secrets-engine/verifier/README.md

Access Engine decision verifier

The API types and internal/sign/sign.go are unchanged producer source, pinned by source revision/proposal and SHA-256 in producer-source.json. License attribution and the original license text are in LICENSE.access-engine. This is source vendoring necessitated by the producer's Go internal package boundary, not a separately maintained crypto implementation. There are no external Go dependencies.

Build in this directory: go build -trimpath -o /tmp/secrets-engine-pdp-verify .. Install that binary through the deployment's reviewed package/image path and set SECRETS_ENGINE_PDP_VERIFIER to its absolute path. Do not compile at request time. The Python wheel alone is insufficient: deployments must install this helper. The testsupport/signer executable is test-only and must not be installed.

From repository root, run python3 scripts/check_pdp_producer_source.py before building, and optionally add --upstream /path/to/access-engine to detect producer drift. To update: select/review an upstream revision, copy these exact source files and native replay fixtures, update the manifest, run both upstream signature checks and downstream consumer tests, then review the complete diff. Never change canonicalization locally. Producer contract additions fail closed until reviewed.

The helper reads the original JSON envelope, verifies using Go's producer verifier, and returns only the authenticated typed envelope. The Python boundary rejects duplicate keys, nonfinite values and invalid UTF-8 before invoking it. Unknown typed fields refuse. The unsigned producer mode is never a production fallback.

The Check API defaults to mandatory authentication. Its deliberately named allow_unsigned_test_fixture argument is used only by synthetic transport tests; production authorize_action never passes it. The helper runs with an empty environment, so ambient backend and identity credentials cannot reach it.

For the complete reproducible CLI build and offline fresh-prefix installation, use the release bundle contract. This replaces manual helper copying for packaged deployments; package and key admission remain separate owner decisions.

The trusted-service successor snapshot follows the frozen Access B2/B3 proposal lineage, identified by its patch SHA-256 in producer-source.json; this is source review, not a claim of published producer revision or runtime/key admission. The wrapper uses producer-owned sign.DecodeEnvelope to preserve JSON numeric lexemes in signed maps. It retains exact authenticated producer JSON through strict preparation and CAS reauthentication; Python does not recreate signed bytes. Approval's fourteen native binding vectors are signature interoperability cases, not an expansion of existing request numeric admission. Signed approval_observation supplements the original immutable carried claim; strict handoff checks its native digest and observation/deadline bounds. It never replaces original context or freshness.

Successor R2 execution builder correspondence emits the producer's fixed public DeclaredServiceBinding only for the typed prod/platform secrets-engine service lane before approval issuance. Both reference tenants are explicit to match existing producer normalization. It is not caller authentication; independently signed enforced caller, exact original/native/descriptor joins and all existing approval, expiry and CAS gates still apply. Actual production source-server interoperability receipts are separate from native runtime admission.