test(object-store): refuse what the converge cannot prove, as the authority does

sean commented

2026-09-10 02:41:00 +00:00

Owner

Binjovi now proves each policy grant at its own target and refuses PutObject on an exact key and any condition other than StringLike s3:prefix on a bucket resource before any mc call. The repository guard must agree, so both rules are added with five negative controls (26 total). This release also re-drives the converge with the corrected read proof (mc head, not mc stat). https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit

2026-09-10 02:41:00 +00:00

test(object-store): refuse what the converge cannot prove, as the authority does

binjovi/ci Binjovi completed the frozen plan

Details

91d253a61a

Binjovi proves each policy grant at its own target now, and two shapes are
refused there before any mc call: PutObject (or s3:*) on an exact key,
because the write proof would overwrite the real object, and any condition
other than StringLike on s3:prefix on a bucket resource, because it would
be attached and never proved. This guard and Binjovi.Domain.ObjectStorePlan
must agree, so both rules are added here with five negative controls: the
exact-key write in both spellings, an IpAddress condition, a second key
inside StringLike, and a prefix condition on an object resource.

Its release also re-drives the converge with the corrected read proof.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

binjovi-bot merged commit 70b3cf74da into trunk

2026-09-10 02:41:32 +00:00

Rows
Columns

test(object-store): refuse what the converge cannot prove, as the authority does #175