From 1d4b7e84d7c037cfb11651d188b62a0ae1d7b1bd Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 4 Nov 2026 01:04:05 +0100 Subject: [PATCH] NK-WP-0056-T19: executor image re-pinned (rapp 3ddacfc); founder: no required_assurance at request Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 523928@bnt-lap001 Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350 --- .../2026-11-03-nk56-t19-approval-exercise/README.md | 13 ++++++------- workplans/NK-WP-0056-bounded-executor-path.md | 11 +++++++---- 2 files changed, 13 insertions(+), 11 deletions(-) diff --git a/docs/evidence/2026-11-03-nk56-t19-approval-exercise/README.md b/docs/evidence/2026-11-03-nk56-t19-approval-exercise/README.md index a72fb7f..abd97e6 100644 --- a/docs/evidence/2026-11-03-nk56-t19-approval-exercise/README.md +++ b/docs/evidence/2026-11-03-nk56-t19-approval-exercise/README.md @@ -59,10 +59,9 @@ refusals. ## Consequences -- **The pinned executor image needs rebuilding.** The image pinned in the rapp by T18 (`c67cb044`, `b90951a`) has the - defect. It must be rebuilt from `625ad65` or later and re-pinned before T06. -- **Open for the founder.** approval-engine accepts an aal1 human entry unless the approval declares - `required_assurance` (APPROVAL-WP-0007-T01). Today the executor is the only aal2 guard. The request phase could - declare `required_assurance: {"level": "aal2"}` so approval-engine also enforces the floor at approve and consume - time. That needs the deployed approval-engine to be at schema v7 or later, and a check that informed-decision's - present_existing accepts the field. +- **Image re-pinned (2026-11-04).** The image built for `66dc397`, `sha256:3aa2bcce…500d8a`, is pinned in the rapp + (`3ddacfc`). Its 7 executed files are byte-identical to the repo, and the `provider` test job passed. It replaces + T21's `e0b9bf6c`, which had the defect. +- **Founder decision (2026-11-04): no `required_assurance` at request.** approval-engine supports a level per + approval: no floor by default, with an optional `required_assurance` floor. This decision does not need + approval-engine to require aal2. The executor still enforces the admission's aal2 (BEA-C4). diff --git a/workplans/NK-WP-0056-bounded-executor-path.md b/workplans/NK-WP-0056-bounded-executor-path.md index 2b23724..872a26c 100644 --- a/workplans/NK-WP-0056-bounded-executor-path.md +++ b/workplans/NK-WP-0056-bounded-executor-path.md @@ -828,11 +828,14 @@ approving, and an aal1 entry. would have refused every real founder approval. Fixed in `625ad65` (`entry_is_aal2`). The request-phase tests no longer expire with the example window. -Follow-ups: +Follow-ups, both settled 2026-11-04: -- rebuild the executor image from `625ad65` and re-pin it in the rapp (T18's `c67cb044` has the defect); -- founder decision: should the request phase also declare `required_assurance: aal2`, so approval-engine enforces - the floor? +- **Image.** The image built for `66dc397` is `sha256:3aa2bcce…500d8a`. The `provider` job (executor tests) passed, + and the 7 executed files are byte-identical to the repo. It is pinned in the rapp (`3ddacfc`), replacing T21's + `e0b9bf6c`, which had the defect. +- **Founder decision: no `required_assurance` at request.** approval-engine's rigidity is per approval: no floor by + default, with an optional `required_assurance` level. This decision does not need approval-engine to require aal2. + The admission's own aal2 (BEA-C4) is still enforced by the executor. ## Executor audit sender