secrets-engine/verifier/README.md

# Access Engine decision verifier

The API types and `internal/sign/sign.go` are unchanged producer source, pinned
by source revision/proposal and SHA-256 in `producer-source.json`. License attribution and the
original license text are in `LICENSE.access-engine`. This is source vendoring
necessitated by the producer's Go `internal` package boundary, not a separately
maintained crypto implementation. There are no external Go dependencies.

Build in this directory: `go build -trimpath -o /tmp/secrets-engine-pdp-verify .`.
Install that binary through the deployment's reviewed package/image path and set
`SECRETS_ENGINE_PDP_VERIFIER` to its absolute path. Do not compile at request time.
The Python wheel alone is insufficient: deployments must install this helper.
The `testsupport/signer` executable is test-only and must not be installed.

From repository root, run `python3 scripts/check_pdp_producer_source.py` before
building, and optionally add `--upstream /path/to/access-engine` to detect producer
drift. To update: select/review an upstream revision, copy these exact source
files and native replay fixtures, update the manifest, run both upstream signature
checks and downstream consumer tests, then review the complete diff. Never change
canonicalization locally. Producer contract additions fail closed until reviewed.

The helper reads the original JSON envelope, verifies using Go's producer verifier,
and returns only the authenticated typed envelope. The Python boundary rejects
duplicate keys, nonfinite values and invalid UTF-8 before invoking it. Unknown
typed fields refuse. The unsigned producer mode is never a production fallback.

The Check API defaults to mandatory authentication. Its deliberately named
`allow_unsigned_test_fixture` argument is used only by synthetic transport tests;
production `authorize_action` never passes it. The helper runs with an empty
environment, so ambient backend and identity credentials cannot reach it.

For the complete reproducible CLI build and offline fresh-prefix installation,
use [the release bundle contract](../docs/cli-release-bundle.md). This replaces
manual helper copying for packaged deployments; package and key admission remain
separate owner decisions.

The trusted-service successor snapshot follows the frozen Access B2/B3 proposal lineage,
identified by its patch SHA-256 in `producer-source.json`; this is source review,
not a claim of published producer revision or runtime/key admission. The wrapper
uses producer-owned `sign.DecodeEnvelope` to preserve JSON numeric lexemes in
signed maps. It retains exact authenticated producer JSON through strict
preparation and CAS reauthentication; Python does not recreate signed bytes.
Approval's fourteen native binding vectors are signature interoperability cases,
not an expansion of existing request numeric admission. Signed
`approval_observation` supplements the original immutable carried claim;
strict handoff checks its native digest and observation/deadline bounds. It never
replaces original context or freshness.

Successor R2 execution builder correspondence emits the producer's fixed public
DeclaredServiceBinding only for the typed prod/platform secrets-engine service
lane before approval issuance. Both reference tenants are explicit to match
existing producer normalization. It is not caller authentication; independently
signed enforced caller, exact original/native/descriptor joins and all existing
approval, expiry and CAS gates still apply. Actual production source-server
interoperability receipts are separate from native runtime admission.