tegwick
ac66753bd4
Schema, validator, fixtures, declarations and tests (40 pass) now use the imported principal_type and authority grants MODE @ SCOPE with activation and environments, estate conventions bind and service-admin, unknown placeholders, and an elimination path on every exception. SI-4 and SI-7 became decidable. Before/after over the same declarations: 1/11/2/5/6 to 1/10/2/5/7 (non-conformant/unknown/excepted/planned/ conformant); the only move is KeyCape's secrets-engine-openbao client, whose scope is established. lldap/admin is now also excepted under SI-4. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 328925@bnt-lap001 Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
52 lines
1.1 KiB
JSON
52 lines
1.1 KiB
JSON
{
|
|
"schema_version": "0.1",
|
|
"service": "example",
|
|
"owner": "Example owners",
|
|
"declared_at": "2026-10-24",
|
|
"attestation": {
|
|
"authored_by": "fixture",
|
|
"basis": [
|
|
"fixture"
|
|
],
|
|
"owner_confirmed": true
|
|
},
|
|
"complete": true,
|
|
"identities": [
|
|
{
|
|
"name": "svc-example",
|
|
"purpose": "Lookup with hvs.ABCDEFGH12345678abcdef smuggled in",
|
|
"interactive_login": false,
|
|
"second_factor": "not_applicable",
|
|
"custody": [
|
|
"delivered-secret"
|
|
],
|
|
"consumers": [
|
|
{
|
|
"name": "example",
|
|
"kind": "service"
|
|
}
|
|
],
|
|
"owner": "Example owners",
|
|
"rotation": {
|
|
"path": "Rotate with the consumer",
|
|
"coupling": []
|
|
},
|
|
"status": "active",
|
|
"principal_type": "SERVICE",
|
|
"conventions": [
|
|
"bind"
|
|
],
|
|
"grants": [
|
|
{
|
|
"mode": "USE",
|
|
"scope": "directory",
|
|
"activation": "STANDING",
|
|
"environments": [
|
|
"PRODUCTION"
|
|
],
|
|
"read_only": true
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|