Finish FLEX-WP-0019 layer-model v0.7 conformance

Close the remaining PDP obligations: mechanical layer declaration check,
registry-snapshot digest in provenance, explicit allow TTL, per-input-class
freshness deadlines, and the published decision-record contract. Document
the canonical request digest as the §6.4.2 replay test.

Assistant: grok
Assistant-Session: 01a06256-fb71-7102-b3a9-27e6734257d0

internal/adapters/rule/adapter.go

@@ -14,12 +14,15 @@ import (
 
 // Adapter wraps rule-PDP responses into flex-auth decision envelopes.
 type Adapter struct {
-	backend       Backend
-	backendName   string
-	policyPackage string
-	policyVersion string
-	language      Language
-	caring        api.CaringPolicyMetadata
+	backend                Backend
+	backendName            string
+	policyPackage          string
+	policyVersion          string
+	policyPackageDigest    string
+	registrySnapshotDigest string
+	allowTTL               string
+	language               Language
+	caring                 api.CaringPolicyMetadata
 }
 
 // New creates a delegated rule-PDP adapter.
@@ -36,12 +39,15 @@ func New(backend Backend, options Options) (*Adapter, error) {
 		language = LanguageRego
 	}
 	return &Adapter{
-		backend:       backend,
-		backendName:   backendName,
-		policyPackage: options.PolicyPackage,
-		policyVersion: options.PolicyVersion,
-		language:      language,
-		caring:        options.Caring,
+		backend:                backend,
+		backendName:            backendName,
+		policyPackage:          options.PolicyPackage,
+		policyVersion:          options.PolicyVersion,
+		policyPackageDigest:    options.PolicyPackageDigest,
+		registrySnapshotDigest: options.RegistrySnapshotDigest,
+		allowTTL:               options.AllowTTL,
+		language:               language,
+		caring:                 options.Caring,
 	}, nil
 }
 
@@ -234,7 +240,8 @@ func (a *Adapter) envelope(request api.CheckRequest, evaluation EvaluationReques
 		},
 		Caring: caringDecisionMetadata(request, firstDescriptor(request.CaringContext, result.CaringDescriptor), a.caring, result.ConformanceFindings),
 	}
-	envelope.ID = decisionID(a.backendName, policyPackage, policyVersion, request, effect, reason)
+	envelope = a.finish(request, envelope)
+	envelope.ID = decisionID(a.backendName, policyPackage, policyVersion, request, envelope.Effect, envelope.Reason)
 	return envelope
 }
 
@@ -259,10 +266,22 @@ func (a *Adapter) failureEnvelope(request api.CheckRequest, evaluation Evaluatio
 		},
 		Caring: caringDecisionMetadata(request, request.CaringContext, a.caring, []api.CaringConformanceFinding{failureFinding(kind)}),
 	}
+	envelope = a.finish(request, envelope)
 	envelope.ID = decisionID(a.backendName, a.policyPackage, policyVersion, request, envelope.Effect, envelope.Reason)
 	return envelope
 }
 
+func (a *Adapter) finish(request api.CheckRequest, envelope api.DecisionEnvelope) api.DecisionEnvelope {
+	if envelope.Provenance.RegistrySnapshotDigest == "" {
+		envelope.Provenance.RegistrySnapshotDigest = a.registrySnapshotDigest
+	}
+	if envelope.Provenance.PolicyPackageDigest == "" {
+		envelope.Provenance.PolicyPackageDigest = a.policyPackageDigest
+	}
+	api.CompleteDecision(&envelope, request, api.DecisionCompletion{AllowTTL: a.allowTTL})
+	return envelope
+}
+
 func caringDecisionMetadata(
 	request api.CheckRequest,
 	descriptor *api.CaringAccessDescriptor,

internal/adapters/rule/types.go

@@ -33,11 +33,14 @@ type Backend interface {
 
 // Options configures the rule adapter.
 type Options struct {
-	BackendName   string
-	PolicyPackage string
-	PolicyVersion string
-	Language      Language
-	Caring        api.CaringPolicyMetadata
+	BackendName            string
+	PolicyPackage          string
+	PolicyVersion          string
+	PolicyPackageDigest    string
+	RegistrySnapshotDigest string
+	AllowTTL               string
+	Language               Language
+	Caring                 api.CaringPolicyMetadata
 }
 
 // EvaluationRequest is the canonical rule-PDP request.