coulomb/ops-warden
4
0
Fork 0
Code Issues Pull requests Projects Releases 2 Packages Wiki Activity Actions

Record GH-DEC-2026-015's narrow R3 permission on the approval page

Browse source 
A correction that only matters when someone finally wires the consume belongs on
the page, not in the thread that delivered it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703
This commit is contained in:
tegwick 2026-09-21 02:21:31 +02:00
parent b4c8be8648
commit 284bfd6521
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
wiki/ApprovalConsumption.md
View file

@ -23,6 +23,14 @@ v0.8 §6.4 obligation 5 hardened this: each artifact **must** be validated again
the layer that owns its data, and a PIP **must not** republish the PDP's decision.
Neither artifact may be taken from the other.
**One narrow exception now exists (`GH-DEC-2026-015`, 2026-09-10).** It revised
`GH-DEC-2026-012`'s R3 to permit nesting a binding digest inside a presentation
hash **for one specific pair, conditioned**. It does not reach this lane and
requires nothing here. It is recorded on this page for one reason: if a composed
artifact ever appears on the approval path, read it as a permission that may
exist rather than as a violation of the rule above — and then go and check which
pair the permission covers, because it is not general.
## Three things that are easy to get wrong
**1. Do not require `provenance.authority == 'state-hub'`.**