2 Commits

Include renames

Author	SHA1	Message	Date
Marius CiepluchandClaude Opus 5	8e26dfd1e2	feat(authorization-obligations): group sibling handlers and find consistency anomalies ... Task 2.2. Handlers on the same resource under the same module are siblings; when at least min_siblings of them discharge an obligation and one does not, that one is the anomaly and the discharging siblings are its evidence (Req 3.2). A set with fewer members than the minimum is under-populated and never reported (Req 3.3). A public route among authenticated siblings is a missing path guard with the mapper's access classification as evidence (Req 3.4). The sibling key is the module path without its suffix, so two same-named files in different directories are never merged. Witness validity (an identity constraint counts only when it binds the authenticated context) is one helper shared by operations, siblings and the checker. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG	2026-09-06 07:24:13 +02:00
Marius CiepluchandClaude Fable 5.1	f44dd2c512	feat(authorization-obligations): obligated operations and dischargers as closed facts ... Task 1.1 (Req 1.1-1.5). - semantic/obligations/facts.py: closed OPERATION_KINDS, DISCHARGER_KINDS and PROVENANCE_KINDS; OperationFact and DischargerFact (calls, decorators, identity sources, constraint params, request sources, permissive values); load_obligation_facts rejects unknown kinds and fields by name; per-language scoping. - ruleset/obligations/{python,javascript,typescript}.toml beside (never inside) the flow facts directory. Protected reads and writes are discharged by an identity constraint or an ownership check; a path guard discharges privileged actions only. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG	2026-09-05 19:38:04 +02:00