From d4024083f8cc75b0dd16c9cec8e7f8596a9c31ac Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 23 Aug 2026 14:24:24 +0200 Subject: [PATCH] fix(contract): pin action authorization digest Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81 --- examples/caring/action_authorization.json | 2 +- pkg/api/canonical_test.go | 5 +++++ .../FLEX-WP-0017-action-bound-authorization-contract.md | 6 ++++++ 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/examples/caring/action_authorization.json b/examples/caring/action_authorization.json index 8df937d..2abe187 100644 --- a/examples/caring/action_authorization.json +++ b/examples/caring/action_authorization.json @@ -87,7 +87,7 @@ "context": { "purpose": "contract-test" }, - "request_digest": "sha256:15a07a9ca41df90f0a97568ecb3547bb9a75b8b04bb96a7197e86fe4589c1f45" + "request_digest": "sha256:73d5d7d5b3363f1a1db8f4c0e79c8f33dae5d77ffb97f21e449438bc0defa4c3" }, "provenance": { "evaluator": "flex-auth/local", diff --git a/pkg/api/canonical_test.go b/pkg/api/canonical_test.go index c1786d7..309db7e 100644 --- a/pkg/api/canonical_test.go +++ b/pkg/api/canonical_test.go @@ -4,6 +4,7 @@ import ( "encoding/json" "os" "path/filepath" + "reflect" "testing" "gopkg.in/yaml.v3" @@ -105,6 +106,10 @@ func TestActionAuthorizationExampleParses(t *testing.T) { if authorization.Approvals.RequiredCount != 2 || len(authorization.Approvals.Entries) != 2 { t.Fatalf("Approvals = %+v; want two-person approval", authorization.Approvals) } + wantBinding := api.NewDecisionBinding(authorization.Request) + if !reflect.DeepEqual(authorization.Decision.Binding, wantBinding) { + t.Fatalf("Decision.Binding = %+v; want canonical binding %+v", authorization.Decision.Binding, wantBinding) + } } func TestSchemaFilesAreJSON(t *testing.T) { diff --git a/workplans/FLEX-WP-0017-action-bound-authorization-contract.md b/workplans/FLEX-WP-0017-action-bound-authorization-contract.md index 1772786..aff9500 100644 --- a/workplans/FLEX-WP-0017-action-bound-authorization-contract.md +++ b/workplans/FLEX-WP-0017-action-bound-authorization-contract.md @@ -47,6 +47,12 @@ Publish `schemas/action_authorization.schema.json` and `docs/action-bound-authorization-contract.md`, including exact target mapping, validity, distinct approvals, supersession, and fail-closed outage semantics. +Corrective verification 2026-08-23: secrets-engine detected that the example's +stored request digest predated its final request shape. The fixture now carries +the digest produced by `NewDecisionBinding`, and the API test compares the full +published binding to a freshly generated canonical binding so future fixture +drift fails the suite. + ## Add durable storage and authenticated approval evidence ```task