63 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
tegwick	af3e8b2af2	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 07:28:16 +02:00
tegwick	99a521e176	Document delegated mode operations	2026-05-17 07:27:45 +02:00
tegwick	1f5e9626e5	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 07:25:20 +02:00
tegwick	32933c71f9	Add directory group resolver adapters	2026-05-17 07:24:50 +02:00
tegwick	ac9cf09545	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 07:19:17 +02:00
tegwick	360025e38b	Add Keycloak authorization adapter path	2026-05-17 07:18:45 +02:00
tegwick	3fdbc7acb7	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 07:13:56 +02:00
tegwick	ad4895187b	Add rule PDP adapter boundary	2026-05-17 07:13:27 +02:00
tegwick	4bb329c921	Add relationship PDP adapter boundary	2026-05-17 07:06:14 +02:00
tegwick	90021d16b6	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 07:04:59 +02:00
tegwick	8a61e40bd6	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 06:58:50 +02:00
tegwick	1ce0181e8f	Implement Topaz adapter	2026-05-17 06:58:04 +02:00
tegwick	0fbb2a45c2	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 06:41:41 +02:00
tegwick	184ce5a380	Document Markitect integration flow	2026-05-17 06:41:07 +02:00
tegwick	131fd2cd9b	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 06:37:27 +02:00
tegwick	3d1967cb41	Add Markitect adapter contract tests	2026-05-17 06:36:52 +02:00
tegwick	7e09a21c5f	Add Markitect check fixtures	2026-05-17 06:32:05 +02:00
tegwick	96e53bf1d9	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 06:31:11 +02:00
tegwick	1c915f12d7	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 06:26:49 +02:00
tegwick	b6712850c3	Define Markitect action vocabulary	2026-05-17 06:26:13 +02:00
tegwick	50e436093a	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 06:22:05 +02:00
tegwick	9e2591c1f4	Import Markitect resource manifests	2026-05-17 06:21:28 +02:00
tegwick	dd4f688ab6	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 06:16:45 +02:00
tegwick	12dbf52586	Mark core workplan completed	2026-05-17 06:16:13 +02:00
tegwick	a285959183	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 06:14:49 +02:00
tegwick	6586adb4f5	Define Markitect resource namespace	2026-05-17 06:14:04 +02:00
tegwick	4c9f964425	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 06:08:42 +02:00
tegwick	6bff4cd7c9	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 06:05:47 +02:00
tegwick	18054bd160	Add CARING examples and coverage	2026-05-17 06:05:18 +02:00
tegwick	49655e40e0	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 06:00:25 +02:00
tegwick	61e113f8b6	Add CLI and service skeleton	2026-05-17 05:59:48 +02:00
tegwick	ccf68332f8	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 05:52:12 +02:00
tegwick	2b103ea70b	Add local decision log	2026-05-17 05:51:37 +02:00
tegwick	4342f98d83	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 05:46:22 +02:00
tegwick	faea068721	Implement list allowed and explain	2026-05-17 05:45:36 +02:00
tegwick	aa70dbebe1	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 05:39:41 +02:00
tegwick	54984585e3	Implement deterministic check APIs	2026-05-17 05:38:57 +02:00
tegwick	fa1b42e678	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 05:31:20 +02:00
tegwick	550d096cb2	Implement policy package loader	2026-05-17 05:30:40 +02:00
tegwick	2cce434d47	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 05:11:06 +02:00
tegwick	3c4f8fc2b4	Implement local registry store	2026-05-17 05:10:17 +02:00
tegwick	4f4c290684	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-17: - update .custodian-brief.md for flex-auth	2026-05-17 05:01:55 +02:00
tegwick	7fdf6d63d5	Implement canonical schema foundation	2026-05-17 04:59:18 +02:00
tegwick	dd0b9663c4	Refine workplans for CARING profile	2026-05-17 04:15:38 +02:00
tegwick	f930e96568	IAM Profile consumption doc + claim fixtures; close FLEX-WP-0005 ... Completes FLEX-WP-0005 T05 and closes the Foundations and Topaz Alignment workstream. docs/iam-profile-consumption.md captures flex-auth's input surface against NetKingdom IAM Profile v0.1: - boundary (flex-auth consumes verified claims; upstream layer validates signatures and audiences) - normalized input envelope (matches Markitect's EnterpriseIdentity) - required, recommended, and tolerated claim variations - role-claim location union (top-level / realm_access / resource_access) - scope encoding (string vs array) - principal-type detection (human / service / emergency) - group-overage and freshness expectations - production vs local-development handling examples/claims/ ships five contract fixtures: - key-cape-lightweight.yaml (profile minimum) - keycloak-heavy.yaml (full variation set + MFA) - service-account.yaml (svc-* hub-to-hub) - emergency.yaml (break-glass with incident metadata) - keycloak-group-overage.yaml (Entra-style hasgroups: true) All fixtures parse as valid YAML. They become contract tests for the standalone evaluator (FLEX-WP-0002 P2.4) and the Topaz adapter (FLEX-WP-0004 T01); both code paths must produce identical normalized envelopes for the same fixture. FLEX-WP-0005 workstream marked status=done in this file and completed in the State Hub. FLEX-WP-0002 is now fully unblocked. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-16 09:09:36 +02:00
tegwick	7471e07cbb	Include topaz bundle .manifest in the spike example ... Dotfile was missed by the previous git add — bundle/.manifest is the OPA bundle root manifest Topaz consults to know which Rego packages belong in the bundle. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-16 09:05:04 +02:00
tegwick	82177d88a9	Topaz alignment spike — mapping doc + green e2e example ... Closes FLEX-WP-0005 T04. Validates ADR-003's commitment to shape the standalone core for cheap Topaz adapter work. Spike output: - docs/topaz-mapping-spike.md — vocabulary map (subject, group, tenant, knowledge_base, document, plus parent / owner_team / reader / steward / member relations), Rego module shape, decision envelope, wire-protocol ranking (gRPC primary, REST fallback, embedding rejected), schema restatement recommendation, implications for FLEX-WP-0002 / 0004. - examples/topaz/ — runnable docker-compose deploying Topaz with the flex-auth-shaped manifest. seed and probe one-shots cover three scenarios: alice (steward) allow, bob (group→reader) allow, eve (outsider) deny. End-to-end green on 2026-05-16: probe: steward-allow OK (check=true) probe: reader-allow OK (check=true) probe: outsider-deny OK (check=false) probe: all checks passed Key findings recorded as Implementation Notes in the spike doc: - Rego input contract bridging (Topaz raw shape ↔ flex-auth canonical shape) is adapter scope, not core scope. - Topaz identity objects are a Topaz convention; the adapter materializes them at directory import time. - Directory-only permission resolution is sufficient for the common case; Rego is reserved for context-dependent decisions. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-16 09:04:42 +02:00
tegwick	52b5575048	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-16: - update .custodian-brief.md for flex-auth	2026-05-16 08:09:10 +02:00
tegwick	f41fa1abb7	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-16: - FLEX-WP-0005-T004: todo → in_progress	2026-05-16 08:09:08 +02:00
tegwick	f885e6d762	chore(consistency): sync task status from DB [auto] ... Updated by fix-consistency on 2026-05-16: - update .custodian-brief.md for flex-auth	2026-05-16 02:06:19 +02:00