fix: bind approval consumption to actual Flex Auth submissions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-09 08:55:46 +02:00
parent 89bc31460f
commit ee4e901611
23 changed files with 612 additions and 1023 deletions

View file

@ -186,3 +186,13 @@ Owner-return clarification: SECRETS-WP-0008-T02 is now progress for the publishe
FLEX-DEC-2026-012 submitted-request replay identity and approval-digest join.
The real-component identity exercise used a PDP double and does not close that
local implementation. T03 also consumes that correction before live activation.
## Replay-contract return — 2026-09-09
SECRETS-WP-0008-T02 supplies the implemented FLEX-DEC-2026-012 consumer join.
334 tests and 13 real local KeyCape/Approval Engine/Flex Auth checks pass;
receipt: docs/evidence/2026-09-09-replay-contract-exercise.json. The former PDP
double limitation is resolved for component conformance. T03 remains wait for
current deployed PDP adoption, separately admitted client-side/audit custody,
actual Approval Engine deployment, and the scoped native OpenBao delivery proof.