Implement role ladder, Admin grants, and fail-closed authorization #4

New issue

Closed

opened 2026-07-19 23:26:30 +02:00 by thecrealm · 1 comment

thecrealm commented

2026-07-19 23:26:30 +02:00

Owner

Acceptance: §2.6 (ladder), §4.2 (Admin-only grants, audit-logged §10), §4.3 (permission matrix incl. approver≠author), §4.4 fail-closed. Tests reference CR-8.

thecrealm added the

labels

2026-07-19 23:27:02 +02:00

thecrealm added

now

and removed

labels

2026-07-20 15:34:40 +02:00

thecrealm referenced this issue

2026-07-20 15:56:59 +02:00

Surface promotion eligibility hints to Admins #14

thecrealm commented

2026-07-20 16:03:30 +02:00

Author

Owner

Live on prod (d031912): strictly ordered ladder with per-request role resolution (grants effective immediately, §4.2), Admin-only grant/revoke/suspend with actor+reason and append-only Admin-only audit log (§10, cursor-paginated §9.2), approver≠author rule with Admin break-glass (§4.3, enforcement point lands with proposals), BOOTSTRAP_ADMIN startup seed (D15). CR-8 verified in 12 new tests and live on prod: 401 unauthenticated, 404-indistinguishable staff surface. Admin elevation on prod intentionally left to the operator: register your account, append BOOTSTRAP_ADMIN= to /opt/mokuroku/.env, docker compose up -d server (runbook).

Live on prod (d031912): strictly ordered ladder with per-request role resolution (grants effective immediately, §4.2), Admin-only grant/revoke/suspend with actor+reason and append-only Admin-only audit log (§10, cursor-paginated §9.2), approver≠author rule with Admin break-glass (§4.3, enforcement point lands with proposals), BOOTSTRAP_ADMIN startup seed (D15). CR-8 verified in 12 new tests and live on prod: 401 unauthenticated, 404-indistinguishable staff surface. Admin elevation on prod intentionally left to the operator: register your account, append BOOTSTRAP_ADMIN=<name> to /opt/mokuroku/.env, docker compose up -d server (runbook).

thecrealm

2026-07-20 16:03:31 +02:00