tegwick
ca0cb75729
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
39 lines
2.7 KiB
Markdown
39 lines
2.7 KiB
Markdown
# Authenticated Go decision client
|
|
|
|
`pkg/decisionpep` is the producer-owned consumer of the normal signed Check
|
|
contract. It sends one current request with a fresh nonce, validates the unchanged
|
|
producer signature and exact request/policy/registry/caller/lifetime bindings, and
|
|
returns only a verified ALLOW without unimplemented obligations. It renders no
|
|
policy and grants no protected effect itself. It requires the explicit
|
|
`lossless-json-v1` wire profile and signed `standalone/lossless-json-v1` provenance;
|
|
legacy callers keep their original numeric projection. Purpose-bearing readback
|
|
and the separate trusted task-execution profile are not accepted by this client.
|
|
|
|
The standalone Go 1.24 slice is generated from the same root source with
|
|
`make decisionpep-export`. `make decisionpep-check` and the ordinary root Go tests
|
|
refuse export drift. The export contains exact API/signature source, one client,
|
|
its tests, license and a synthetic-fixture signer. It contains no signer key,
|
|
credential, OPA engine, policy evaluator or deployable service. Outer release
|
|
provenance pins the actual producer commit and complete export hashes; the
|
|
manifest's older API/signature baseline identifies those unchanged contract bytes.
|
|
|
|
Consumers vendor the generated directory and retain its original module/import
|
|
identity through their dependency lock. Independently admitted configuration must
|
|
supply the HTTPS endpoint, CA, PDP public keys, policy/registry digests and caller
|
|
identity, with only a path to the private rotating caller credential. There is no
|
|
usable production admission or default trust in this source example. Do not
|
|
bootstrap trust from a response, environment proxy, token contents or discovered
|
|
key. Redirects, missing trust and unavailable/expired/unsigned/downgraded decisions
|
|
refuse. Caller credentials are read per Check; consumers must also reload their
|
|
admission under the owner's revocation and rotation contract.
|
|
|
|
The Forgejo example keeps the three original groups in PDP policy. Its application
|
|
resource tenant and issuer are registry-owned. Verified runtime identity and fresh
|
|
UserInfo facts are supplied in request context only by the admitted Forgejo caller;
|
|
they are not fictional static subject attributes. The actual Forgejo consumer
|
|
independently validates issuer JWT signature, algorithm, type, issuer, audience,
|
|
authorized party and lifetime before consulting this PDP. The example registry and
|
|
keys used in tests are synthetic. A login callback decision covers that callback;
|
|
it does not establish later HTTP/API/Git/SSH, operation/inverse or session
|
|
revocation acceptance. Native application admission and complete coverage remain
|
|
CUST-WP-0080 / NK-WP-0048-T43 / RAPPS-WP-0016-T09 work.
|