Match native proof HTTPS egress to the service ingress peer

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f

docs/evidence/infd-requester-proof-before-ingress-peer.json

@@ -0,0 +1,14 @@
+{
+  "complete": false,
+  "exact_identity": true,
+  "exact_path_projection_matches": true,
+  "exact_policy_and_ttl": true,
+  "negative_identity": false,
+  "parent_list_refused": true,
+  "phase": "requester_exchange",
+  "projection_mode": true,
+  "reader_revoked": true,
+  "revoked_lookup_refused": true,
+  "sibling_get_refused": true,
+  "wrong_audience_refused": true
+}

scripts/verify_informed_decision_requester.py

@@ -8,6 +8,7 @@ from urllib.parse import urlencode, quote_plus
 from urllib.request import Request, build_opener, ProxyHandler, HTTPRedirectHandler
 from urllib.error import HTTPError
 from informed_decision.requester import RequesterTokenProvider, CLIENT_ID
+from informed_decision.http_transport import JSONTransport
 
 BAO = 'http://openbao.openbao.svc:8200/v1/'
 ISSUER = 'https://kc.coulomb.social'
@@ -69,7 +70,14 @@ def run(negative=False):
             check('exact_path_projection_matches', status == 200 and bool(secret)
                   and result.get('data', {}).get('data', {}).get('CLIENT_SECRET') == secret)
             receipt['phase'] = 'requester_exchange'
-            provider = RequesterTokenProvider(ISSUER, str(SECRET))
+            class ObservedTransport:
+                def request(self, method, url, **kwargs):
+                    step = 'issuer_token_request' if method == 'POST' else 'issuer_jwks_request'
+                    receipt['phase'] = step
+                    status, result = JSONTransport().request(method, url, **kwargs)
+                    receipt[step+'_ok'] = status == 200
+                    return status, result
+            provider = RequesterTokenProvider(ISSUER, str(SECRET), transport=ObservedTransport())
             check('signed_create_only_exchange', bool(provider()))
             credentials = base64.b64encode((quote_plus(CLIENT_ID)+':'+quote_plus(secret)).encode()).decode()
             for scope in ('approval:approve', 'approval:read', 'approval:consume'):