Repository navigation
D-IAM-SAG-0: map IAM stack onto dir_sim, OGAR and #1509 SAG (RFC + research + prompt) - #1512
AdaWorldAPI wants to merge 13 commits into
Conversation
|
Warning Review limit reachedYour organization has reached its usage spending cap. Adjust your spending cap in the billing tab. Next included review available in 38 minutes. View limit details
Warning Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c108237170
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -0,0 +1,32 @@ | |||
| # 2026-10-12 — D-IAM-SAG-0: six IAM views over dir_sim and #1509 SAG | |||
There was a problem hiding this comment.
Adding this entry without updating .claude/board/entries/README.md leaves it unreferenced. Running python3 .claude/tools/entries_index.py --check exits 1 with UNREFERENCED: 2026-10-12-iam-substrate-sag-dir-sim.md; because .github/workflows/supersession-index.yml:26,88-89 triggers this check for every board-entry change, CI will fail for this commit. Run the documented --write command and commit the regenerated index.
Useful? React with 👍 / 👎.
|
Superseded by #1523. Every commit from this branch is merged there unchanged except for the alignment edits. Changes for this PR:
Closing in favour of the capstone. Generated by Claude Code |
1 participant
D-IAM-SAG-0 — six IAM projections on the existing substrate
Starts exactly from merged #1509 (merge
42fa2a347cda22eaaa327bba514f2029cc9daa82; verified branch has 0 commits behind main at creation). Draft / documentation-first, with no Rust runtime modification or production IAM action.Thesis
IGA, privileged access, SSO/access, directories, devices/apps, and automation can be overlapping semantic views over version-pinned identity, group, entitlement, policy, device and evidence relationships. They are not six applications already delivered by lance-graph, and an analytical result never supersedes live IdP/PAM/MDM/PDP authorization.
Baseline evidence from code and #1509
lance-graph-dir-simalready has GUID/DN-distinct SoA, immutable observation + delta overlay, versioned simulation/diff/plan and role/path evidence withHeld/NotHeld/Undetermined.SoftwareGraph(D-SAG-1: software-awareness graph — lance-graph's own methods, programs and evidence as Quack-queried rows #1509) already projects MethodTable methods, compiled programs, failures and hypothesis/verified tiers into Quack-queryable rows, but only one-hop and in-memory; no second engine.EqU32Viaresearch and parity tests, not an output-mask-as-input shortcut or invented opcode.In this PR (4 documentation files)
Deliberate boundaries / negative claims
explain -> simulate -> role impact, grounded in existing dir_sim and D-SAG-1: software-awareness graph — lance-graph's own methods, programs and evidence as Quack-queried rows #1509.Research references
Review requested: Is the proposal strict enough about native source authority and role-evidence completeness? Which multi-hop carrier can be implemented without making Quack a second traversal engine?
This PR is intentionally a research and implementation prompt, not an implementation completion claim.
Follow-on expansion (same draft branch): D-IAM-SAG-1
Added 2 substantial research/architecture documents and extended the original plan, Claude Code prompt and board entry without modifying Rust runtime code:
Primary architectural correction:
positive graph grant != negative/exhaustive proof != native PDP decision != live provider enforcement. No token, belief, generated prompt, SAG certificate, or confidence score can authorize a write. The first implementation slice remains read-only.Post-#1509 implementation drift: #1514 has since merged to
main, earning a functional one-hop relation carrier (out(rel),Semijoin,EqU32Via) in the method glove. This research branch remains anchored at the #1509 merge and is not yet rebased onto later main changes. General many-to-many group traversal, a second hop and R2ILGATHERremain open. D-PBL GPO/Intune baseline is a proposal, not a policy connector; IAM tests 41..45 protect configured vs assigned vs observed device state and the exact one-hop limit.Not shipped: runtime features, policy-evaluation engine, alternative graph traversal engine, external provider DO, test results, performance figures or approved new byte semantics. Those require separate code-grounded implementation PRs.