secrets-engine/verifier/README.md

Access Engine decision verifier

The API types and internal/sign/sign.go are unchanged producer source, pinned by revision and SHA-256 in producer-source.json. License attribution and the original license text are in LICENSE.access-engine. This is source vendoring necessitated by the producer's Go internal package boundary, not a separately maintained crypto implementation. There are no external Go dependencies.

Build in this directory: go build -trimpath -o /tmp/secrets-engine-pdp-verify .. Install that binary through the deployment's reviewed package/image path and set SECRETS_ENGINE_PDP_VERIFIER to its absolute path. Do not compile at request time. The Python wheel alone is insufficient: deployments must install this helper. The testsupport/signer executable is test-only and must not be installed.

From repository root, run python3 scripts/check_pdp_producer_source.py before building, and optionally add --upstream /path/to/access-engine to detect producer drift. To update: select/review an upstream revision, copy these exact source files and native replay fixtures, update the manifest, run both upstream signature checks and downstream consumer tests, then review the complete diff. Never change canonicalization locally. Producer contract additions fail closed until reviewed.

The helper reads the original JSON envelope, verifies using Go's producer verifier, and returns only the authenticated typed envelope. The Python boundary rejects duplicate keys, nonfinite values and invalid UTF-8 before invoking it. Unknown typed fields refuse. The unsigned producer mode is never a production fallback.

The Check API defaults to mandatory authentication. Its deliberately named allow_unsigned_test_fixture argument is used only by synthetic transport tests; production authorize_action never passes it. The helper runs with an empty environment, so ambient backend and identity credentials cannot reach it.

For the complete reproducible CLI build and offline fresh-prefix installation, use the release bundle contract. This replaces manual helper copying for packaged deployments; package and key admission remain separate owner decisions.