fix(auth): sign served decisions before recording and returning them

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

charts/access-engine/templates/deployment.yaml

@@ -12,6 +12,14 @@
 {{- fail "auditDelivery.mountPath must be an absolute normalized directory" }}
 {{- end }}
 {{- end }}
+{{- if .Values.envelopeSigning.enabled }}
+{{- if ne (first .Values.args) "serve" }}
+{{- fail "envelopeSigning currently supports serve decision pins only" }}
+{{- end }}
+{{- if or (not (hasPrefix "/" .Values.envelopeSigning.mountPath)) (contains ".." .Values.envelopeSigning.mountPath) }}
+{{- fail "envelopeSigning.mountPath must be an absolute normalized directory" }}
+{{- end }}
+{{- end }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -53,6 +61,12 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
             {{- toYaml .Values.args | nindent 12 }}
+            {{- if .Values.envelopeSigning.enabled }}
+            - --envelope-signing-key-file
+            - {{ printf "%s/seed" .Values.envelopeSigning.mountPath | quote }}
+            - --envelope-signing-kid
+            - {{ required "envelopeSigning.kid must be independently admitted" .Values.envelopeSigning.kid | quote }}
+            {{- end }}
             {{- if .Values.outbox.enabled }}
             - --outbox-dir
             - {{ .Values.outbox.mountPath | quote }}
@@ -114,8 +128,13 @@ spec:
               drop:
                 - ALL
             readOnlyRootFilesystem: true
-          {{- if or .Values.outbox.enabled .Values.auditDelivery.enabled (eq (include "access-engine.callerAuth.enabled" .) "true") }}
+          {{- if or .Values.envelopeSigning.enabled .Values.outbox.enabled .Values.auditDelivery.enabled (eq (include "access-engine.callerAuth.enabled" .) "true") }}
           volumeMounts:
+            {{- if .Values.envelopeSigning.enabled }}
+            - mountPath: {{ .Values.envelopeSigning.mountPath | quote }}
+              name: access-engine-envelope-signing
+              readOnly: true
+            {{- end }}
             {{- if .Values.auditDelivery.enabled }}
             - mountPath: {{ .Values.auditDelivery.mountPath | quote }}
               name: access-engine-audit
@@ -131,8 +150,17 @@ spec:
               readOnly: true
             {{- end }}
           {{- end }}
-      {{- if or .Values.outbox.enabled .Values.auditDelivery.enabled (eq (include "access-engine.callerAuth.enabled" .) "true") }}
+      {{- if or .Values.envelopeSigning.enabled .Values.outbox.enabled .Values.auditDelivery.enabled (eq (include "access-engine.callerAuth.enabled" .) "true") }}
       volumes:
+        {{- if .Values.envelopeSigning.enabled }}
+        - name: access-engine-envelope-signing
+          secret:
+            secretName: {{ required "envelopeSigning.secretName must name an admitted existing Secret" .Values.envelopeSigning.secretName | quote }}
+            defaultMode: 0440
+            items:
+              - key: {{ required "envelopeSigning.secretKey is required" .Values.envelopeSigning.secretKey | quote }}
+                path: seed
+        {{- end }}
         {{- if .Values.auditDelivery.enabled }}
         - name: access-engine-audit
           secret:

charts/access-engine/values.yaml

@@ -85,3 +85,11 @@ resources:
   limits:
     cpu: 300m
     memory: 192Mi
+
+# Inert until an independently admitted signer and existing custody Secret exist.
+envelopeSigning:
+  enabled: false
+  kid: ""
+  secretName: ""
+  secretKey: ""
+  mountPath: /var/run/secrets/decision-envelope-signing