65 lines
4.2 KiB
Markdown
65 lines
4.2 KiB
Markdown
# Approval exact-consume source provenance
|
|
|
|
Prepared by the approval-engine worker, with its AGENTS.md and INTENT.md loaded,
|
|
in `/tmp/netkingdom-approval-reference-20261016`. Canonical owner source remained
|
|
unchanged and clean at `9491d1d3a7b6554fa04f8dc06f65d50e3d6ee4e1`.
|
|
This is source preparation and owner technical judgement, not a formal delegated
|
|
review, native approval or independently accepted deployment. The new owner work
|
|
record must be integrated before a formal review is recorded.
|
|
|
|
The existing authoritative consume CAS, durable transactional outbox,
|
|
ExecutionConfirmationClient and hardened fixed-origin transport already supply
|
|
the factual consumer boundary. A signed portable consume receipt is absent,
|
|
but adding another signer/service is unnecessary for the independently
|
|
authenticated mediator. The reachable source gap was discarded consume caller
|
|
identity and insufficient standalone act/PDP correspondence in the use event.
|
|
|
|
The patch passes HTTP-verified Identity to consume and atomically retains bounded
|
|
consumer metadata, native binding, PDP digest/path alongside existing full
|
|
request/decision and threshold evidence. Top-level actor remains the approved
|
|
initiator. Caller JSON cannot replace verified consumer provenance. Internal
|
|
calls retain null, retries preserve the first event, and historical rows remain
|
|
unchanged. Existing response/claim fields and schema version are unchanged.
|
|
INTENT basis: authenticated consumable object, exact binding and local atomic
|
|
evidence. It supplies facts and creates no new permission decision.
|
|
|
|
`implementation.patch`, `manifest.json`, `validation.json` and `patch-check.json`
|
|
pin the exact deliverable. Patch SHA256:
|
|
`a6bf77fa8b6916f423db7832f475e38747b828dd632a88f9631131e28e3230ee`.
|
|
44 focused tests passed. Full suite: 277 passed and one failed deployment-evidence
|
|
image pin check; the identical failure was reproduced on an untouched baseline.
|
|
Historical release/native evidence was preserved. No real token, approval,
|
|
OpenBao, native side effect, deployment or migration was used.
|
|
|
|
The scoped demand from CUST-WP-0080 is reconciled into WP0002 without promoting
|
|
all residuals. New WP0004 tracks the bounded source delivery and pending canonical
|
|
review/integration. The coordinator handles canonical sync after independent
|
|
review. Hub progress logging has its request/receipt here; no new workplan was
|
|
registered from the temporary checkout.
|
|
|
|
Native acceptance requires the existing owner interfaces:
|
|
|
|
- Approval T01: exact KeyCape issuer/audience/scope/tenant provenance receipt and
|
|
human-authorized release/migration with native verified entry/readback. Current
|
|
source identity tests do not prove issuer admission or deployment.
|
|
- Approval T04 / Audit: admit the refined source payload, drain actual lifecycle
|
|
rows and independently read receiver event ID/content; reconcile counts,
|
|
duplicate/lag/boundary handling, silence and scoped bearer revocation. Existing
|
|
local atomicity cannot prove omission resistance under source compromise.
|
|
- Approval T05 / Platform / Secrets: name actual served PEP revision/route and
|
|
actual independently authenticated read/consume client; establish trusted server
|
|
transport/custody/ingress. Validate fresh exact claim and signed Access decision,
|
|
approved native act, approval-free/full request bindings and immutable operation
|
|
plan before CAS. Preserve live one-shot journal admission, deadlines, unknown
|
|
outcomes, independently confirmed cleanup and approved recovery.
|
|
- Secrets and Access retain strict downstream consumption correspondence,
|
|
published policy/action/initiating-principal representation admission and
|
|
producer-compatible signed-decision trust. The outbox row does not validate
|
|
that a supplied decision ID exists or authorize a protected operation.
|
|
|
|
The native proof must bind exact source/image/config, identity, operation/body,
|
|
CAS evidence, actual protected effect, event/source/receiver correspondence and
|
|
cleanup. Wrong actor/tenant/body/decision, expiry, replay, unavailability and
|
|
consume-before-effect failure are required refusals. Fixture success is never
|
|
reported as native acceptance. The existing deployment pin/evidence discrepancy
|
|
must be reconciled by its owner from real release evidence before rollout.
|