tegwick
c44306b1b2
The vocabulary mapping this path was waiting on is not coming: gate-house rejected it in GH-DEC-2026-008, because a translation can be confidently wrong and fails open by accepting a claim approved for a different action. The stronger option arrived instead, and both halves are enforced here. flex-auth published binding.approval_binding_digest (FLEX-DEC-2026-007) to fix the circularity this repo reported: a pdp_digest recorded at issue time can never equal the request_digest of the request that carries the claim in its hashed context, so with GH-DEC-2026-008 requiring that equality, destroy would have failed closed forever on a check no correct record could pass. - authorization.approval_binding_digest implements the published exclusion rule, including Go's context,omitempty behaviour when stripping empties the context; digest_material drops an empty context for the same reason. - validate_decision_envelope recomputes the field rather than trusting it, refuses a claim-bearing request whose decision records none, and compares the claim's digest from step 1 against it -- never against request_digest, which still covers the claim so it stays a sound replay identity. - validate_approval_claim requires binding.pdp_path true before using pdp_digest at all. Path intent is never inferred from a digest that happens to be present; pre-schema-v3 approvals carry pdp_path false regardless of any digest they hold. Replay fixtures re-vendored from dd3ce4c. The destroy pins moved a second and final time; approval_binding_digest did not, which is the point. The fixture now demonstrates the property instead of asserting it: we rederive fa07becf... from its own request through our canonical implementation, proving we hash the same material flex-auth does rather than pinning a constant we cannot reproduce. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01E4tNMAYcSQmZWUE4wqP4ij Assistant: claude-code Assistant-Model: opus Assistant-Process: 715726@bnt-lap001 Assistant-Session: 80a42b32-cba6-4b23-8be0-68819b1a6092
36 lines
1.8 KiB
Markdown
36 lines
1.8 KiB
Markdown
# flex-auth T03 replay fixtures
|
|
|
|
Copied verbatim from `flex-auth/examples/secrets-engine/replay/` (commit
|
|
`9e10d1c`, `FLEX-WP-0021-T03`). Real `DecisionEnvelope`s emitted by the
|
|
published `secrets-engine.catalog-lane.lifecycle` v1 package via
|
|
`go run ./cmd/flex-auth check`, from `flex-auth/local` in `standalone` mode.
|
|
|
|
Vendored so the digest contract test is hermetic. Regenerate upstream and
|
|
re-copy if the contract version changes.
|
|
|
|
Re-copied 2026-09-06 (twice, both upstream regenerations):
|
|
|
|
1. commit `9f3e7e3` completed the approval-claim on `context.approval`. Because
|
|
`context` is hashed material, completing the claim moved the request digest.
|
|
2. commit `dd3ce4c` (`FLEX-DEC-2026-007`) published
|
|
`binding.approval_binding_digest` and set the embedded claim's
|
|
`binding.pdp_digest` to it with `binding.pdp_path` true. The request digest
|
|
moved once more with the claim's contents; the approval-binding digest did
|
|
**not**, which is the property the fixture now demonstrates rather than
|
|
asserts.
|
|
|
|
`decision_rotate.json` is unchanged and carries no `approval_binding_digest` —
|
|
the field is omitted on claim-free decisions rather than duplicated onto them.
|
|
|
|
**Pinned here** (stable across runs, per the upstream README):
|
|
`binding.request_digest`, `binding.approval_binding_digest`,
|
|
`provenance.policy_package_digest`, `provenance.registry_snapshot_digest`, and
|
|
the presence/absence of `provenance.input_claim_digests.context`.
|
|
|
|
`approval_binding_digest` is not only pinned but **rederived** by
|
|
`test_pdp_digest_equals_the_published_approval_binding_digest`: our canonical
|
|
implementation must reproduce it from the fixture's own request. A pin asserts
|
|
the constant; rederiving it proves we hash the same material flex-auth does.
|
|
|
|
**Never pin:** `id`, `provenance.decision_time`, `lifetime.not_before`,
|
|
`lifetime.expires_at` — all move with the clock.
|