Add producer-owned Go approval fact validation and canonical vectors

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

tests/test_access_claim_vectors.py

@@ -0,0 +1,42 @@
+"""Producer facts/canonical vectors only; not a Go consumer acceptance test."""
+import json
+from pathlib import Path
+
+import jsonschema
+
+from approval_engine.binding import binding_digest, canonical_binding, canonical_json
+from approval_engine.store import Engine
+from tests.conftest import FROZEN, binding, validity
+
+ROOT = Path(__file__).resolve().parents[1]
+VECTORS = json.loads((ROOT / "examples/access-claim-reader-vectors.json").read_text())
+
+
+def test_native_vectors_match_actual_producer_bytes_and_digest():
+    for case in VECTORS["native_binding_vectors"]:
+        act = binding(target=json.loads(case["input_target_json"]))
+        assert act == case["binding"]
+        assert canonical_json(canonical_binding(act)).decode() == case["canonical_binding_utf8"]
+        assert binding_digest(act) == case["native_digest"]
+    digests = [v["native_digest"] for v in VECTORS["native_binding_vectors"]]
+    assert len(set(digests)) == len(digests)
+
+
+def test_positive_claim_vector_matches_actual_provider_and_schema():
+    case = VECTORS["claim_cases"][0]
+    engine = Engine(clock=lambda: FROZEN)
+    obj = engine.create(binding(), validity(), approval_id=case["submitted_claim"]["approval_id"],
+                        required_count=2, pdp_digest=case["expected_pdp_digest"],
+                        pdp_path=True, human_control=True)
+    engine.add_entry(obj.id, "human:one", principal_type="human")
+    assert engine.claim(obj.id)["valid_now"] is False
+    engine.add_entry(obj.id, "human:two", principal_type="human")
+    assert engine.claim(obj.id) == case["submitted_claim"]
+    from datetime import timedelta
+    engine.clock = lambda: FROZEN + timedelta(seconds=5)
+    assert engine.claim(obj.id) == case["observed_claim"]
+    assert case["submitted_claim"]["freshness"] != case["observed_claim"]["freshness"]
+    schema = json.loads((ROOT / "schemas/approval_claim.schema.json").read_text())
+    jsonschema.Draft202012Validator(schema, format_checker=jsonschema.FormatChecker()).validate(
+        case["observed_claim"])
+    engine.close()