# flex-auth T03 replay fixtures

Copied verbatim from `flex-auth/examples/secrets-engine/replay/` (commit
`9e10d1c`, `FLEX-WP-0021-T03`). Real `DecisionEnvelope`s emitted by the
published `secrets-engine.catalog-lane.lifecycle` v1 package via
`go run ./cmd/flex-auth check`, from `flex-auth/local` in `standalone` mode.

Vendored so the digest contract test is hermetic. Regenerate upstream and
re-copy if the contract version changes.

**Pinned here** (stable across runs, per the upstream README):
`binding.request_digest`, `provenance.policy_package_digest`,
`provenance.registry_snapshot_digest`, and the presence/absence of
`provenance.input_claim_digests.context`.

**Never pin:** `id`, `provenance.decision_time`, `lifetime.not_before`,
`lifetime.expires_at` — all move with the clock.