Adopt canonical flex-auth credential checks

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e56-e4ad-71a2-b3e2-b6193e0d8093

tests/test_wp0025_broker_readiness.py

@@ -7,6 +7,7 @@ import stat
 import sys
 import tempfile
 import unittest
+from datetime import datetime
 from pathlib import Path
 
 
@@ -28,6 +29,12 @@ SPEC.loader.exec_module(module)
 
 
 class BrokerReadinessTests(unittest.TestCase):
+    @staticmethod
+    def engagement_time(contract: dict) -> datetime:
+        return datetime.fromisoformat(
+            contract["window"]["starts_at"].replace("Z", "+00:00")
+        )
+
     def test_show_is_direct_and_authorizes_no_live_mutation(self) -> None:
         result = module.show(projection_contract())
         self.assertEqual("whitehat-security", result["owner"])
@@ -78,13 +85,21 @@ class BrokerReadinessTests(unittest.TestCase):
             },
             "secret_values_observed": False,
         }
-        receipt = module.build_approval(contract, "whitehat-owner", verification)
+        now = self.engagement_time(contract)
+        receipt = module.build_approval(
+            contract, "whitehat-owner", verification, now=now
+        )
         self.assertEqual("approve", receipt["decision"])
         self.assertTrue(receipt["cleanup_request_supported"])
-        change = module.build_change_request(contract, "whitehat-owner", "Bind cleanup acknowledgement.")
+        change = module.build_change_request(
+            contract,
+            "whitehat-owner",
+            "Bind cleanup acknowledgement.",
+            now=now,
+        )
         self.assertEqual("request-changes", change["decision"])
         with self.assertRaises(module.ReadinessError):
-            module.build_change_request(contract, "whitehat-owner", "")
+            module.build_change_request(contract, "whitehat-owner", "", now=now)
 
     def test_receipt_export_is_raw_canonical_document_with_private_mode(self) -> None:
         contract = projection_contract()
@@ -99,7 +114,12 @@ class BrokerReadinessTests(unittest.TestCase):
             },
             "secret_values_observed": False,
         }
-        receipt = module.build_approval(contract, "whitehat-owner", verification)
+        receipt = module.build_approval(
+            contract,
+            "whitehat-owner",
+            verification,
+            now=self.engagement_time(contract),
+        )
         with tempfile.TemporaryDirectory() as directory:
             path = Path(directory) / "nested" / "broker.json"
             module.write_receipt(path, receipt)