# Custody Record Validator

Validates the non-secret platform-root custody record defined by
`canon/schemas/custody-record_v0.1.schema.json` (NK-ADR-0017, status
proposed; NK-WP-0045-T02/T03). Offline and read-only.

```bash
uv run tools/custody-record/validate.py tools/custody-record/fixtures/valid/*.json
uv run pytest tools/custody-record/tests
```

Beyond the schema it checks: one active grant per exact `(issuer, subject)`,
revision ordering and supersession links inside a record, append-only
successors across reads (`successor_errors`: an older revision is a stale read,
a removed entry is not a revocation), and secret-looking values.
`observe_root_grant` is the consumer rule from ADR-0017 section 3: a grant only
for tenant `platform`, from a valid record read at most 15 minutes ago,
otherwise no grant (fail closed).

Fixtures: `valid/` covers grant, revocation and supersession; `invalid/`
covers projection-only grants, tenant-admin implication, other tenants,
secret-bearing fields and values, username keys, an over-long cache bound,
duplicate active grants and an entry both revoked and superseded.