# T03 replay fixtures

Real `DecisionEnvelope`s emitted from the published package, for secrets-engine
to verify its digest join (`627810b`) unchanged. `FLEX-WP-0021-T03`.

| File | From |
| --- | --- |
| `decision_rotate.json` | `../check_request_allow_rotate.json` — plain allow, empty context |
| `decision_destroy_dual_control.json` | `../check_request_allow_destroy_dual_control.json` — dual control, valid approval-claim |

Regenerate either with:

```bash
go run ./cmd/flex-auth check \
  -policy   examples/secrets-engine/policy_package.md \
  -registry examples/secrets-engine/registry_snapshot.json \
  -request  examples/secrets-engine/check_request_allow_rotate.json
```

## What is stable and what is not

**Stable across runs** — these are the fields to pin a contract test against:

| Field | `rotate` | `destroy` |
| --- | --- | --- |
| `binding.request_digest` | `sha256:de67324f…4345` | `sha256:fc155db…bdf3` |
| `provenance.policy_package_digest` | `sha256:fe0070b7…bd8c` | same |
| `provenance.registry_snapshot_digest` | `sha256:f5a309bc…40bb` | same |
| `provenance.input_claim_digests.context` | absent (empty context) | `sha256:b0d2203…c221` |

Verified identical across two runs.

**Not stable:** `id`, `provenance.decision_time`, and `lifetime.not_before` /
`lifetime.expires_at` move with the clock. `lifetime.ttl` is `15m` from the
package's `allow_ttl`. Do not pin the record as a whole.

`input_claim_digests.context` appears only when the request carries a non-empty
context — which is why both fixtures are here rather than just one. A consumer
asserting the field is always present would pass on `destroy` and fail on
`rotate`.

The `destroy` request's `context.approval` is a **complete** approval-claim,
valid against `approval-engine/schemas/approval_claim.schema.json` including the
now-required `binding.pdp_digest`. It was regenerated on 2026-09-06 when that
claim was completed, so its digests differ from the first emission — a partial
claim in a fixture is how a consumer learns the wrong shape.

## Not a deployment

These come from `flex-auth/local` in `standalone` mode
(`provenance.evaluator` / `mode`), not from a cluster pin. No
`flex-auth-secrets-engine` pin exists yet (`FLEX-WP-0021-T04`), and the consumer
policy pin stays unset until `T05`.