coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FLEX-WP-0024: CCR-2026-0050 Access review, signer public receipt and T07 founder gate
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Approve CCR-2026-0050 for Access scope (sent to railiance-platform).
Add the exact consumer pin derived at candidate 84c78e0 and an offline
projection from the Platform custody receipt to the secrets-engine
pdp-trust.v1 bytes plus a public receipt. No key, rollout or admission.
T07 waits on founder decision 4fab263d.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 809600@bnt-lap001
Assistant-Session: 40ba228f-c8a0-4ec9-bb29-3129951afdc4
This commit is contained in:
tegwick 2026-10-21 01:22:46 +02:00
parent c130b7d739
commit c1e83c16bf
6 changed files with 236 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

46
tests/test_signer_public_receipt.py Normal file
View file

@ -0,0 +1,46 @@
"""Offline regression for the signer public receipt projection (synthetic values only)."""
import base64
import hashlib
import importlib.util
import json
from pathlib import Path
import unittest
ROOT = Path(__file__).resolve().parents[1]
spec = importlib.util.spec_from_file_location('public_receipt', ROOT / 'tools/prepare_signer_public_receipt.py')
MODULE = importlib.util.module_from_spec(spec)
spec.loader.exec_module(MODULE)
PIN = (ROOT / 'docs/native-signer-public-pin.json').read_bytes()
KEY = base64.urlsafe_b64encode(bytes(range(32))).decode().rstrip('=') # synthetic, not a real key
def custody(**changes):
value = {'schema': MODULE.CUSTODY_SCHEMA, 'path': MODULE.CUSTODY_PATH, 'kv_version': 1,
'status': 'custody-verified-pending-independent-public-admission',
'kid': 'flex-auth-lifecycle-20261016-r1', 'public_key': KEY,
'public_fingerprint': 'sha256:' + hashlib.sha256(KEY.encode()).hexdigest()}
value.update(changes)
return json.dumps(value).encode()
class PublicReceiptTests(unittest.TestCase):
def test_trust_matches_secrets_schema(self):
trust_bytes, receipt = MODULE.build(custody(), PIN, b'ccr', b'plan')
trust = json.loads(trust_bytes)
self.assertEqual(set(trust), {'schema', 'evaluator', 'mode', 'policy_package', 'policy_version',
'policy_package_digest', 'keys'})
self.assertEqual(trust['keys'], {'flex-auth-lifecycle-20261016-r1': KEY})
self.assertEqual(receipt['trust_file_sha256'], 'sha256:' + hashlib.sha256(trust_bytes).hexdigest())
self.assertNotIn(b'PRIVATE', json.dumps(receipt).encode())
def test_refusals(self):
for bad in (custody(kv_version=None), custody(status='write-intent-unknown'),
custody(kid='other'), custody(public_fingerprint='sha256:00'),
custody(public_key=KEY + '='), custody(ED25519_PRIVATE_KEY='x'),
custody(source_ccr_sha256='sha256:other')):
with self.assertRaises(ValueError):
MODULE.build(bad, PIN, b'ccr', b'plan')
if __name__ == '__main__':
unittest.main()