coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record flex-auth fail-closed coverage
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-18 10:53:41 +02:00
parent 4622b64061
commit 260029e2f6
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
workplans/USER-WP-0023-flex-auth-caller-identity.md
View file

@ -28,6 +28,14 @@ Read the audience-scoped caller token from a file per authorization decision,
fail closed on rotation/read errors, and cover token rotation. Completed
2026-08-18; the full suite passes 143 tests with three provider-gated skips.
2026-08-18 fail-closed coverage: the contract promised denial on a missing,
empty, or unreadable token file, but only rotation was proven. Conformance now
covers all three unusable-token cases and asserts the adapter never reaches
flex-auth without a usable credential, so an unauthenticated call cannot be
mistaken for an authorized one. A further test proves the token value appears
in neither the deny reason nor the decision repr. Suite: 148 tests, three
provider-gated skips.
```task
id: USER-WP-0023-T02
status: done