From 119910640fc0b390b76b5fb43941a402778a06bf Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 9 Oct 2026 19:21:56 +0200 Subject: [PATCH] USER-WP-0026-T03: record review of access-engine readback contract Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 629164@bnt-lap001 Assistant-Session: 22dee475-6a23-47f3-8588-00a7f62d8720 --- workplans/USER-WP-0026-account-recovery.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/workplans/USER-WP-0026-account-recovery.md b/workplans/USER-WP-0026-account-recovery.md index 3d52460..b4cf10e 100644 --- a/workplans/USER-WP-0026-account-recovery.md +++ b/workplans/USER-WP-0026-account-recovery.md @@ -87,6 +87,20 @@ access-engine. Ask filed for the decision/readback contract and a readable protected-system registry. If access-engine declines, return to net-kingdom for an orchestration workplan. +2026-10-09 (later): access-engine accepted the ask as FLEX-WP-0035 and sent +the draft contract `docs/application-access-readback.md` (9d9ca69, +FLEX-DEC-2026-019) for review. user-engine reviewed it and replied (hub message +f54df082). Shape accepted: dedicated readback pin, `purpose=readback` in the +hashed request, per-package `application.access`, no grant surface. Answers: +forward verified claims, in the same subject shape as `/v1/check`, plus +`subject.tenant`; informed-decision first; 64 per request is enough; reuse +each row until `expires_at`, per session and only on account-page views. +Requested: application.access rules may use only realm-level IAM Profile +claims, because the session claims carry user-engine's audience. Render +deny, not_applicable, failure and expired as not available, never as allow. +Use a separate `USER_ENGINE_READBACK_TOKEN_FILE`. Wait stays on access-engine +T02/T03 code and its T04 founder go. + ### Live recovery rollout — 2026-09-12 Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993