tegwick
925d028ac2
flex-auth regenerated decision_destroy_dual_control so context.approval
carries a complete approval-claim including the now-required
binding.pdp_digest. Because context is part of the digest material, that
changed both the request digest and the context input-claim digest; the
vendored copy and its pins are updated. Our digest join reproduces the new
envelope digest exactly, so the digest_material fix holds.
Two properties are now asserted rather than described:
- The embedded claim's binding speaks approval-engine's vocabulary
(secrets.kv.destroy, target {id, stage}) while the decision speaks ours
(destroy, lane:...). That is the unpublished mapping, now a test.
- The claim's pdp_digest cannot equal the request digest of the request that
carries it: embedding the claim in a hashed context changes that digest.
It matches neither the full request nor the request with the claim
removed. Raised with both teams; recorded here so a future change to it is
visible rather than silent.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M65ovP3eiiPHubibvWs9mD
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 393550@bnt-lap001
Assistant-Session: 4bb359f9-1f12-4410-9e76-079cf23c82e4
1.1 KiB
flex-auth T03 replay fixtures
Copied verbatim from flex-auth/examples/secrets-engine/replay/ (commit
9e10d1c, FLEX-WP-0021-T03). Real DecisionEnvelopes emitted by the
published secrets-engine.catalog-lane.lifecycle v1 package via
go run ./cmd/flex-auth check, from flex-auth/local in standalone mode.
Vendored so the digest contract test is hermetic. Regenerate upstream and re-copy if the contract version changes.
Re-copied 2026-09-06 after flex-auth regenerated decision_destroy_dual_control
to carry a complete approval-claim on context.approval (including the
now-required binding.pdp_digest). Because context is part of the digest
material, completing the claim changed both the request digest and the context
input-claim digest. The pins below are the post-regeneration values.
Pinned here (stable across runs, per the upstream README):
binding.request_digest, provenance.policy_package_digest,
provenance.registry_snapshot_digest, and the presence/absence of
provenance.input_claim_digests.context.
Never pin: id, provenance.decision_time, lifetime.not_before,
lifetime.expires_at — all move with the clock.