access-engine/docs/decisionpep-adapter.md

Authenticated Go decision client

pkg/decisionpep is the producer-owned consumer of the normal signed Check contract. It sends one current request with a fresh nonce, validates the unchanged producer signature and exact request/policy/registry/caller/lifetime bindings, and returns only a verified ALLOW without unimplemented obligations. It renders no policy and grants no protected effect itself. It requires the explicit lossless-json-v1 wire profile and signed standalone/lossless-json-v1 provenance; legacy callers keep their original numeric projection. Purpose-bearing readback and the separate trusted task-execution profile are not accepted by this client.

The standalone Go 1.24 slice is generated from the same root source with make decisionpep-export. make decisionpep-check and the ordinary root Go tests refuse export drift. The export contains exact API/signature source, one client, its tests, license and a synthetic-fixture signer. It contains no signer key, credential, OPA engine, policy evaluator or deployable service. Outer release provenance pins the actual producer commit and complete export hashes; the manifest's older API/signature baseline identifies those unchanged contract bytes.

Consumers vendor the generated directory and retain its original module/import identity through their dependency lock. Independently admitted configuration must supply the HTTPS endpoint, CA, PDP public keys, policy/registry digests and caller identity, with only a path to the private rotating caller credential. There is no usable production admission or default trust in this source example. Do not bootstrap trust from a response, environment proxy, token contents or discovered key. Redirects, missing trust and unavailable/expired/unsigned/downgraded decisions refuse. Caller credentials are read per Check; consumers must also reload their admission under the owner's revocation and rotation contract.

The Forgejo example keeps the three original groups in PDP policy. Its application resource tenant and issuer are registry-owned. Verified runtime identity and fresh UserInfo facts are supplied in request context only by the admitted Forgejo caller; they are not fictional static subject attributes. The actual Forgejo consumer independently validates issuer JWT signature, algorithm, type, issuer, audience, authorized party and lifetime before consulting this PDP. The example registry and keys used in tests are synthetic. A login callback decision covers that callback; it does not establish later HTTP/API/Git/SSH, operation/inverse or session revocation acceptance. Native application admission and complete coverage remain CUST-WP-0080 / NK-WP-0048-T43 / RAPPS-WP-0016-T09 work.