Implement authenticated alert receipt acknowledgments and audit delivery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e6f1-443f-7783-9920-a16b2ffc467f

integration/telemetry-policy.md

@@ -0,0 +1,71 @@
+---
+id: railiance-telemetry.alert-acknowledgment
+name: Railiance admin alert receipt acknowledgment
+namespace: railiance-telemetry:telemetry-alert
+version: v1
+status: ready
+package: flexauth.railiance_telemetry.alert_acknowledgment
+allow_ttl: 30s
+actions: [read, acknowledge]
+owner: flex-auth
+fixtures: [fixtures.json]
+caring:
+  profile: caring-0.4.0-rc2
+  enforce: false
+activation:
+  mode: local
+---
+
+# Requested telemetry admin mandate
+
+Bernd Worsch authorized the named Railiance admin role and receipt actions on
+September 28 under RTEL-WP-0002-T04. Native service caller admission and directory
+membership remain required. This policy permits no alert silencing, resolution,
+configuration change or unrelated estate operation. The caller must validate
+the signed KeyCape session and supply its unchanged identity/assurance facts.
+
+```rego
+import rego.v1
+
+decision := {"effect": "allow", "reason": "railiance_admin_alert_receipt"} if {
+  input.tenant == "tenant:platform"
+  input.subject.type == "human"
+  input.subject.tenant == "tenant:platform"
+  is_string(input.subject.id)
+  input.subject.id != ""
+  input.subject.id == "uid=tegwick,ou=people,dc=netkingdom,dc=local"
+  "railiance-admin" in input.subject.attributes.roles
+  authentication := input.context.authentication
+  authentication.issuer == "https://kc.coulomb.social"
+  authentication.principal_type_source == "authentication-derived"
+  authentication.tenant_source == "directory-asserted"
+  "railiance-admin" in authentication.roles
+  "railiance-admins" in authentication.groups
+  assurance := authentication.assurance
+  assurance.level == "aal2"
+  assurance.mfa == true
+  assurance.source == "key-cape"
+  assurance.methods == ["pwd", "otp"]
+  is_number(assurance.at)
+  age := time.now_ns() / 1000000000 - assurance.at
+  age >= -30
+  age <= 900
+  input.resource.system == "railiance-telemetry"
+  input.resource.type == "telemetry-alert"
+  input.resource.tenant == "tenant:platform"
+  regex.match("^alert:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", input.resource.id)
+  input.action in {"read", "acknowledge"}
+} else := {"effect": "deny", "reason": "telemetry_identity_or_scope_refused"} if {
+  true
+}
+```
+
+```rego test
+package flexauth.railiance_telemetry.alert_acknowledgment_test
+import rego.v1
+import data.flexauth.railiance_telemetry.alert_acknowledgment
+
+test_unknown_request_denied if {
+  alert_acknowledgment.decision.effect == "deny" with input as {}
+}
+```