# Access Engine decision verifier

The API types and `internal/sign/sign.go` are unchanged producer source, pinned
by revision and SHA-256 in `producer-source.json`. License attribution and the
original license text are in `LICENSE.access-engine`. This is source vendoring
necessitated by the producer's Go `internal` package boundary, not a separately
maintained crypto implementation. There are no external Go dependencies.

Build in this directory: `go build -trimpath -o /tmp/secrets-engine-pdp-verify .`.
Install that binary through the deployment's reviewed package/image path and set
`SECRETS_ENGINE_PDP_VERIFIER` to its absolute path. Do not compile at request time.
The Python wheel alone is insufficient: deployments must install this helper.
The `testsupport/signer` executable is test-only and must not be installed.

From repository root, run `python3 scripts/check_pdp_producer_source.py` before
building, and optionally add `--upstream /path/to/access-engine` to detect producer
drift. To update: select/review an upstream revision, copy these exact source
files and native replay fixtures, update the manifest, run both upstream signature
checks and downstream consumer tests, then review the complete diff. Never change
canonicalization locally. Producer contract additions fail closed until reviewed.

The helper reads the original JSON envelope, verifies using Go's producer verifier,
and returns only the authenticated typed envelope. The Python boundary rejects
duplicate keys, nonfinite values and invalid UTF-8 before invoking it. Unknown
typed fields refuse. The unsigned producer mode is never a production fallback.

The Check API defaults to mandatory authentication. Its deliberately named
`allow_unsigned_test_fixture` argument is used only by synthetic transport tests;
production `authorize_action` never passes it. The helper runs with an empty
environment, so ambient backend and identity credentials cannot reach it.

For the complete reproducible CLI build and offline fresh-prefix installation,
use [the release bundle contract](../docs/cli-release-bundle.md). This replaces
manual helper copying for packaged deployments; package and key admission remain
separate owner decisions.