Adopt canonical flex-auth credential checks

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093

scripts/wp0025-broker-readiness.py

@@ -121,7 +121,14 @@ def verify_adapter(
     }
 
 
-def receipt_base(contract: dict[str, Any], reviewer: str, decision: str) -> dict[str, Any]:
+def receipt_base(
+    contract: dict[str, Any],
+    reviewer: str,
+    decision: str,
+    *,
+    now: datetime | None = None,
+) -> dict[str, Any]:
+    created_at = now or datetime.now(UTC)
     return {
         "interface": BROKER_INTERFACE,
         "version": 1,
@@ -129,7 +136,7 @@ def receipt_base(contract: dict[str, Any], reviewer: str, decision: str) -> dict
         "owner": BROKER_OWNER,
         "reviewer": validate_reviewer(reviewer),
         "decision": decision,
-        "created_at": datetime.now(UTC).replace(microsecond=0).isoformat().replace("+00:00", "Z"),
+        "created_at": created_at.replace(microsecond=0).isoformat().replace("+00:00", "Z"),
         "engagement_id": contract["engagement_id"],
         "target_id": contract["target"]["id"],
         "projection_contract_digest": contract_digest(contract),
@@ -142,22 +149,32 @@ def receipt_base(contract: dict[str, Any], reviewer: str, decision: str) -> dict
 
 
 def build_approval(
-    contract: dict[str, Any], reviewer: str, verification: dict[str, Any]
+    contract: dict[str, Any],
+    reviewer: str,
+    verification: dict[str, Any],
+    *,
+    now: datetime | None = None,
 ) -> dict[str, Any]:
     if verification.get("passed") is not True or verification.get("secret_values_observed") is not False:
         raise ReadinessError("consumer adapter verification did not pass")
     receipt = {
-        **receipt_base(contract, reviewer, "approve"),
+        **receipt_base(contract, reviewer, "approve", now=now),
         "adapter": verification["adapter"],
         "cleanup_request_supported": True,
     }
-    validate_broker_receipt(receipt, contract)
+    validate_broker_receipt(receipt, contract, now=now)
     return receipt
 
 
-def build_change_request(contract: dict[str, Any], reviewer: str, note: str) -> dict[str, Any]:
+def build_change_request(
+    contract: dict[str, Any],
+    reviewer: str,
+    note: str,
+    *,
+    now: datetime | None = None,
+) -> dict[str, Any]:
     return {
-        **receipt_base(contract, reviewer, "request-changes"),
+        **receipt_base(contract, reviewer, "request-changes", now=now),
         "note": validate_note(note),
     }