# flex-auth T03 replay fixtures

Copied verbatim from `flex-auth/examples/secrets-engine/replay/` (commit
`9e10d1c`, `FLEX-WP-0021-T03`). Real `DecisionEnvelope`s emitted by the
published `secrets-engine.catalog-lane.lifecycle` v1 package via
`go run ./cmd/flex-auth check`, from `flex-auth/local` in `standalone` mode.

Vendored so the digest contract test is hermetic. Regenerate upstream and
re-copy if the contract version changes.

Re-copied 2026-09-06 after flex-auth regenerated `decision_destroy_dual_control`
to carry a **complete** approval-claim on `context.approval` (including the
now-required `binding.pdp_digest`). Because `context` is part of the digest
material, completing the claim changed both the request digest and the context
input-claim digest. The pins below are the post-regeneration values.

**Pinned here** (stable across runs, per the upstream README):
`binding.request_digest`, `provenance.policy_package_digest`,
`provenance.registry_snapshot_digest`, and the presence/absence of
`provenance.input_claim_digests.context`.

**Never pin:** `id`, `provenance.decision_time`, `lifetime.not_before`,
`lifetime.expires_at` — all move with the clock.