History

tegwick 17f92c9f11 All checks were successful CI Smoke / host-smoke (push) Successful in 0s Details CI Smoke / container-smoke (push) Successful in 1s Details CUST-WP-0075: NK-WP-0045 custody-record schema and validator; NK-WP-0042 reply Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3		2026-10-03 12:56:22 +02:00
..
fixtures	CUST-WP-0075: NK-WP-0045 custody-record schema and validator; NK-WP-0042 reply	2026-10-03 12:56:22 +02:00
tests	CUST-WP-0075: NK-WP-0045 custody-record schema and validator; NK-WP-0042 reply	2026-10-03 12:56:22 +02:00
README.md	CUST-WP-0075: NK-WP-0045 custody-record schema and validator; NK-WP-0042 reply	2026-10-03 12:56:22 +02:00
validate.py	CUST-WP-0075: NK-WP-0045 custody-record schema and validator; NK-WP-0042 reply	2026-10-03 12:56:22 +02:00

README.md

Custody Record Validator

Validates the non-secret platform-root custody record defined by canon/schemas/custody-record_v0.1.schema.json (NK-ADR-0017, status proposed; NK-WP-0045-T02/T03). Offline and read-only.

uv run tools/custody-record/validate.py tools/custody-record/fixtures/valid/*.json
uv run pytest tools/custody-record/tests

Beyond the schema it checks: one active grant per exact (issuer, subject), revision ordering and supersession links inside a record, append-only successors across reads (successor_errors: an older revision is a stale read, a removed entry is not a revocation), and secret-looking values. observe_root_grant is the consumer rule from ADR-0017 section 3: a grant only for tenant platform, from a valid record read at most 15 minutes ago, otherwise no grant (fail closed).

Fixtures: valid/ covers grant, revocation and supersession; invalid/ covers projection-only grants, tenant-admin implication, other tenants, secret-bearing fields and values, username keys, an over-long cache bound, duplicate active grants and an entry both revoked and superseded.