# Authenticated Go decision client

`pkg/decisionpep` is the producer-owned consumer of the normal signed Check
contract. It sends one current request with a fresh nonce, validates the unchanged
producer signature and exact request/policy/registry/caller/lifetime bindings, and
returns only a verified ALLOW without unimplemented obligations. It renders no
policy and grants no protected effect itself. It requires the explicit
`lossless-json-v1` wire profile and signed `standalone/lossless-json-v1` provenance;
legacy callers keep their original numeric projection. Purpose-bearing readback
and the separate trusted task-execution profile are not accepted by this client.

The standalone Go 1.24 slice is generated from the same root source with
`make decisionpep-export`. `make decisionpep-check` and the ordinary root Go tests
refuse export drift. The export contains exact API/signature source, one client,
its tests, license and a synthetic-fixture signer. It contains no signer key,
credential, OPA engine, policy evaluator or deployable service. Outer release
provenance pins the actual producer commit and complete export hashes; the
manifest's older API/signature baseline identifies those unchanged contract bytes.

Consumers vendor the generated directory and retain its original module/import
identity through their dependency lock. Independently admitted configuration must
supply the HTTPS endpoint, CA, PDP public keys, policy/registry digests and caller
identity, with only a path to the private rotating caller credential. There is no
usable production admission or default trust in this source example. Do not
bootstrap trust from a response, environment proxy, token contents or discovered
key. Redirects, missing trust and unavailable/expired/unsigned/downgraded decisions
refuse. Caller credentials are read per Check; consumers must also reload their
admission under the owner's revocation and rotation contract.

The Forgejo example keeps the three original groups in PDP policy. Its application
resource tenant and issuer are registry-owned. Verified runtime identity and fresh
UserInfo facts are supplied in request context only by the admitted Forgejo caller;
they are not fictional static subject attributes. The actual Forgejo consumer
independently validates issuer JWT signature, algorithm, type, issuer, audience,
authorized party and lifetime before consulting this PDP. The example registry and
keys used in tests are synthetic. A login callback decision covers that callback;
it does not establish later HTTP/API/Git/SSH, operation/inverse or session
revocation acceptance. Native application admission and complete coverage remain
CUST-WP-0080 / NK-WP-0048-T43 / RAPPS-WP-0016-T09 work.