Record seven created sitting approvals; silence attended stdout.
Warden failed closed on leftover JSON after a successful create. Objects are requested, no entries. Flex Auth package draft pins the seven ids; c01 skipped. No human bind. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
This commit is contained in:
parent
a911eaf816
commit
ca563504c4
9 changed files with 360 additions and 25 deletions
|
|
@ -1,8 +1,9 @@
|
|||
{
|
||||
"kind": "informed-decision-approval-create-intents",
|
||||
"sitting_id": "infd-sitting-2026-09-14",
|
||||
"status": "draft-not-posted",
|
||||
"posted": false,
|
||||
"status": "created-unapproved",
|
||||
"posted": true,
|
||||
"receipt": "docs/evidence/2026-09-15-sitting-approval-creates.json",
|
||||
"requester_client": "informed-decision-sitting-requester",
|
||||
"human_control": true,
|
||||
"pdp_path": false,
|
||||
|
|
|
|||
73
docs/batches/2026-09-14/policy-package.md
Normal file
73
docs/batches/2026-09-14/policy-package.md
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
# Flex Auth package draft — compact sitting (seven records)
|
||||
|
||||
**Not admitted. Not served. Not an expansion of FLEX-WP-0027.**
|
||||
Owner: flex-auth. Source pins: `docs/evidence/2026-09-15-sitting-approval-creates.json`.
|
||||
`c01` is absent (create-client still undecided).
|
||||
|
||||
Same identity bar as `examples/informed-decision-t03`. Deny every other
|
||||
resource id. No consume.
|
||||
|
||||
```rego
|
||||
import rego.v1
|
||||
|
||||
records := {
|
||||
"memo:infd-20260914-c02": {
|
||||
"approval_id": "ccfd8007-2061-48fd-9356-99b16279dac1",
|
||||
"binding_digest": "sha256:942cf7d5e6805987df2077a0cc6cde75b148e1729a96dd0692153287820b6a0a"
|
||||
},
|
||||
"memo:infd-20260914-c03": {
|
||||
"approval_id": "a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f",
|
||||
"binding_digest": "sha256:95cae135b994acea6dad9da978dd3df1aa3354de900a1f43c2e5a03a20e8e844"
|
||||
},
|
||||
"memo:infd-20260914-c04": {
|
||||
"approval_id": "22ac6df3-e6a9-472b-a68e-c8caca4289a7",
|
||||
"binding_digest": "sha256:dec960b30efaf654abbdcd8a2cdd20d4ff6bf52e170744f817dc55845d9cb192"
|
||||
},
|
||||
"memo:infd-20260914-d01": {
|
||||
"approval_id": "9f7c3506-68de-4826-86ff-e301f428408d",
|
||||
"binding_digest": "sha256:8cb7cc93f38db9d19b49e201e0554b50af1891fec853fef333a06ea078541d15"
|
||||
},
|
||||
"memo:infd-20260914-d02": {
|
||||
"approval_id": "b3ce2c01-0a3b-401e-b4ed-c1954af169c9",
|
||||
"binding_digest": "sha256:be0c7de123216740d2c2eeaed80384e03e6b6d1668104f94bb8f9cbae7dfe30f"
|
||||
},
|
||||
"memo:infd-20260914-d03": {
|
||||
"approval_id": "3b483e6b-0b92-45ff-83b6-bc5057c0a496",
|
||||
"binding_digest": "sha256:3c562278e86bb5e7f747452cf2e99d3a136853ab748676e8359262b835cd1425"
|
||||
},
|
||||
"memo:infd-20260914-d04": {
|
||||
"approval_id": "356e67a3-5539-46a1-922a-f5591fd38ee5",
|
||||
"binding_digest": "sha256:3c2d7759679d871cb7c5cac8999542a365e64c918d59d0c4ce864ffb837453e4"
|
||||
}
|
||||
}
|
||||
|
||||
decision := {"effect": "allow", "reason": "operator_admitted_compact_sitting"} if {
|
||||
input.tenant == "tenant:platform"
|
||||
input.subject.tenant == "tenant:platform"
|
||||
input.subject.type == "human"
|
||||
is_string(input.subject.id)
|
||||
input.subject.id != ""
|
||||
input.subject.attributes.principal_type_source == "authentication-derived"
|
||||
input.subject.attributes.tenant_source in {"registration-supplied", "directory-asserted"}
|
||||
"net-kingdom-admins" in input.subject.attributes.groups
|
||||
assurance := input.subject.attributes.assurance
|
||||
assurance.level == "aal2"
|
||||
assurance.mfa == true
|
||||
assurance.source == "key-cape"
|
||||
assurance.methods == ["pwd", "otp"]
|
||||
is_number(assurance.at)
|
||||
age := time.now_ns() / 1000000000 - assurance.at
|
||||
age >= -30
|
||||
age <= 900
|
||||
input.resource.tenant == "tenant:platform"
|
||||
input.resource.system == "informed-decision"
|
||||
input.resource.type == "decision-memo"
|
||||
record := records[input.resource.id]
|
||||
input.context.memo_version == 1
|
||||
input.context.approval_id == record.approval_id
|
||||
input.context.approval_binding_digest == record.binding_digest
|
||||
input.action in {"read", "acknowledge", "accept", "return", "discuss", "decline"}
|
||||
} else := {"effect": "deny", "reason": "compact_sitting_scope_or_identity_refused"} if {
|
||||
true
|
||||
}
|
||||
```
|
||||
|
|
@ -3,10 +3,8 @@
|
|||
Not admitted. Not a local allow. Not an expansion of the T03 three-record
|
||||
mandate (`FLEX-WP-0027`, `examples/informed-decision-t03`).
|
||||
|
||||
`net-kingdom-admins` may review these eight Decision Memos **only after**
|
||||
the operator admits a new package that pins exact `memo_id`, `approval_id`
|
||||
and native `binding.digest`. Until those approval objects exist, this file
|
||||
is a request shape, not a compilable package.
|
||||
Native objects exist for seven memos (2026-09-15T20:35Z). Compilable draft:
|
||||
`policy-package.md`. `c01` is still omitted.
|
||||
|
||||
## Intended allow (same identity bar as T03)
|
||||
|
||||
|
|
@ -17,21 +15,18 @@ is a request shape, not a compilable package.
|
|||
- deny every other resource id
|
||||
- no consume, no approval create, no presentation claim as policy input
|
||||
|
||||
## Exact resource ids (approval ids still unknown)
|
||||
## Exact pins (from sitting-create receipt)
|
||||
|
||||
| resource.id | Blocking record |
|
||||
| --- | --- |
|
||||
| `memo:infd-20260914-c01` | SECRETS-WP-0010 native delivery |
|
||||
| `memo:infd-20260914-c02` | RPF-WP-0035-T02 |
|
||||
| `memo:infd-20260914-c03` | NK-WP-0032-T03 |
|
||||
| `memo:infd-20260914-c04` | WARDEN-WP-0027-T02 |
|
||||
| `memo:infd-20260914-d01` | CUST-WP-0038-T08 |
|
||||
| `memo:infd-20260914-d02` | HFACT-WP-0001-T03 |
|
||||
| `memo:infd-20260914-d03` | MASON-WP-0005 plan |
|
||||
| `memo:infd-20260914-d04` | RCLK-WP-0002-T01 |
|
||||
| resource.id | approval_id | Blocking record |
|
||||
| --- | --- | --- |
|
||||
| `memo:infd-20260914-c02` | `ccfd8007-2061-48fd-9356-99b16279dac1` | RPF-WP-0035-T02 |
|
||||
| `memo:infd-20260914-c03` | `a0611d0d-b9ef-4b9a-aa79-e94a9e3fcd5f` | NK-WP-0032-T03 |
|
||||
| `memo:infd-20260914-c04` | `22ac6df3-e6a9-472b-a68e-c8caca4289a7` | WARDEN-WP-0027-T02 |
|
||||
| `memo:infd-20260914-d01` | `9f7c3506-68de-4826-86ff-e301f428408d` | CUST-WP-0038-T08 |
|
||||
| `memo:infd-20260914-d02` | `b3ce2c01-0a3b-401e-b4ed-c1954af169c9` | HFACT-WP-0001-T03 |
|
||||
| `memo:infd-20260914-d03` | `3b483e6b-0b92-45ff-83b6-bc5057c0a496` | MASON-WP-0005 plan |
|
||||
| `memo:infd-20260914-d04` | `356e67a3-5539-46a1-922a-f5591fd38ee5` | RCLK-WP-0002-T01 |
|
||||
|
||||
Do not copy T03 approval ids into this table. Do not serve this list as
|
||||
policy until a created-receipt supplies `approval_id` and `binding.digest`
|
||||
for every row.
|
||||
`memo:infd-20260914-c01` is not in this package.
|
||||
|
||||
Owner: flex-auth. This repository drafts; it does not evaluate authorization.
|
||||
|
|
|
|||
|
|
@ -8,6 +8,6 @@
|
|||
"infd-batch-2026-09-14-decisions"
|
||||
],
|
||||
"memo_count": 8,
|
||||
"bind_path": "live accept open; sitting-requester live; attended create not yet run",
|
||||
"note": "Unsigned drafts. CCR-2026-0026/0027 applied and create-only exchange proof verified 2026-09-15. Next: attended tools/create_sitting_approvals.py (skips c01), then Flex Auth package, then human sitting."
|
||||
"bind_path": "seven native objects requested 2026-09-15T20:35Z; human bind and Flex Auth admission remaining",
|
||||
"note": "Create succeeded. Warden then failed closed on child stdout (now silenced). c01 skipped. No human entries. Next: flex-auth admits policy-package.md, attach live KeyCape sub, load store, sit."
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue