Record verified one-application catalogue exception and remaining acceptance
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
This commit is contained in:
parent
5d80644efa
commit
cd8909154c
13 changed files with 446 additions and 5 deletions
|
|
@ -0,0 +1,53 @@
|
|||
# Native one-app catalogue acceptance — 2026-10-11
|
||||
|
||||
The founder confirmed native R1 acceptance b859698b-5d08-4da5-9599-4760c6a799f1 at
|
||||
2026-10-11T02:07:09Z. Under that exact standalone maintenance exception, root
|
||||
executed the approved dry-run and apply on Ready f239 pod
|
||||
e500bcae-c911-43a2-bd40-6a30b39064ab. Apply committed the exact two records,
|
||||
retained a genuine ordinary PDP denial and truthfully attributed maintenance
|
||||
without inventing human claims or a PDP allow. The original exception remains
|
||||
one trial; this evidence is not another approval or scored autonomous success.
|
||||
|
||||
Independent read-only verification at 02:10:37Z reports exact two rows, one
|
||||
consumed digest-bound ledger, three maintenance SERVICE-attributed audits with
|
||||
the genuine ordinary-denial link, and one attributed application.registered
|
||||
event. Ordinary application.register still returns an identified deny. Actual
|
||||
Access system/client/issuer binding joins the exact User Engine records; fresh
|
||||
native KeyCape rejects the known client unregistered redirect with HTTP400.
|
||||
The real installed account reader sees one actual bound workload and denies
|
||||
the truthful maintenance SERVICE without inferring permission. Actual HTTPS
|
||||
entry ownership is retained in the accepted human packet, not inserted into a
|
||||
DTO that has no entry URL field.
|
||||
|
||||
Native labelled policy fixtures independently pass allow/deny, stale MFA deny,
|
||||
30-second TTL, expired answer, unavailable transport and tenant cache checks.
|
||||
These fixtures are advisory policy inputs, not a real human session or MFA
|
||||
proof. The SERVICE account-reader projection likewise does not verify a
|
||||
signed-in human account page. USER-WP-0026-T03 and USER-WP-0028-T02 remain wait
|
||||
for their actual supported scoped grant/revocation and human account projection
|
||||
acceptance. USER-WP-0028-T03 real OTP journeys remain separately open.
|
||||
|
||||
Event evt_7690c83144a0469891598dee5c1d38e1 was unclaimed, undelivered, not failed
|
||||
and not dead-lettered at verification, with zero delivery attempts. Its ID
|
||||
digest matches the retained event list and consumed ledger. No consumer
|
||||
receipt is verified and no delivery or replay was requested. Already-authorized
|
||||
ordinary delivery may later change status; observe it and never infer receiver
|
||||
custody from a local delivered bit. Recovery remains the accepted original
|
||||
grant only before expiry, exact created rows and no dependencies, under the
|
||||
matching delivery lock, refusing missing/claimed/delivered events. Dead-letter
|
||||
excludes automatic drain only; later targeted delivery/replay needs separate
|
||||
owner reconciliation and authority. Preserve audit/ledger/event history.
|
||||
|
||||
Ordinary authenticated catalogue-management admission must be established and
|
||||
verified before customer production. Its owner follow-up remains on the live
|
||||
existing USER-WP-0026-T03 (reused by USER-WP-0028-T02); no duplicate intake or
|
||||
workplan is created. Root activates the one conditional security-close-down
|
||||
row with this exact exception and evidence. A private grant and transient
|
||||
inputs are not copied here; hashes only are retained. Root records cleanup
|
||||
separately, so this worker does not infer a cleanup outcome.
|
||||
|
||||
These are receipts of root-executed native actions. The independent User Engine
|
||||
worker authored and statically checked the verifier and then reviewed root's
|
||||
returned receipts; it performed no native commands, credential reads or replay.
|
||||
Original16/21 PostgreSQL checks, failed initial5 assertions and transport guard
|
||||
proofs remain unchanged in the accepted human packet and owner review evidence.
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
# User Engine owner verification criteria — source preparation only
|
||||
|
||||
Reviewed authority context: native founder accept b859698b-5d08-4da5-9599-4760c6a799f1 at 2026-10-11T02:07:09Z, separate R1 memo; source helper itself performs nothing. Root must preserve source/transport/pod/image hashes and runtime package equality from the exact accepted human packet.
|
||||
|
||||
`verify_catalogue_readonly.py` expects metadata-only JSON with precisely grant_sha256, approval_receipt_sha256 and operator_id from the actual original private grant/native receipt. None is a secret value. Do not print or pass runtime DB/token values. Its CLI consumes metadata stdin; if transmitting source on stdin to `python3 -`, use a supervisor wrapper that compiles this source with non-main module name and calls verify(metadata) under whole-output suppression. Capture only returned fixed JSON and suppress raw exception/driver/provider output. Freeze the same Ready pod/image and verify helper hash before execution. No service mutation method is called.
|
||||
|
||||
The DB snapshot uses REPEATABLE READ READ ONLY and always ROLLBACK. Expected ledger/audits/events are restricted to maintenance:b859...; exact application and binding are decoded with installed owner codecs. No full audit scan, raw payload output, credentials exported, event delivery/replay, or native principal creation occurs. The ordinary current application.register check is a genuine SERVICE request and records only whether the result is an identified deny. Provider may retain decision telemetry; read-only describes local persistence, not globally zero telemetry.
|
||||
|
||||
An actual three-way catalogue requires (1) exact User Engine two records, (2) actual protected-system/client/issuer binding and enabled readback from admitted Access registry, and (3) independent fresh native KeyCape proof of this registered OIDC client. The separate `keycape_client_presence_readonly.py` repeats the existing known-client/wrong-redirect check without login, cookies or response dumps. Its native redirect_uri error supports registered client presence, not MFA or redirect allow-list completeness. Retain separate existing actual HTTPS ingress/entry URL ownership evidence; the DTO has no URL field and none is invented here.
|
||||
|
||||
The helper invokes the installed account-facing ApplicationAccessReader on the real DB facts and real provider registry. Its request subject is the actual maintenance SERVICE with no roles/groups/scopes/assurance/human login claim. It must display one unavailable/denied row and no inferred allow. This proves actual catalogue joining and safe advisory projection for that service context. It does not prove a real signed-in human account page or an allow/MFA outcome. Previously approved labelled synthetic-policy probes may remain supplementary, but cannot be relabelled real-user evidence.
|
||||
|
||||
`created_metadata_evidence_passed` is true only for a created case with exact 2 rows, one consumed digest-bound ledger, three correctly attributed audits including genuine ordinary denial, one corresponding attributed registered event, no rollback ledger, unchanged ordinary deny, provider binding/readback and one safe account-reader row. Exact no-change admission has no original denial/registration event or undo authority; this verifier intentionally does not claim created proof for it. Record those cases separately using the original executor's semantics.
|
||||
|
||||
Event state is reported by counts only. Already claimed/delivered events prohibit automatic rollback and require owner reconciliation; delivered metadata is not proof of receiver custody. Dead-letter excludes automatic drain only. Neither verification nor accepted maintenance authority authorizes targeted outbox delivery/replay. Event receipt and full consumer inventory stay explicit gaps if unavailable.
|
||||
|
||||
## USER-WP-0026-T03
|
||||
|
||||
After successful created metadata proof, fresh KeyCape check and existing actual entry URL evidence, record the concrete one-app catalogue/admitted-readback integration milestone as achieved. Task text asks current access decisions for a signed-in identity, allow/deny/unavailable separation and registered HTTPS entry points; it also retains broader supported scoped grant/revocation acceptance. This SERVICE projection alone cannot close the task. Closure requires independently evidenced actual signed-in account-page projection and owner-supported scope/action/tenant contract, applicable grant/revocation acceptance or an explicit governed scope split into live residual records before finishing. Preserve absent-provider/stale/expiry/cache/fail-closed evidence and do not infer user access from app creation or memberships. If that evidence is not already present, keep T03 open with the remaining exact boundary, while removing the missing-catalogue blocker.
|
||||
|
||||
## USER-WP-0028-T02
|
||||
|
||||
U09/T05 explicitly includes supported scoped grants/revocation, not solely a catalogue row or advisory policy evaluation. It cannot be marked done from this helper; actual owner-supported grant/revocation semantics and resulting authoritative access/readback/UI acceptance are still needed. A scope split requires explicit governance and live handoff records; no prose-only residual. Reuse T03 integration evidence and avoid duplicate implementation.
|
||||
|
||||
The real human MFA journey U05-U08 belongs to USER-WP-0028-T03 and related human tasks. It remains open regardless of catalogue success. Catalogue acceptance must not accidentally inherit this separate MFA gate, and must not falsely satisfy it. Root records exact applied/verified/refused/unknown outcome under the original R1 trial and active conditional close-down obligation; no second scored success or autopilot promotion.
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"outcome": {
|
||||
"created_entities": 2,
|
||||
"created_event_ids": [
|
||||
"evt_7690c83144a0469891598dee5c1d38e1"
|
||||
],
|
||||
"grant_native_single_use": true,
|
||||
"ordinary_pdp_allow_claimed": false,
|
||||
"ordinary_pdp_refusal_retained": true,
|
||||
"result": "created",
|
||||
"transaction_committed": true
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{
|
||||
"grant_sha256": "72ee846034809f4ae6848eac3a43f2b7390f1df7a67ede50eff7435d1b43f839",
|
||||
"pod_uid": "e500bcae-c911-43a2-bd40-6a30b39064ab",
|
||||
"approval_receipt_sha256": "acb5ae4a1557d025473fb2d91865d1f958b8e17ea78c58f327b269b70090546e"
|
||||
}
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
{
|
||||
"account_reader_actual_catalogue_row_count": 1,
|
||||
"account_reader_service_rows_have_no_inferred_allow": true,
|
||||
"account_reader_service_status_counts": {
|
||||
"available": 0,
|
||||
"denied": 1,
|
||||
"not_offered": 0,
|
||||
"unchecked": 0
|
||||
},
|
||||
"actual_bound_catalogue_count": 1,
|
||||
"all_audits_truthful_maintenance_actor": true,
|
||||
"all_events_fixed_registration_and_attribution": true,
|
||||
"approval_id": "b859698b-5d08-4da5-9599-4760c6a799f1",
|
||||
"audit_count_for_approval": 3,
|
||||
"complete_user_journey_acceptance": false,
|
||||
"consumed_ledger_count": 1,
|
||||
"consumed_ledger_exact_digests": true,
|
||||
"consumed_ledger_maintenance_authority": true,
|
||||
"created_metadata_evidence_passed": true,
|
||||
"database_read_only_enforced": true,
|
||||
"downstream_consumer_receipt_verified": false,
|
||||
"event_claimed_count": 0,
|
||||
"event_dead_lettered_count": 0,
|
||||
"event_delivered_count": 0,
|
||||
"event_delivery_attempts": 0,
|
||||
"event_failed_count": 0,
|
||||
"event_ids_digest": "194a0b049fd1463f095663c2366400f1d45c2de5e5d6cdbeb4e5397fa925852e",
|
||||
"exact_application_and_binding": true,
|
||||
"fixed_catalogue_row_count": 2,
|
||||
"genuine_ordinary_denial_count": 1,
|
||||
"independent_keycape_registered_client_check_required": true,
|
||||
"ledger_created": true,
|
||||
"ledger_event_ids_match": true,
|
||||
"maintenance_ledger_action_exact": true,
|
||||
"maintenance_registration_audit_count": 1,
|
||||
"maintenance_registration_has_no_pdp_allow_id": true,
|
||||
"native_mutation": false,
|
||||
"observed_at": "2026-10-11T02:10:37.988942+00:00",
|
||||
"ordinary_denial_link_matches_ledger": true,
|
||||
"ordinary_enforcement_still_identified_deny": true,
|
||||
"provider_binding_exact": true,
|
||||
"provider_readback_enabled": true,
|
||||
"provider_system_count": 1,
|
||||
"raw_output_suppressed": true,
|
||||
"real_human_login_or_mfa_verified": false,
|
||||
"registered_event_count": 1,
|
||||
"rollback_ledger_absent": true,
|
||||
"schema": "user-engine.one-app-postapply-readonly.v1",
|
||||
"signed_in_human_account_projection_verified": false,
|
||||
"subject_context": "truthful maintenance SERVICE, no human claims, roles, groups or assurance",
|
||||
"pod_uid": "e500bcae-c911-43a2-bd40-6a30b39064ab",
|
||||
"pod_image_match": true,
|
||||
"native_exec_returncode": 0
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"read_only": true,
|
||||
"secret_objects_read": false,
|
||||
"real_human_login_performed": false,
|
||||
"method": "Known client rejects unregistered redirect with native KeyCape redirect_uri error; no login/cookie/state output.",
|
||||
"http_status": 400,
|
||||
"registered_client_rejects_wrong_redirect": true
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
import json,base64,hashlib,os
|
||||
from urllib.request import build_opener,HTTPRedirectHandler
|
||||
from urllib.error import HTTPError
|
||||
from urllib.parse import urlencode
|
||||
class NoRedirect(HTTPRedirectHandler):
|
||||
def redirect_request(self,*args,**kwargs):return None
|
||||
out={'read_only':True,'secret_objects_read':False,'real_human_login_performed':False,'method':'Known client rejects unregistered redirect with native KeyCape redirect_uri error; no login/cookie/state output.'}
|
||||
params={'client_id':'informed-decision-approver','response_type':'code','redirect_uri':'https://invalid.example/oidc/callback','scope':'openid','state':'readback-verification-no-login','code_challenge':base64.urlsafe_b64encode(hashlib.sha256(os.urandom(32)).digest()).rstrip(b'=').decode(),'code_challenge_method':'S256'}
|
||||
try:
|
||||
try:r=build_opener(NoRedirect).open('https://kc.coulomb.social/authorize?'+urlencode(params),timeout=10)
|
||||
except HTTPError as e:r=e
|
||||
with r:
|
||||
out['http_status']=r.code
|
||||
try:body=json.loads(r.read(4096));out['registered_client_rejects_wrong_redirect']=r.code==400 and body.get('error')=='invalid_profile_usage' and body.get('feature')=='redirect_uri'
|
||||
except Exception:out['registered_client_rejects_wrong_redirect']=False
|
||||
except Exception as e:out['exception_class']=type(e).__name__
|
||||
print(json.dumps(out,sort_keys=True))
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
{
|
||||
"memo_id": "infd-20261011-user-catalogue-bootstrap-r1",
|
||||
"review": {
|
||||
"intake_state": "ready",
|
||||
"memo_id": "review-08bc1f0e-7ae8-4e69-b6c9-edc2528b17e8",
|
||||
"path": "/review?memo_id=review-08bc1f0e-7ae8-4e69-b6c9-edc2528b17e8",
|
||||
"stale": false
|
||||
},
|
||||
"disposition_count": 1,
|
||||
"dispositions": [
|
||||
{
|
||||
"id": null,
|
||||
"approval_id": null,
|
||||
"submission_state": "confirmed",
|
||||
"disposition": {
|
||||
"actor": {
|
||||
"kind": "person",
|
||||
"sub": "uid=platform-root,ou=people,dc=netkingdom,dc=local"
|
||||
},
|
||||
"approval_id": "b859698b-5d08-4da5-9599-4760c6a799f1",
|
||||
"at": "2026-10-11T02:07:09Z",
|
||||
"id": "disp-7683bfbb-3743-4c9f-8ae3-962b6514c92e",
|
||||
"memo_id": "review-08bc1f0e-7ae8-4e69-b6c9-edc2528b17e8",
|
||||
"memo_version": 1,
|
||||
"note": null,
|
||||
"presentation_id": "pres-9cd24b21-d16d-4902-a758-04c52f58133a",
|
||||
"reasons": [],
|
||||
"verb": "accept"
|
||||
},
|
||||
"approved_at": "2026-10-11T02:07:09+00:00",
|
||||
"decided_at": null
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,44 @@
|
|||
{
|
||||
"access_registered_participant": true,
|
||||
"advisory_only_probe": true,
|
||||
"allow_expiry_future": true,
|
||||
"allow_ttl_bounded_30s": true,
|
||||
"catalogue_executor_package_sources": {
|
||||
"adapters/flex_auth.py": "73d645b7b37904ebfe0df6f7ed397b74b4c47f505cd64a30c39e60717ce71455",
|
||||
"adapters/postgres.py": "528d75431d1f3a7e55423ffa55d34722ac343582e513985db74ba3add36e6da6",
|
||||
"domain/models.py": "8c9cb8051a930fa05a1657c8b539510588f1788812d68510df55712d2f4df050",
|
||||
"service.py": "1c60b69e08c36eb3f678893a4a945eeeb9c73d5246c6566857cd8c134f75446d",
|
||||
"store_records.py": "3cec4575434e82e29932a3e9cc7659f3dd8fa7e5be81d5690487033796bbfc16"
|
||||
},
|
||||
"cross_provider_token_substitution_tested": false,
|
||||
"enforcement_evaluated": false,
|
||||
"expired_native_answer_renders_unchecked": true,
|
||||
"fixture_other_tenant_not_reused": true,
|
||||
"fixture_same_tenant_cache_reused": true,
|
||||
"informed_decision_local_binding_matches": true,
|
||||
"installed_sources": {
|
||||
"adapters/application_access.py": "adf1fac707446f41b5859ba5102e820cd88f60af5daf20a42f13dfa2067d5481",
|
||||
"application_access.py": "798f180474d98e1c6abacc7b8bfba3184d40ecb77d9ca90f6526cd4f774cf363"
|
||||
},
|
||||
"keycape_client_independently_verified": false,
|
||||
"live_mutation": false,
|
||||
"local_binding_count": 1,
|
||||
"local_bound_application_count": 1,
|
||||
"local_catalogue_readonly_success": true,
|
||||
"native_policy_fixture_allow": true,
|
||||
"native_policy_fixture_deny": true,
|
||||
"native_stale_mfa_fixture_deny": true,
|
||||
"observed_at": "2026-10-11T02:10:06.920592+00:00",
|
||||
"readback_config_exact": true,
|
||||
"readyz_status": 200,
|
||||
"real_human_login_mfa_verified": false,
|
||||
"registry_projection_sha256": "57e44ec14e5f4079628a5dc4aa0424b0ad234549c1eb5cf70835079e97854e9b",
|
||||
"registry_transport_success": true,
|
||||
"schema": "user-engine.native-readback-verification.v1",
|
||||
"subject_claims": "Synthetic policy fixtures forwarded by admitted User Engine; not real human login or MFA evidence.",
|
||||
"three_way_catalogue_count": 1,
|
||||
"unavailable_transport_refused": true,
|
||||
"pod_uid": "e500bcae-c911-43a2-bd40-6a30b39064ab",
|
||||
"pod_image_match": true,
|
||||
"native_exec_returncode": 0
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"source_only": true,
|
||||
"native_execution": false,
|
||||
"syntax_passed": true,
|
||||
"literal_sql_allow_list_passed": true,
|
||||
"literal_sql_statement_count": 5,
|
||||
"service_mutation_methods_absent": true,
|
||||
"credential_values_read": false,
|
||||
"test_scope": "AST/compile only; not native verification proof"
|
||||
}
|
||||
|
|
@ -0,0 +1,123 @@
|
|||
"""SOURCE ONLY. Supervisor supplies metadata; run only under exact approved sequence.
|
||||
No native writes or outbox delivery. Existing runtime configuration remains internal.
|
||||
Outputs fixed booleans/counts/digests only, never raw DB payloads or credentials.
|
||||
"""
|
||||
import os, sys, json, re, hashlib
|
||||
from datetime import datetime, timezone
|
||||
APP_ID='informed-decision'
|
||||
APPROVAL_ID='b859698b-5d08-4da5-9599-4760c6a799f1'
|
||||
EXECUTOR_SHA='b0dbbb9786e927055030acf849a72e9a44e9d3d55c84efdf245e419d381684f3'
|
||||
RECORDS_SHA='23577cc4f3ea6c0ca43eb21ca0e3280eb53fb64e29b030dcd31251593f0f3f2f'
|
||||
PROPOSAL='USER-CATALOGUE-INFDEC-20261011-R1'
|
||||
CORRELATION='maintenance:'+APPROVAL_ID
|
||||
LEDGER='aud_catalogue_bootstrap_'+APPROVAL_ID
|
||||
|
||||
def canonical_sha(value):
|
||||
return hashlib.sha256(json.dumps(value,sort_keys=True,separators=(',',':')).encode()).hexdigest()
|
||||
|
||||
def verify(expected):
|
||||
if type(expected) is not dict or set(expected)!={'grant_sha256','approval_receipt_sha256','operator_id'}:
|
||||
raise ValueError('fixed supervisor metadata required')
|
||||
for key in ('grant_sha256','approval_receipt_sha256'):
|
||||
if type(expected[key]) is not str or not re.fullmatch('[0-9a-f]{64}',expected[key]):
|
||||
raise ValueError('exact metadata digest required')
|
||||
if type(expected['operator_id']) is not str or not re.fullmatch('[a-zA-Z0-9:._-]{3,80}',expected['operator_id']):
|
||||
raise ValueError('fixed maintenance attribution required')
|
||||
import psycopg
|
||||
from user_engine.adapters.postgres import PostgresUserEngineStore
|
||||
from user_engine.domain import Application,ApplicationBinding,Actor,PrincipalType,AuthorizationRequest
|
||||
from user_engine.store_records import store_record_for
|
||||
from user_engine.adapters.flex_auth import FlexAuthHTTPAdapter
|
||||
from user_engine.adapters.application_access import ApplicationAccessReadbackHTTPAdapter
|
||||
from user_engine.application_access import ApplicationAccessReader,workload_catalogue
|
||||
app=Application(APP_ID,'Informed Decision',APP_ID)
|
||||
binding=ApplicationBinding(APP_ID,oidc_client_id='informed-decision-approver',protected_system_id=APP_ID)
|
||||
expected_records=[store_record_for(x).__dict__ for x in (app,binding)]
|
||||
if canonical_sha(expected_records)!=RECORDS_SHA:raise ValueError('installed codec drift')
|
||||
out={'schema':'user-engine.one-app-postapply-readonly.v1','approval_id':APPROVAL_ID,
|
||||
'native_mutation':False,'raw_output_suppressed':True,'real_human_login_or_mfa_verified':False,
|
||||
'subject_context':'truthful maintenance SERVICE, no human claims, roles, groups or assurance',
|
||||
'observed_at':datetime.now(timezone.utc).isoformat()}
|
||||
with psycopg.connect(os.environ['USER_ENGINE_DATABASE_URL'],autocommit=True) as conn:
|
||||
conn.execute('BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY')
|
||||
try:
|
||||
store=PostgresUserEngineStore(conn)
|
||||
a,b=store.application(APP_ID),store.binding(APP_ID)
|
||||
out['exact_application_and_binding']=a==app and b==binding
|
||||
with conn.cursor() as cur:
|
||||
cur.execute('SHOW transaction_read_only');out['database_read_only_enforced']=cur.fetchone()[0]=='on'
|
||||
cur.execute('SELECT count(*) FROM user_engine_records WHERE application_id=%s AND record_type IN (%s,%s)',(APP_ID,'applications','application_bindings'))
|
||||
out['fixed_catalogue_row_count']=cur.fetchone()[0]
|
||||
cur.execute('SELECT audit_id,payload FROM user_engine_audit_records WHERE correlation_id=%s ORDER BY audit_id',(CORRELATION,))
|
||||
audited=cur.fetchall()
|
||||
audits=[store._decode_payload_row('audit_records',(row[1],)) for row in audited]
|
||||
ledgers=[x for x in audits if x.audit_id==LEDGER]
|
||||
out['consumed_ledger_count']=len(ledgers)
|
||||
out['audit_count_for_approval']=len(audits)
|
||||
summaries=[json.loads(x.summary) for x in ledgers]
|
||||
summary=summaries[0] if len(summaries)==1 else {}
|
||||
out['consumed_ledger_exact_digests']=all(summary.get(k)==v for k,v in {
|
||||
'grant_sha256':expected['grant_sha256'],'approval_receipt_sha256':expected['approval_receipt_sha256'],
|
||||
'executor_sha256':EXECUTOR_SHA,'records_sha256':RECORDS_SHA}.items())
|
||||
out['consumed_ledger_maintenance_authority']=summary.get('authority')=='founder-approved-one-time-administrative-exception' and summary.get('not_human_authentication') is True
|
||||
out['ledger_created']=summary.get('created') is True
|
||||
out['rollback_ledger_absent']=not any(x.audit_id==LEDGER+'_rollback' for x in audits)
|
||||
actor_match=lambda x:(x.actor.issuer=='urn:supervised-maintenance' and x.actor.subject==expected['operator_id'] and x.actor.principal_type==PrincipalType.SERVICE and not x.actor.roles and not x.actor.tenant_roles and not x.actor.groups and not x.actor.assurance and not x.actor.audience and not x.actor.scopes and x.actor.tenant=='tenant:platform' and x.actor.claims=={'maintenance_proposal':PROPOSAL} and x.tenant=='tenant:platform' and x.subject==APP_ID)
|
||||
out['all_audits_truthful_maintenance_actor']=bool(audits) and all(actor_match(x) for x in audits)
|
||||
denies=[x for x in audits if x.action=='application.register' and x.summary=='authorization denied' and x.decision_id is not None]
|
||||
out['genuine_ordinary_denial_count']=len(denies)
|
||||
out['ordinary_denial_link_matches_ledger']=len(denies)==1 and denies[0].decision_id==summary.get('ordinary_pdp_denial_id')
|
||||
registrations=[x for x in audits if x.action=='application.register' and x.summary!='authorization denied']
|
||||
out['maintenance_registration_audit_count']=len(registrations)
|
||||
out['maintenance_registration_has_no_pdp_allow_id']=len(registrations)==1 and registrations[0].decision_id is None
|
||||
out['maintenance_ledger_action_exact']=len(ledgers)==1 and ledgers[0].action=='application.metadata.bootstrap'
|
||||
cur.execute('SELECT event_id FROM user_engine_outbox_events WHERE correlation_id=%s ORDER BY event_id',(CORRELATION,))
|
||||
event_ids=[row[0] for row in cur.fetchall()]
|
||||
out['registered_event_count']=len(event_ids)
|
||||
out['ledger_event_ids_match']=summary.get('event_ids')==event_ids
|
||||
events=[store.outbox_event(i) for i in event_ids]
|
||||
out['all_events_fixed_registration_and_attribution']=len(events)==1 and all(e is not None and e.event_type=='application.registered' and e.aggregate_id==APP_ID and e.tenant=='tenant:platform' and e.payload.get('application_id')==APP_ID and e.payload.get('maintenance_exception') is True and e.payload.get('proposal_id')==PROPOSAL and e.payload.get('approval_id')==APPROVAL_ID and e.payload.get('operator_id')==expected['operator_id'] for e in events)
|
||||
out['event_claimed_count']=sum(e.claimed_by is not None or e.claimed_at is not None for e in events)
|
||||
out['event_delivered_count']=sum(e.delivered_at is not None for e in events)
|
||||
out['event_dead_lettered_count']=sum(e.dead_lettered_at is not None for e in events)
|
||||
out['event_failed_count']=sum(e.failed_at is not None for e in events)
|
||||
out['event_delivery_attempts']=sum(e.delivery_attempts for e in events)
|
||||
out['downstream_consumer_receipt_verified']=False
|
||||
out['event_ids_digest']=canonical_sha(event_ids)
|
||||
bound=[(a,b)] if a==app and b==binding else []
|
||||
finally:conn.rollback()
|
||||
actor=Actor(issuer='urn:supervised-maintenance',subject=expected['operator_id'],tenant='tenant:platform',principal_type=PrincipalType.SERVICE,audience=())
|
||||
ordinary=FlexAuthHTTPAdapter(base_url=os.environ['USER_ENGINE_FLEX_AUTH_URL'],bearer_token_file=os.environ['USER_ENGINE_FLEX_AUTH_TOKEN_FILE'],timeout_seconds=3)
|
||||
denied=ordinary.check(AuthorizationRequest(actor,'user-engine:application',APP_ID,'application.register','tenant:platform','verify:'+APPROVAL_ID,APP_ID))
|
||||
out['ordinary_enforcement_still_identified_deny']=not denied.allowed and denied.decision_id is not None and denied.reason!='authorization service unavailable'
|
||||
readback=ApplicationAccessReadbackHTTPAdapter(base_url=os.environ['USER_ENGINE_READBACK_URL'],bearer_token_file=os.environ['USER_ENGINE_READBACK_TOKEN_FILE'],timeout_seconds=3)
|
||||
systems=readback.systems()
|
||||
matches=[s for s in systems if s.system_id==APP_ID]
|
||||
out['provider_system_count']=len(matches)
|
||||
out['provider_binding_exact']=len(matches)==1 and matches[0].client_id=='informed-decision-approver' and (matches[0].client_issuer or '').rstrip('/')=='https://kc.coulomb.social'
|
||||
out['provider_readback_enabled']=len(matches)==1 and matches[0].readback is True
|
||||
actual=workload_catalogue(bound,systems,issuer='https://kc.coulomb.social')
|
||||
out['actual_bound_catalogue_count']=len(actual)
|
||||
reader=ApplicationAccessReader(readback,issuer='https://kc.coulomb.social',bound_applications=lambda:bound)
|
||||
rows=reader.rows(actor,'maintenance-verification:'+APPROVAL_ID)
|
||||
out['account_reader_actual_catalogue_row_count']=0 if rows is None else len(rows)
|
||||
out['account_reader_service_rows_have_no_inferred_allow']=rows is not None and len(rows)==1 and all(not row.available for row in rows)
|
||||
out['account_reader_service_status_counts']={status:sum(row.status==status for row in rows or ()) for status in ('available','denied','not_offered','unchecked')}
|
||||
out['signed_in_human_account_projection_verified']=False
|
||||
required=['exact_application_and_binding','database_read_only_enforced','consumed_ledger_exact_digests','consumed_ledger_maintenance_authority','ledger_created','rollback_ledger_absent','all_audits_truthful_maintenance_actor','ordinary_denial_link_matches_ledger','maintenance_registration_has_no_pdp_allow_id','maintenance_ledger_action_exact','ledger_event_ids_match','all_events_fixed_registration_and_attribution','ordinary_enforcement_still_identified_deny','provider_binding_exact','provider_readback_enabled','account_reader_service_rows_have_no_inferred_allow']
|
||||
out['created_metadata_evidence_passed']=all(out.get(k) is True for k in required) and out['fixed_catalogue_row_count']==2 and out['consumed_ledger_count']==1 and out['audit_count_for_approval']==3 and out['genuine_ordinary_denial_count']==1 and out['actual_bound_catalogue_count']==1 and out['account_reader_actual_catalogue_row_count']==1
|
||||
out['independent_keycape_registered_client_check_required']=True
|
||||
out['complete_user_journey_acceptance']=False
|
||||
return out
|
||||
|
||||
def main():
|
||||
saved=os.dup(1);null=os.open(os.devnull,os.O_WRONLY);os.dup2(null,1);os.dup2(null,2)
|
||||
try:
|
||||
data=sys.stdin.buffer.read(4097)
|
||||
if len(data)>4096:raise ValueError('bounded metadata required')
|
||||
out=verify(json.loads(data))
|
||||
except Exception:out={'schema':'user-engine.one-app-postapply-readonly.v1','result':'verification-incomplete','raw_output_suppressed':True,'native_mutation':False}
|
||||
os.dup2(saved,1);os.close(saved);os.close(null)
|
||||
print(json.dumps(out,sort_keys=True))
|
||||
return 0 if out.get('created_metadata_evidence_passed') else 2
|
||||
if __name__=='__main__':raise SystemExit(main())
|
||||
|
|
@ -9,7 +9,7 @@ flavor: implementation
|
|||
owner: codex
|
||||
topic_slug: user-engine
|
||||
created: "2026-09-12"
|
||||
updated: "2026-10-09"
|
||||
updated: "2026-10-11"
|
||||
state_hub_workstream_id: "0aea0a52-13f9-515b-bda8-665f8a4f2d5e"
|
||||
---
|
||||
|
||||
|
|
@ -62,8 +62,8 @@ logout. This does not accept the remaining multi-user Vergabe pilot.
|
|||
```task
|
||||
id: USER-WP-0026-T03
|
||||
status: wait
|
||||
blocked_on: message-from:rapp-user-engine
|
||||
blocking_reason: "FLEX-WP-0035-T04 delivered the admitted readback pin on 2026-10-10. Needs rapp-user-engine readback URL, separate projected caller token and exact-pin egress, an image containing the readback client, and native consumer allow/deny/unavailable acceptance against the live pin."
|
||||
blocked_on: message-from:access-engine
|
||||
blocking_reason: "Actual one-app catalogue and admitted runtime readback verified 2026-10-11. Remains owner-supported scoped grant/revocation contract, actual signed-in human account projection and ordinary authenticated catalogue-management admission before customer production; SERVICE/synthetic checks do not satisfy those gates."
|
||||
priority: high
|
||||
state_hub_task_id: "95e9a6d4-7e57-5483-97c5-3f4a45bb6767"
|
||||
```
|
||||
|
|
@ -169,3 +169,30 @@ regression exercises an allow in tenant-a followed by a deny in tenant-b.
|
|||
2026-10-11 actual native integration update: confirmed scoped R2 approval0dd18a5a-5555-461e-8470-931d530435cf allowed root to apply only the published User Engine Deployment and runtime NP; Ready1 generation73 on imagef239. The admitted User Engine workload's installed adapter now reaches the real readback registry and produces bounded allow/deny/stale-MFA synthetic policy results; tenant-separated cache, allow expiry and unavailable transport checks pass. Existing enforcement remains healthy and denies the checked unknown action; purpose-bearing application.access also denies, but current source's explicit400 purpose rejection is not proven on the older native provider. That is a distinct Access owner runtime gap, not a consumer regression or new grant.
|
||||
|
||||
Read-only actual catalogue query found zero local application bindings/apps. Access advertises informed-decision and the actual KeyCape informed-decision-approver client independently rejects an unregistered redirect, but the third User Engine application record is absent. The local catalogue registration implementation is User Engine-owned; informed-decision owns its application registration facts and Access owns the protected system/client contract. Obtain an exact supported registration/admission proposal and application-owner return before any native record mutation; no seed or fake record was created under the two-object approval. USER-WP-0026-T03 / USER-WP-0028-T02 remain open for actual bound catalogue and broader scoped grant/revocation acceptance. Browser login/MFA tasks retain their separate human gates. Full receipts: rapp-user-engine/docs/evidence/2026-10-11-native-readback.
|
||||
|
||||
|
||||
2026-10-11 native R1 catalogue milestone (02:10Z): the founder accepted
|
||||
infd-20261011-user-catalogue-bootstrap-r1, approval
|
||||
b859698b-5d08-4da5-9599-4760c6a799f1. Root's exact approved standalone dry-run
|
||||
and apply committed Application informed-decision and its OIDC
|
||||
informed-decision-approver / protected-system informed-decision binding.
|
||||
Independent READ ONLY verification proves 2 rows, 1 digest-bound consumed ledger,
|
||||
3 truthfully maintenance SERVICE-attributed audits including genuine ordinary
|
||||
PDP deny and no maintenance PDP allow ID, and 1 attributed registered event.
|
||||
Fresh Access registry and native KeyCape known-client/wrong-redirect check bind
|
||||
the actual three-way catalogue. The installed account reader joins real rows
|
||||
and renders the maintenance SERVICE denied; native labelled policy fixtures
|
||||
pass allow/deny/expiry/unavailable/tenant-cache checks. Evidence:
|
||||
`docs/evidence/2026-10-11-one-app-catalogue-native-acceptance/README.md`.
|
||||
|
||||
The missing local catalogue record and consumer runtime-wiring blockers are
|
||||
resolved for this one application. This task stays wait: owner-supported scoped
|
||||
grant/revocation semantics and actual signed-in human account projection are
|
||||
not established by SERVICE or synthetic policy checks. Ordinary authenticated
|
||||
catalogue-management admission must be implemented and verified before customer
|
||||
production; retain this follow-up on existing USER-WP-0026-T03 and its reuse in
|
||||
USER-WP-0028-T02, linked to the single Custodian close-down exception row. No
|
||||
duplicate intake or leftover only in prose is created. Never infer entitlement
|
||||
from catalogue/membership facts. Real OTP/browser journey acceptance remains
|
||||
separate. At verification the original event was unclaimed/undelivered with no
|
||||
consumer receipt; maintenance authority grants no targeted delivery/replay.
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ flavor: implementation
|
|||
owner: codex
|
||||
topic_slug: communication
|
||||
created: "2026-09-13"
|
||||
updated: "2026-10-03"
|
||||
updated: "2026-10-11"
|
||||
state_hub_workstream_id: "145df9d5-a7e9-5d20-8280-9d3ea069838b"
|
||||
---
|
||||
|
||||
|
|
@ -33,7 +33,7 @@ U01–U04/U10–U13: preserve safe profile input on validation failure; confirm
|
|||
id: USER-WP-0028-T02
|
||||
status: wait
|
||||
depends_on: [USER-WP-0026-T03]
|
||||
blocking_reason: "Blocked on the provider-owned catalogue/admission and scoped grant/revocation contract from USER-WP-0026-T03."
|
||||
blocking_reason: "Actual one-app catalogue/readback verified under native R1 exception. Reuses USER-WP-0026-T03 for supported scoped grant/revocation, signed-in human account projection and ordinary authenticated management restoration; no complete U09/T05 claim from SERVICE/synthetic evidence."
|
||||
priority: high
|
||||
state_hub_task_id: "5d1bf977-034d-5448-b4fb-5a8b630af6ba"
|
||||
```
|
||||
|
|
@ -105,3 +105,30 @@ pink-account link. Next: the attended run with tegwick.
|
|||
2026-10-11 actual native integration update: confirmed scoped R2 approval0dd18a5a-5555-461e-8470-931d530435cf allowed root to apply only the published User Engine Deployment and runtime NP; Ready1 generation73 on imagef239. The admitted User Engine workload's installed adapter now reaches the real readback registry and produces bounded allow/deny/stale-MFA synthetic policy results; tenant-separated cache, allow expiry and unavailable transport checks pass. Existing enforcement remains healthy and denies the checked unknown action; purpose-bearing application.access also denies, but current source's explicit400 purpose rejection is not proven on the older native provider. That is a distinct Access owner runtime gap, not a consumer regression or new grant.
|
||||
|
||||
Read-only actual catalogue query found zero local application bindings/apps. Access advertises informed-decision and the actual KeyCape informed-decision-approver client independently rejects an unregistered redirect, but the third User Engine application record is absent. The local catalogue registration implementation is User Engine-owned; informed-decision owns its application registration facts and Access owns the protected system/client contract. Obtain an exact supported registration/admission proposal and application-owner return before any native record mutation; no seed or fake record was created under the two-object approval. USER-WP-0026-T03 / USER-WP-0028-T02 remain open for actual bound catalogue and broader scoped grant/revocation acceptance. Browser login/MFA tasks retain their separate human gates. Full receipts: rapp-user-engine/docs/evidence/2026-10-11-native-readback.
|
||||
|
||||
|
||||
2026-10-11 native R1 catalogue milestone (02:10Z): the founder accepted
|
||||
infd-20261011-user-catalogue-bootstrap-r1, approval
|
||||
b859698b-5d08-4da5-9599-4760c6a799f1. Root's exact approved standalone dry-run
|
||||
and apply committed Application informed-decision and its OIDC
|
||||
informed-decision-approver / protected-system informed-decision binding.
|
||||
Independent READ ONLY verification proves 2 rows, 1 digest-bound consumed ledger,
|
||||
3 truthfully maintenance SERVICE-attributed audits including genuine ordinary
|
||||
PDP deny and no maintenance PDP allow ID, and 1 attributed registered event.
|
||||
Fresh Access registry and native KeyCape known-client/wrong-redirect check bind
|
||||
the actual three-way catalogue. The installed account reader joins real rows
|
||||
and renders the maintenance SERVICE denied; native labelled policy fixtures
|
||||
pass allow/deny/expiry/unavailable/tenant-cache checks. Evidence:
|
||||
`docs/evidence/2026-10-11-one-app-catalogue-native-acceptance/README.md`.
|
||||
|
||||
The missing local catalogue record and consumer runtime-wiring blockers are
|
||||
resolved for this one application. This task stays wait: owner-supported scoped
|
||||
grant/revocation semantics and actual signed-in human account projection are
|
||||
not established by SERVICE or synthetic policy checks. Ordinary authenticated
|
||||
catalogue-management admission must be implemented and verified before customer
|
||||
production; retain this follow-up on existing USER-WP-0026-T03 and its reuse in
|
||||
USER-WP-0028-T02, linked to the single Custodian close-down exception row. No
|
||||
duplicate intake or leftover only in prose is created. Never infer entitlement
|
||||
from catalogue/membership facts. Real OTP/browser journey acceptance remains
|
||||
separate. At verification the original event was unclaimed/undelivered with no
|
||||
consumer receipt; maintenance authority grants no targeted delivery/replay.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue