fix(auth): authenticate producer-signed decisions before authorization

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

verifier/README.md

@@ -0,0 +1,30 @@
+# Access Engine decision verifier
+
+The API types and `internal/sign/sign.go` are unchanged producer source, pinned
+by revision and SHA-256 in `producer-source.json`. License attribution and the
+original license text are in `LICENSE.access-engine`. This is source vendoring
+necessitated by the producer's Go `internal` package boundary, not a separately
+maintained crypto implementation. There are no external Go dependencies.
+
+Build in this directory: `go build -trimpath -o /tmp/secrets-engine-pdp-verify .`.
+Install that binary through the deployment's reviewed package/image path and set
+`SECRETS_ENGINE_PDP_VERIFIER` to its absolute path. Do not compile at request time.
+The Python wheel alone is insufficient: deployments must install this helper.
+The `testsupport/signer` executable is test-only and must not be installed.
+
+From repository root, run `python3 scripts/check_pdp_producer_source.py` before
+building, and optionally add `--upstream /path/to/access-engine` to detect producer
+drift. To update: select/review an upstream revision, copy these exact source
+files and native replay fixtures, update the manifest, run both upstream signature
+checks and downstream consumer tests, then review the complete diff. Never change
+canonicalization locally. Producer contract additions fail closed until reviewed.
+
+The helper reads the original JSON envelope, verifies using Go's producer verifier,
+and returns only the authenticated typed envelope. The Python boundary rejects
+duplicate keys, nonfinite values and invalid UTF-8 before invoking it. Unknown
+typed fields refuse. The unsigned producer mode is never a production fallback.
+
+The Check API defaults to mandatory authentication. Its deliberately named
+`allow_unsigned_test_fixture` argument is used only by synthetic transport tests;
+production `authorize_action` never passes it. The helper runs with an empty
+environment, so ambient backend and identity credentials cannot reach it.