tegwick
63d646b594
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 44s
GH-DEC-2026-013 §5 is a finding nobody asked for and ours to implement: tenant is
a bare string, so a consumer cannot tell a zone the directory asserted about the
person from one a registration supplied about the client they came through.
approval-engine exact-matches that string while its contract reads as though it
relies on the first -- the check is sound and the property a reader infers from
it is absent. gate-house named the property and left the mechanism to us.
Every token now carries tenant_source beside tenant: directory, registration or
default. Advertised in claims_supported, and asserted at the token level on both
grants rather than only in the resolution function, since the claim a consumer
reads is the thing under obligation.
Three values where the ruling names two, which is the judgement here. Labelling
an unasserted profile default as directory would reproduce the same defect one
level down -- a consumer reading an assertion the identity layer never made. The
ruling cites GH-DEC-2026-011 §3 on unknown versus absent for the case it
examined; the same rule applies to our own fallback. The agreement case resolves
to directory deliberately: if a registration declares the zone the directory also
assigned, the directory did assert it, and reporting the weaker source would
understate what is known.
Also corrects the guard shipped in
|
||
|---|---|---|
| .. | ||
| adr | ||
| evidence | ||
| approval-clients-deployment.patch.yaml | ||
| approval-clients-rollout.md | ||
| approval-engine-auth-contract.md | ||
| approval-engine-provisioning-request.yaml | ||
| authorization-code-bindings.md | ||
| native-authentication.md | ||
| openbao-service-auth-contract.md | ||
| operations.md | ||
| qonto-runtime-identity-contract.md | ||
| tenant-claim-contract.md | ||
| upstream-issuer-proof.md | ||