Finish FLEX-WP-0019 layer-model v0.7 conformance

Close the remaining PDP obligations: mechanical layer declaration check,
registry-snapshot digest in provenance, explicit allow TTL, per-input-class
freshness deadlines, and the published decision-record contract. Document
the canonical request digest as the §6.4.2 replay test.

Assistant: grok
Assistant-Session: 01a06256-fb71-7102-b3a9-27e6734257d0

internal/adapters/relationship/adapter.go

@@ -14,10 +14,13 @@ import (
 
 // Adapter wraps tuple-oriented PDP results into flex-auth decision envelopes.
 type Adapter struct {
-	backend       Backend
-	backendName   string
-	policyPackage string
-	policyVersion string
+	backend                Backend
+	backendName            string
+	policyPackage          string
+	policyVersion          string
+	policyPackageDigest    string
+	registrySnapshotDigest string
+	allowTTL               string
 }
 
 // New creates a relationship PDP adapter.
@@ -30,10 +33,13 @@ func New(backend Backend, options Options) (*Adapter, error) {
 		backendName = "relationship"
 	}
 	return &Adapter{
-		backend:       backend,
-		backendName:   backendName,
-		policyPackage: options.PolicyPackage,
-		policyVersion: options.PolicyVersion,
+		backend:                backend,
+		backendName:            backendName,
+		policyPackage:          options.PolicyPackage,
+		policyVersion:          options.PolicyVersion,
+		policyPackageDigest:    options.PolicyPackageDigest,
+		registrySnapshotDigest: options.RegistrySnapshotDigest,
+		allowTTL:               options.AllowTTL,
 	}, nil
 }
 
@@ -230,7 +236,8 @@ func (a *Adapter) envelope(request api.CheckRequest, tupleRequest TupleCheckRequ
 		},
 		Caring: caringDecisionMetadata(request, descriptorForResult(request, result), result.ConformanceFindings),
 	}
-	envelope.ID = decisionID(a.backendName, a.policyPackage, policyVersion, request, effect, reason, result.ConsistencyToken)
+	envelope = a.finish(request, envelope)
+	envelope.ID = decisionID(a.backendName, a.policyPackage, policyVersion, request, envelope.Effect, envelope.Reason, result.ConsistencyToken)
 	return envelope
 }
 
@@ -255,10 +262,22 @@ func (a *Adapter) failureEnvelope(request api.CheckRequest, tupleRequest TupleCh
 		},
 		Caring: caringDecisionMetadata(request, request.CaringContext, []api.CaringConformanceFinding{failureFinding(kind)}),
 	}
+	envelope = a.finish(request, envelope)
 	envelope.ID = decisionID(a.backendName, a.policyPackage, policyVersion, request, envelope.Effect, envelope.Reason, "")
 	return envelope
 }
 
+func (a *Adapter) finish(request api.CheckRequest, envelope api.DecisionEnvelope) api.DecisionEnvelope {
+	if envelope.Provenance.RegistrySnapshotDigest == "" {
+		envelope.Provenance.RegistrySnapshotDigest = a.registrySnapshotDigest
+	}
+	if envelope.Provenance.PolicyPackageDigest == "" {
+		envelope.Provenance.PolicyPackageDigest = a.policyPackageDigest
+	}
+	api.CompleteDecision(&envelope, request, api.DecisionCompletion{AllowTTL: a.allowTTL})
+	return envelope
+}
+
 func descriptorForResult(request api.CheckRequest, result TupleCheckResult) *api.CaringAccessDescriptor {
 	if request.CaringContext != nil {
 		return request.CaringContext

internal/adapters/relationship/types.go

@@ -27,9 +27,12 @@ type Backend interface {
 // Options configures the relationship adapter without binding callers to a
 // specific backend protocol.
 type Options struct {
-	BackendName   string
-	PolicyPackage string
-	PolicyVersion string
+	BackendName            string
+	PolicyPackage          string
+	PolicyVersion          string
+	PolicyPackageDigest    string
+	RegistrySnapshotDigest string
+	AllowTTL               string
 }
 
 // Tuple is the canonical relation fact sent to tuple-oriented PDPs.