{
  "schema": "access-engine.signer-public-pin.v1",
  "purpose": "Exact issuer/policy pin the retained Secrets lifecycle PDP signs under. Input to tools/prepare_signer_public_receipt.py; never a key and never consumer trust by itself.",
  "expected_kid": "flex-auth-lifecycle-20261016-r1",
  "pin": {
    "evaluator": "flex-auth/local",
    "mode": "standalone",
    "policy_package": "secrets-engine.catalog-lane.lifecycle",
    "policy_version": "v2",
    "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4"
  },
  "derivation": {
    "date": "2026-10-21",
    "source_revision": "84c78e072c8f3daf2bc3b90f8efc8fbeb16c3cf0",
    "image": "forgejo.coulomb.social/coulomb/flex-auth@sha256:09a83b273740133518cc7e7915fb211381e06545d347d2dd1974042525ac981f",
    "policy_file": "examples/secrets-engine/policy_package.md",
    "policy_file_sha256": "sha256:657fa9312c9dcabee059ec31c89ee13396fe9aa54d852edc9e6559a74bbc139a",
    "command": "git archive 84c78e0 | tar -x -C <dir>; cd <dir>; go run ./cmd/access-engine check -policy examples/secrets-engine/policy_package.md -registry examples/secrets-engine/registry_snapshot.json -request examples/secrets-engine/check_request_allow_rotate.json",
    "result": "provenance fields above; signature {mode: unsigned} (no key in source)",
    "rollout_manifest": "the-custodian docs/changes/netkingdom-target-2026-10-16/access-native-admission/rollout-r2/manifest.json sha256:5be7a7f438624dcb35b7dbc96e7c9e5a8e2d5d1b1966cb4338aa5aecbe3a8b59",
    "rollout_activation_values_sha256": "sha256:e76a30967add800ed8b588368757e7a5fa0ce4d8305ef658b5a4a08e377eb5b8",
    "confirmation_required": "The first native signed allow/deny must carry these exact provenance values; tools/verify_native_signer_receipt.py refuses otherwise. A changed policy package, image or source is a new pin and a new receipt."
  }
}