generated from coulomb/repo-seed
tegwick
82177d88a9
Closes FLEX-WP-0005 T04. Validates ADR-003's commitment to shape the
standalone core for cheap Topaz adapter work.
Spike output:
- docs/topaz-mapping-spike.md — vocabulary map (subject, group, tenant,
knowledge_base, document, plus parent / owner_team / reader / steward /
member relations), Rego module shape, decision envelope, wire-protocol
ranking (gRPC primary, REST fallback, embedding rejected), schema
restatement recommendation, implications for FLEX-WP-0002 / 0004.
- examples/topaz/ — runnable docker-compose deploying Topaz with the
flex-auth-shaped manifest. seed and probe one-shots cover three
scenarios: alice (steward) allow, bob (group→reader) allow, eve
(outsider) deny. End-to-end green on 2026-05-16:
probe: steward-allow OK (check=true)
probe: reader-allow OK (check=true)
probe: outsider-deny OK (check=false)
probe: all checks passed
Key findings recorded as Implementation Notes in the spike doc:
- Rego input contract bridging (Topaz raw shape ↔ flex-auth canonical
shape) is adapter scope, not core scope.
- Topaz identity objects are a Topaz convention; the adapter
materializes them at directory import time.
- Directory-only permission resolution is sufficient for the common
case; Rego is reserved for context-dependent decisions.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
21 lines
881 B
JSON
21 lines
881 B
JSON
{
|
|
"objects": [
|
|
{"type": "tenant", "id": "platform"},
|
|
{"type": "group", "id": "team:platform-architecture", "display_name": "Platform Architecture"},
|
|
{"type": "group", "id": "reader:platform-architecture", "display_name": "Platform Architecture Readers"},
|
|
{"type": "user", "id": "alice@example.test", "display_name": "Alice (steward)"},
|
|
{"type": "user", "id": "bob@example.test", "display_name": "Bob (reader)"},
|
|
{"type": "user", "id": "eve@example.test", "display_name": "Eve (outsider)"},
|
|
{
|
|
"type": "knowledge_base",
|
|
"id": "knowledge-base:markitect-example",
|
|
"properties": {"trust_zone": "public", "labels": ["public"]}
|
|
},
|
|
{
|
|
"type": "document",
|
|
"id": "document:internal-note",
|
|
"properties": {"trust_zone": "internal", "labels": ["internal"], "path": "examples/policy/private/internal-note.md"}
|
|
}
|
|
]
|
|
}
|