Sign decision envelopes and close FLEX-WP-0024.

Detached Ed25519 over the canonical envelope with signature omitted. Unsigned is stated, not implied. Testdata fixtures prove verify and tamper failure without minting a production key. FLEX-WP-0025 is finished with the validate check from the previous commit. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267
2026-09-14 09:57:50 +02:00 · 2026-09-14 09:57:50 +02:00 · 127f83da4d
commit 127f83da4d
parent c074237aac
15 changed files with 697 additions and 4 deletions
--- a/examples/secrets-engine/replay/decision_rotate_signed_tampered.json
+++ b/examples/secrets-engine/replay/decision_rotate_signed_tampered.json
@ -0,0 +1,118 @@
+{
+  "id": "decision:414734bb30381ff7",
+  "contract_version": "flex-auth.decision-record.v1",
+  "request_id": "check:secrets-engine-rotate",
+  "effect": "deny",
+  "reason": "tampered_after_signing",
+  "matched_policy_version": "v2",
+  "matched_rule": "catalog_lane_policy_matched",
+  "resource": {
+    "id": "lane:glas-primary",
+    "type": "secret-catalog-lane",
+    "system": "secrets-engine",
+    "tenant": "tenant:platform",
+    "attributes": {
+      "auth_targets": [],
+      "fields": [
+        "password"
+      ],
+      "policy_targets": [],
+      "stage": "prod"
+    }
+  },
+  "subject": {
+    "id": "secrets-engine",
+    "type": "service",
+    "tenant": "tenant:platform",
+    "attributes": {
+      "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
+      "display_name": "secrets-engine service principal",
+      "groups": [
+        "group:secrets-engine-lane-operators"
+      ],
+      "organization_relation": "ServiceProvider",
+      "roles": [
+        "Operator"
+      ]
+    }
+  },
+  "binding": {
+    "tenant": "tenant:platform",
+    "subject": {
+      "id": "secrets-engine",
+      "type": "service",
+      "tenant": "tenant:platform",
+      "attributes": {
+        "description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
+        "display_name": "secrets-engine service principal",
+        "groups": [
+          "group:secrets-engine-lane-operators"
+        ],
+        "organization_relation": "ServiceProvider",
+        "roles": [
+          "Operator"
+        ]
+      }
+    },
+    "action": "rotate",
+    "resource": {
+      "id": "lane:glas-primary",
+      "type": "secret-catalog-lane",
+      "system": "secrets-engine",
+      "tenant": "tenant:platform",
+      "attributes": {
+        "auth_targets": [],
+        "fields": [
+          "password"
+        ],
+        "policy_targets": [],
+        "stage": "prod"
+      }
+    },
+    "request_digest": "sha256:de67324f54187055307a833235f83ced9fcd3a20952a27b3d19493ed39734345",
+    "submitted_request_digest": "sha256:41c8fc084e58c46554ccb6afe9943a99906e5986668c923811721f66d9b30a6a"
+  },
+  "lifetime": {
+    "kind": "ttl",
+    "ttl": "15m",
+    "not_before": "2026-09-07T07:10:23Z",
+    "expires_at": "2026-09-07T07:25:23Z"
+  },
+  "diagnostics": {
+    "action": "rotate",
+    "matched_relationship": "",
+    "policy_package": "secrets-engine.catalog-lane.lifecycle",
+    "policy_status": "ready",
+    "registry_overrode": [],
+    "registry_resource": false,
+    "registry_subject": true
+  },
+  "provenance": {
+    "evaluator": "flex-auth/local",
+    "mode": "standalone",
+    "policy_package": "secrets-engine.catalog-lane.lifecycle",
+    "policy_version": "v2",
+    "policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
+    "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
+    "decision_time": "2026-09-07T07:10:23Z"
+  },
+  "signature": {
+    "mode": "signed",
+    "alg": "ed25519",
+    "kid": "testdata-ed25519",
+    "value": "G45R7eb_7Dl7B8RO5HTgefcys6QabYwe7NZcF4ju_zpEAfEBWKVK5T5e5rP1GNJ5uuVusrw6Fd90tttg3_-CAQ"
+  },
+  "caring": {
+    "profile": "caring-0.4.0-rc2",
+    "conformance_findings": [
+      {
+        "code": "CARING-DESCRIPTOR-MISSING",
+        "severity": "warning",
+        "message": "no CARING descriptor matched the request",
+        "fields": [
+          "caring_context"
+        ]
+      }
+    ]
+  }
+}