tegwick c44306b1b2

CI Smoke / host-smoke (push) Successful in 0s

Details

CI Smoke / container-smoke (push) Successful in 1s

Details

feat: bind the destroy gate to approval_binding_digest and pdp_path

The vocabulary mapping this path was waiting on is not coming: gate-house
rejected it in GH-DEC-2026-008, because a translation can be confidently
wrong and fails open by accepting a claim approved for a different action.
The stronger option arrived instead, and both halves are enforced here.

flex-auth published binding.approval_binding_digest (FLEX-DEC-2026-007) to
fix the circularity this repo reported: a pdp_digest recorded at issue time
can never equal the request_digest of the request that carries the claim in
its hashed context, so with GH-DEC-2026-008 requiring that equality, destroy
would have failed closed forever on a check no correct record could pass.

- authorization.approval_binding_digest implements the published exclusion
  rule, including Go's context,omitempty behaviour when stripping empties
  the context; digest_material drops an empty context for the same reason.
- validate_decision_envelope recomputes the field rather than trusting it,
  refuses a claim-bearing request whose decision records none, and compares
  the claim's digest from step 1 against it -- never against request_digest,
  which still covers the claim so it stays a sound replay identity.
- validate_approval_claim requires binding.pdp_path true before using
  pdp_digest at all. Path intent is never inferred from a digest that
  happens to be present; pre-schema-v3 approvals carry pdp_path false
  regardless of any digest they hold.

Replay fixtures re-vendored from dd3ce4c. The destroy pins moved a second
and final time; approval_binding_digest did not, which is the point. The
fixture now demonstrates the property instead of asserting it: we rederive
fa07becf... from its own request through our canonical implementation,
proving we hash the same material flex-auth does rather than pinning a
constant we cannot reproduce.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E4tNMAYcSQmZWUE4wqP4ij

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 715726@bnt-lap001
Assistant-Session: 80a42b32-cba6-4b23-8be0-68819b1a6092

2026-09-06 20:39:59 +02:00

1.8 KiB

Raw Blame History

flex-auth T03 replay fixtures

Copied verbatim from flex-auth/examples/secrets-engine/replay/ (commit 9e10d1c, FLEX-WP-0021-T03). Real DecisionEnvelopes emitted by the published secrets-engine.catalog-lane.lifecycle v1 package via go run ./cmd/flex-auth check, from flex-auth/local in standalone mode.

Vendored so the digest contract test is hermetic. Regenerate upstream and re-copy if the contract version changes.

Re-copied 2026-09-06 (twice, both upstream regenerations):

commit 9f3e7e3 completed the approval-claim on context.approval. Because context is hashed material, completing the claim moved the request digest.
commit dd3ce4c (FLEX-DEC-2026-007) published binding.approval_binding_digest and set the embedded claim's binding.pdp_digest to it with binding.pdp_path true. The request digest moved once more with the claim's contents; the approval-binding digest did not, which is the property the fixture now demonstrates rather than asserts.

decision_rotate.json is unchanged and carries no approval_binding_digest — the field is omitted on claim-free decisions rather than duplicated onto them.

Pinned here (stable across runs, per the upstream README): binding.request_digest, binding.approval_binding_digest, provenance.policy_package_digest, provenance.registry_snapshot_digest, and the presence/absence of provenance.input_claim_digests.context.

approval_binding_digest is not only pinned but rederived by test_pdp_digest_equals_the_published_approval_binding_digest: our canonical implementation must reproduce it from the fixture's own request. A pin asserts the constant; rederiving it proves we hash the same material flex-auth does.

Never pin: id, provenance.decision_time, lifetime.not_before, lifetime.expires_at — all move with the clock.

1.8 KiB Raw Blame History

flex-auth T03 replay fixtures

1.8 KiB

Raw Blame History