Publish reviewed exact task execution PDP binding contract

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

pkg/api/execution_contract_test.go

@@ -0,0 +1,52 @@
+package api
+
+import (
+ "encoding/json"
+ "testing"
+)
+
+func executionRequest(t *testing.T) CheckRequest {
+ t.Helper()
+ var r CheckRequest
+ err := json.Unmarshal([]byte(`{"tenant":"tenant:platform","subject":{"id":"secrets-engine","type":"service"},"action":"execute-ccr","resource":{"id":"catalog:test","type":"secret-catalog-lane","system":"secrets-engine","attributes":{"stage":"prod"}},"context":{"purpose":"metadata-apply-ccr","human_control":true,"execution_contract":{"contract_version":"SECRETS-EXEC-20261011-v1","operation_id":"018b3ff9-7470-470b-bf37-36d8b9b67eb1","catalog_sha256":"catalog-original","ccr_immutable_sha256":"ccr-original","source_bundle":[{"path":"/owner/mediator.py","sha256":"source-original"}],"operations":[{"method":"POST","path":"/v1/sys/policies/acl/exact","payload_sha256":"body-original"}]}}}`), &r)
+ if err != nil { t.Fatal(err) }
+ return r
+}
+
+func TestExecutionContractExactSemanticChangesInvalidateBinding(t *testing.T) {
+ original := executionRequest(t)
+ digest := RequestDigest(original)
+ cases := map[string]func(*CheckRequest){
+ "operation id":func(r *CheckRequest){r.Context["execution_contract"].(map[string]any)["operation_id"]="other"},
+ "catalog":func(r *CheckRequest){r.Context["execution_contract"].(map[string]any)["catalog_sha256"]="other"},
+ "ccr":func(r *CheckRequest){r.Context["execution_contract"].(map[string]any)["ccr_immutable_sha256"]="other"},
+ "source":func(r *CheckRequest){r.Context["execution_contract"].(map[string]any)["source_bundle"].([]any)[0].(map[string]any)["sha256"]="other"},
+ "method":func(r *CheckRequest){r.Context["execution_contract"].(map[string]any)["operations"].([]any)[0].(map[string]any)["method"]="DELETE"},
+ "target":func(r *CheckRequest){r.Context["execution_contract"].(map[string]any)["operations"].([]any)[0].(map[string]any)["path"]="/v1/sys/policies/acl/sibling"},
+ "body":func(r *CheckRequest){r.Context["execution_contract"].(map[string]any)["operations"].([]any)[0].(map[string]any)["payload_sha256"]="other"},
+ "principal":func(r *CheckRequest){r.Subject.ID="other"},
+ "action":func(r *CheckRequest){r.Action="apply"},
+ "tenant":func(r *CheckRequest){r.Tenant="other"},
+ }
+ for name, change := range cases {t.Run(name,func(t *testing.T){r:=executionRequest(t);change(&r);if RequestDigest(r)==digest || ApprovalBindingDigest(r)==digest {t.Fatal("semantic mutation retained binding")}})}
+}
+
+func TestExecutionContractApprovalJoinAndEnrichment(t *testing.T) {
+ issue:=executionRequest(t)
+ // Model the actual evaluator's tenant/registry overlay before issue Check.
+ issue.Subject.Tenant=issue.Tenant
+ issue.Subject.Attributes=map[string]any{"display_name":"Engine owner"}
+ issue.Resource.Tenant=issue.Tenant
+ submitted:=executionRequest(t)
+ submitted.Context["approval"]=map[string]any{"kind":"approval-claim","binding":map[string]any{"pdp_digest":RequestDigest(issue)}}
+ evaluated:=issue
+ evaluated.Context=map[string]any{}
+ for k,v:=range issue.Context {evaluated.Context[k]=v}
+ evaluated.Context["approval"]=submitted.Context["approval"]
+ binding:=NewDecisionBindingFor(evaluated,submitted)
+ if binding.SubmittedRequestDigest!=RequestDigest(submitted) {t.Fatal("submitted request not bound")}
+ if binding.ApprovalBindingDigest!=RequestDigest(issue) {t.Fatal("claim-free issue digest does not join")}
+ if binding.RequestDigest==binding.SubmittedRequestDigest {t.Fatal("test did not exercise enriched request")}
+ submitted.ID="different-correlation-id"
+ if RequestDigest(submitted)!=binding.SubmittedRequestDigest {t.Fatal("correlation id unexpectedly authorizes")}
+}