tegwick
925d028ac2
flex-auth regenerated decision_destroy_dual_control so context.approval
carries a complete approval-claim including the now-required
binding.pdp_digest. Because context is part of the digest material, that
changed both the request digest and the context input-claim digest; the
vendored copy and its pins are updated. Our digest join reproduces the new
envelope digest exactly, so the digest_material fix holds.
Two properties are now asserted rather than described:
- The embedded claim's binding speaks approval-engine's vocabulary
(secrets.kv.destroy, target {id, stage}) while the decision speaks ours
(destroy, lane:...). That is the unpublished mapping, now a test.
- The claim's pdp_digest cannot equal the request digest of the request that
carries it: embedding the claim in a hashed context changes that digest.
It matches neither the full request nor the request with the claim
removed. Raised with both teams; recorded here so a future change to it is
visible rather than silent.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M65ovP3eiiPHubibvWs9mD
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 393550@bnt-lap001
Assistant-Session: 4bb359f9-1f12-4410-9e76-079cf23c82e4
23 lines
1.1 KiB
Markdown
23 lines
1.1 KiB
Markdown
# flex-auth T03 replay fixtures
|
|
|
|
Copied verbatim from `flex-auth/examples/secrets-engine/replay/` (commit
|
|
`9e10d1c`, `FLEX-WP-0021-T03`). Real `DecisionEnvelope`s emitted by the
|
|
published `secrets-engine.catalog-lane.lifecycle` v1 package via
|
|
`go run ./cmd/flex-auth check`, from `flex-auth/local` in `standalone` mode.
|
|
|
|
Vendored so the digest contract test is hermetic. Regenerate upstream and
|
|
re-copy if the contract version changes.
|
|
|
|
Re-copied 2026-09-06 after flex-auth regenerated `decision_destroy_dual_control`
|
|
to carry a **complete** approval-claim on `context.approval` (including the
|
|
now-required `binding.pdp_digest`). Because `context` is part of the digest
|
|
material, completing the claim changed both the request digest and the context
|
|
input-claim digest. The pins below are the post-regeneration values.
|
|
|
|
**Pinned here** (stable across runs, per the upstream README):
|
|
`binding.request_digest`, `provenance.policy_package_digest`,
|
|
`provenance.registry_snapshot_digest`, and the presence/absence of
|
|
`provenance.input_claim_digests.context`.
|
|
|
|
**Never pin:** `id`, `provenance.decision_time`, `lifetime.not_before`,
|
|
`lifetime.expires_at` — all move with the clock.
|