From ca563504c44f08a4ef67b1d40daaf34b0a995513 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 15 Sep 2026 22:37:04 +0200 Subject: [PATCH] Record seven created sitting approvals; silence attended stdout. Warden failed closed on leftover JSON after a successful create. Objects are requested, no entries. Flex Auth package draft pins the seven ids; c01 skipped. No human bind. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267 --- .../2026-09-14/approval-create-intents.json | 5 +- docs/batches/2026-09-14/policy-package.md | 73 ++++++ docs/batches/2026-09-14/policy-request.md | 31 +-- docs/batches/2026-09-14/sitting.json | 4 +- .../2026-09-15-sitting-approval-creates.json | 229 ++++++++++++++++++ tests/test_create_sitting_approvals.py | 27 +++ tests/test_sitting_requester_registration.py | 3 +- tools/create_sitting_approvals.sh | 5 +- .../INFD-WP-0002-compact-signoff-batches.md | 8 + 9 files changed, 360 insertions(+), 25 deletions(-) create mode 100644 docs/batches/2026-09-14/policy-package.md create mode 100644 docs/evidence/2026-09-15-sitting-approval-creates.json diff --git a/docs/batches/2026-09-14/approval-create-intents.json b/docs/batches/2026-09-14/approval-create-intents.json index b4152c8..9301152 100644 --- a/docs/batches/2026-09-14/approval-create-intents.json +++ b/docs/batches/2026-09-14/approval-create-intents.json @@ -1,8 +1,9 @@ { "kind": "informed-decision-approval-create-intents", "sitting_id": "infd-sitting-2026-09-14", - "status": "draft-not-posted", - "posted": false, + "status": "created-unapproved", + "posted": true, + "receipt": "docs/evidence/2026-09-15-sitting-approval-creates.json", "requester_client": "informed-decision-sitting-requester", "human_control": true, "pdp_path": false, diff --git a/docs/batches/2026-09-14/policy-package.md b/docs/batches/2026-09-14/policy-package.md new file mode 100644 index 0000000..629f86d --- /dev/null +++ b/docs/batches/2026-09-14/policy-package.md @@ -0,0 +1,73 @@ +# Flex Auth package draft — compact sitting (seven records) + +**Not admitted. Not served. Not an expansion of FLEX-WP-0027.** +Owner: flex-auth. Source pins: `docs/evidence/2026-09-15-sitting-approval-creates.json`. +`c01` is absent (create-client still undecided). + +Same identity bar as `examples/informed-decision-t03`. Deny every other +resource id. No consume. + +```rego +import rego.v1 + +records := { + "memo:infd-20260914-c02": { + "approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1", + "binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a" + }, + "memo:infd-20260914-c03": { + "approval_id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f", + "binding_digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844" + }, + "memo:infd-20260914-c04": { + "approval_id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7", + "binding_digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192" + }, + "memo:infd-20260914-d01": { + "approval_id": "9f7c3506-68de-4826-86ff-e301f428408d", + "binding_digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15" + }, + "memo:infd-20260914-d02": { + "approval_id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9", + "binding_digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f" + }, + "memo:infd-20260914-d03": { + "approval_id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496", + "binding_digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425" + }, + "memo:infd-20260914-d04": { + "approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5", + "binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4" + } +} + +decision := {"effect": "allow", "reason": "operator_admitted_compact_sitting"} if { + input.tenant == "tenant:platform" + input.subject.tenant == "tenant:platform" + input.subject.type == "human" + is_string(input.subject.id) + input.subject.id != "" + input.subject.attributes.principal_type_source == "authentication-derived" + input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"} + "net-kingdom-admins" in input.subject.attributes.groups + assurance := input.subject.attributes.assurance + assurance.level == "aal2" + assurance.mfa == true + assurance.source == "key-cape" + assurance.methods == ["pwd", "otp"] + is_number(assurance.at) + age := time.now_ns() / 1000000000 - assurance.at + age >= -30 + age <= 900 + input.resource.tenant == "tenant:platform" + input.resource.system == "informed-decision" + input.resource.type == "decision-memo" + record := records[input.resource.id] + input.context.memo_version == 1 + input.context.approval_id == record.approval_id + input.context.approval_binding_digest == record.binding_digest + input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"} +} else := {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"} if { + true +} +``` diff --git a/docs/batches/2026-09-14/policy-request.md b/docs/batches/2026-09-14/policy-request.md index dc169e3..6ffcea2 100644 --- a/docs/batches/2026-09-14/policy-request.md +++ b/docs/batches/2026-09-14/policy-request.md @@ -3,10 +3,8 @@ Not admitted. Not a local allow. Not an expansion of the T03 three-record mandate (`FLEX-WP-0027`, `examples/informed-decision-t03`). -`net-kingdom-admins` may review these eight Decision Memos **only after** -the operator admits a new package that pins exact `memo_id`, `approval_id` -and native `binding.digest`. Until those approval objects exist, this file -is a request shape, not a compilable package. +Native objects exist for seven memos (2026-09-15T20:35Z). Compilable draft: +`policy-package.md`. `c01` is still omitted. ## Intended allow (same identity bar as T03) @@ -17,21 +15,18 @@ is a request shape, not a compilable package. - deny every other resource id - no consume, no approval create, no presentation claim as policy input -## Exact resource ids (approval ids still unknown) +## Exact pins (from sitting-create receipt) -| resource.id | Blocking record | -| --- | --- | -| `memo:infd-20260914-c01` | SECRETS-WP-0010 native delivery | -| `memo:infd-20260914-c02` | RPF-WP-0035-T02 | -| `memo:infd-20260914-c03` | NK-WP-0032-T03 | -| `memo:infd-20260914-c04` | WARDEN-WP-0027-T02 | -| `memo:infd-20260914-d01` | CUST-WP-0038-T08 | -| `memo:infd-20260914-d02` | HFACT-WP-0001-T03 | -| `memo:infd-20260914-d03` | MASON-WP-0005 plan | -| `memo:infd-20260914-d04` | RCLK-WP-0002-T01 | +| resource.id | approval_id | Blocking record | +| --- | --- | --- | +| `memo:infd-20260914-c02` | `ccfd8007-2061-48fd-9356-99b16279dac1` | RPF-WP-0035-T02 | +| `memo:infd-20260914-c03` | `a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f` | NK-WP-0032-T03 | +| `memo:infd-20260914-c04` | `22ac6df3-e6a9-472b-a68e-c8caca4289a7` | WARDEN-WP-0027-T02 | +| `memo:infd-20260914-d01` | `9f7c3506-68de-4826-86ff-e301f428408d` | CUST-WP-0038-T08 | +| `memo:infd-20260914-d02` | `b3ce2c01-0a3b-401e-b4ed-c1954af169c9` | HFACT-WP-0001-T03 | +| `memo:infd-20260914-d03` | `3b483e6b-0b92-45ff-83b6-bc5057c0a496` | MASON-WP-0005 plan | +| `memo:infd-20260914-d04` | `356e67a3-5539-46a1-922a-f5591fd38ee5` | RCLK-WP-0002-T01 | -Do not copy T03 approval ids into this table. Do not serve this list as -policy until a created-receipt supplies `approval_id` and `binding.digest` -for every row. +`memo:infd-20260914-c01` is not in this package. Owner: flex-auth. This repository drafts; it does not evaluate authorization. diff --git a/docs/batches/2026-09-14/sitting.json b/docs/batches/2026-09-14/sitting.json index 7e7f549..609a452 100644 --- a/docs/batches/2026-09-14/sitting.json +++ b/docs/batches/2026-09-14/sitting.json @@ -8,6 +8,6 @@ "infd-batch-2026-09-14-decisions" ], "memo_count": 8, - "bind_path": "live accept open; sitting-requester live; attended create not yet run", - "note": "Unsigned drafts. CCR-2026-0026/0027 applied and create-only exchange proof verified 2026-09-15. Next: attended tools/create_sitting_approvals.py (skips c01), then Flex Auth package, then human sitting." + "bind_path": "seven native objects requested 2026-09-15T20:35Z; human bind and Flex Auth admission remaining", + "note": "Create succeeded. Warden then failed closed on child stdout (now silenced). c01 skipped. No human entries. Next: flex-auth admits policy-package.md, attach live KeyCape sub, load store, sit." } diff --git a/docs/evidence/2026-09-15-sitting-approval-creates.json b/docs/evidence/2026-09-15-sitting-approval-creates.json new file mode 100644 index 0000000..038e127 --- /dev/null +++ b/docs/evidence/2026-09-15-sitting-approval-creates.json @@ -0,0 +1,229 @@ +{ + "observed_at": "2026-09-15T20:35:14.412859+00:00", + "status": "created", + "phase": "seven_unapproved_requests_created", + "requests": [ + { + "memo_id": "infd-20260914-c02", + "approval": { + "binding": { + "action": "accept", + "actor": "informed-decision", + "digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a", + "human_control": true, + "pdp_digest": null, + "pdp_path": false, + "principal": "railiance-platform", + "purpose": "Accept provisioning of the secrets-engine service JWT login on the reviewed credential lane", + "target": { + "id": "rpf-wp-0035-t02", + "system": "railiance-platform", + "type": "credential-lane" + } + }, + "created_at": "2026-09-15T20:35:16+00:00", + "entries": [], + "id": "ccfd8007-2061-48fd-9356-99b16279dac1", + "required_count": 1, + "status": "requested", + "superseded_by": null, + "updated_at": "2026-09-15T20:35:16+00:00", + "validity": { + "expires_at": "2026-09-16T20:35:16.122938+00:00", + "not_before": "2026-09-15T20:35:16.122938+00:00" + } + } + }, + { + "memo_id": "infd-20260914-c03", + "approval": { + "binding": { + "action": "apply", + "actor": "informed-decision", + "digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844", + "human_control": true, + "pdp_digest": null, + "pdp_path": false, + "principal": "netkingdom", + "purpose": "Apply the live OpenBao role addition already specified for the operator-tunneled browser callback", + "target": { + "id": "nk-wp-0032-t03", + "system": "netkingdom", + "type": "openbao-role" + } + }, + "created_at": "2026-09-15T20:35:16+00:00", + "entries": [], + "id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f", + "required_count": 1, + "status": "requested", + "superseded_by": null, + "updated_at": "2026-09-15T20:35:16+00:00", + "validity": { + "expires_at": "2026-09-16T20:35:16.122938+00:00", + "not_before": "2026-09-15T20:35:16.122938+00:00" + } + } + }, + { + "memo_id": "infd-20260914-c04", + "approval": { + "binding": { + "action": "attend", + "actor": "informed-decision", + "digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192", + "human_control": true, + "pdp_digest": null, + "pdp_path": false, + "principal": "ops-warden", + "purpose": "Attend the graded lockdown / break-glass seal for ops-warden trust-root work", + "target": { + "id": "warden-wp-0027-t02", + "system": "ops-warden", + "type": "trust-root" + } + }, + "created_at": "2026-09-15T20:35:17+00:00", + "entries": [], + "id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7", + "required_count": 1, + "status": "requested", + "superseded_by": null, + "updated_at": "2026-09-15T20:35:17+00:00", + "validity": { + "expires_at": "2026-09-16T20:35:16.122938+00:00", + "not_before": "2026-09-15T20:35:16.122938+00:00" + } + } + }, + { + "memo_id": "infd-20260914-d01", + "approval": { + "binding": { + "action": "retire", + "actor": "informed-decision", + "digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15", + "human_control": true, + "pdp_digest": null, + "pdp_path": false, + "principal": "the-custodian", + "purpose": "After HA failover and restore drills pass, retire WSL2 as a State Hub fallback", + "target": { + "id": "cust-wp-0038-t08", + "system": "the-custodian", + "type": "operating-model" + } + }, + "created_at": "2026-09-15T20:35:17+00:00", + "entries": [], + "id": "9f7c3506-68de-4826-86ff-e301f428408d", + "required_count": 1, + "status": "requested", + "superseded_by": null, + "updated_at": "2026-09-15T20:35:17+00:00", + "validity": { + "expires_at": "2026-09-16T20:35:16.122938+00:00", + "not_before": "2026-09-15T20:35:16.122938+00:00" + } + } + }, + { + "memo_id": "infd-20260914-d02", + "approval": { + "binding": { + "action": "confirm", + "actor": "informed-decision", + "digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f", + "human_control": true, + "pdp_digest": null, + "pdp_path": false, + "principal": "helixforge-factory", + "purpose": "Confirm the existing operator-group claim for CCR-2026-0019 as required by the factory identity/audit/approval path", + "target": { + "id": "ccr-2026-0019", + "system": "helixforge-factory", + "type": "ccr" + } + }, + "created_at": "2026-09-15T20:35:17+00:00", + "entries": [], + "id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9", + "required_count": 1, + "status": "requested", + "superseded_by": null, + "updated_at": "2026-09-15T20:35:17+00:00", + "validity": { + "expires_at": "2026-09-16T20:35:16.122938+00:00", + "not_before": "2026-09-15T20:35:16.122938+00:00" + } + } + }, + { + "memo_id": "infd-20260914-d03", + "approval": { + "binding": { + "action": "accept", + "actor": "informed-decision", + "digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425", + "human_control": true, + "pdp_digest": null, + "pdp_path": false, + "principal": "mason", + "purpose": "Accept the fluid-telegram operator credential lane plan so construction may proceed", + "target": { + "id": "mason-wp-0005", + "system": "mason", + "type": "workplan" + } + }, + "created_at": "2026-09-15T20:35:17+00:00", + "entries": [], + "id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496", + "required_count": 1, + "status": "requested", + "superseded_by": null, + "updated_at": "2026-09-15T20:35:17+00:00", + "validity": { + "expires_at": "2026-09-16T20:35:16.122938+00:00", + "not_before": "2026-09-15T20:35:16.122938+00:00" + } + } + }, + { + "memo_id": "infd-20260914-d04", + "approval": { + "binding": { + "action": "confirm", + "actor": "informed-decision", + "digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4", + "human_control": true, + "pdp_digest": null, + "pdp_path": false, + "principal": "railiance-clock", + "purpose": "Confirm ecosystem ownership and the security role for Railiance Clock as specified", + "target": { + "id": "rclk-wp-0002-t01", + "system": "railiance-clock", + "type": "workplan" + } + }, + "created_at": "2026-09-15T20:35:17+00:00", + "entries": [], + "id": "356e67a3-5539-46a1-922a-f5591fd38ee5", + "required_count": 1, + "status": "requested", + "superseded_by": null, + "updated_at": "2026-09-15T20:35:17+00:00", + "validity": { + "expires_at": "2026-09-16T20:35:16.122938+00:00", + "not_before": "2026-09-15T20:35:16.122938+00:00" + } + } + } + ], + "credential_values_emitted": false, + "human_entries_created": false, + "skipped": [ + "infd-20260914-c01" + ] +} diff --git a/tests/test_create_sitting_approvals.py b/tests/test_create_sitting_approvals.py index 98b8de2..c6a49f3 100644 --- a/tests/test_create_sitting_approvals.py +++ b/tests/test_create_sitting_approvals.py @@ -1,4 +1,5 @@ import importlib.util +import json from pathlib import Path import pytest @@ -26,6 +27,32 @@ def test_require_attended_refuses_this_shell(): create.require_attended() +def test_created_receipt_has_seven_requested_and_no_entries(): + receipt = json.loads((Path(__file__).resolve().parents[1] / "docs" / "evidence" / "2026-09-15-sitting-approval-creates.json").read_text()) + assert receipt["status"] == "created" + assert receipt["human_entries_created"] is False + assert receipt["credential_values_emitted"] is False + assert len(receipt["requests"]) == 7 + assert receipt["skipped"] == ["infd-20260914-c01"] + for row in receipt["requests"]: + approval = row["approval"] + assert approval["status"] == "requested" + assert approval["entries"] == [] + assert approval["binding"]["human_control"] is True + assert approval["binding"]["digest"].startswith("sha256:") + + +def test_policy_package_pins_match_created_receipt(): + root = Path(__file__).resolve().parents[1] / "docs" / "batches" / "2026-09-14" + receipt = json.loads((Path(__file__).resolve().parents[1] / "docs" / "evidence" / "2026-09-15-sitting-approval-creates.json").read_text()) + package = (root / "policy-package.md").read_text() + assert "c01" not in package or "infd-20260914-c01" not in package + for row in receipt["requests"]: + assert f'memo:{row["memo_id"]}' in package + assert row["approval"]["id"] in package + assert row["approval"]["binding"]["digest"] in package + + def test_failed_receipt_does_not_block_retry(tmp_path, monkeypatch): receipt = tmp_path / "r.json" monkeypatch.setattr(create, "RECEIPT", receipt) diff --git a/tests/test_sitting_requester_registration.py b/tests/test_sitting_requester_registration.py index 279ec85..50777fd 100644 --- a/tests/test_sitting_requester_registration.py +++ b/tests/test_sitting_requester_registration.py @@ -26,7 +26,8 @@ def test_sitting_requester_is_create_only_and_applied(): def test_create_intents_cover_the_sitting_and_are_not_posted(): - assert INTENTS["posted"] is False + assert INTENTS["posted"] is True + assert INTENTS["status"] == "created-unapproved" assert INTENTS["human_control"] is True assert INTENTS["pdp_path"] is False ids = [row["memo_id"] for row in INTENTS["intents"]] diff --git a/tools/create_sitting_approvals.sh b/tools/create_sitting_approvals.sh index 39fdddc..e46d716 100755 --- a/tools/create_sitting_approvals.sh +++ b/tools/create_sitting_approvals.sh @@ -1,7 +1,8 @@ #!/usr/bin/env bash -# Attended child for openbao-attended-exec / warden access. Metadata only. +# Silent attended child. Outcome is the receipt file, not stdout. set -euo pipefail export INFD_APPROVAL_ORIGIN="${INFD_APPROVAL_ORIGIN:-http://127.0.0.1:18281}" exec /home/worsch/informed-decision/.venv/bin/python -B \ /home/worsch/informed-decision/tools/create_sitting_approvals.py \ - --approval-origin "$INFD_APPROVAL_ORIGIN" + --approval-origin "$INFD_APPROVAL_ORIGIN" \ + >/dev/null 2>&1 diff --git a/workplans/INFD-WP-0002-compact-signoff-batches.md b/workplans/INFD-WP-0002-compact-signoff-batches.md index 7168065..7288b73 100644 --- a/workplans/INFD-WP-0002-compact-signoff-batches.md +++ b/workplans/INFD-WP-0002-compact-signoff-batches.md @@ -166,6 +166,14 @@ child stays `prove-sitting-requester-exchange.sh`). Operator must export `WARDEN_ROUTING_CATALOG` and `BAO_ADDR=http://127.0.0.1:18200`. No POST from this shell. Task stays `wait`. +2026-09-15 20:35 UTC — **seven unapproved objects exist.** Attended create +wrote `docs/evidence/2026-09-15-sitting-approval-creates.json` +(`created` / `seven_unapproved_requests_created`, no entries). Warden +then failed closed on child stdout; wrapper is now silent. `c01` skipped. +Flex Auth draft `docs/batches/2026-09-14/policy-package.md` is not +admitted. Attach still needs the operator KeyCape `sub`. No human bind. +Task stays `wait`. + ## Feed outcomes back to State Hub without hub-authoring ```task