tegwick
17f92c9f11
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 3775@bnt-lap001 Assistant-Session: cfacb6a5-ad5b-4f79-ac67-053e3b0d34a3
23 lines
1.1 KiB
Markdown
23 lines
1.1 KiB
Markdown
# Custody Record Validator
|
|
|
|
Validates the non-secret platform-root custody record defined by
|
|
`canon/schemas/custody-record_v0.1.schema.json` (NK-ADR-0017, status
|
|
proposed; NK-WP-0045-T02/T03). Offline and read-only.
|
|
|
|
```bash
|
|
uv run tools/custody-record/validate.py tools/custody-record/fixtures/valid/*.json
|
|
uv run pytest tools/custody-record/tests
|
|
```
|
|
|
|
Beyond the schema it checks: one active grant per exact `(issuer, subject)`,
|
|
revision ordering and supersession links inside a record, append-only
|
|
successors across reads (`successor_errors`: an older revision is a stale read,
|
|
a removed entry is not a revocation), and secret-looking values.
|
|
`observe_root_grant` is the consumer rule from ADR-0017 section 3: a grant only
|
|
for tenant `platform`, from a valid record read at most 15 minutes ago,
|
|
otherwise no grant (fail closed).
|
|
|
|
Fixtures: `valid/` covers grant, revocation and supersession; `invalid/`
|
|
covers projection-only grants, tenant-admin implication, other tenants,
|
|
secret-bearing fields and values, username keys, an over-long cache bound,
|
|
duplicate active grants and an entry both revoked and superseded.
|