test: refresh regenerated destroy fixture and pin the vocabulary gap

flex-auth regenerated decision_destroy_dual_control so context.approval
carries a complete approval-claim including the now-required
binding.pdp_digest. Because context is part of the digest material, that
changed both the request digest and the context input-claim digest; the
vendored copy and its pins are updated. Our digest join reproduces the new
envelope digest exactly, so the digest_material fix holds.

Two properties are now asserted rather than described:

- The embedded claim's binding speaks approval-engine's vocabulary
  (secrets.kv.destroy, target {id, stage}) while the decision speaks ours
  (destroy, lane:...). That is the unpublished mapping, now a test.
- The claim's pdp_digest cannot equal the request digest of the request that
  carries it: embedding the claim in a hashed context changes that digest.
  It matches neither the full request nor the request with the claim
  removed. Raised with both teams; recorded here so a future change to it is
  visible rather than silent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M65ovP3eiiPHubibvWs9mD

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 393550@bnt-lap001
Assistant-Session: 4bb359f9-1f12-4410-9e76-079cf23c82e4

tests/fixtures/flex-auth-replay/PROVENANCE.md

@@ -8,6 +8,12 @@ published `secrets-engine.catalog-lane.lifecycle` v1 package via
 Vendored so the digest contract test is hermetic. Regenerate upstream and
 re-copy if the contract version changes.
 
+Re-copied 2026-09-06 after flex-auth regenerated `decision_destroy_dual_control`
+to carry a **complete** approval-claim on `context.approval` (including the
+now-required `binding.pdp_digest`). Because `context` is part of the digest
+material, completing the claim changed both the request digest and the context
+input-claim digest. The pins below are the post-regeneration values.
+
 **Pinned here** (stable across runs, per the upstream README):
 `binding.request_digest`, `provenance.policy_package_digest`,
 `provenance.registry_snapshot_digest`, and the presence/absence of

tests/fixtures/flex-auth-replay/decision_destroy_dual_control.json

@@ -1,5 +1,5 @@
 {
-  "id": "decision:669a12badaa3d82e",
+  "id": "decision:395efe37c5066e8a",
   "contract_version": "flex-auth.decision-record.v1",
   "request_id": "check:secrets-engine-destroy",
   "effect": "allow",
@@ -68,22 +68,43 @@
     "context": {
       "approval": {
         "approval_id": "3d1c0a8e-6b7f-4c21-9a0e-1f2b3c4d5e6f",
+        "binding": {
+          "action": "secrets.kv.destroy",
+          "actor": "agt-secrets-engine",
+          "digest": "sha256:3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f3f",
+          "pdp_digest": "sha256:570d112890586d3cbf00c0e81c85ae7806f40f00afa1a2c0a23fd5e077a27f56",
+          "principal": "bernd",
+          "purpose": "rotate-exposed-key",
+          "target": {
+            "id": "lane-openbao-root",
+            "stage": "prod"
+          }
+        },
         "consumed": false,
+        "freshness": {
+          "not_after": "2026-09-06T12:00:30+00:00",
+          "observed_at": "2026-09-06T12:00:00+00:00",
+          "ttl_seconds": 30
+        },
         "issuer": "approval-engine",
         "kind": "approval-claim",
         "reason_code": "ok",
         "schema_version": "0.1",
         "state": "valid",
-        "valid_now": true
+        "valid_now": true,
+        "validity": {
+          "expires_at": "2026-09-06T15:00:00+00:00",
+          "not_before": "2026-09-06T11:00:00+00:00"
+        }
       }
     },
-    "request_digest": "sha256:570d112890586d3cbf00c0e81c85ae7806f40f00afa1a2c0a23fd5e077a27f56"
+    "request_digest": "sha256:fc155dba88f8ab18b3032ed086ba2f455158c6981106e7829d520ab7b036bdf3"
   },
   "lifetime": {
     "kind": "ttl",
     "ttl": "15m",
-    "not_before": "2026-09-06T06:13:43Z",
-    "expires_at": "2026-09-06T06:28:43Z"
+    "not_before": "2026-09-06T12:18:21Z",
+    "expires_at": "2026-09-06T12:33:21Z"
   },
   "diagnostics": {
     "action": "destroy",
@@ -101,9 +122,9 @@
     "policy_package_digest": "sha256:fe0070b79f66442ae6c218697a49c470c6c8f670aa57a30c078a5284d097bd8c",
     "registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
     "input_claim_digests": {
-      "context": "sha256:45fa9f41271c684f2c26570be11869a8eda28e7b3b25f11e01f9378b6f89fdc8"
+      "context": "sha256:b0d2203cd2b43a9ba573c21c038154c131afba4255e313affd7ecf810e2cc221"
     },
-    "decision_time": "2026-09-06T06:13:43Z"
+    "decision_time": "2026-09-06T12:18:21Z"
   },
   "caring": {
     "profile": "caring-0.4.0-rc2",

tests/test_decision_replay.py

@@ -37,9 +37,9 @@ CASES = {
     },
     "destroy": {
         "file": "decision_destroy_dual_control.json",
-        "digest": "sha256:570d112890586d3cbf00c0e81c85ae7806f40f00afa1a2c0a23fd5e077a27f56",
+        "digest": "sha256:fc155dba88f8ab18b3032ed086ba2f455158c6981106e7829d520ab7b036bdf3",
         "action": "destroy",
-        "context_claim_digest": "sha256:45fa9f41271c684f2c26570be11869a8eda28e7b3b25f11e01f9378b6f89fdc8",
+        "context_claim_digest": "sha256:b0d2203cd2b43a9ba573c21c038154c131afba4255e313affd7ecf810e2cc221",
     },
 }
 
@@ -157,3 +157,46 @@ def test_expired_real_envelope_fails_closed():
             accepted_policy_packages={"secrets-engine.catalog-lane.lifecycle"},
             accepted_policy_versions={"v1"},
         )
+
+
+def test_embedded_claim_uses_approval_engine_vocabulary_not_ours():
+    """The published vocabulary gap, asserted rather than described.
+
+    The dual-control request carries a complete approval-claim in
+    context.approval. Its binding speaks approval-engine's language while the
+    decision speaks ours, and no mapping between them is published -- which is
+    why this engine compares pdp_digest and refuses to derive a native digest
+    from its own vocabulary.
+    """
+    envelope = _envelope("destroy")
+    claim = envelope["binding"]["context"]["approval"]
+    assert claim["kind"] == "approval-claim"
+    assert claim["issuer"] == "approval-engine"
+    assert claim["valid_now"] is True
+    assert claim["binding"]["action"] == "secrets.kv.destroy"
+    assert envelope["binding"]["action"] == "destroy"
+    assert claim["binding"]["action"] != envelope["binding"]["action"]
+    assert set(claim["binding"]["target"]) == {"id", "stage"}
+    assert claim["binding"]["target"]["id"] != envelope["resource"]["id"]
+
+
+def test_embedded_claim_pdp_digest_cannot_equal_the_carrying_request_digest():
+    """Carrying the claim inside a hashed context makes the two unequal.
+
+    context is part of the digest material, so embedding an approval-claim
+    changes the request digest of the very request that carries it. A
+    pdp_digest recorded at issue time therefore cannot equal the final digest
+    of the dual-control request. Raised with approval-engine and flex-auth; this
+    test records the property so a future change is visible rather than silent.
+    """
+    envelope = _envelope("destroy")
+    binding = envelope["binding"]
+    pdp = binding["context"]["approval"]["binding"]["pdp_digest"]
+    request = _request_from(envelope)
+    assert request_digest(request) == binding["request_digest"]
+    assert pdp != binding["request_digest"]
+    without_claim = dict(request)
+    without_claim["context"] = {
+        k: v for k, v in binding["context"].items() if k != "approval"
+    }
+    assert pdp != request_digest(without_claim)