coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Point identity and evidence mappings to current canon owners
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 33s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a070b5-4994-7271-bd8b-7c3dbcedec4b
This commit is contained in:
tegwick 2026-09-06 01:39:09 +02:00
parent c431915d56
commit b9ae48b00c
9 changed files with 86 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

17
docs/canon-interface-card.yaml
View file

@ -7,7 +7,7 @@ owner: codex
updated: "2026-08-19"
implements:
- identity-canon conceptual model as an implementation-facing domain facade
- InfoTechCanon identity/organization/access models as implementation-facing mappings
- InfoTechCanon user-engine evaluation pack
- small-saas user-management alignment surface
@ -35,7 +35,7 @@ consumes:
- platform audit and event sinks
owned_concepts:
user_record: User-engine local user record mapped to identity-canon User as a convenience term.
user_record: User-engine local user record mapped to InfoTechCanon User as a convenience term.
account_record: Operational account state for a user-engine scope.
external_identity_link: Source-specific issuer and subject link to a user record.
profile_value: Scoped profile or preference value.
@ -86,7 +86,7 @@ required_identifiers:
correlation_id: "operation-level audit and event correlation id"
mapping_rules:
- Resolve source terms such as user, group, role, tenant, subject, and principal into identity-canon layers before exposing them as implementation concepts.
- Resolve source terms such as user, group, role, tenant, subject, and principal into InfoTechCanon identity, organization and access layers before exposing them as implementation concepts.
- Keep account records, authenticated subjects, and authorization principals distinct even when they share issuer or subject identifiers.
- Treat memberships as relationship facts that may produce grant-like access facts, not as final authorization decisions.
- Preserve source system, scope, lifecycle state, and evidence reference whenever a relationship affects access, privacy, or lifecycle.
@ -113,7 +113,16 @@ source_of_truth:
organization_authority: NetKingdom organization or directory systems
known_deviations:
- User remains a local implementation class even though identity-canon treats user as a non-root convenience term; mappings must state whether it represents actor-facing profile holder, account owner, or local user record.
- User remains a local implementation class even though InfoTechCanon treats user as a non-root convenience term; mappings must state whether it represents actor-facing profile holder, account owner, or local user record.
- Access Grant is currently a grant-like reference derived from memberships, not a durable authorization grant table.
- Evidence Source references currently derive from local audit records unless an external evidence exporter is supplied.
- AccessReview, Policy, Control, Exception, and lifecycle Task are references or gaps, not first-class owned records.
federation_reference_review:
date: "2026-09-06"
project_task: CFED-WP-0001-T09
mapping: docs/canon-mapping.md
canon_interfaces:
- info-tech-canon/infospace/interfaces/federation.yaml
- commerce-canon/infospace/interfaces/federation.yaml
disposition: Source references updated; runtime contracts and candidate conformance status unchanged.