coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

USER-WP-0026-T03: record review of access-engine readback contract
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 629164@bnt-lap001
Assistant-Session: 22dee475-6a23-47f3-8588-00a7f62d8720
This commit is contained in:
tegwick 2026-10-09 19:21:56 +02:00
parent a10e596d82
commit 119910640f
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
workplans/USER-WP-0026-account-recovery.md
View file

@ -87,6 +87,20 @@ access-engine. Ask filed for the decision/readback contract and a readable
protected-system registry. If access-engine declines, return to net-kingdom
for an orchestration workplan.
2026-10-09 (later): access-engine accepted the ask as FLEX-WP-0035 and sent
the draft contract `docs/application-access-readback.md` (9d9ca69,
FLEX-DEC-2026-019) for review. user-engine reviewed it and replied (hub message
f54df082). Shape accepted: dedicated readback pin, `purpose=readback` in the
hashed request, per-package `application.access`, no grant surface. Answers:
forward verified claims, in the same subject shape as `/v1/check`, plus
`subject.tenant`; informed-decision first; 64 per request is enough; reuse
each row until `expires_at`, per session and only on account-page views.
Requested: application.access rules may use only realm-level IAM Profile
claims, because the session claims carry user-engine's audience. Render
deny, not_applicable, failure and expired as not available, never as allow.
Use a separate `USER_ENGINE_READBACK_TOKEN_FILE`. Wait stays on access-engine
T02/T03 code and its T04 founder go.
### Live recovery rollout — 2026-09-12
Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993