coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Wait within decision validity bounds and preserve failed preflight evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
tegwick 2026-09-14 03:46:28 +02:00
parent 1c9fd5279c
commit 5aaa49a2ec
7 changed files with 647 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/approval-consumption.md
View file

@ -199,3 +199,11 @@ The catalog CCR reference remains provenance; the native path does not demand a
second hub decision or local fixture with that CCR identifier. Unserved legacy
build/test paths retain their existing review gate. Claim, PDP, human-control,
stance, freshness and consume refusals still prevent backend access.
A future `not_before` is now awaited for at most two seconds before full decision
validation. Larger skew refuses. Expiry and claim freshness are checked afterward;
the consumer never shifts its validation clock or treats a future decision as
already valid. Native preflight exposed workstation clock drift; the existing
NTP service was restarted. All three owner-store/native-PDP diagnostic joins
passed afterward, without consuming approvals. Full regression suite: 420 passed.