coulomb/approval-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Publish the valid-but-unbound claim; the missing shape was confounded

Browse source 
The example set satisfied §11's both-shapes clause only by accident. Both
values of pdp_digest and pdp_path appeared, but they appeared in perfect
correlation with validity: claim.valid carried a digest with pdp_path true,
claim.revoked carried null with pdp_path false, and nothing else existed.

Two independent dimensions presented as one. A reader could reasonably conclude
that pdp_digest is null because the claim is revoked, or that pdp_path tracks
validity. Both are false, and the example set is what would have taught them --
the failure the both-shapes clause exists to catch, which this repo proposed and
then shipped a case of.

The missing shape is the consequential one: a claim that is entirely valid --
valid_now true, reason_code ok, not consumed -- and carries no PDP binding. It
is usable for a consumer comparing the native binding.digest and unusable on the
GH-DEC-2026-003 path, where a PEP MUST refuse it. valid_now true is not
permission to proceed on that lane. A consumer writing that refusal previously
had no published shape to test against and would have had to invent a fixture,
which is the drift §12 names.

examples/claim.valid.no-pdp.json publishes it. The tests now assert the
decorrelation rather than mere presence: one requires a valid claim with no PDP
binding to exist, the other requires valid claims to cover both pdp_path
declarations. Verified both fail when the new example is removed, so they hold
the property rather than restating today's file list. 121 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PM5HnEAhokxdfcPqBNpT7D

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 715850@bnt-lap001
Assistant-Session: eb557e93-7cb1-45d0-9e57-7d15b3edc60e
This commit is contained in:
tegwick 2026-09-07 13:48:00 +02:00
parent 119359c33d
commit d5d1e41035
3 changed files with 99 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

44
tests/test_examples.py
View file

@ -46,6 +46,50 @@ def test_examples_cover_both_pdp_path_declarations():
assert states == {True, False}
def test_pdp_binding_is_not_confounded_with_validity():
"""Both shapes present is not enough if they only ever co-vary.
With only `claim.valid` (pdp_digest set, pdp_path true) and `claim.revoked`
(null, false), the two dimensions are perfectly correlated and an
implementer can reasonably infer that pdp_digest is null *because* the claim
is revoked, or that pdp_path tracks validity. Both inferences are wrong and
the example set is what teaches them.
The shape that must exist is a claim that is entirely valid -- `valid_now`
true, `reason_code` ok, not consumed -- and still carries no PDP binding.
That is the claim a privileged-lane PEP MUST refuse under
`GH-DEC-2026-008`, and it is the one a consumer would otherwise have to
invent a fixture for.
"""
claims = [json.loads(p.read_text()) for p in EXAMPLES]
valid_without_pdp = [
c
for c in claims
if c["valid_now"]
and c["reason_code"] == "ok"
and not c["consumed"]
and c["binding"]["pdp_digest"] is None
and c["binding"]["pdp_path"] is False
]
assert valid_without_pdp, (
"no example of a valid claim with no PDP binding; a consumer writing the "
"privileged-lane refusal has no published shape to test against"
)
def test_valid_claims_cover_both_pdp_path_declarations():
"""The decorrelation stated as coverage rather than as one instance."""
paths = {
c["binding"]["pdp_path"]
for c in (json.loads(p.read_text()) for p in EXAMPLES)
if c["valid_now"]
}
assert paths == {True, False}, (
f"valid examples declare only pdp_path={paths}; both are reachable states "
"for a valid approval"
)
@pytest.mark.parametrize("path", EXAMPLES, ids=lambda p: p.name)
def test_pdp_path_examples_always_carry_a_digest(path):
"""GH-DEC-2026-008: pdp_path true guarantees pdp_digest non-null."""