coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

test: refresh regenerated destroy fixture and pin the vocabulary gap
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
flex-auth regenerated decision_destroy_dual_control so context.approval
carries a complete approval-claim including the now-required
binding.pdp_digest. Because context is part of the digest material, that
changed both the request digest and the context input-claim digest; the
vendored copy and its pins are updated. Our digest join reproduces the new
envelope digest exactly, so the digest_material fix holds.

Two properties are now asserted rather than described:

- The embedded claim's binding speaks approval-engine's vocabulary
  (secrets.kv.destroy, target {id, stage}) while the decision speaks ours
  (destroy, lane:...). That is the unpublished mapping, now a test.
- The claim's pdp_digest cannot equal the request digest of the request that
  carries it: embedding the claim in a hashed context changes that digest.
  It matches neither the full request nor the request with the claim
  removed. Raised with both teams; recorded here so a future change to it is
  visible rather than silent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M65ovP3eiiPHubibvWs9mD

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 393550@bnt-lap001
Assistant-Session: 4bb359f9-1f12-4410-9e76-079cf23c82e4
This commit is contained in:
tegwick 2026-09-06 14:20:16 +02:00
parent 6e9c15228c
commit 925d028ac2
3 changed files with 79 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tests/fixtures/flex-auth-replay/PROVENANCE.md vendored
View file

@ -8,6 +8,12 @@ published `secrets-engine.catalog-lane.lifecycle` v1 package via
Vendored so the digest contract test is hermetic. Regenerate upstream and
re-copy if the contract version changes.
Re-copied 2026-09-06 after flex-auth regenerated `decision_destroy_dual_control`
to carry a **complete** approval-claim on `context.approval` (including the
now-required `binding.pdp_digest`). Because `context` is part of the digest
material, completing the claim changed both the request digest and the context
input-claim digest. The pins below are the post-regeneration values.
**Pinned here** (stable across runs, per the upstream README):
`binding.request_digest`, `provenance.policy_package_digest`,
`provenance.registry_snapshot_digest`, and the presence/absence of