tegwick
da2c5a720f
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
33 lines
3.1 KiB
Markdown
33 lines
3.1 KiB
Markdown
# Lifecycle admission and evidence boundary
|
|
|
|
2026-10-05; INFD-WP-0007-T02. This closes the implementation choices for the
|
|
initial production audience. Expansion is tracked separately; these limits are
|
|
observable behavior, not an implied grant to extend another owner's interface.
|
|
|
|
| Concern | Implemented contract |
|
|
| --- | --- |
|
|
| Human identity | KeyCape-authenticated net-kingdom-admins, tenant:platform; twelve-hour MFA authoring/list window, fifteen-minute review/read/act window |
|
|
| Agent identity | Kubernetes TokenReview for the registered State Hub service account with a separate lifecycle audience; unknown and external bearer identities refused |
|
|
| Publication | Explicit subject/group audience on an exact revision, authorized by Access Engine; not anonymous or indexed publicly; successor revisions require republication |
|
|
| Research | Caller retrieves evidence externally and submits reference, retrieval time, digest and summary; the service does not fetch URLs or attest their truth |
|
|
| Evaluation | Attributed assessment, uncertainty and source-event references constrained to the same record/revision/tenant |
|
|
| Retention | Append-only revisions, sources, comments, evaluations and binding evidence in the durable store; no automatic purge, mutable source replacement or source connector credentials |
|
|
| Documents | Digest-verified bytes supplied through the bounded API; the browser adds short text documents with optional required acknowledgments as new revisions |
|
|
| Review | Organizational English approval profile using the existing shared schema and native Approval Engine; recipient from the configured review group, initially platform-root |
|
|
| Discovery | Lifecycle workspace uses per-record lifecycle policy. Review overview uses its own list decision; attribute discovery requires the immutable named recipient plus verified native requester, human-control flag and digest |
|
|
| Human acceptance | Existing protected review surface, fresh policy/read/act decisions, exact revision/presentation and required acknowledgments; no agent binding route |
|
|
| Non-approval profiles | Discussion drafts may be authored and refined, but cannot create an approval review. L0/L2 core schema compatibility does not enable new production disposition profiles |
|
|
| Hub write-back | Notification/dispatcher delivery is admitted; optional automatic resolution write-back remains disabled and cannot imply permission to execute |
|
|
|
|
Identity verification stays in KeyCape/TokenReview; authorization stays in Access
|
|
Engine. The headless application service is shared by browser and private API.
|
|
Client-supplied research descriptions and evaluation conclusions remain claims
|
|
with attribution, not machine-verified facts. Packet bytes are retained so an
|
|
external URL changing cannot alter a past presentation.
|
|
|
|
No finite retention duration, deletion mechanism, new connector, external agent
|
|
identity or non-approval signing semantics is invented here. Those product
|
|
extensions require their own owner contracts and delivery evidence under
|
|
INFD-WP-0008. The existing source/evaluation and organizational approval workflows
|
|
provide all nine initial lifecycle operations without per-decision infrastructure
|
|
changes.
|