||
approval = row["approval"]
|
||||
assert approval["status"] == "requested"
|
||||
assert approval["entries"] == []
|
||||
assert approval["binding"]["human_control"] is True
|
||||
assert approval["binding"]["digest"].startswith("sha256:")
|
||||
|
||||
|
||||
def test_policy_package_pins_match_created_receipt():
|
||||
root = Path(__file__).resolve().parents[1] / "docs" / "batches" / "2026-09-14"
|
||||
receipt = json.loads((Path(__file__).resolve().parents[1] / "docs" / "evidence" / "2026-09-15-sitting-approval-creates.json").read_text())
|
||||
package = (root / "policy-package.md").read_text()
|
||||
assert "c01" not in package or "infd-20260914-c01" not in package
|
||||
for row in receipt["requests"]:
|
||||
assert f'memo:{row["memo_id"]}' in package
|
||||
assert row["approval"]["id"] in package
|
||||
assert row["approval"]["binding"]["digest"] in package
|
||||
|
||||
|
||||
def test_failed_receipt_does_not_block_retry(tmp_path, monkeypatch):
|
||||
receipt = tmp_path / "r.json"
|
||||
monkeypatch.setattr(create, "RECEIPT", receipt)
|
||||
|
|
|
|||
|
|
@ -26,7 +26,8 @@ def test_sitting_requester_is_create_only_and_applied():
|
|||
|
||||
|
||||
def test_create_intents_cover_the_sitting_and_are_not_posted():
|
||||
assert INTENTS["posted"] is False
|
||||
assert INTENTS["posted"] is True
|
||||
assert INTENTS["status"] == "created-unapproved"
|
||||
assert INTENTS["human_control"] is True
|
||||
assert INTENTS["pdp_path"] is False
|
||||
ids = [row["memo_id"] for row in INTENTS["intents"]]
|
||||
|
|
|
|||
|
|
@ -1,7 +1,8 @@
|
|||
#!/usr/bin/env bash
|
||||
# Attended child for openbao-attended-exec / warden access. Metadata only.
|
||||
# Silent attended child. Outcome is the receipt file, not stdout.
|
||||
set -euo pipefail
|
||||
export INFD_APPROVAL_ORIGIN="${INFD_APPROVAL_ORIGIN:-http://127.0.0.1:18281}"
|
||||
exec /home/worsch/informed-decision/.venv/bin/python -B \
|
||||
/home/worsch/informed-decision/tools/create_sitting_approvals.py \
|
||||
--approval-origin "$INFD_APPROVAL_ORIGIN"
|
||||
--approval-origin "$INFD_APPROVAL_ORIGIN" \
|
||||
>/dev/null 2>&1
|
||||
|
|
|
|||
|
|
@ -166,6 +166,14 @@ child stays `prove-sitting-requester-exchange.sh`). Operator must export
|
|||
`WARDEN_ROUTING_CATALOG` and `BAO_ADDR=http://127.0.0.1:18200`. No POST
|
||||
from this shell. Task stays `wait`.
|
||||
|
||||
2026-09-15 20:35 UTC — **seven unapproved objects exist.** Attended create
|
||||
wrote `docs/evidence/2026-09-15-sitting-approval-creates.json`
|
||||
(`created` / `seven_unapproved_requests_created`, no entries). Warden
|
||||
then failed closed on child stdout; wrapper is now silent. `c01` skipped.
|
||||
Flex Auth draft `docs/batches/2026-09-14/policy-package.md` is not
|
||||
admitted. Attach still needs the operator KeyCape `sub`. No human bind.
|
||||
Task stays `wait`.
|
||||
|
||||
## Feed outcomes back to State Hub without hub-authoring
|
||||
|
||||
```task
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue