docs: preserve reviewed NetKingdom session artifacts
This commit is contained in:
codex
parent
a856698b03
commit
0863ba073a
50 changed files with 5644 additions and 0 deletions
|
|
@ -0,0 +1,98 @@
|
|||
{
|
||||
"approval_binding_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a",
|
||||
"approval_expires_at": "2026-10-16T15:08:43.625859+00:00",
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"decision_expires_at": "2026-10-16T15:06:43Z",
|
||||
"decision_id": "decision:9da2b8442a192d6d",
|
||||
"decision_not_before": "2026-10-16T15:05:44.150488791Z",
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T15:06:43+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"native_binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:ac65003b1b527d2194d7a50872f3dda3a9a4824fd3f8ba61721ba20c475ae645",
|
||||
"submitted_request_digest": "sha256:6133a8947e450efc52f9f35883ab20b2c2f3539c8a8fa89c93a586edb0670a96"
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"missing-service-binding": true,
|
||||
"changed-descriptor": true,
|
||||
"changed-native-target": true,
|
||||
"expired-original": true,
|
||||
"tampered-signature": true,
|
||||
"prepared-replay": true
|
||||
}
|
||||
|
|
@ -0,0 +1,226 @@
|
|||
{
|
||||
"id": "decision:b420b2c43aff27f2",
|
||||
"contract_version": "flex-auth.decision-record.v1",
|
||||
"effect": "deny",
|
||||
"reason": "service_execution_contract_unmatched",
|
||||
"matched_policy_version": "v2",
|
||||
"matched_rule": "service_execution_contract_unmatched",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||
"display_name": "secrets-engine service principal",
|
||||
"groups": [
|
||||
"group:secrets-engine-lane-operators"
|
||||
],
|
||||
"organization_relation": "ServiceProvider",
|
||||
"roles": [
|
||||
"Operator"
|
||||
]
|
||||
}
|
||||
},
|
||||
"binding": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||
"display_name": "secrets-engine service principal",
|
||||
"groups": [
|
||||
"group:secrets-engine-lane-operators"
|
||||
],
|
||||
"organization_relation": "ServiceProvider",
|
||||
"roles": [
|
||||
"Operator"
|
||||
]
|
||||
}
|
||||
},
|
||||
"action": "execute-ccr",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T15:06:43+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a",
|
||||
"approval_binding_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a",
|
||||
"submitted_request_digest": "sha256:a3cb02a5a0521416d41128e8298fd191b033b4268d518be8a7b6791fcb3998a8"
|
||||
},
|
||||
"diagnostics": {
|
||||
"action": "execute-ccr",
|
||||
"matched_relationship": "",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_status": "proposed",
|
||||
"registry_overrode": [],
|
||||
"registry_resource": false,
|
||||
"registry_subject": true
|
||||
},
|
||||
"provenance": {
|
||||
"evaluator": "flex-auth/local",
|
||||
"mode": "standalone",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_version": "v2",
|
||||
"policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d",
|
||||
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||||
"input_claim_digests": {
|
||||
"context": "sha256:48a3deac59c4cfdd1b1ee6faadb861c4162e9432406224521c51b5126fcdb07d"
|
||||
},
|
||||
"decision_time": "2026-10-16T15:05:43Z",
|
||||
"caller": {
|
||||
"mode": "enforce",
|
||||
"principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"audience": "flex-auth",
|
||||
"not_after": "2026-10-16T15:07:43Z"
|
||||
}
|
||||
},
|
||||
"signature": {
|
||||
"mode": "signed",
|
||||
"alg": "ed25519",
|
||||
"kid": "synthetic-v2",
|
||||
"value": "YeNWS7cj35EydBet36hpbM_SgG-8oARxrFXYFXI6ZempCtJufwFEJHHme3EuuqVonqKgkk6L_GgYurldtedjCg"
|
||||
},
|
||||
"caring": {
|
||||
"profile": "caring-0.4.0-rc2",
|
||||
"conformance_findings": [
|
||||
{
|
||||
"code": "CARING-DESCRIPTOR-MISSING",
|
||||
"severity": "warning",
|
||||
"message": "no CARING descriptor matched the request",
|
||||
"fields": [
|
||||
"caring_context"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"normalization-source-record.json": {
|
||||
"effect": "deny",
|
||||
"decision_id": "decision:b420b2c43aff27f2",
|
||||
"signature_valid": true
|
||||
},
|
||||
"response.json": {
|
||||
"effect": "allow",
|
||||
"decision_id": "decision:9da2b8442a192d6d",
|
||||
"signature_valid": true
|
||||
},
|
||||
"source-record.json": {
|
||||
"effect": "allow",
|
||||
"decision_id": "decision:9da2b8442a192d6d",
|
||||
"signature_valid": true
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
{
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T15:07:44.099087+00:00",
|
||||
"observed_at": "2026-10-16T15:05:44.099087+00:00",
|
||||
"ttl_seconds": 120
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T15:08:43.625859+00:00",
|
||||
"not_before": "2026-10-16T15:04:43.625859+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
}
|
||||
|
|
@ -0,0 +1,224 @@
|
|||
{
|
||||
"approval_binding_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a",
|
||||
"decision_id": "decision:b420b2c43aff27f2",
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T15:06:43+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"native_binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"original_request": {
|
||||
"action": "execute-ccr",
|
||||
"context": {
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T15:06:43+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"resource": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "service"
|
||||
},
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||||
"submitted_request_digest": "sha256:a3cb02a5a0521416d41128e8298fd191b033b4268d518be8a7b6791fcb3998a8"
|
||||
}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
{
|
||||
"scope": "disposable synthetic only",
|
||||
"actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine",
|
||||
"actual_access": "production serve binary from frozen B2/B3 retained-registry R3",
|
||||
"allow": true,
|
||||
"original_context_unchanged": true,
|
||||
"published_digest_match": true,
|
||||
"returned_source_record_match": true,
|
||||
"actual_source_consumed_refused": true,
|
||||
"actual_strict_prepare_and_consume": true,
|
||||
"retained_registry": true,
|
||||
"signed_deny_preapproval": true,
|
||||
"no_precision_sleep": true,
|
||||
"approval_precision_patch": "74eb0ff67d14508c2a2cee14d055790321ee171a96d5290ad6d037ce8f61dbcd",
|
||||
"actual_registry_drift_refuses_before_cas": true,
|
||||
"no_record_after_refusal": true,
|
||||
"native_admission": false,
|
||||
"files_sha256": {
|
||||
"consumption-confirmation.json": "sha256:b8e73258585ebcba195c16d9ea3866afbcdfb226b70225e804ceade4a80da929",
|
||||
"preapproval.json": "sha256:75a808a854af61465e5f1fd8a5a8fd003c9530a748fbed54ec3e825a31e2778a",
|
||||
"negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd",
|
||||
"registry-drift-refusal.json": "sha256:e6ce8bfeb9559370022b801d556d78df39ce82dc425d461e0ad5dcdf7b2a39c6",
|
||||
"synthetic-public-trust.json": "sha256:a612f8b7ca6cc7342bb150d7ff48b2da15b342efa0f8d6bae55f288f266bb7cb",
|
||||
"source-record.json": "sha256:80d140aec62a1a6ab49b14374d2349732bfa39aa15dc33ad6f7dfe3b02553872",
|
||||
"handoff.json": "sha256:7994cccc9491ed3c7cbb56d35e7f5d9f27b46aa1abde299be3818d9e2aea97ea",
|
||||
"claimfree-request.json": "sha256:03735c353218483016ee42e054097b1b26b7faf8cecf7991c2bfc2c3a301b0e8",
|
||||
"normalization-source-record.json": "sha256:67dff5deb09aa98ce9fb11af1eff213a98cb3a730a06de062cb08442de4fd90c",
|
||||
"response.json": "sha256:80d140aec62a1a6ab49b14374d2349732bfa39aa15dc33ad6f7dfe3b02553872",
|
||||
"original-approval-claim.json": "sha256:a4347f3ba2ac0ba29c9104948b10fe62f6292179315abcbd268998c1a3046e07",
|
||||
"request.json": "sha256:c4f6d753b433f8b60b649fb4afda96336e8c60e5a84ec5b0efaeca909b1d54ca"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"actual_owner_registry_changed": true,
|
||||
"original_registry_sha256": "sha256:37fba44ec0e0fd9b1e17a05ad1b7e4f9bb6ec9e0fc0bb3133e8af2ac6f832d7c",
|
||||
"authoritative_registry_enrichment_retained": true,
|
||||
"original_preapproval_refused_by_final_check": true,
|
||||
"new_decision_record": false,
|
||||
"approval_consumed": false,
|
||||
"CAS_calls": 0,
|
||||
"native_effects": 0
|
||||
}
|
||||
|
|
@ -0,0 +1,172 @@
|
|||
{
|
||||
"action": "execute-ccr",
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T15:07:44.099087+00:00",
|
||||
"observed_at": "2026-10-16T15:05:44.099087+00:00",
|
||||
"ttl_seconds": 120
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T15:08:43.625859+00:00",
|
||||
"not_before": "2026-10-16T15:04:43.625859+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T15:06:43+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"resource": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "service"
|
||||
},
|
||||
"tenant": "tenant:platform"
|
||||
}
|
||||
|
|
@ -0,0 +1,284 @@
|
|||
{
|
||||
"id": "decision:9da2b8442a192d6d",
|
||||
"contract_version": "flex-auth.decision-record.v1",
|
||||
"effect": "allow",
|
||||
"reason": "exact_task_execution_matched",
|
||||
"matched_policy_version": "v2",
|
||||
"matched_rule": "exact_task_execution_matched",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||
"display_name": "secrets-engine service principal",
|
||||
"groups": [
|
||||
"group:secrets-engine-lane-operators"
|
||||
],
|
||||
"organization_relation": "ServiceProvider",
|
||||
"roles": [
|
||||
"Operator"
|
||||
]
|
||||
}
|
||||
},
|
||||
"binding": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||
"display_name": "secrets-engine service principal",
|
||||
"groups": [
|
||||
"group:secrets-engine-lane-operators"
|
||||
],
|
||||
"organization_relation": "ServiceProvider",
|
||||
"roles": [
|
||||
"Operator"
|
||||
]
|
||||
}
|
||||
},
|
||||
"action": "execute-ccr",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T15:07:44.099087+00:00",
|
||||
"observed_at": "2026-10-16T15:05:44.099087+00:00",
|
||||
"ttl_seconds": 120
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T15:08:43.625859+00:00",
|
||||
"not_before": "2026-10-16T15:04:43.625859+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T15:06:43+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:ac65003b1b527d2194d7a50872f3dda3a9a4824fd3f8ba61721ba20c475ae645",
|
||||
"approval_binding_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a",
|
||||
"submitted_request_digest": "sha256:6133a8947e450efc52f9f35883ab20b2c2f3539c8a8fa89c93a586edb0670a96"
|
||||
},
|
||||
"lifetime": {
|
||||
"kind": "ttl",
|
||||
"ttl": "58.849511209s",
|
||||
"not_before": "2026-10-16T15:05:44.150488791Z",
|
||||
"expires_at": "2026-10-16T15:06:43Z"
|
||||
},
|
||||
"diagnostics": {
|
||||
"action": "execute-ccr",
|
||||
"matched_relationship": "",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_status": "proposed",
|
||||
"registry_overrode": [],
|
||||
"registry_resource": false,
|
||||
"registry_subject": true
|
||||
},
|
||||
"provenance": {
|
||||
"evaluator": "flex-auth/local",
|
||||
"mode": "standalone",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_version": "v2",
|
||||
"policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d",
|
||||
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||||
"input_claim_digests": {
|
||||
"context": "sha256:2a7db6ed9f4a978909074b38fc17dc1c26127b72a10fe515895bac7bdb083435"
|
||||
},
|
||||
"decision_time": "2026-10-16T15:05:44Z",
|
||||
"approval_observation": {
|
||||
"source_id": "synthetic-actual-approval-app",
|
||||
"source_revision": "actual-owner-python-source-fixture",
|
||||
"configuration_digest": "sha256:be934b2a902bbc14fa3a4fea20f1c1648390505900734b46599c7b5c544def22",
|
||||
"claim_digest": "sha256:f5c973c833e6038d4a4cf7bd3425a10646265e7d9633199b88f57009b849fd4b",
|
||||
"native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"observed_at": "2026-10-16T15:05:44.137304Z",
|
||||
"not_after": "2026-10-16T15:07:44.099087Z",
|
||||
"validated_at": "2026-10-16T15:05:44.13814262Z"
|
||||
},
|
||||
"caller": {
|
||||
"mode": "enforce",
|
||||
"principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"audience": "flex-auth",
|
||||
"not_after": "2026-10-16T15:07:43Z"
|
||||
}
|
||||
},
|
||||
"signature": {
|
||||
"mode": "signed",
|
||||
"alg": "ed25519",
|
||||
"kid": "synthetic-v2",
|
||||
"value": "utV-0akTB0x404y6mdQHAMuL8YLKrwdGtLYWCsk51pLiA_TxkamzL5fqoflcVXJfUBIEaMP8IfR3g53bUqyWBw"
|
||||
},
|
||||
"caring": {
|
||||
"profile": "caring-0.4.0-rc2",
|
||||
"conformance_findings": [
|
||||
{
|
||||
"code": "CARING-DESCRIPTOR-MISSING",
|
||||
"severity": "warning",
|
||||
"message": "no CARING descriptor matched the request",
|
||||
"fields": [
|
||||
"caring_context"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,284 @@
|
|||
{
|
||||
"id": "decision:9da2b8442a192d6d",
|
||||
"contract_version": "flex-auth.decision-record.v1",
|
||||
"effect": "allow",
|
||||
"reason": "exact_task_execution_matched",
|
||||
"matched_policy_version": "v2",
|
||||
"matched_rule": "exact_task_execution_matched",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||
"display_name": "secrets-engine service principal",
|
||||
"groups": [
|
||||
"group:secrets-engine-lane-operators"
|
||||
],
|
||||
"organization_relation": "ServiceProvider",
|
||||
"roles": [
|
||||
"Operator"
|
||||
]
|
||||
}
|
||||
},
|
||||
"binding": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||
"display_name": "secrets-engine service principal",
|
||||
"groups": [
|
||||
"group:secrets-engine-lane-operators"
|
||||
],
|
||||
"organization_relation": "ServiceProvider",
|
||||
"roles": [
|
||||
"Operator"
|
||||
]
|
||||
}
|
||||
},
|
||||
"action": "execute-ccr",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T15:07:44.099087+00:00",
|
||||
"observed_at": "2026-10-16T15:05:44.099087+00:00",
|
||||
"ttl_seconds": 120
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T15:08:43.625859+00:00",
|
||||
"not_before": "2026-10-16T15:04:43.625859+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T15:06:43+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:ac65003b1b527d2194d7a50872f3dda3a9a4824fd3f8ba61721ba20c475ae645",
|
||||
"approval_binding_digest": "sha256:5dbfc366910c8f62bf26a15f9e00289f774016a4092d462b2a82b9e30790e25a",
|
||||
"submitted_request_digest": "sha256:6133a8947e450efc52f9f35883ab20b2c2f3539c8a8fa89c93a586edb0670a96"
|
||||
},
|
||||
"lifetime": {
|
||||
"kind": "ttl",
|
||||
"ttl": "58.849511209s",
|
||||
"not_before": "2026-10-16T15:05:44.150488791Z",
|
||||
"expires_at": "2026-10-16T15:06:43Z"
|
||||
},
|
||||
"diagnostics": {
|
||||
"action": "execute-ccr",
|
||||
"matched_relationship": "",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_status": "proposed",
|
||||
"registry_overrode": [],
|
||||
"registry_resource": false,
|
||||
"registry_subject": true
|
||||
},
|
||||
"provenance": {
|
||||
"evaluator": "flex-auth/local",
|
||||
"mode": "standalone",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_version": "v2",
|
||||
"policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d",
|
||||
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||||
"input_claim_digests": {
|
||||
"context": "sha256:2a7db6ed9f4a978909074b38fc17dc1c26127b72a10fe515895bac7bdb083435"
|
||||
},
|
||||
"decision_time": "2026-10-16T15:05:44Z",
|
||||
"approval_observation": {
|
||||
"source_id": "synthetic-actual-approval-app",
|
||||
"source_revision": "actual-owner-python-source-fixture",
|
||||
"configuration_digest": "sha256:be934b2a902bbc14fa3a4fea20f1c1648390505900734b46599c7b5c544def22",
|
||||
"claim_digest": "sha256:f5c973c833e6038d4a4cf7bd3425a10646265e7d9633199b88f57009b849fd4b",
|
||||
"native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"observed_at": "2026-10-16T15:05:44.137304Z",
|
||||
"not_after": "2026-10-16T15:07:44.099087Z",
|
||||
"validated_at": "2026-10-16T15:05:44.13814262Z"
|
||||
},
|
||||
"caller": {
|
||||
"mode": "enforce",
|
||||
"principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"audience": "flex-auth",
|
||||
"not_after": "2026-10-16T15:07:43Z"
|
||||
}
|
||||
},
|
||||
"signature": {
|
||||
"mode": "signed",
|
||||
"alg": "ed25519",
|
||||
"kid": "synthetic-v2",
|
||||
"value": "utV-0akTB0x404y6mdQHAMuL8YLKrwdGtLYWCsk51pLiA_TxkamzL5fqoflcVXJfUBIEaMP8IfR3g53bUqyWBw"
|
||||
},
|
||||
"caring": {
|
||||
"profile": "caring-0.4.0-rc2",
|
||||
"conformance_findings": [
|
||||
{
|
||||
"code": "CARING-DESCRIPTOR-MISSING",
|
||||
"severity": "warning",
|
||||
"message": "no CARING descriptor matched the request",
|
||||
"fields": [
|
||||
"caring_context"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
{"schema": "secrets-engine.pdp-trust.v1", "evaluator": "flex-auth/local", "mode": "standalone", "policy_package": "secrets-engine.task-execution.service-pilot", "policy_version": "v2", "policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d", "keys": {"synthetic-v2": "Zs1gi5KLiOUODv6qM_rxxDzv4HKUsLh-n-CrpqPPdjM"}}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
{
|
||||
"scope": "disposable synthetic only",
|
||||
"actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine",
|
||||
"actual_access": "production serve binary from frozen B2/B3 retained-registry R3",
|
||||
"allow": true,
|
||||
"original_context_unchanged": true,
|
||||
"published_digest_match": true,
|
||||
"returned_source_record_match": true,
|
||||
"actual_source_consumed_refused": true,
|
||||
"actual_strict_prepare_and_consume": true,
|
||||
"retained_registry": true,
|
||||
"signed_deny_preapproval": true,
|
||||
"no_precision_sleep": true,
|
||||
"approval_precision_patch": "74eb0ff67d14508c2a2cee14d055790321ee171a96d5290ad6d037ce8f61dbcd",
|
||||
"actual_registry_drift_refuses_before_cas": true,
|
||||
"no_record_after_refusal": true,
|
||||
"native_admission": false,
|
||||
"files_sha256": {
|
||||
"consumption-confirmation.json": "sha256:b8e73258585ebcba195c16d9ea3866afbcdfb226b70225e804ceade4a80da929",
|
||||
"preapproval.json": "sha256:75a808a854af61465e5f1fd8a5a8fd003c9530a748fbed54ec3e825a31e2778a",
|
||||
"negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd",
|
||||
"registry-drift-refusal.json": "sha256:e6ce8bfeb9559370022b801d556d78df39ce82dc425d461e0ad5dcdf7b2a39c6",
|
||||
"synthetic-public-trust.json": "sha256:a612f8b7ca6cc7342bb150d7ff48b2da15b342efa0f8d6bae55f288f266bb7cb",
|
||||
"source-record.json": "sha256:80d140aec62a1a6ab49b14374d2349732bfa39aa15dc33ad6f7dfe3b02553872",
|
||||
"handoff.json": "sha256:7994cccc9491ed3c7cbb56d35e7f5d9f27b46aa1abde299be3818d9e2aea97ea",
|
||||
"claimfree-request.json": "sha256:03735c353218483016ee42e054097b1b26b7faf8cecf7991c2bfc2c3a301b0e8",
|
||||
"normalization-source-record.json": "sha256:67dff5deb09aa98ce9fb11af1eff213a98cb3a730a06de062cb08442de4fd90c",
|
||||
"response.json": "sha256:80d140aec62a1a6ab49b14374d2349732bfa39aa15dc33ad6f7dfe3b02553872",
|
||||
"original-approval-claim.json": "sha256:a4347f3ba2ac0ba29c9104948b10fe62f6292179315abcbd268998c1a3046e07",
|
||||
"request.json": "sha256:c4f6d753b433f8b60b649fb4afda96336e8c60e5a84ec5b0efaeca909b1d54ca"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,98 @@
|
|||
{
|
||||
"approval_binding_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29",
|
||||
"approval_expires_at": "2026-10-16T14:58:12.078227+00:00",
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"decision_expires_at": "2026-10-16T14:56:12Z",
|
||||
"decision_id": "decision:fbb2533578fcbd1b",
|
||||
"decision_not_before": "2026-10-16T14:55:12.720633573Z",
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:56:12+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"native_binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:63eab50cea34a62c794fbad1c969354420172c94aac7dd0070701d5c6ff95a6e",
|
||||
"submitted_request_digest": "sha256:63c4c4da6d4f112919a57f595fecd7b311dac541c00f51403484e1742417b4e2"
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"missing-service-binding": true,
|
||||
"changed-descriptor": true,
|
||||
"changed-native-target": true,
|
||||
"expired-original": true,
|
||||
"tampered-signature": true,
|
||||
"prepared-replay": true
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
{
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:57:12+00:00",
|
||||
"observed_at": "2026-10-16T14:55:12+00:00",
|
||||
"ttl_seconds": 120
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:58:12.078227+00:00",
|
||||
"not_before": "2026-10-16T14:54:12.078227+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
}
|
||||
|
|
@ -0,0 +1,223 @@
|
|||
{
|
||||
"approval_binding_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29",
|
||||
"decision_id": "decision:d887e6c2729dee80",
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:56:12+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"native_binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"original_request": {
|
||||
"action": "execute-ccr",
|
||||
"context": {
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:56:12+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"resource": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "service"
|
||||
},
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"submitted_request_digest": "sha256:ddceaa8669948ca6e80ae9a909d4971fcde52332f92997c9902d6cb05aabe44d"
|
||||
}
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
"scope": "disposable synthetic only",
|
||||
"actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine",
|
||||
"actual_access": "production serve binary from frozen B2/B3 temporal R2",
|
||||
"allow": true,
|
||||
"original_context_unchanged": true,
|
||||
"published_digest_match": true,
|
||||
"returned_source_record_match": true,
|
||||
"actual_source_consumed_refused": true,
|
||||
"actual_strict_prepare_and_consume": true,
|
||||
"retained_registry": true,
|
||||
"signed_deny_preapproval": true,
|
||||
"no_precision_sleep": true,
|
||||
"no_record_after_refusal": true,
|
||||
"native_admission": false,
|
||||
"files_sha256": {
|
||||
"preapproval.json": "sha256:4de92cf77938a99ed24d12f858cd57d173497035bd0bb1c41775da77d61818e9",
|
||||
"negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd",
|
||||
"source-record.json": "sha256:462a9b1ef5eaa755ad9c0b912227be3f0d4103291ba5fe401ae532b6ac1219fd",
|
||||
"handoff.json": "sha256:c14618c039cd5254872b7dc5420f6a40695c98e9993b9c55513cb541c5616c06",
|
||||
"response.json": "sha256:462a9b1ef5eaa755ad9c0b912227be3f0d4103291ba5fe401ae532b6ac1219fd",
|
||||
"original-approval-claim.json": "sha256:25f472fb00948bd3c9d806d7a5f61cd4e6a548a1f69933d240f7dfc1067155be",
|
||||
"request.json": "sha256:0929ad6106d3739a1fd5a951e2827e417c9026e73586359b0f7d48820e05cc86"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,172 @@
|
|||
{
|
||||
"action": "execute-ccr",
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:57:12+00:00",
|
||||
"observed_at": "2026-10-16T14:55:12+00:00",
|
||||
"ttl_seconds": 120
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:58:12.078227+00:00",
|
||||
"not_before": "2026-10-16T14:54:12.078227+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:56:12+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"resource": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "service"
|
||||
},
|
||||
"tenant": "tenant:platform"
|
||||
}
|
||||
|
|
@ -0,0 +1,284 @@
|
|||
{
|
||||
"id": "decision:fbb2533578fcbd1b",
|
||||
"contract_version": "flex-auth.decision-record.v1",
|
||||
"effect": "allow",
|
||||
"reason": "exact_task_execution_matched",
|
||||
"matched_policy_version": "v2",
|
||||
"matched_rule": "exact_task_execution_matched",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||
"display_name": "secrets-engine service principal",
|
||||
"groups": [
|
||||
"group:secrets-engine-lane-operators"
|
||||
],
|
||||
"organization_relation": "ServiceProvider",
|
||||
"roles": [
|
||||
"Operator"
|
||||
]
|
||||
}
|
||||
},
|
||||
"binding": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||
"display_name": "secrets-engine service principal",
|
||||
"groups": [
|
||||
"group:secrets-engine-lane-operators"
|
||||
],
|
||||
"organization_relation": "ServiceProvider",
|
||||
"roles": [
|
||||
"Operator"
|
||||
]
|
||||
}
|
||||
},
|
||||
"action": "execute-ccr",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:57:12+00:00",
|
||||
"observed_at": "2026-10-16T14:55:12+00:00",
|
||||
"ttl_seconds": 120
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:58:12.078227+00:00",
|
||||
"not_before": "2026-10-16T14:54:12.078227+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:56:12+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:63eab50cea34a62c794fbad1c969354420172c94aac7dd0070701d5c6ff95a6e",
|
||||
"approval_binding_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29",
|
||||
"submitted_request_digest": "sha256:63c4c4da6d4f112919a57f595fecd7b311dac541c00f51403484e1742417b4e2"
|
||||
},
|
||||
"lifetime": {
|
||||
"kind": "ttl",
|
||||
"ttl": "59.279366427s",
|
||||
"not_before": "2026-10-16T14:55:12.720633573Z",
|
||||
"expires_at": "2026-10-16T14:56:12Z"
|
||||
},
|
||||
"diagnostics": {
|
||||
"action": "execute-ccr",
|
||||
"matched_relationship": "",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_status": "proposed",
|
||||
"registry_overrode": [],
|
||||
"registry_resource": false,
|
||||
"registry_subject": true
|
||||
},
|
||||
"provenance": {
|
||||
"evaluator": "flex-auth/local",
|
||||
"mode": "standalone",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_version": "v2",
|
||||
"policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d",
|
||||
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||||
"input_claim_digests": {
|
||||
"context": "sha256:0cbf619be3ce222fe0c3c74474f37d46678df486a77f540046390b13a64b5fc2"
|
||||
},
|
||||
"decision_time": "2026-10-16T14:55:12Z",
|
||||
"approval_observation": {
|
||||
"source_id": "synthetic-actual-approval-app",
|
||||
"source_revision": "actual-owner-python-source-fixture",
|
||||
"configuration_digest": "sha256:ba4fc2cc956173b731487ff742e446efd6e318ab77f3d2bb97040c9a14a74f09",
|
||||
"claim_digest": "sha256:045c9ae25cda8e28ff97f2b646d07d177cab6c012d1c6aac8179f9e7d65a54e2",
|
||||
"native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"observed_at": "2026-10-16T14:55:12Z",
|
||||
"not_after": "2026-10-16T14:57:12Z",
|
||||
"validated_at": "2026-10-16T14:55:12.692281563Z"
|
||||
},
|
||||
"caller": {
|
||||
"mode": "enforce",
|
||||
"principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"audience": "flex-auth",
|
||||
"not_after": "2026-10-16T14:57:12Z"
|
||||
}
|
||||
},
|
||||
"signature": {
|
||||
"mode": "signed",
|
||||
"alg": "ed25519",
|
||||
"kid": "synthetic-v2",
|
||||
"value": "IgqOKC3xNGiurjliAin8w36agCazymTi8gMfTCGsXCzAZaLmX_m_5vk-h4OnQ7YDcX0wK7B7KARm9AczDJ4wDA"
|
||||
},
|
||||
"caring": {
|
||||
"profile": "caring-0.4.0-rc2",
|
||||
"conformance_findings": [
|
||||
{
|
||||
"code": "CARING-DESCRIPTOR-MISSING",
|
||||
"severity": "warning",
|
||||
"message": "no CARING descriptor matched the request",
|
||||
"fields": [
|
||||
"caring_context"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,284 @@
|
|||
{
|
||||
"id": "decision:fbb2533578fcbd1b",
|
||||
"contract_version": "flex-auth.decision-record.v1",
|
||||
"effect": "allow",
|
||||
"reason": "exact_task_execution_matched",
|
||||
"matched_policy_version": "v2",
|
||||
"matched_rule": "exact_task_execution_matched",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||
"display_name": "secrets-engine service principal",
|
||||
"groups": [
|
||||
"group:secrets-engine-lane-operators"
|
||||
],
|
||||
"organization_relation": "ServiceProvider",
|
||||
"roles": [
|
||||
"Operator"
|
||||
]
|
||||
}
|
||||
},
|
||||
"binding": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||||
"display_name": "secrets-engine service principal",
|
||||
"groups": [
|
||||
"group:secrets-engine-lane-operators"
|
||||
],
|
||||
"organization_relation": "ServiceProvider",
|
||||
"roles": [
|
||||
"Operator"
|
||||
]
|
||||
}
|
||||
},
|
||||
"action": "execute-ccr",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:57:12+00:00",
|
||||
"observed_at": "2026-10-16T14:55:12+00:00",
|
||||
"ttl_seconds": 120
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:58:12.078227+00:00",
|
||||
"not_before": "2026-10-16T14:54:12.078227+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:56:12+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:63eab50cea34a62c794fbad1c969354420172c94aac7dd0070701d5c6ff95a6e",
|
||||
"approval_binding_digest": "sha256:955e1c42ba2ec2c4e33c03168c0a3081d2c272d17d1e176395764308aae82a29",
|
||||
"submitted_request_digest": "sha256:63c4c4da6d4f112919a57f595fecd7b311dac541c00f51403484e1742417b4e2"
|
||||
},
|
||||
"lifetime": {
|
||||
"kind": "ttl",
|
||||
"ttl": "59.279366427s",
|
||||
"not_before": "2026-10-16T14:55:12.720633573Z",
|
||||
"expires_at": "2026-10-16T14:56:12Z"
|
||||
},
|
||||
"diagnostics": {
|
||||
"action": "execute-ccr",
|
||||
"matched_relationship": "",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_status": "proposed",
|
||||
"registry_overrode": [],
|
||||
"registry_resource": false,
|
||||
"registry_subject": true
|
||||
},
|
||||
"provenance": {
|
||||
"evaluator": "flex-auth/local",
|
||||
"mode": "standalone",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_version": "v2",
|
||||
"policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d",
|
||||
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||||
"input_claim_digests": {
|
||||
"context": "sha256:0cbf619be3ce222fe0c3c74474f37d46678df486a77f540046390b13a64b5fc2"
|
||||
},
|
||||
"decision_time": "2026-10-16T14:55:12Z",
|
||||
"approval_observation": {
|
||||
"source_id": "synthetic-actual-approval-app",
|
||||
"source_revision": "actual-owner-python-source-fixture",
|
||||
"configuration_digest": "sha256:ba4fc2cc956173b731487ff742e446efd6e318ab77f3d2bb97040c9a14a74f09",
|
||||
"claim_digest": "sha256:045c9ae25cda8e28ff97f2b646d07d177cab6c012d1c6aac8179f9e7d65a54e2",
|
||||
"native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"observed_at": "2026-10-16T14:55:12Z",
|
||||
"not_after": "2026-10-16T14:57:12Z",
|
||||
"validated_at": "2026-10-16T14:55:12.692281563Z"
|
||||
},
|
||||
"caller": {
|
||||
"mode": "enforce",
|
||||
"principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"audience": "flex-auth",
|
||||
"not_after": "2026-10-16T14:57:12Z"
|
||||
}
|
||||
},
|
||||
"signature": {
|
||||
"mode": "signed",
|
||||
"alg": "ed25519",
|
||||
"kid": "synthetic-v2",
|
||||
"value": "IgqOKC3xNGiurjliAin8w36agCazymTi8gMfTCGsXCzAZaLmX_m_5vk-h4OnQ7YDcX0wK7B7KARm9AczDJ4wDA"
|
||||
},
|
||||
"caring": {
|
||||
"profile": "caring-0.4.0-rc2",
|
||||
"conformance_findings": [
|
||||
{
|
||||
"code": "CARING-DESCRIPTOR-MISSING",
|
||||
"severity": "warning",
|
||||
"message": "no CARING descriptor matched the request",
|
||||
"fields": [
|
||||
"caring_context"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,196 @@
|
|||
"""Disposable synthetic proof: actual Approval App HTTPS -> actual Access serve.
|
||||
No native config, credential environment, approval or backend effect is used.
|
||||
"""
|
||||
import copy, base64, hashlib, http.server, io, json, os, pathlib, socket, ssl, subprocess, sys, tempfile, threading, time
|
||||
from datetime import datetime, timedelta, timezone
|
||||
from wsgiref.simple_server import make_server, WSGIRequestHandler
|
||||
from cryptography import x509
|
||||
from cryptography.x509.oid import NameOID
|
||||
from cryptography.hazmat.primitives import hashes, serialization
|
||||
from cryptography.hazmat.primitives.asymmetric import rsa
|
||||
sys.path.insert(0, '/tmp/netkingdom-approval-timestamp-precision-20261016')
|
||||
sys.path.insert(0, '/tmp/netkingdom-secrets-trusted-successor/src')
|
||||
from approval_engine.api import App
|
||||
from approval_engine.auth import Identity, StaticTokenAuthenticator
|
||||
from approval_engine.store import Engine
|
||||
from secrets_engine.authorization import request_digest, approval_binding_digest
|
||||
from secrets_engine.approval_consume import _expected_request
|
||||
from secrets_engine.approval_claim import binding_from_check_request
|
||||
from secrets_engine.execution_contract import ExecutionContract
|
||||
from secrets_engine.task_execution_handoff import authorize_task_execution,consume_task_execution,prepare_task_approval
|
||||
sys.path.insert(0,'/tmp/netkingdom-secrets-trusted-successor')
|
||||
from tests.test_execution_context import entry,descriptor
|
||||
from types import SimpleNamespace
|
||||
from urllib.request import Request, urlopen
|
||||
from urllib.error import HTTPError
|
||||
|
||||
OUT=pathlib.Path(sys.argv[1]);OUT.mkdir(exist_ok=True)
|
||||
def digest(raw):return 'sha256:'+hashlib.sha256(raw).hexdigest()
|
||||
def write(path,raw,mode=0o600):path.write_bytes(raw);path.chmod(mode)
|
||||
def identity(subject,kind,scopes):return Identity(subject=subject,issuer='synthetic-test-only',audiences=('approval-engine',),principal_type=kind,tenant='tenant:platform',roles=frozenset(),scopes=frozenset(scopes),assurance={'level':'synthetic'},evidence_ref='synthetic-test-only',tenant_source='directory')
|
||||
class Quiet(WSGIRequestHandler):
|
||||
def log_message(self,*args):pass
|
||||
class Review(http.server.BaseHTTPRequestHandler):
|
||||
def do_POST(self):
|
||||
raw=self.rfile.read(int(self.headers['Content-Length']));body=json.loads(raw)
|
||||
assert self.path=='/apis/authentication.k8s.io/v1/tokenreviews'
|
||||
assert self.headers['Authorization']=='Bearer synthetic-reviewer'
|
||||
assert body['spec']['audiences']==['flex-auth','access-engine']
|
||||
self.send_response(200);self.send_header('Content-Type','application/json');self.end_headers();self.wfile.write(json.dumps({'status':{'authenticated':True,'audiences':['flex-auth'],'user':{'username':'system:serviceaccount:secrets-engine:secrets-engine'}}}).encode())
|
||||
def log_message(self,*args):pass
|
||||
with tempfile.TemporaryDirectory(prefix='access-actual-python-source-') as folder:
|
||||
root=pathlib.Path(folder);now=datetime.now(timezone.utc)
|
||||
key=rsa.generate_private_key(public_exponent=65537,key_size=2048);name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,'localhost')]);cert=(x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key()).serial_number(x509.random_serial_number()).not_valid_before(now-timedelta(minutes=1)).not_valid_after(now+timedelta(hours=1)).add_extension(x509.SubjectAlternativeName([x509.DNSName('localhost')]),critical=False).sign(key,hashes.SHA256()))
|
||||
ca=root/'ca.pem';private=root/'tls-key.pem';write(ca,cert.public_bytes(serialization.Encoding.PEM));write(private,key.private_bytes(serialization.Encoding.PEM,serialization.PrivateFormat.PKCS8,serialization.NoEncryption()))
|
||||
tls=ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER);tls.load_cert_chain(ca,private)
|
||||
ctx=ssl.create_default_context(cafile=str(ca))
|
||||
def start(server):server.socket=tls.wrap_socket(server.socket,server_side=True);threading.Thread(target=server.serve_forever,daemon=True).start();return 'https://localhost:'+str(server.server_port)
|
||||
review=http.server.HTTPServer(('127.0.0.1',0),Review);review_origin=start(review)
|
||||
engine=Engine(root/'approval.sqlite3',freshness_ttl=120)
|
||||
auth=StaticTokenAuthenticator({'synthetic-creator':identity('secrets-engine','service',{'approval:create'}),'synthetic-human':identity('synthetic-human','human',{'approval:approve'}),'synthetic-reader':identity('synthetic-access-reader','service',{'approval:read'}),'synthetic-consumer':identity('secrets-engine','service',{'approval:read','approval:consume'})})
|
||||
app=App(engine,auth)
|
||||
source=make_server('127.0.0.1',0,app,handler_class=Quiet);origin=start(source)
|
||||
consumer=make_server('127.0.0.1',0,app,handler_class=Quiet);threading.Thread(target=consumer.serve_forever,daemon=True).start()
|
||||
def source_call(method,path,body,token):
|
||||
request=Request(origin+path,data=json.dumps(body).encode() if body is not None else None,method=method,headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'})
|
||||
with urlopen(request,context=ctx,timeout=3) as response:return response.status,json.load(response)
|
||||
# Actual production builder, before issue: no caller approval enrichment.
|
||||
aid='8bfc20be-47a4-4fb0-97a2-bf0a920afad8'
|
||||
e=entry();d=descriptor(e)
|
||||
d['operation_deadline']=(now+timedelta(seconds=60)).replace(microsecond=0).isoformat()
|
||||
h='sha256:'+'a'*64
|
||||
d['backend_budget']={'ttl_seconds':30,'uses':12}
|
||||
d['operations']=[{'method':method,'path':path,'payload_sha256':h} for path in ['sys/policies/acl/synthetic','auth/synthetic/role/synthetic'] for method in ['GET','PUT','GET']]
|
||||
contract=ExecutionContract.parse(d)
|
||||
cfg=SimpleNamespace(authorization_subject_id='secrets-engine',authorization_subject_type='service',authorization_policy_package='secrets-engine.task-execution.service-pilot',authorization_policy_version='v2',approval_url='http://127.0.0.1:'+str(consumer.server_port))
|
||||
request=_expected_request(cfg,e,'execute-ccr',execution_contract=contract)
|
||||
native=binding_from_check_request(request)
|
||||
seed=root/'seed';write(seed,base64.urlsafe_b64encode(bytes([19])*32).rstrip(b'='),0o440)
|
||||
reviewer_token=root/'review-token';write(reviewer_token,b'synthetic-reviewer',0o440)
|
||||
reader_token=root/'reader-token';write(reader_token,b'synthetic-reader',0o440)
|
||||
registry=root/'registry.json';write(registry,pathlib.Path('/tmp/access-trusted-b2-b3-r2/examples/secrets-engine/registry_snapshot.json').read_bytes())
|
||||
config=root/'source.json';write(config,json.dumps({'source_id':'synthetic-actual-approval-app','source_revision':'actual-owner-python-source-fixture','origin':origin,'store_tenant':'tenant:platform','ca_file':str(ca),'token_file':str(reader_token)}).encode())
|
||||
listener=socket.socket();listener.bind(('127.0.0.1',0));port=listener.getsockname()[1];listener.close()
|
||||
record=root/'record.jsonl';url=f'http://127.0.0.1:{port}'
|
||||
command=['/tmp/netkingdom-access-trusted-r3','serve','--addr',f'127.0.0.1:{port}','--registry',str(registry),'--policy','/tmp/access-trusted-b2-b3-r2/examples/secrets-engine-service-task-execution-v2/policy_package.md','--log',str(record),'--caller-auth-mode','enforce','--caller-audience','flex-auth','--caller-kubernetes-url',review_origin,'--caller-reviewer-token-file',str(reviewer_token),'--caller-ca-file',str(ca),'--caller-binding','secrets-engine=system:serviceaccount:secrets-engine:secrets-engine','--envelope-signing-key-file',str(seed),'--envelope-signing-kid','synthetic-v2','--approval-source-file',str(config)]
|
||||
child=subprocess.Popen(command,env={},stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
|
||||
try:
|
||||
for _ in range(100):
|
||||
try:
|
||||
with urlopen(url+'/healthz',timeout=.2):break
|
||||
except Exception:time.sleep(.02)
|
||||
jwt='synthetic.'+base64.urlsafe_b64encode(json.dumps({'exp':int((now+timedelta(minutes=2)).timestamp())}).encode()).decode().rstrip('=')+'.synthetic'
|
||||
def check(value):
|
||||
req=Request(url+'/v1/check',data=json.dumps(value).encode(),headers={'Authorization':'Bearer '+jwt,'Content-Type':'application/json'})
|
||||
try:
|
||||
with urlopen(req,timeout=5) as response:return response.status,response.read()
|
||||
except HTTPError as error:return error.code,error.read()
|
||||
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
|
||||
public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw)
|
||||
trust={'schema':'secrets-engine.pdp-trust.v1','evaluator':'flex-auth/local','mode':'standalone','policy_package':cfg.authorization_policy_package,'policy_version':'v2','policy_package_digest':'sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d','keys':{'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')}}
|
||||
trustfile=root/'synthetic-trust.json';write(trustfile,json.dumps(trust).encode())
|
||||
pdptoken=root/'consumer-pdp-token';write(pdptoken,jwt.encode())
|
||||
approvaltoken=root/'consumer-approval-token';write(approvaltoken,b'synthetic-consumer')
|
||||
cfg.pdp_url=url;cfg.pdp_token_file=pdptoken;cfg.approval_token_file=approvaltoken;cfg.pdp_trust_file=trustfile;cfg.pdp_verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier')
|
||||
preapproval=prepare_task_approval(cfg,e,execution_contract=contract).as_owner_handoff()
|
||||
assert preapproval['original_request']==request
|
||||
assert preapproval['approval_binding_digest']!=preapproval['submitted_request_digest']
|
||||
native=preapproval['native_binding']
|
||||
status,created=source_call('POST','/v1/approvals',{'id':aid,'binding':native,'validity':{'not_before':(now-timedelta(minutes=1)).isoformat(),'expires_at':(now+timedelta(minutes=3)).isoformat()},'required_count':1,'pdp_digest':preapproval['approval_binding_digest'],'pdp_path':True,'human_control':True},'synthetic-creator');assert status==201
|
||||
status,_=source_call('POST',f'/v1/approvals/{aid}/entries',{},'synthetic-human');assert status==200
|
||||
status,claim=source_call('GET',f'/v1/approvals/{aid}/claim',None,'synthetic-reader');assert status==200 and claim['valid_now'] is True and claim['binding']['human_control'] is True
|
||||
request['context']['approval']=claim
|
||||
|
||||
# An old normalization cannot survive authoritative owner registry drift.
|
||||
from secrets_engine.errors import DecisionError
|
||||
normalized_record=record.read_bytes();original_registry=registry.read_bytes()
|
||||
changed_registry=json.loads(original_registry)
|
||||
changed_registry['subjects'][0]['roles'].append('SyntheticChangedRegistryRole')
|
||||
def restart_registry(raw_registry):
|
||||
global child
|
||||
child.terminate();child.wait(timeout=5)
|
||||
write(registry,raw_registry)
|
||||
child=subprocess.Popen(command,env={},stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
|
||||
for _ in range(100):
|
||||
try:
|
||||
with urlopen(url+'/healthz',timeout=.2):return
|
||||
except Exception:time.sleep(.02)
|
||||
raise AssertionError('restarted Access unavailable')
|
||||
restart_registry(json.dumps(changed_registry).encode())
|
||||
try:authorize_task_execution(cfg,e,execution_contract=contract)
|
||||
except DecisionError:pass
|
||||
else:raise AssertionError('registry drift accepted original preapproval')
|
||||
assert record.read_bytes()==normalized_record
|
||||
_,unconsumed=source_call('GET',f'/v1/approvals/{aid}/claim',None,'synthetic-reader')
|
||||
assert unconsumed['consumed'] is False
|
||||
write(OUT/'registry-drift-refusal.json',(json.dumps({'actual_owner_registry_changed':True,'original_registry_sha256':digest(original_registry),'authoritative_registry_enrichment_retained':True,'original_preapproval_refused_by_final_check':True,'new_decision_record':False,'approval_consumed':False,'CAS_calls':0,'native_effects':0},indent=2)+'\n').encode(),0o644)
|
||||
restart_registry(original_registry)
|
||||
saved=record.read_bytes()
|
||||
negative={}
|
||||
for case in ['missing-service-binding','changed-descriptor','changed-native-target','expired-original']:
|
||||
changed=copy.deepcopy(request)
|
||||
if case=='missing-service-binding':del changed['context']['service_actor_binding']
|
||||
elif case=='changed-descriptor':changed['context']['execution_contract']['expected_after']='sha256:'+'b'*64
|
||||
elif case=='changed-native-target':changed['resource']['attributes']['synthetic_extra']=1.0
|
||||
else:changed['context']['approval']['freshness']['not_after']='2000-01-01T00:00:00Z'
|
||||
refused_case,_=check(changed)
|
||||
assert refused_case!=200 and record.read_bytes()==saved,case
|
||||
negative[case]=True
|
||||
authorization=authorize_task_execution(cfg,e,execution_contract=contract)
|
||||
handoff=authorization.as_owner_handoff()
|
||||
artifacts=json.loads(authorization._action.artifacts)
|
||||
request=artifacts['request'];claim=artifacts['claim'];raw=artifacts['authenticated_envelope_json'].encode()
|
||||
assert handoff['native_binding']==native
|
||||
assert handoff['execution_contract']==contract.as_dict()
|
||||
assert datetime.fromisoformat(handoff['decision_expires_at'].replace('Z','+00:00'))==datetime.fromisoformat(contract.as_dict()['operation_deadline'])
|
||||
assert handoff['execution_contract']['backend_budget']=={'ttl_seconds':30,'uses':12}
|
||||
assert handoff['request_digest']==request_digest(artifacts['envelope']['binding'])
|
||||
assert handoff['submitted_request_digest']==request_digest(request)
|
||||
response=json.loads(raw)
|
||||
assert response['provenance']['registry_snapshot_digest']==preapproval['registry_snapshot_digest']
|
||||
assert claim['binding']['pdp_digest']==preapproval['approval_binding_digest']
|
||||
assert response['effect']=='allow' and response['signature']['mode']=='signed'
|
||||
assert response['binding']['context']==request['context'];assert response['binding']['submitted_request_digest']==request_digest(request);assert response['binding']['approval_binding_digest']==preapproval['approval_binding_digest']
|
||||
assert response['provenance']['approval_observation']['source_id']=='synthetic-actual-approval-app'
|
||||
from secrets_engine.decision_signature import authenticate_response
|
||||
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
|
||||
public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw)
|
||||
trust={k:response['provenance'][k] for k in ('evaluator','mode','policy_package','policy_version','policy_package_digest')}
|
||||
trust['keys']={'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')}
|
||||
authenticated=authenticate_response(raw,trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier'))
|
||||
assert authenticated['binding']['context']==request['context']
|
||||
assert authenticate_response(authenticated.authenticated_json.encode(),trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier'))==authenticated
|
||||
saved=record.read_bytes();records=[json.loads(line) for line in saved.splitlines()]
|
||||
assert len(records)==2 and records[0]['effect']=='deny' and records[-1]==response
|
||||
assert records[0]['binding']['request_digest']==preapproval['approval_binding_digest']
|
||||
assert response['binding']['submitted_request_digest']==request_digest(request)
|
||||
from secrets_engine.errors import DecisionError
|
||||
tampered=raw.replace(b'"effect":"allow"',b'"effect":"deny"')
|
||||
assert tampered!=raw
|
||||
try:authenticate_response(tampered,trust=trust,verifier=cfg.pdp_verifier)
|
||||
except DecisionError:negative['tampered-signature']=True
|
||||
else:raise AssertionError('tampered envelope accepted')
|
||||
consumption=consume_task_execution(cfg,authorization)
|
||||
assert datetime.fromisoformat(consumption.consumed_at.replace('Z','+00:00')).microsecond!=0
|
||||
assert consumption.idempotent is False and consumption.request_digest==handoff['request_digest'] and consumption.decision_id==handoff['decision_id']
|
||||
from approval_engine.execution_confirmation import ExecutionConfirmationClient
|
||||
confirmed=ExecutionConfirmationClient(cfg.approval_url,approvaltoken).confirm_consumption(aid,handoff['request_digest'],handoff['decision_id'],expected_binding=handoff['native_binding'],expected_pdp_digest=handoff['approval_binding_digest'])
|
||||
assert confirmed['request_digest']==handoff['request_digest'] and confirmed['decision_id']==handoff['decision_id']
|
||||
try:consume_task_execution(cfg,authorization)
|
||||
except DecisionError:negative['prepared-replay']=True
|
||||
else:raise AssertionError('prepared replay accepted')
|
||||
write(OUT/'negative-cases.json',(json.dumps(negative,indent=2)+'\n').encode(),0o644)
|
||||
write(OUT/'normalization-source-record.json',(json.dumps(records[0],indent=2)+'\n').encode(),0o644)
|
||||
write(OUT/'claimfree-request.json',(json.dumps(preapproval['original_request'],indent=2)+'\n').encode(),0o644)
|
||||
write(OUT/'synthetic-public-trust.json',trustfile.read_bytes(),0o644)
|
||||
write(OUT/'consumption-confirmation.json',(json.dumps(confirmed,indent=2)+'\n').encode(),0o644)
|
||||
write(OUT/'preapproval.json',(json.dumps(preapproval,indent=2)+'\n').encode(),0o644)
|
||||
write(OUT/'handoff.json' ,(json.dumps(handoff,indent=2)+'\n').encode(),0o644)
|
||||
# Consumed provider state cannot be rescued by the original carried claim.
|
||||
|
||||
refused,_=check(request);assert refused!=200 and record.read_bytes()==saved
|
||||
for name,value in [('request.json',request),('response.json',response),('source-record.json',records[-1]),('original-approval-claim.json',claim)]:write(OUT/name,(json.dumps(value,indent=2)+'\n').encode(),0o644)
|
||||
receipt={'scope':'disposable synthetic only','actual_source':'Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine','actual_access':'production serve binary from frozen B2/B3 retained-registry R3','allow':True,'original_context_unchanged':True,'published_digest_match':True,'returned_source_record_match':True,'actual_source_consumed_refused':True,'actual_strict_prepare_and_consume':True,'retained_registry':True,'signed_deny_preapproval':True,'no_precision_sleep':True,'approval_precision_patch':'74eb0ff67d14508c2a2cee14d055790321ee171a96d5290ad6d037ce8f61dbcd','actual_registry_drift_refuses_before_cas':True,'no_record_after_refusal':True,'native_admission':False,'files_sha256':{p.name:digest(p.read_bytes()) for p in OUT.iterdir() if p.suffix=='.json' and p.name not in ('receipt.json','offline-signature-replay.json')}}
|
||||
write(OUT/'receipt.json',(json.dumps(receipt,indent=2)+'\n').encode(),0o644);print(json.dumps(receipt,indent=2))
|
||||
finally:
|
||||
child.terminate();child.wait(timeout=5);source.shutdown();consumer.shutdown();review.shutdown();engine.close()
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
{
|
||||
"scope": "disposable synthetic only",
|
||||
"actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine",
|
||||
"actual_access": "production serve binary from frozen B2/B3 temporal R2",
|
||||
"allow": true,
|
||||
"original_context_unchanged": true,
|
||||
"published_digest_match": true,
|
||||
"returned_source_record_match": true,
|
||||
"actual_source_consumed_refused": true,
|
||||
"actual_strict_prepare_and_consume": true,
|
||||
"retained_registry": true,
|
||||
"signed_deny_preapproval": true,
|
||||
"no_precision_sleep": true,
|
||||
"no_record_after_refusal": true,
|
||||
"native_admission": false,
|
||||
"files_sha256": {
|
||||
"preapproval.json": "sha256:4de92cf77938a99ed24d12f858cd57d173497035bd0bb1c41775da77d61818e9",
|
||||
"negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd",
|
||||
"source-record.json": "sha256:462a9b1ef5eaa755ad9c0b912227be3f0d4103291ba5fe401ae532b6ac1219fd",
|
||||
"handoff.json": "sha256:c14618c039cd5254872b7dc5420f6a40695c98e9993b9c55513cb541c5616c06",
|
||||
"response.json": "sha256:462a9b1ef5eaa755ad9c0b912227be3f0d4103291ba5fe401ae532b6ac1219fd",
|
||||
"original-approval-claim.json": "sha256:25f472fb00948bd3c9d806d7a5f61cd4e6a548a1f69933d240f7dfc1067155be",
|
||||
"request.json": "sha256:0929ad6106d3739a1fd5a951e2827e417c9026e73586359b0f7d48820e05cc86"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,98 @@
|
|||
"""Disposable synthetic proof: actual Approval App HTTPS -> actual Access serve.
|
||||
No native config, credential environment, approval or backend effect is used.
|
||||
"""
|
||||
import base64, hashlib, http.server, io, json, os, pathlib, socket, ssl, subprocess, sys, tempfile, threading, time
|
||||
from datetime import datetime, timedelta, timezone
|
||||
from wsgiref.simple_server import make_server, WSGIRequestHandler
|
||||
from cryptography import x509
|
||||
from cryptography.x509.oid import NameOID
|
||||
from cryptography.hazmat.primitives import hashes, serialization
|
||||
from cryptography.hazmat.primitives.asymmetric import rsa
|
||||
sys.path.insert(0, '/home/worsch/approval-engine')
|
||||
sys.path.insert(0, '/tmp/netkingdom-secrets-trusted-successor/src')
|
||||
from approval_engine.api import App
|
||||
from approval_engine.auth import Identity, StaticTokenAuthenticator
|
||||
from approval_engine.store import Engine
|
||||
from secrets_engine.authorization import request_digest, approval_binding_digest
|
||||
from urllib.request import Request, urlopen
|
||||
from urllib.error import HTTPError
|
||||
|
||||
OUT=pathlib.Path(sys.argv[1]);OUT.mkdir(exist_ok=True)
|
||||
def digest(raw):return 'sha256:'+hashlib.sha256(raw).hexdigest()
|
||||
def write(path,raw,mode=0o600):path.write_bytes(raw);path.chmod(mode)
|
||||
def identity(subject,kind,scopes):return Identity(subject=subject,issuer='synthetic-test-only',audiences=('approval-engine',),principal_type=kind,tenant='tenant:platform',roles=frozenset(),scopes=frozenset(scopes),assurance={'level':'synthetic'},evidence_ref='synthetic-test-only',tenant_source='directory')
|
||||
class Quiet(WSGIRequestHandler):
|
||||
def log_message(self,*args):pass
|
||||
class Review(http.server.BaseHTTPRequestHandler):
|
||||
def do_POST(self):
|
||||
raw=self.rfile.read(int(self.headers['Content-Length']));body=json.loads(raw)
|
||||
assert self.path=='/apis/authentication.k8s.io/v1/tokenreviews'
|
||||
assert self.headers['Authorization']=='Bearer synthetic-reviewer'
|
||||
assert body['spec']['audiences']==['flex-auth','access-engine']
|
||||
self.send_response(200);self.send_header('Content-Type','application/json');self.end_headers();self.wfile.write(json.dumps({'status':{'authenticated':True,'audiences':['flex-auth'],'user':{'username':'system:serviceaccount:secrets-engine:secrets-engine'}}}).encode())
|
||||
def log_message(self,*args):pass
|
||||
with tempfile.TemporaryDirectory(prefix='access-actual-python-source-') as folder:
|
||||
root=pathlib.Path(folder);now=datetime.now(timezone.utc)
|
||||
key=rsa.generate_private_key(public_exponent=65537,key_size=2048);name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,'localhost')]);cert=(x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key()).serial_number(x509.random_serial_number()).not_valid_before(now-timedelta(minutes=1)).not_valid_after(now+timedelta(hours=1)).add_extension(x509.SubjectAlternativeName([x509.DNSName('localhost')]),critical=False).sign(key,hashes.SHA256()))
|
||||
ca=root/'ca.pem';private=root/'tls-key.pem';write(ca,cert.public_bytes(serialization.Encoding.PEM));write(private,key.private_bytes(serialization.Encoding.PEM,serialization.PrivateFormat.PKCS8,serialization.NoEncryption()))
|
||||
tls=ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER);tls.load_cert_chain(ca,private)
|
||||
ctx=ssl.create_default_context(cafile=str(ca))
|
||||
def start(server):server.socket=tls.wrap_socket(server.socket,server_side=True);threading.Thread(target=server.serve_forever,daemon=True).start();return 'https://localhost:'+str(server.server_port)
|
||||
review=http.server.HTTPServer(('127.0.0.1',0),Review);review_origin=start(review)
|
||||
engine=Engine(root/'approval.sqlite3',freshness_ttl=60)
|
||||
auth=StaticTokenAuthenticator({'synthetic-creator':identity('secrets-engine','service',{'approval:create'}),'synthetic-human':identity('synthetic-human','human',{'approval:approve'}),'synthetic-reader':identity('synthetic-access-reader','service',{'approval:read'})})
|
||||
app=App(engine,auth)
|
||||
source=make_server('127.0.0.1',0,app,handler_class=Quiet);origin=start(source)
|
||||
def source_call(method,path,body,token):
|
||||
request=Request(origin+path,data=json.dumps(body).encode() if body is not None else None,method=method,headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'})
|
||||
with urlopen(request,context=ctx,timeout=3) as response:return response.status,json.load(response)
|
||||
# Reuse existing owner interoperability contract generator; it has synthetic metadata only.
|
||||
generated=subprocess.check_output([sys.executable,'/tmp/access-trusted-b2-b3/tools/service_task_execution_fixture.py'],env={'PATH':os.defpath})
|
||||
request=json.loads(generated)['request'];request['subject']['tenant']='tenant:platform';request['resource']['tenant']='tenant:platform';request['context']['purpose']='actual Python App source-only synthetic proof';del request['context']['approval']
|
||||
native={'action':request['action'],'actor':'secrets-engine','principal':'secrets-engine','purpose':request['context']['purpose'],'target':request['resource']}
|
||||
aid='aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee'
|
||||
status,created=source_call('POST','/v1/approvals',{'id':aid,'binding':native,'validity':{'not_before':(now-timedelta(minutes=1)).isoformat(),'expires_at':(now+timedelta(minutes=3)).isoformat()},'required_count':1,'pdp_digest':approval_binding_digest(request),'pdp_path':True,'human_control':True},'synthetic-creator');assert status==201
|
||||
status,_=source_call('POST',f'/v1/approvals/{aid}/entries',{},'synthetic-human');assert status==200
|
||||
status,claim=source_call('GET',f'/v1/approvals/{aid}/claim',None,'synthetic-reader');assert status==200 and claim['valid_now'] is True and claim['binding']['human_control'] is True
|
||||
request['context']['approval']=claim
|
||||
seed=root/'seed';write(seed,base64.urlsafe_b64encode(bytes([19])*32).rstrip(b'='),0o440)
|
||||
reviewer_token=root/'review-token';write(reviewer_token,b'synthetic-reviewer',0o440)
|
||||
reader_token=root/'reader-token';write(reader_token,b'synthetic-reader',0o440)
|
||||
registry=root/'registry.json';write(registry,b'{}')
|
||||
config=root/'source.json';write(config,json.dumps({'source_id':'synthetic-actual-approval-app','source_revision':'actual-owner-python-source-fixture','origin':origin,'store_tenant':'tenant:platform','ca_file':str(ca),'token_file':str(reader_token)}).encode())
|
||||
listener=socket.socket();listener.bind(('127.0.0.1',0));port=listener.getsockname()[1];listener.close()
|
||||
record=root/'record.jsonl';url=f'http://127.0.0.1:{port}'
|
||||
command=['/tmp/netkingdom-access-trusted-r1','serve','--addr',f'127.0.0.1:{port}','--registry',str(registry),'--policy','/tmp/access-trusted-b2-b3/examples/secrets-engine-service-task-execution-v2/policy_package.md','--log',str(record),'--caller-auth-mode','enforce','--caller-audience','flex-auth','--caller-kubernetes-url',review_origin,'--caller-reviewer-token-file',str(reviewer_token),'--caller-ca-file',str(ca),'--caller-binding','secrets-engine=system:serviceaccount:secrets-engine:secrets-engine','--envelope-signing-key-file',str(seed),'--envelope-signing-kid','synthetic-v2','--approval-source-file',str(config)]
|
||||
child=subprocess.Popen(command,env={},stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
|
||||
try:
|
||||
for _ in range(100):
|
||||
try:
|
||||
with urlopen(url+'/healthz',timeout=.2):break
|
||||
except Exception:time.sleep(.02)
|
||||
jwt='synthetic.'+base64.urlsafe_b64encode(json.dumps({'exp':int((now+timedelta(minutes=2)).timestamp())}).encode()).decode().rstrip('=')+'.synthetic'
|
||||
def check(value):
|
||||
req=Request(url+'/v1/check',data=json.dumps(value).encode(),headers={'Authorization':'Bearer '+jwt,'Content-Type':'application/json'})
|
||||
try:
|
||||
with urlopen(req,timeout=5) as response:return response.status,response.read()
|
||||
except HTTPError as error:return error.code,error.read()
|
||||
status,raw=check(request);assert status==200,(status,raw)
|
||||
response=json.loads(raw);assert response['effect']=='allow' and response['signature']['mode']=='signed'
|
||||
assert response['binding']['context']==request['context'];assert response['binding']['submitted_request_digest']==request_digest(request);assert response['binding']['approval_binding_digest']==approval_binding_digest(request)
|
||||
assert response['provenance']['approval_observation']['source_id']=='synthetic-actual-approval-app'
|
||||
from secrets_engine.decision_signature import authenticate_response
|
||||
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
|
||||
public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw)
|
||||
trust={k:response['provenance'][k] for k in ('evaluator','mode','policy_package','policy_version','policy_package_digest')}
|
||||
trust['keys']={'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')}
|
||||
authenticated=authenticate_response(raw,trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier'))
|
||||
assert authenticated['binding']['context']==request['context']
|
||||
assert authenticate_response(authenticated.authenticated_json.encode(),trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier'))==authenticated
|
||||
saved=record.read_bytes();assert json.loads(saved)==response
|
||||
# Actual producer state transition is fetched anew and cannot be rescued by carried claim.
|
||||
engine.revoke(aid)
|
||||
refused,_=check(request);assert refused!=200 and record.read_bytes()==saved
|
||||
for name,value in [('request.json',request),('response.json',response),('source-record.json',json.loads(saved)),('original-approval-claim.json',claim)]:write(OUT/name,(json.dumps(value,indent=2)+'\n').encode(),0o644)
|
||||
receipt={'scope':'disposable synthetic only','actual_source':'Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine','actual_access':'production serve binary from frozen B2/B3 R1','allow':True,'original_context_unchanged':True,'published_digest_match':True,'returned_source_record_match':True,'actual_source_revoke_refused':True,'no_record_after_refusal':True,'native_admission':False,'files_sha256':{p.name:digest(p.read_bytes()) for p in OUT.iterdir() if p.suffix=='.json'}}
|
||||
write(OUT/'receipt.json',(json.dumps(receipt,indent=2)+'\n').encode(),0o644);print(json.dumps(receipt,indent=2))
|
||||
finally:
|
||||
child.terminate();child.wait(timeout=5);source.shutdown();review.shutdown();engine.close()
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"scope": "disposable synthetic only",
|
||||
"actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine",
|
||||
"actual_access": "production serve binary from frozen B2/B3 R1",
|
||||
"allow": true,
|
||||
"original_context_unchanged": true,
|
||||
"published_digest_match": true,
|
||||
"returned_source_record_match": true,
|
||||
"actual_source_revoke_refused": true,
|
||||
"no_record_after_refusal": true,
|
||||
"native_admission": false,
|
||||
"files_sha256": {
|
||||
"source-record.json": "sha256:4161d0cc595aa1d73fac4acb632c620cebdf100fa7e54cbb741cc43663feebc8",
|
||||
"response.json": "sha256:4161d0cc595aa1d73fac4acb632c620cebdf100fa7e54cbb741cc43663feebc8",
|
||||
"original-approval-claim.json": "sha256:144f133000451e504fd208b1c6b3212b7a4fa7d16c7545e7ae17e509d122619a",
|
||||
"request.json": "sha256:50db27dc3f782c844df9510174383465ca554136bc10524fd566a0edf06a4df8"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,39 @@
|
|||
{
|
||||
"approval_id": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:9683b49e53006e36ea4813e631ecd688df5a7a6242a8734c2cc5dca1887fb090",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "actual Python App source-only synthetic proof",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:synthetic",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:20:53+00:00",
|
||||
"observed_at": "2026-10-16T14:19:53+00:00",
|
||||
"ttl_seconds": 60
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:22:53.492254+00:00",
|
||||
"not_before": "2026-10-16T14:18:53.492254+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
}
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"scope": "disposable synthetic only",
|
||||
"actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine",
|
||||
"actual_access": "production serve binary from frozen B2/B3 R1",
|
||||
"allow": true,
|
||||
"original_context_unchanged": true,
|
||||
"published_digest_match": true,
|
||||
"returned_source_record_match": true,
|
||||
"actual_source_revoke_refused": true,
|
||||
"no_record_after_refusal": true,
|
||||
"native_admission": false,
|
||||
"files_sha256": {
|
||||
"source-record.json": "sha256:4161d0cc595aa1d73fac4acb632c620cebdf100fa7e54cbb741cc43663feebc8",
|
||||
"response.json": "sha256:4161d0cc595aa1d73fac4acb632c620cebdf100fa7e54cbb741cc43663feebc8",
|
||||
"original-approval-claim.json": "sha256:144f133000451e504fd208b1c6b3212b7a4fa7d16c7545e7ae17e509d122619a",
|
||||
"request.json": "sha256:50db27dc3f782c844df9510174383465ca554136bc10524fd566a0edf06a4df8"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,142 @@
|
|||
{
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"action": "execute-ccr",
|
||||
"resource": {
|
||||
"id": "catalog:synthetic",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod"
|
||||
},
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"context": {
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 120,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:290e55b2258d66980f9443ba7d1436adfc77b8814bd161004d5af2ba272bc9cc",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "synthetic-not-native",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:21:33.683190+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/synthetic/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/synthetic/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/synthetic/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/synthetic/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"catalog_target": {
|
||||
"lane": "synthetic",
|
||||
"stage": "prod"
|
||||
},
|
||||
"human_control": true,
|
||||
"service_actor_binding": {
|
||||
"version": "proposed-service-task-caller/v1",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"purpose": "actual Python App source-only synthetic proof",
|
||||
"approval": {
|
||||
"approval_id": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:9683b49e53006e36ea4813e631ecd688df5a7a6242a8734c2cc5dca1887fb090",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "actual Python App source-only synthetic proof",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:synthetic",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:20:53+00:00",
|
||||
"observed_at": "2026-10-16T14:19:53+00:00",
|
||||
"ttl_seconds": 60
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:22:53.492254+00:00",
|
||||
"not_before": "2026-10-16T14:18:53.492254+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,229 @@
|
|||
{
|
||||
"id": "decision:974ba42d31e13fe2",
|
||||
"contract_version": "flex-auth.decision-record.v1",
|
||||
"effect": "allow",
|
||||
"reason": "exact_task_execution_matched",
|
||||
"matched_policy_version": "v2",
|
||||
"matched_rule": "exact_task_execution_matched",
|
||||
"resource": {
|
||||
"id": "catalog:synthetic",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"binding": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"action": "execute-ccr",
|
||||
"resource": {
|
||||
"id": "catalog:synthetic",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:9683b49e53006e36ea4813e631ecd688df5a7a6242a8734c2cc5dca1887fb090",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "actual Python App source-only synthetic proof",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:synthetic",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:20:53+00:00",
|
||||
"observed_at": "2026-10-16T14:19:53+00:00",
|
||||
"ttl_seconds": 60
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:22:53.492254+00:00",
|
||||
"not_before": "2026-10-16T14:18:53.492254+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"lane": "synthetic",
|
||||
"stage": "prod"
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 120,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:290e55b2258d66980f9443ba7d1436adfc77b8814bd161004d5af2ba272bc9cc",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "synthetic-not-native",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:21:33.683190+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/synthetic/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/synthetic/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/synthetic/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/synthetic/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "actual Python App source-only synthetic proof",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:38925892a5f3e3ff93a7e1b21bddf3556ca037c4a473466172ecceea3f0db628",
|
||||
"approval_binding_digest": "sha256:9683b49e53006e36ea4813e631ecd688df5a7a6242a8734c2cc5dca1887fb090",
|
||||
"submitted_request_digest": "sha256:38925892a5f3e3ff93a7e1b21bddf3556ca037c4a473466172ecceea3f0db628"
|
||||
},
|
||||
"lifetime": {
|
||||
"kind": "ttl",
|
||||
"ttl": "15s",
|
||||
"not_before": "2026-10-16T14:19:53Z",
|
||||
"expires_at": "2026-10-16T14:20:08Z"
|
||||
},
|
||||
"diagnostics": {
|
||||
"action": "execute-ccr",
|
||||
"matched_relationship": "",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_status": "proposed",
|
||||
"registry_overrode": [],
|
||||
"registry_resource": false,
|
||||
"registry_subject": false
|
||||
},
|
||||
"provenance": {
|
||||
"evaluator": "flex-auth/local",
|
||||
"mode": "standalone",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_version": "v2",
|
||||
"policy_package_digest": "sha256:fc5a8769886b72006ba298bc0799741d0f1ed327dde9e36a6c35d26be4ea0bdc",
|
||||
"registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
|
||||
"input_claim_digests": {
|
||||
"context": "sha256:29a4d2e1ccb1ffed60d7e84bade5e719ed39d1eebbfa9ee80c8ca46d7d38062e"
|
||||
},
|
||||
"decision_time": "2026-10-16T14:19:53Z",
|
||||
"approval_observation": {
|
||||
"source_id": "synthetic-actual-approval-app",
|
||||
"source_revision": "actual-owner-python-source-fixture",
|
||||
"configuration_digest": "sha256:f886cf108e79530e83dcc0f1fd127a39479dddaf5039014c2d7ed8f795b92947",
|
||||
"claim_digest": "sha256:547015020ab77d8c179216c21141b1ffd47072124e97de848f16cea5ec9719f8",
|
||||
"native_binding_digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d",
|
||||
"observed_at": "2026-10-16T14:19:53Z",
|
||||
"not_after": "2026-10-16T14:20:53Z",
|
||||
"validated_at": "2026-10-16T14:19:53.8556608Z"
|
||||
},
|
||||
"caller": {
|
||||
"mode": "enforce",
|
||||
"principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"audience": "flex-auth",
|
||||
"not_after": "2026-10-16T14:21:53Z"
|
||||
}
|
||||
},
|
||||
"signature": {
|
||||
"mode": "signed",
|
||||
"alg": "ed25519",
|
||||
"kid": "synthetic-v2",
|
||||
"value": "tVf1ppYrKsvLHJL-7Q9c9IEegJYIHql3s2Xvw8vjucz2KyufnMBArzEnK9J5k9BBtfWpDgP8OEEj7Dw6QjVrBg"
|
||||
},
|
||||
"caring": {
|
||||
"profile": "caring-0.4.0-rc2",
|
||||
"conformance_findings": [
|
||||
{
|
||||
"code": "CARING-DESCRIPTOR-MISSING",
|
||||
"severity": "warning",
|
||||
"message": "no CARING descriptor matched the request",
|
||||
"fields": [
|
||||
"caring_context"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,229 @@
|
|||
{
|
||||
"id": "decision:974ba42d31e13fe2",
|
||||
"contract_version": "flex-auth.decision-record.v1",
|
||||
"effect": "allow",
|
||||
"reason": "exact_task_execution_matched",
|
||||
"matched_policy_version": "v2",
|
||||
"matched_rule": "exact_task_execution_matched",
|
||||
"resource": {
|
||||
"id": "catalog:synthetic",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"binding": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"action": "execute-ccr",
|
||||
"resource": {
|
||||
"id": "catalog:synthetic",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:9683b49e53006e36ea4813e631ecd688df5a7a6242a8734c2cc5dca1887fb090",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "actual Python App source-only synthetic proof",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:synthetic",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:20:53+00:00",
|
||||
"observed_at": "2026-10-16T14:19:53+00:00",
|
||||
"ttl_seconds": 60
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:22:53.492254+00:00",
|
||||
"not_before": "2026-10-16T14:18:53.492254+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"lane": "synthetic",
|
||||
"stage": "prod"
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 120,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:290e55b2258d66980f9443ba7d1436adfc77b8814bd161004d5af2ba272bc9cc",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "synthetic-not-native",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:21:33.683190+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/synthetic/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/synthetic/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/synthetic/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/synthetic/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "actual Python App source-only synthetic proof",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:38925892a5f3e3ff93a7e1b21bddf3556ca037c4a473466172ecceea3f0db628",
|
||||
"approval_binding_digest": "sha256:9683b49e53006e36ea4813e631ecd688df5a7a6242a8734c2cc5dca1887fb090",
|
||||
"submitted_request_digest": "sha256:38925892a5f3e3ff93a7e1b21bddf3556ca037c4a473466172ecceea3f0db628"
|
||||
},
|
||||
"lifetime": {
|
||||
"kind": "ttl",
|
||||
"ttl": "15s",
|
||||
"not_before": "2026-10-16T14:19:53Z",
|
||||
"expires_at": "2026-10-16T14:20:08Z"
|
||||
},
|
||||
"diagnostics": {
|
||||
"action": "execute-ccr",
|
||||
"matched_relationship": "",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_status": "proposed",
|
||||
"registry_overrode": [],
|
||||
"registry_resource": false,
|
||||
"registry_subject": false
|
||||
},
|
||||
"provenance": {
|
||||
"evaluator": "flex-auth/local",
|
||||
"mode": "standalone",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_version": "v2",
|
||||
"policy_package_digest": "sha256:fc5a8769886b72006ba298bc0799741d0f1ed327dde9e36a6c35d26be4ea0bdc",
|
||||
"registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
|
||||
"input_claim_digests": {
|
||||
"context": "sha256:29a4d2e1ccb1ffed60d7e84bade5e719ed39d1eebbfa9ee80c8ca46d7d38062e"
|
||||
},
|
||||
"decision_time": "2026-10-16T14:19:53Z",
|
||||
"approval_observation": {
|
||||
"source_id": "synthetic-actual-approval-app",
|
||||
"source_revision": "actual-owner-python-source-fixture",
|
||||
"configuration_digest": "sha256:f886cf108e79530e83dcc0f1fd127a39479dddaf5039014c2d7ed8f795b92947",
|
||||
"claim_digest": "sha256:547015020ab77d8c179216c21141b1ffd47072124e97de848f16cea5ec9719f8",
|
||||
"native_binding_digest": "sha256:19cfbe20e156cef1f4c0a37842c47666d2f5b2164d803d77a12346ed38a9444d",
|
||||
"observed_at": "2026-10-16T14:19:53Z",
|
||||
"not_after": "2026-10-16T14:20:53Z",
|
||||
"validated_at": "2026-10-16T14:19:53.8556608Z"
|
||||
},
|
||||
"caller": {
|
||||
"mode": "enforce",
|
||||
"principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"audience": "flex-auth",
|
||||
"not_after": "2026-10-16T14:21:53Z"
|
||||
}
|
||||
},
|
||||
"signature": {
|
||||
"mode": "signed",
|
||||
"alg": "ed25519",
|
||||
"kid": "synthetic-v2",
|
||||
"value": "tVf1ppYrKsvLHJL-7Q9c9IEegJYIHql3s2Xvw8vjucz2KyufnMBArzEnK9J5k9BBtfWpDgP8OEEj7Dw6QjVrBg"
|
||||
},
|
||||
"caring": {
|
||||
"profile": "caring-0.4.0-rc2",
|
||||
"conformance_findings": [
|
||||
{
|
||||
"code": "CARING-DESCRIPTOR-MISSING",
|
||||
"severity": "warning",
|
||||
"message": "no CARING descriptor matched the request",
|
||||
"fields": [
|
||||
"caring_context"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
Traceback (most recent call last):
|
||||
File "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-source-smoke-r2.py", line 121, in <module>
|
||||
assert status==200 and confirmed['request_digest']==handoff['request_digest'] and confirmed['decision_id']==handoff['decision_id']
|
||||
~~~~~~~~~^^^^^^^^^^^^^^^^^^
|
||||
KeyError: 'request_digest'
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
Traceback (most recent call last):
|
||||
File "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-source-smoke-r3.py", line 105, in <module>
|
||||
assert handoff['decision_expires_at']==contract.as_dict()['operation_deadline']
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
AssertionError
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
Traceback (most recent call last):
|
||||
File "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-16/decision-trusted-successor/actual-strict-source-smoke-r3.py", line 137, in <module>
|
||||
consumption=consume_task_execution(cfg,authorization)
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
File "/tmp/netkingdom-secrets-trusted-successor/src/secrets_engine/task_execution_handoff.py", line 206, in consume_task_execution
|
||||
_refuse()
|
||||
File "/tmp/netkingdom-secrets-trusted-successor/src/secrets_engine/task_execution_handoff.py", line 34, in _refuse
|
||||
raise DecisionError('strict task execution handoff correspondence refused')
|
||||
secrets_engine.errors.DecisionError: strict task execution handoff correspondence refused
|
||||
|
|
@ -0,0 +1,98 @@
|
|||
{
|
||||
"approval_binding_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19",
|
||||
"approval_expires_at": "2026-10-16T14:31:11.162458+00:00",
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"decision_expires_at": "2026-10-16T14:28:23Z",
|
||||
"decision_id": "decision:65b3e4594d0e3af8",
|
||||
"decision_not_before": "2026-10-16T14:28:11Z",
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 120,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:28:23+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"native_binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:e47269c2c3458bb7c23fef40092e2bf5c084c705a13f72a1cbfeac0c6fbadc3e",
|
||||
"submitted_request_digest": "sha256:e47269c2c3458bb7c23fef40092e2bf5c084c705a13f72a1cbfeac0c6fbadc3e"
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"missing-service-binding": true,
|
||||
"changed-descriptor": true,
|
||||
"changed-native-target": true,
|
||||
"expired-original": true,
|
||||
"tampered-signature": true,
|
||||
"prepared-replay": true
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
{
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:29:11+00:00",
|
||||
"observed_at": "2026-10-16T14:28:11+00:00",
|
||||
"ttl_seconds": 60
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:31:11.162458+00:00",
|
||||
"not_before": "2026-10-16T14:27:11.162458+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
"scope": "disposable synthetic only",
|
||||
"actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine",
|
||||
"actual_access": "production serve binary from frozen B2/B3 R1",
|
||||
"allow": true,
|
||||
"original_context_unchanged": true,
|
||||
"published_digest_match": true,
|
||||
"returned_source_record_match": true,
|
||||
"actual_source_consumed_refused": true,
|
||||
"actual_strict_prepare_and_consume": true,
|
||||
"no_record_after_refusal": true,
|
||||
"native_admission": false,
|
||||
"files_sha256": {
|
||||
"negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd",
|
||||
"receipt.json": "sha256:ef67d3235ac36e01f03c6b49e73f106f4fb328e954d71a6cfd84e1d8baac3b28",
|
||||
"source-record.json": "sha256:3d85490777303e032ce371ec0e7de514ea8b5825ad9b9437e7ff06414551e7bd",
|
||||
"handoff.json": "sha256:6156a5378ddfdd583ccafde75063165ead5e8df8c7114c94c3c4e44d637d813f",
|
||||
"response.json": "sha256:3d85490777303e032ce371ec0e7de514ea8b5825ad9b9437e7ff06414551e7bd",
|
||||
"original-approval-claim.json": "sha256:ecb921ebc1d836ab2a8fff9ec185011cdaf28f7c9341778107cae4605fc5f0e2",
|
||||
"request.json": "sha256:c4d9c5fe344185a7361b605db0df9b9018cae03a2b54818fad33b8a131c67aa5"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,172 @@
|
|||
{
|
||||
"action": "execute-ccr",
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:29:11+00:00",
|
||||
"observed_at": "2026-10-16T14:28:11+00:00",
|
||||
"ttl_seconds": 60
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:31:11.162458+00:00",
|
||||
"not_before": "2026-10-16T14:27:11.162458+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 120,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:28:23+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"resource": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "service"
|
||||
},
|
||||
"tenant": "tenant:platform"
|
||||
}
|
||||
|
|
@ -0,0 +1,262 @@
|
|||
{
|
||||
"id": "decision:65b3e4594d0e3af8",
|
||||
"contract_version": "flex-auth.decision-record.v1",
|
||||
"effect": "allow",
|
||||
"reason": "exact_task_execution_matched",
|
||||
"matched_policy_version": "v2",
|
||||
"matched_rule": "exact_task_execution_matched",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"binding": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"action": "execute-ccr",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:29:11+00:00",
|
||||
"observed_at": "2026-10-16T14:28:11+00:00",
|
||||
"ttl_seconds": 60
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:31:11.162458+00:00",
|
||||
"not_before": "2026-10-16T14:27:11.162458+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 120,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:28:23+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:e47269c2c3458bb7c23fef40092e2bf5c084c705a13f72a1cbfeac0c6fbadc3e",
|
||||
"approval_binding_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19",
|
||||
"submitted_request_digest": "sha256:e47269c2c3458bb7c23fef40092e2bf5c084c705a13f72a1cbfeac0c6fbadc3e"
|
||||
},
|
||||
"lifetime": {
|
||||
"kind": "ttl",
|
||||
"ttl": "15s",
|
||||
"not_before": "2026-10-16T14:28:11Z",
|
||||
"expires_at": "2026-10-16T14:28:23Z"
|
||||
},
|
||||
"diagnostics": {
|
||||
"action": "execute-ccr",
|
||||
"matched_relationship": "",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_status": "proposed",
|
||||
"registry_overrode": [],
|
||||
"registry_resource": false,
|
||||
"registry_subject": false
|
||||
},
|
||||
"provenance": {
|
||||
"evaluator": "flex-auth/local",
|
||||
"mode": "standalone",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_version": "v2",
|
||||
"policy_package_digest": "sha256:fc5a8769886b72006ba298bc0799741d0f1ed327dde9e36a6c35d26be4ea0bdc",
|
||||
"registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
|
||||
"input_claim_digests": {
|
||||
"context": "sha256:096701cc4eba7e263fa0f5ea3952215c5cc5058efc7100fa5496f8600ccd8628"
|
||||
},
|
||||
"decision_time": "2026-10-16T14:28:11Z",
|
||||
"approval_observation": {
|
||||
"source_id": "synthetic-actual-approval-app",
|
||||
"source_revision": "actual-owner-python-source-fixture",
|
||||
"configuration_digest": "sha256:ab433ef1edc7ebfba886f8fb8884aee18216aa85785c8e92e7ef5ef8cae362c6",
|
||||
"claim_digest": "sha256:db787ffa2d8b44c72455938af1fd086d5909167be5cc5c987252065a34d58381",
|
||||
"native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"observed_at": "2026-10-16T14:28:11Z",
|
||||
"not_after": "2026-10-16T14:29:11Z",
|
||||
"validated_at": "2026-10-16T14:28:11.442090034Z"
|
||||
},
|
||||
"caller": {
|
||||
"mode": "enforce",
|
||||
"principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"audience": "flex-auth",
|
||||
"not_after": "2026-10-16T14:30:11Z"
|
||||
}
|
||||
},
|
||||
"signature": {
|
||||
"mode": "signed",
|
||||
"alg": "ed25519",
|
||||
"kid": "synthetic-v2",
|
||||
"value": "XjHoJQkkPktnYV41DqOaoRWxS9m0IP3NjGGTLHav6GG7fS7mDXjYfoNDxYdf-DgI6IeBPDMfKHvHVz7niWY3CA"
|
||||
},
|
||||
"caring": {
|
||||
"profile": "caring-0.4.0-rc2",
|
||||
"conformance_findings": [
|
||||
{
|
||||
"code": "CARING-DESCRIPTOR-MISSING",
|
||||
"severity": "warning",
|
||||
"message": "no CARING descriptor matched the request",
|
||||
"fields": [
|
||||
"caring_context"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,262 @@
|
|||
{
|
||||
"id": "decision:65b3e4594d0e3af8",
|
||||
"contract_version": "flex-auth.decision-record.v1",
|
||||
"effect": "allow",
|
||||
"reason": "exact_task_execution_matched",
|
||||
"matched_policy_version": "v2",
|
||||
"matched_rule": "exact_task_execution_matched",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"binding": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"action": "execute-ccr",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:29:11+00:00",
|
||||
"observed_at": "2026-10-16T14:28:11+00:00",
|
||||
"ttl_seconds": 60
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:31:11.162458+00:00",
|
||||
"not_before": "2026-10-16T14:27:11.162458+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 120,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:28:23+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:e47269c2c3458bb7c23fef40092e2bf5c084c705a13f72a1cbfeac0c6fbadc3e",
|
||||
"approval_binding_digest": "sha256:7568d4dd53da932730b5e83bc03d821b612bb5ba4b53992940b08d805d03ea19",
|
||||
"submitted_request_digest": "sha256:e47269c2c3458bb7c23fef40092e2bf5c084c705a13f72a1cbfeac0c6fbadc3e"
|
||||
},
|
||||
"lifetime": {
|
||||
"kind": "ttl",
|
||||
"ttl": "15s",
|
||||
"not_before": "2026-10-16T14:28:11Z",
|
||||
"expires_at": "2026-10-16T14:28:23Z"
|
||||
},
|
||||
"diagnostics": {
|
||||
"action": "execute-ccr",
|
||||
"matched_relationship": "",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_status": "proposed",
|
||||
"registry_overrode": [],
|
||||
"registry_resource": false,
|
||||
"registry_subject": false
|
||||
},
|
||||
"provenance": {
|
||||
"evaluator": "flex-auth/local",
|
||||
"mode": "standalone",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_version": "v2",
|
||||
"policy_package_digest": "sha256:fc5a8769886b72006ba298bc0799741d0f1ed327dde9e36a6c35d26be4ea0bdc",
|
||||
"registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
|
||||
"input_claim_digests": {
|
||||
"context": "sha256:096701cc4eba7e263fa0f5ea3952215c5cc5058efc7100fa5496f8600ccd8628"
|
||||
},
|
||||
"decision_time": "2026-10-16T14:28:11Z",
|
||||
"approval_observation": {
|
||||
"source_id": "synthetic-actual-approval-app",
|
||||
"source_revision": "actual-owner-python-source-fixture",
|
||||
"configuration_digest": "sha256:ab433ef1edc7ebfba886f8fb8884aee18216aa85785c8e92e7ef5ef8cae362c6",
|
||||
"claim_digest": "sha256:db787ffa2d8b44c72455938af1fd086d5909167be5cc5c987252065a34d58381",
|
||||
"native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"observed_at": "2026-10-16T14:28:11Z",
|
||||
"not_after": "2026-10-16T14:29:11Z",
|
||||
"validated_at": "2026-10-16T14:28:11.442090034Z"
|
||||
},
|
||||
"caller": {
|
||||
"mode": "enforce",
|
||||
"principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"audience": "flex-auth",
|
||||
"not_after": "2026-10-16T14:30:11Z"
|
||||
}
|
||||
},
|
||||
"signature": {
|
||||
"mode": "signed",
|
||||
"alg": "ed25519",
|
||||
"kid": "synthetic-v2",
|
||||
"value": "XjHoJQkkPktnYV41DqOaoRWxS9m0IP3NjGGTLHav6GG7fS7mDXjYfoNDxYdf-DgI6IeBPDMfKHvHVz7niWY3CA"
|
||||
},
|
||||
"caring": {
|
||||
"profile": "caring-0.4.0-rc2",
|
||||
"conformance_findings": [
|
||||
{
|
||||
"code": "CARING-DESCRIPTOR-MISSING",
|
||||
"severity": "warning",
|
||||
"message": "no CARING descriptor matched the request",
|
||||
"fields": [
|
||||
"caring_context"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,98 @@
|
|||
{
|
||||
"approval_binding_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998",
|
||||
"approval_expires_at": "2026-10-16T14:49:01.265708+00:00",
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"decision_expires_at": "2026-10-16T14:47:01Z",
|
||||
"decision_id": "decision:ad3121ba5791bf53",
|
||||
"decision_not_before": "2026-10-16T14:46:01.504124217Z",
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:47:01+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"native_binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:14737221b7e4bd7e4d0b0ea4f3c5cdca77c1e5cf7696bebdce02d41a938b8c7a",
|
||||
"submitted_request_digest": "sha256:14737221b7e4bd7e4d0b0ea4f3c5cdca77c1e5cf7696bebdce02d41a938b8c7a"
|
||||
}
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
"missing-service-binding": true,
|
||||
"changed-descriptor": true,
|
||||
"changed-native-target": true,
|
||||
"expired-original": true,
|
||||
"tampered-signature": true,
|
||||
"prepared-replay": true
|
||||
}
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
{
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:48:01+00:00",
|
||||
"observed_at": "2026-10-16T14:46:01+00:00",
|
||||
"ttl_seconds": 120
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:49:01.265708+00:00",
|
||||
"not_before": "2026-10-16T14:45:01.265708+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
"scope": "disposable synthetic only",
|
||||
"actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine",
|
||||
"actual_access": "production serve binary from frozen B2/B3 temporal R2",
|
||||
"allow": true,
|
||||
"original_context_unchanged": true,
|
||||
"published_digest_match": true,
|
||||
"returned_source_record_match": true,
|
||||
"actual_source_consumed_refused": true,
|
||||
"actual_strict_prepare_and_consume": true,
|
||||
"no_record_after_refusal": true,
|
||||
"native_admission": false,
|
||||
"files_sha256": {
|
||||
"negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd",
|
||||
"source-record.json": "sha256:e7e9f7a0ecfc86c7cd449de7443f615e9ba19cecab1cf85f67ec03267e949e64",
|
||||
"handoff.json": "sha256:ef9739fce5d6be84f0a9e5a593499d4289fcc8bda79573c7d21316a45310234a",
|
||||
"response.json": "sha256:e7e9f7a0ecfc86c7cd449de7443f615e9ba19cecab1cf85f67ec03267e949e64",
|
||||
"original-approval-claim.json": "sha256:9e62510e1599d9bc61b15ebb24099e48a6992b808451af4fb3ce26a4b3338f1e",
|
||||
"request.json": "sha256:d65fb473885c9d6fbb089f5b7dcdcecb75cf31cf20e60a9158e562cb0eb3af4d"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,172 @@
|
|||
{
|
||||
"action": "execute-ccr",
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:48:01+00:00",
|
||||
"observed_at": "2026-10-16T14:46:01+00:00",
|
||||
"ttl_seconds": 120
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:49:01.265708+00:00",
|
||||
"not_before": "2026-10-16T14:45:01.265708+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:47:01+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"resource": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "service"
|
||||
},
|
||||
"tenant": "tenant:platform"
|
||||
}
|
||||
|
|
@ -0,0 +1,262 @@
|
|||
{
|
||||
"id": "decision:ad3121ba5791bf53",
|
||||
"contract_version": "flex-auth.decision-record.v1",
|
||||
"effect": "allow",
|
||||
"reason": "exact_task_execution_matched",
|
||||
"matched_policy_version": "v2",
|
||||
"matched_rule": "exact_task_execution_matched",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"binding": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"action": "execute-ccr",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:48:01+00:00",
|
||||
"observed_at": "2026-10-16T14:46:01+00:00",
|
||||
"ttl_seconds": 120
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:49:01.265708+00:00",
|
||||
"not_before": "2026-10-16T14:45:01.265708+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:47:01+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:14737221b7e4bd7e4d0b0ea4f3c5cdca77c1e5cf7696bebdce02d41a938b8c7a",
|
||||
"approval_binding_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998",
|
||||
"submitted_request_digest": "sha256:14737221b7e4bd7e4d0b0ea4f3c5cdca77c1e5cf7696bebdce02d41a938b8c7a"
|
||||
},
|
||||
"lifetime": {
|
||||
"kind": "ttl",
|
||||
"ttl": "59.495875783s",
|
||||
"not_before": "2026-10-16T14:46:01.504124217Z",
|
||||
"expires_at": "2026-10-16T14:47:01Z"
|
||||
},
|
||||
"diagnostics": {
|
||||
"action": "execute-ccr",
|
||||
"matched_relationship": "",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_status": "proposed",
|
||||
"registry_overrode": [],
|
||||
"registry_resource": false,
|
||||
"registry_subject": false
|
||||
},
|
||||
"provenance": {
|
||||
"evaluator": "flex-auth/local",
|
||||
"mode": "standalone",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_version": "v2",
|
||||
"policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d",
|
||||
"registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
|
||||
"input_claim_digests": {
|
||||
"context": "sha256:31feadf96c5282ca5963f1d4412c85daf6c892f058b10bbb92f73c7154967443"
|
||||
},
|
||||
"decision_time": "2026-10-16T14:46:01Z",
|
||||
"approval_observation": {
|
||||
"source_id": "synthetic-actual-approval-app",
|
||||
"source_revision": "actual-owner-python-source-fixture",
|
||||
"configuration_digest": "sha256:cc14058ab8fccb20af522c8e81e1c910b189301ccba8f318035a3bc0e3d6151c",
|
||||
"claim_digest": "sha256:250d0a45171435aa58ee79d68aadde8a5fc67100ea4aad920bd43022eba2288e",
|
||||
"native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"observed_at": "2026-10-16T14:46:01Z",
|
||||
"not_after": "2026-10-16T14:48:01Z",
|
||||
"validated_at": "2026-10-16T14:46:01.489860006Z"
|
||||
},
|
||||
"caller": {
|
||||
"mode": "enforce",
|
||||
"principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"audience": "flex-auth",
|
||||
"not_after": "2026-10-16T14:48:01Z"
|
||||
}
|
||||
},
|
||||
"signature": {
|
||||
"mode": "signed",
|
||||
"alg": "ed25519",
|
||||
"kid": "synthetic-v2",
|
||||
"value": "V86xS5ODlLLZK466slLjn652QkqzsOXoNIesK2MOYo38bC_8UIPNZCOJTGCRbXeTpVzcGEXgOgGCuhRWvwErBg"
|
||||
},
|
||||
"caring": {
|
||||
"profile": "caring-0.4.0-rc2",
|
||||
"conformance_findings": [
|
||||
{
|
||||
"code": "CARING-DESCRIPTOR-MISSING",
|
||||
"severity": "warning",
|
||||
"message": "no CARING descriptor matched the request",
|
||||
"fields": [
|
||||
"caring_context"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,262 @@
|
|||
{
|
||||
"id": "decision:ad3121ba5791bf53",
|
||||
"contract_version": "flex-auth.decision-record.v1",
|
||||
"effect": "allow",
|
||||
"reason": "exact_task_execution_matched",
|
||||
"matched_policy_version": "v2",
|
||||
"matched_rule": "exact_task_execution_matched",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"binding": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service",
|
||||
"tenant": "tenant:platform"
|
||||
},
|
||||
"action": "execute-ccr",
|
||||
"resource": {
|
||||
"id": "catalog:test-lane",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"approval": {
|
||||
"approval_id": "8bfc20be-47a4-4fb0-97a2-bf0a920afad8",
|
||||
"binding": {
|
||||
"action": "execute-ccr",
|
||||
"actor": "secrets-engine",
|
||||
"digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"human_control": true,
|
||||
"pdp_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998",
|
||||
"pdp_path": true,
|
||||
"principal": "secrets-engine",
|
||||
"purpose": "metadata-test",
|
||||
"target": {
|
||||
"attributes": {
|
||||
"auth_targets": [],
|
||||
"fields": [],
|
||||
"policy_targets": [],
|
||||
"stage": "prod"
|
||||
},
|
||||
"id": "catalog:test-lane",
|
||||
"system": "secrets-engine",
|
||||
"tenant": "tenant:platform",
|
||||
"type": "secret-catalog-lane"
|
||||
}
|
||||
},
|
||||
"consumed": false,
|
||||
"freshness": {
|
||||
"not_after": "2026-10-16T14:48:01+00:00",
|
||||
"observed_at": "2026-10-16T14:46:01+00:00",
|
||||
"ttl_seconds": 120
|
||||
},
|
||||
"issuer": "approval-engine",
|
||||
"kind": "approval-claim",
|
||||
"reason_code": "ok",
|
||||
"schema_version": "0.1",
|
||||
"state": "valid",
|
||||
"valid_now": true,
|
||||
"validity": {
|
||||
"expires_at": "2026-10-16T14:49:01.265708+00:00",
|
||||
"not_before": "2026-10-16T14:45:01.265708+00:00"
|
||||
},
|
||||
"yields_to": "net-kingdom taxonomy request-claim schema (statute \u00a717; unassigned)"
|
||||
},
|
||||
"catalog_target": {
|
||||
"auth_capability": {},
|
||||
"consumers": [
|
||||
{
|
||||
"auth": "approle",
|
||||
"claim": "role:c",
|
||||
"name": "c"
|
||||
}
|
||||
],
|
||||
"delivery_auth": {
|
||||
"management": "engine",
|
||||
"method": "approle"
|
||||
},
|
||||
"delivery_config": {},
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"fields": [
|
||||
"api_token"
|
||||
],
|
||||
"kind": "kv",
|
||||
"mount": "secret",
|
||||
"mount_management": "engine",
|
||||
"org": "coulomb",
|
||||
"path": "test/team/thing",
|
||||
"repo": "team-repo",
|
||||
"workload_delivery": []
|
||||
},
|
||||
"execution_contract": {
|
||||
"backend_budget": {
|
||||
"ttl_seconds": 30,
|
||||
"uses": 12
|
||||
},
|
||||
"backend_origin": "http://127.0.0.1:18200",
|
||||
"catalog_sha256": "sha256:e1c16ef3e5e064ce1896cef276e5c1a38347ed6d6b9af83783c177323301551f",
|
||||
"ccr_id": "CCR-2099-0001",
|
||||
"ccr_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"cluster_uid": "test-estate-not-live",
|
||||
"contract_version": "SECRETS-EXEC-20261011-v1",
|
||||
"execution_actor": "service:secrets-engine",
|
||||
"execution_grant_ccr_id": "CCR-2099-0002",
|
||||
"expected_after": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"expected_before": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"grant_immutable_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
|
||||
"operation": "metadata-apply-ccr",
|
||||
"operation_deadline": "2026-10-16T14:47:01+00:00",
|
||||
"operation_id": "cbfbced0-09d5-48c8-a1e7-a2ea4dc69153",
|
||||
"operations": [
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "sys/policies/acl/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "PUT",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
{
|
||||
"method": "GET",
|
||||
"path": "auth/synthetic/role/synthetic",
|
||||
"payload_sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
],
|
||||
"source_bundle": {
|
||||
"engine_dispatcher": {
|
||||
"path": "/owner/engine_dispatcher.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"platform_mediator": {
|
||||
"path": "/owner/platform_mediator.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"policy_auth": {
|
||||
"path": "/owner/policy_auth.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
},
|
||||
"typed_ccr": {
|
||||
"path": "/owner/typed_ccr.py",
|
||||
"sha256": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
||||
}
|
||||
}
|
||||
},
|
||||
"human_control": true,
|
||||
"purpose": "metadata-test",
|
||||
"service_actor_binding": {
|
||||
"subject_id": "secrets-engine",
|
||||
"subject_type": "service",
|
||||
"tenant": "tenant:platform",
|
||||
"transport_principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"version": "proposed-service-task-caller/v1"
|
||||
}
|
||||
},
|
||||
"request_digest": "sha256:14737221b7e4bd7e4d0b0ea4f3c5cdca77c1e5cf7696bebdce02d41a938b8c7a",
|
||||
"approval_binding_digest": "sha256:628214785b65ab29635aa49c23fe44005dd9cf6a383dc2eb8a537a2b03812998",
|
||||
"submitted_request_digest": "sha256:14737221b7e4bd7e4d0b0ea4f3c5cdca77c1e5cf7696bebdce02d41a938b8c7a"
|
||||
},
|
||||
"lifetime": {
|
||||
"kind": "ttl",
|
||||
"ttl": "59.495875783s",
|
||||
"not_before": "2026-10-16T14:46:01.504124217Z",
|
||||
"expires_at": "2026-10-16T14:47:01Z"
|
||||
},
|
||||
"diagnostics": {
|
||||
"action": "execute-ccr",
|
||||
"matched_relationship": "",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_status": "proposed",
|
||||
"registry_overrode": [],
|
||||
"registry_resource": false,
|
||||
"registry_subject": false
|
||||
},
|
||||
"provenance": {
|
||||
"evaluator": "flex-auth/local",
|
||||
"mode": "standalone",
|
||||
"policy_package": "secrets-engine.task-execution.service-pilot",
|
||||
"policy_version": "v2",
|
||||
"policy_package_digest": "sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d",
|
||||
"registry_snapshot_digest": "sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
|
||||
"input_claim_digests": {
|
||||
"context": "sha256:31feadf96c5282ca5963f1d4412c85daf6c892f058b10bbb92f73c7154967443"
|
||||
},
|
||||
"decision_time": "2026-10-16T14:46:01Z",
|
||||
"approval_observation": {
|
||||
"source_id": "synthetic-actual-approval-app",
|
||||
"source_revision": "actual-owner-python-source-fixture",
|
||||
"configuration_digest": "sha256:cc14058ab8fccb20af522c8e81e1c910b189301ccba8f318035a3bc0e3d6151c",
|
||||
"claim_digest": "sha256:250d0a45171435aa58ee79d68aadde8a5fc67100ea4aad920bd43022eba2288e",
|
||||
"native_binding_digest": "sha256:c0569199966763e924032a092b4a6a9a42541bcc635bdd30f65d7ef05a5af3a2",
|
||||
"observed_at": "2026-10-16T14:46:01Z",
|
||||
"not_after": "2026-10-16T14:48:01Z",
|
||||
"validated_at": "2026-10-16T14:46:01.489860006Z"
|
||||
},
|
||||
"caller": {
|
||||
"mode": "enforce",
|
||||
"principal": "system:serviceaccount:secrets-engine:secrets-engine",
|
||||
"audience": "flex-auth",
|
||||
"not_after": "2026-10-16T14:48:01Z"
|
||||
}
|
||||
},
|
||||
"signature": {
|
||||
"mode": "signed",
|
||||
"alg": "ed25519",
|
||||
"kid": "synthetic-v2",
|
||||
"value": "V86xS5ODlLLZK466slLjn652QkqzsOXoNIesK2MOYo38bC_8UIPNZCOJTGCRbXeTpVzcGEXgOgGCuhRWvwErBg"
|
||||
},
|
||||
"caring": {
|
||||
"profile": "caring-0.4.0-rc2",
|
||||
"conformance_findings": [
|
||||
{
|
||||
"code": "CARING-DESCRIPTOR-MISSING",
|
||||
"severity": "warning",
|
||||
"message": "no CARING descriptor matched the request",
|
||||
"fields": [
|
||||
"caring_context"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,151 @@
|
|||
"""Disposable synthetic proof: actual Approval App HTTPS -> actual Access serve.
|
||||
No native config, credential environment, approval or backend effect is used.
|
||||
"""
|
||||
import copy, base64, hashlib, http.server, io, json, os, pathlib, socket, ssl, subprocess, sys, tempfile, threading, time
|
||||
from datetime import datetime, timedelta, timezone
|
||||
from wsgiref.simple_server import make_server, WSGIRequestHandler
|
||||
from cryptography import x509
|
||||
from cryptography.x509.oid import NameOID
|
||||
from cryptography.hazmat.primitives import hashes, serialization
|
||||
from cryptography.hazmat.primitives.asymmetric import rsa
|
||||
sys.path.insert(0, '/home/worsch/approval-engine')
|
||||
sys.path.insert(0, '/tmp/netkingdom-secrets-trusted-successor/src')
|
||||
from approval_engine.api import App
|
||||
from approval_engine.auth import Identity, StaticTokenAuthenticator
|
||||
from approval_engine.store import Engine
|
||||
from secrets_engine.authorization import request_digest, approval_binding_digest
|
||||
from secrets_engine.approval_consume import _expected_request
|
||||
from secrets_engine.approval_claim import binding_from_check_request
|
||||
from secrets_engine.execution_contract import ExecutionContract
|
||||
from secrets_engine.task_execution_handoff import authorize_task_execution,consume_task_execution
|
||||
sys.path.insert(0,'/tmp/netkingdom-secrets-trusted-successor')
|
||||
from tests.test_execution_context import entry,descriptor
|
||||
from types import SimpleNamespace
|
||||
from urllib.request import Request, urlopen
|
||||
from urllib.error import HTTPError
|
||||
|
||||
OUT=pathlib.Path(sys.argv[1]);OUT.mkdir(exist_ok=True)
|
||||
def digest(raw):return 'sha256:'+hashlib.sha256(raw).hexdigest()
|
||||
def write(path,raw,mode=0o600):path.write_bytes(raw);path.chmod(mode)
|
||||
def identity(subject,kind,scopes):return Identity(subject=subject,issuer='synthetic-test-only',audiences=('approval-engine',),principal_type=kind,tenant='tenant:platform',roles=frozenset(),scopes=frozenset(scopes),assurance={'level':'synthetic'},evidence_ref='synthetic-test-only',tenant_source='directory')
|
||||
class Quiet(WSGIRequestHandler):
|
||||
def log_message(self,*args):pass
|
||||
class Review(http.server.BaseHTTPRequestHandler):
|
||||
def do_POST(self):
|
||||
raw=self.rfile.read(int(self.headers['Content-Length']));body=json.loads(raw)
|
||||
assert self.path=='/apis/authentication.k8s.io/v1/tokenreviews'
|
||||
assert self.headers['Authorization']=='Bearer synthetic-reviewer'
|
||||
assert body['spec']['audiences']==['flex-auth','access-engine']
|
||||
self.send_response(200);self.send_header('Content-Type','application/json');self.end_headers();self.wfile.write(json.dumps({'status':{'authenticated':True,'audiences':['flex-auth'],'user':{'username':'system:serviceaccount:secrets-engine:secrets-engine'}}}).encode())
|
||||
def log_message(self,*args):pass
|
||||
with tempfile.TemporaryDirectory(prefix='access-actual-python-source-') as folder:
|
||||
root=pathlib.Path(folder);now=datetime.now(timezone.utc)
|
||||
key=rsa.generate_private_key(public_exponent=65537,key_size=2048);name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,'localhost')]);cert=(x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key()).serial_number(x509.random_serial_number()).not_valid_before(now-timedelta(minutes=1)).not_valid_after(now+timedelta(hours=1)).add_extension(x509.SubjectAlternativeName([x509.DNSName('localhost')]),critical=False).sign(key,hashes.SHA256()))
|
||||
ca=root/'ca.pem';private=root/'tls-key.pem';write(ca,cert.public_bytes(serialization.Encoding.PEM));write(private,key.private_bytes(serialization.Encoding.PEM,serialization.PrivateFormat.PKCS8,serialization.NoEncryption()))
|
||||
tls=ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER);tls.load_cert_chain(ca,private)
|
||||
ctx=ssl.create_default_context(cafile=str(ca))
|
||||
def start(server):server.socket=tls.wrap_socket(server.socket,server_side=True);threading.Thread(target=server.serve_forever,daemon=True).start();return 'https://localhost:'+str(server.server_port)
|
||||
review=http.server.HTTPServer(('127.0.0.1',0),Review);review_origin=start(review)
|
||||
engine=Engine(root/'approval.sqlite3',freshness_ttl=60)
|
||||
auth=StaticTokenAuthenticator({'synthetic-creator':identity('secrets-engine','service',{'approval:create'}),'synthetic-human':identity('synthetic-human','human',{'approval:approve'}),'synthetic-reader':identity('synthetic-access-reader','service',{'approval:read'}),'synthetic-consumer':identity('secrets-engine','service',{'approval:read','approval:consume'})})
|
||||
app=App(engine,auth)
|
||||
source=make_server('127.0.0.1',0,app,handler_class=Quiet);origin=start(source)
|
||||
consumer=make_server('127.0.0.1',0,app,handler_class=Quiet);threading.Thread(target=consumer.serve_forever,daemon=True).start()
|
||||
def source_call(method,path,body,token):
|
||||
request=Request(origin+path,data=json.dumps(body).encode() if body is not None else None,method=method,headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'})
|
||||
with urlopen(request,context=ctx,timeout=3) as response:return response.status,json.load(response)
|
||||
# Actual production builder, before issue: no caller approval enrichment.
|
||||
aid='8bfc20be-47a4-4fb0-97a2-bf0a920afad8'
|
||||
e=entry();d=descriptor(e)
|
||||
d['operation_deadline']=(now+timedelta(seconds=12)).replace(microsecond=0).isoformat()
|
||||
h='sha256:'+'a'*64
|
||||
d['operations']=[{'method':method,'path':path,'payload_sha256':h} for path in ['sys/policies/acl/synthetic','auth/synthetic/role/synthetic'] for method in ['GET','PUT','GET']]
|
||||
contract=ExecutionContract.parse(d)
|
||||
cfg=SimpleNamespace(authorization_subject_id='secrets-engine',authorization_subject_type='service',authorization_policy_package='secrets-engine.task-execution.service-pilot',authorization_policy_version='v2',approval_url='http://127.0.0.1:'+str(consumer.server_port))
|
||||
request=_expected_request(cfg,e,'execute-ccr',execution_contract=contract)
|
||||
native=binding_from_check_request(request)
|
||||
status,created=source_call('POST','/v1/approvals',{'id':aid,'binding':native,'validity':{'not_before':(now-timedelta(minutes=1)).isoformat(),'expires_at':(now+timedelta(minutes=3)).isoformat()},'required_count':1,'pdp_digest':approval_binding_digest(request),'pdp_path':True,'human_control':True},'synthetic-creator');assert status==201
|
||||
status,_=source_call('POST',f'/v1/approvals/{aid}/entries',{},'synthetic-human');assert status==200
|
||||
status,claim=source_call('GET',f'/v1/approvals/{aid}/claim',None,'synthetic-reader');assert status==200 and claim['valid_now'] is True and claim['binding']['human_control'] is True
|
||||
request['context']['approval']=claim
|
||||
seed=root/'seed';write(seed,base64.urlsafe_b64encode(bytes([19])*32).rstrip(b'='),0o440)
|
||||
reviewer_token=root/'review-token';write(reviewer_token,b'synthetic-reviewer',0o440)
|
||||
reader_token=root/'reader-token';write(reader_token,b'synthetic-reader',0o440)
|
||||
registry=root/'registry.json';write(registry,b'{}')
|
||||
config=root/'source.json';write(config,json.dumps({'source_id':'synthetic-actual-approval-app','source_revision':'actual-owner-python-source-fixture','origin':origin,'store_tenant':'tenant:platform','ca_file':str(ca),'token_file':str(reader_token)}).encode())
|
||||
listener=socket.socket();listener.bind(('127.0.0.1',0));port=listener.getsockname()[1];listener.close()
|
||||
record=root/'record.jsonl';url=f'http://127.0.0.1:{port}'
|
||||
command=['/tmp/netkingdom-access-trusted-r1','serve','--addr',f'127.0.0.1:{port}','--registry',str(registry),'--policy','/tmp/access-trusted-b2-b3/examples/secrets-engine-service-task-execution-v2/policy_package.md','--log',str(record),'--caller-auth-mode','enforce','--caller-audience','flex-auth','--caller-kubernetes-url',review_origin,'--caller-reviewer-token-file',str(reviewer_token),'--caller-ca-file',str(ca),'--caller-binding','secrets-engine=system:serviceaccount:secrets-engine:secrets-engine','--envelope-signing-key-file',str(seed),'--envelope-signing-kid','synthetic-v2','--approval-source-file',str(config)]
|
||||
child=subprocess.Popen(command,env={},stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
|
||||
try:
|
||||
for _ in range(100):
|
||||
try:
|
||||
with urlopen(url+'/healthz',timeout=.2):break
|
||||
except Exception:time.sleep(.02)
|
||||
jwt='synthetic.'+base64.urlsafe_b64encode(json.dumps({'exp':int((now+timedelta(minutes=2)).timestamp())}).encode()).decode().rstrip('=')+'.synthetic'
|
||||
def check(value):
|
||||
req=Request(url+'/v1/check',data=json.dumps(value).encode(),headers={'Authorization':'Bearer '+jwt,'Content-Type':'application/json'})
|
||||
try:
|
||||
with urlopen(req,timeout=5) as response:return response.status,response.read()
|
||||
except HTTPError as error:return error.code,error.read()
|
||||
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
|
||||
public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw)
|
||||
trust={'schema':'secrets-engine.pdp-trust.v1','evaluator':'flex-auth/local','mode':'standalone','policy_package':cfg.authorization_policy_package,'policy_version':'v2','policy_package_digest':'sha256:fc5a8769886b72006ba298bc0799741d0f1ed327dde9e36a6c35d26be4ea0bdc','keys':{'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')}}
|
||||
trustfile=root/'synthetic-trust.json';write(trustfile,json.dumps(trust).encode())
|
||||
pdptoken=root/'consumer-pdp-token';write(pdptoken,jwt.encode())
|
||||
approvaltoken=root/'consumer-approval-token';write(approvaltoken,b'synthetic-consumer')
|
||||
cfg.pdp_url=url;cfg.pdp_token_file=pdptoken;cfg.approval_token_file=approvaltoken;cfg.pdp_trust_file=trustfile;cfg.pdp_verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier')
|
||||
authorization=authorize_task_execution(cfg,e,execution_contract=contract)
|
||||
handoff=authorization.as_owner_handoff()
|
||||
artifacts=json.loads(authorization._action.artifacts)
|
||||
request=artifacts['request'];claim=artifacts['claim'];raw=artifacts['authenticated_envelope_json'].encode()
|
||||
assert handoff['native_binding']==native
|
||||
assert handoff['execution_contract']==contract.as_dict()
|
||||
assert handoff['request_digest']==request_digest(artifacts['envelope']['binding'])
|
||||
assert handoff['submitted_request_digest']==request_digest(request)
|
||||
response=json.loads(raw);assert response['effect']=='allow' and response['signature']['mode']=='signed'
|
||||
assert response['binding']['context']==request['context'];assert response['binding']['submitted_request_digest']==request_digest(request);assert response['binding']['approval_binding_digest']==approval_binding_digest(request)
|
||||
assert response['provenance']['approval_observation']['source_id']=='synthetic-actual-approval-app'
|
||||
from secrets_engine.decision_signature import authenticate_response
|
||||
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
|
||||
public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw)
|
||||
trust={k:response['provenance'][k] for k in ('evaluator','mode','policy_package','policy_version','policy_package_digest')}
|
||||
trust['keys']={'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')}
|
||||
authenticated=authenticate_response(raw,trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier'))
|
||||
assert authenticated['binding']['context']==request['context']
|
||||
assert authenticate_response(authenticated.authenticated_json.encode(),trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier'))==authenticated
|
||||
saved=record.read_bytes();assert json.loads(saved)==response
|
||||
from secrets_engine.errors import DecisionError
|
||||
negative={}
|
||||
for case in ['missing-service-binding','changed-descriptor','changed-native-target','expired-original']:
|
||||
changed=copy.deepcopy(request)
|
||||
if case=='missing-service-binding':del changed['context']['service_actor_binding']
|
||||
elif case=='changed-descriptor':changed['context']['execution_contract']['expected_after']='sha256:'+'b'*64
|
||||
elif case=='changed-native-target':changed['resource']['attributes']['synthetic_extra']=1.0
|
||||
else:changed['context']['approval']['freshness']['not_after']='2000-01-01T00:00:00Z'
|
||||
refused_case,_=check(changed)
|
||||
assert refused_case!=200 and record.read_bytes()==saved,case
|
||||
negative[case]=True
|
||||
tampered=raw.replace(b'"effect":"allow"',b'"effect":"deny"')
|
||||
assert tampered!=raw
|
||||
try:authenticate_response(tampered,trust=trust,verifier=cfg.pdp_verifier)
|
||||
except DecisionError:negative['tampered-signature']=True
|
||||
else:raise AssertionError('tampered envelope accepted')
|
||||
consumption=consume_task_execution(cfg,authorization)
|
||||
assert consumption.idempotent is False and consumption.request_digest==handoff['request_digest'] and consumption.decision_id==handoff['decision_id']
|
||||
from approval_engine.execution_confirmation import ExecutionConfirmationClient
|
||||
confirmed=ExecutionConfirmationClient(cfg.approval_url,approvaltoken).confirm_consumption(aid,handoff['request_digest'],handoff['decision_id'],expected_binding=handoff['native_binding'],expected_pdp_digest=handoff['approval_binding_digest'])
|
||||
assert confirmed['request_digest']==handoff['request_digest'] and confirmed['decision_id']==handoff['decision_id']
|
||||
try:consume_task_execution(cfg,authorization)
|
||||
except DecisionError:negative['prepared-replay']=True
|
||||
else:raise AssertionError('prepared replay accepted')
|
||||
write(OUT/'negative-cases.json',(json.dumps(negative,indent=2)+'\n').encode(),0o644)
|
||||
write(OUT/'handoff.json' ,(json.dumps(handoff,indent=2)+'\n').encode(),0o644)
|
||||
# Consumed provider state cannot be rescued by the original carried claim.
|
||||
|
||||
refused,_=check(request);assert refused!=200 and record.read_bytes()==saved
|
||||
for name,value in [('request.json',request),('response.json',response),('source-record.json',json.loads(saved)),('original-approval-claim.json',claim)]:write(OUT/name,(json.dumps(value,indent=2)+'\n').encode(),0o644)
|
||||
receipt={'scope':'disposable synthetic only','actual_source':'Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine','actual_access':'production serve binary from frozen B2/B3 R1','allow':True,'original_context_unchanged':True,'published_digest_match':True,'returned_source_record_match':True,'actual_source_consumed_refused':True,'actual_strict_prepare_and_consume':True,'no_record_after_refusal':True,'native_admission':False,'files_sha256':{p.name:digest(p.read_bytes()) for p in OUT.iterdir() if p.suffix=='.json'}}
|
||||
write(OUT/'receipt.json',(json.dumps(receipt,indent=2)+'\n').encode(),0o644);print(json.dumps(receipt,indent=2))
|
||||
finally:
|
||||
child.terminate();child.wait(timeout=5);source.shutdown();consumer.shutdown();review.shutdown();engine.close()
|
||||
|
|
@ -0,0 +1,161 @@
|
|||
"""Disposable synthetic proof: actual Approval App HTTPS -> actual Access serve.
|
||||
No native config, credential environment, approval or backend effect is used.
|
||||
"""
|
||||
import copy, base64, hashlib, http.server, io, json, os, pathlib, socket, ssl, subprocess, sys, tempfile, threading, time
|
||||
from datetime import datetime, timedelta, timezone
|
||||
from wsgiref.simple_server import make_server, WSGIRequestHandler
|
||||
from cryptography import x509
|
||||
from cryptography.x509.oid import NameOID
|
||||
from cryptography.hazmat.primitives import hashes, serialization
|
||||
from cryptography.hazmat.primitives.asymmetric import rsa
|
||||
sys.path.insert(0, '/home/worsch/approval-engine')
|
||||
sys.path.insert(0, '/tmp/netkingdom-secrets-trusted-successor/src')
|
||||
from approval_engine.api import App
|
||||
from approval_engine.auth import Identity, StaticTokenAuthenticator
|
||||
from approval_engine.store import Engine
|
||||
from secrets_engine.authorization import request_digest, approval_binding_digest
|
||||
from secrets_engine.approval_consume import _expected_request
|
||||
from secrets_engine.approval_claim import binding_from_check_request
|
||||
from secrets_engine.execution_contract import ExecutionContract
|
||||
from secrets_engine.task_execution_handoff import authorize_task_execution,consume_task_execution
|
||||
sys.path.insert(0,'/tmp/netkingdom-secrets-trusted-successor')
|
||||
from tests.test_execution_context import entry,descriptor
|
||||
from types import SimpleNamespace
|
||||
from urllib.request import Request, urlopen
|
||||
from urllib.error import HTTPError
|
||||
|
||||
OUT=pathlib.Path(sys.argv[1]);OUT.mkdir(exist_ok=True)
|
||||
def digest(raw):return 'sha256:'+hashlib.sha256(raw).hexdigest()
|
||||
def write(path,raw,mode=0o600):path.write_bytes(raw);path.chmod(mode)
|
||||
def identity(subject,kind,scopes):return Identity(subject=subject,issuer='synthetic-test-only',audiences=('approval-engine',),principal_type=kind,tenant='tenant:platform',roles=frozenset(),scopes=frozenset(scopes),assurance={'level':'synthetic'},evidence_ref='synthetic-test-only',tenant_source='directory')
|
||||
class Quiet(WSGIRequestHandler):
|
||||
def log_message(self,*args):pass
|
||||
class Review(http.server.BaseHTTPRequestHandler):
|
||||
def do_POST(self):
|
||||
raw=self.rfile.read(int(self.headers['Content-Length']));body=json.loads(raw)
|
||||
assert self.path=='/apis/authentication.k8s.io/v1/tokenreviews'
|
||||
assert self.headers['Authorization']=='Bearer synthetic-reviewer'
|
||||
assert body['spec']['audiences']==['flex-auth','access-engine']
|
||||
self.send_response(200);self.send_header('Content-Type','application/json');self.end_headers();self.wfile.write(json.dumps({'status':{'authenticated':True,'audiences':['flex-auth'],'user':{'username':'system:serviceaccount:secrets-engine:secrets-engine'}}}).encode())
|
||||
def log_message(self,*args):pass
|
||||
with tempfile.TemporaryDirectory(prefix='access-actual-python-source-') as folder:
|
||||
root=pathlib.Path(folder);now=datetime.now(timezone.utc)
|
||||
key=rsa.generate_private_key(public_exponent=65537,key_size=2048);name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME,'localhost')]);cert=(x509.CertificateBuilder().subject_name(name).issuer_name(name).public_key(key.public_key()).serial_number(x509.random_serial_number()).not_valid_before(now-timedelta(minutes=1)).not_valid_after(now+timedelta(hours=1)).add_extension(x509.SubjectAlternativeName([x509.DNSName('localhost')]),critical=False).sign(key,hashes.SHA256()))
|
||||
ca=root/'ca.pem';private=root/'tls-key.pem';write(ca,cert.public_bytes(serialization.Encoding.PEM));write(private,key.private_bytes(serialization.Encoding.PEM,serialization.PrivateFormat.PKCS8,serialization.NoEncryption()))
|
||||
tls=ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER);tls.load_cert_chain(ca,private)
|
||||
ctx=ssl.create_default_context(cafile=str(ca))
|
||||
def start(server):server.socket=tls.wrap_socket(server.socket,server_side=True);threading.Thread(target=server.serve_forever,daemon=True).start();return 'https://localhost:'+str(server.server_port)
|
||||
review=http.server.HTTPServer(('127.0.0.1',0),Review);review_origin=start(review)
|
||||
engine=Engine(root/'approval.sqlite3',freshness_ttl=120)
|
||||
auth=StaticTokenAuthenticator({'synthetic-creator':identity('secrets-engine','service',{'approval:create'}),'synthetic-human':identity('synthetic-human','human',{'approval:approve'}),'synthetic-reader':identity('synthetic-access-reader','service',{'approval:read'}),'synthetic-consumer':identity('secrets-engine','service',{'approval:read','approval:consume'})})
|
||||
app=App(engine,auth)
|
||||
source=make_server('127.0.0.1',0,app,handler_class=Quiet);origin=start(source)
|
||||
consumer=make_server('127.0.0.1',0,app,handler_class=Quiet);threading.Thread(target=consumer.serve_forever,daemon=True).start()
|
||||
def source_call(method,path,body,token):
|
||||
request=Request(origin+path,data=json.dumps(body).encode() if body is not None else None,method=method,headers={'Authorization':'Bearer '+token,'Content-Type':'application/json'})
|
||||
with urlopen(request,context=ctx,timeout=3) as response:return response.status,json.load(response)
|
||||
# Actual production builder, before issue: no caller approval enrichment.
|
||||
aid='8bfc20be-47a4-4fb0-97a2-bf0a920afad8'
|
||||
e=entry();d=descriptor(e)
|
||||
d['operation_deadline']=(now+timedelta(seconds=60)).replace(microsecond=0).isoformat()
|
||||
h='sha256:'+'a'*64
|
||||
d['backend_budget']={'ttl_seconds':30,'uses':12}
|
||||
d['operations']=[{'method':method,'path':path,'payload_sha256':h} for path in ['sys/policies/acl/synthetic','auth/synthetic/role/synthetic'] for method in ['GET','PUT','GET']]
|
||||
contract=ExecutionContract.parse(d)
|
||||
cfg=SimpleNamespace(authorization_subject_id='secrets-engine',authorization_subject_type='service',authorization_policy_package='secrets-engine.task-execution.service-pilot',authorization_policy_version='v2',approval_url='http://127.0.0.1:'+str(consumer.server_port))
|
||||
request=_expected_request(cfg,e,'execute-ccr',execution_contract=contract)
|
||||
native=binding_from_check_request(request)
|
||||
status,created=source_call('POST','/v1/approvals',{'id':aid,'binding':native,'validity':{'not_before':(now-timedelta(minutes=1)).isoformat(),'expires_at':(now+timedelta(minutes=3)).isoformat()},'required_count':1,'pdp_digest':approval_binding_digest(request),'pdp_path':True,'human_control':True},'synthetic-creator');assert status==201
|
||||
status,_=source_call('POST',f'/v1/approvals/{aid}/entries',{},'synthetic-human');assert status==200
|
||||
status,claim=source_call('GET',f'/v1/approvals/{aid}/claim',None,'synthetic-reader');assert status==200 and claim['valid_now'] is True and claim['binding']['human_control'] is True
|
||||
request['context']['approval']=claim
|
||||
seed=root/'seed';write(seed,base64.urlsafe_b64encode(bytes([19])*32).rstrip(b'='),0o440)
|
||||
reviewer_token=root/'review-token';write(reviewer_token,b'synthetic-reviewer',0o440)
|
||||
reader_token=root/'reader-token';write(reader_token,b'synthetic-reader',0o440)
|
||||
registry=root/'registry.json';write(registry,b'{}')
|
||||
config=root/'source.json';write(config,json.dumps({'source_id':'synthetic-actual-approval-app','source_revision':'actual-owner-python-source-fixture','origin':origin,'store_tenant':'tenant:platform','ca_file':str(ca),'token_file':str(reader_token)}).encode())
|
||||
listener=socket.socket();listener.bind(('127.0.0.1',0));port=listener.getsockname()[1];listener.close()
|
||||
record=root/'record.jsonl';url=f'http://127.0.0.1:{port}'
|
||||
command=['/tmp/netkingdom-access-trusted-r2','serve','--addr',f'127.0.0.1:{port}','--registry',str(registry),'--policy','/tmp/access-trusted-b2-b3-r2/examples/secrets-engine-service-task-execution-v2/policy_package.md','--log',str(record),'--caller-auth-mode','enforce','--caller-audience','flex-auth','--caller-kubernetes-url',review_origin,'--caller-reviewer-token-file',str(reviewer_token),'--caller-ca-file',str(ca),'--caller-binding','secrets-engine=system:serviceaccount:secrets-engine:secrets-engine','--envelope-signing-key-file',str(seed),'--envelope-signing-kid','synthetic-v2','--approval-source-file',str(config)]
|
||||
child=subprocess.Popen(command,env={},stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL)
|
||||
try:
|
||||
for _ in range(100):
|
||||
try:
|
||||
with urlopen(url+'/healthz',timeout=.2):break
|
||||
except Exception:time.sleep(.02)
|
||||
jwt='synthetic.'+base64.urlsafe_b64encode(json.dumps({'exp':int((now+timedelta(minutes=2)).timestamp())}).encode()).decode().rstrip('=')+'.synthetic'
|
||||
def check(value):
|
||||
req=Request(url+'/v1/check',data=json.dumps(value).encode(),headers={'Authorization':'Bearer '+jwt,'Content-Type':'application/json'})
|
||||
try:
|
||||
with urlopen(req,timeout=5) as response:return response.status,response.read()
|
||||
except HTTPError as error:return error.code,error.read()
|
||||
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
|
||||
public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw)
|
||||
trust={'schema':'secrets-engine.pdp-trust.v1','evaluator':'flex-auth/local','mode':'standalone','policy_package':cfg.authorization_policy_package,'policy_version':'v2','policy_package_digest':'sha256:de5683e5a34161b9349b10cd8e4abef704e0136e3b14b97719fcd7a79850fc4d','keys':{'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')}}
|
||||
trustfile=root/'synthetic-trust.json';write(trustfile,json.dumps(trust).encode())
|
||||
pdptoken=root/'consumer-pdp-token';write(pdptoken,jwt.encode())
|
||||
approvaltoken=root/'consumer-approval-token';write(approvaltoken,b'synthetic-consumer')
|
||||
cfg.pdp_url=url;cfg.pdp_token_file=pdptoken;cfg.approval_token_file=approvaltoken;cfg.pdp_trust_file=trustfile;cfg.pdp_verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier')
|
||||
authorization=authorize_task_execution(cfg,e,execution_contract=contract)
|
||||
handoff=authorization.as_owner_handoff()
|
||||
artifacts=json.loads(authorization._action.artifacts)
|
||||
request=artifacts['request'];claim=artifacts['claim'];raw=artifacts['authenticated_envelope_json'].encode()
|
||||
assert handoff['native_binding']==native
|
||||
assert handoff['execution_contract']==contract.as_dict()
|
||||
assert datetime.fromisoformat(handoff['decision_expires_at'].replace('Z','+00:00'))==datetime.fromisoformat(contract.as_dict()['operation_deadline'])
|
||||
assert handoff['execution_contract']['backend_budget']=={'ttl_seconds':30,'uses':12}
|
||||
assert handoff['request_digest']==request_digest(artifacts['envelope']['binding'])
|
||||
assert handoff['submitted_request_digest']==request_digest(request)
|
||||
response=json.loads(raw);assert response['effect']=='allow' and response['signature']['mode']=='signed'
|
||||
assert response['binding']['context']==request['context'];assert response['binding']['submitted_request_digest']==request_digest(request);assert response['binding']['approval_binding_digest']==approval_binding_digest(request)
|
||||
assert response['provenance']['approval_observation']['source_id']=='synthetic-actual-approval-app'
|
||||
from secrets_engine.decision_signature import authenticate_response
|
||||
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
|
||||
public=Ed25519PrivateKey.from_private_bytes(bytes([19])*32).public_key().public_bytes(serialization.Encoding.Raw,serialization.PublicFormat.Raw)
|
||||
trust={k:response['provenance'][k] for k in ('evaluator','mode','policy_package','policy_version','policy_package_digest')}
|
||||
trust['keys']={'synthetic-v2':base64.urlsafe_b64encode(public).decode().rstrip('=')}
|
||||
authenticated=authenticate_response(raw,trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier'))
|
||||
assert authenticated['binding']['context']==request['context']
|
||||
assert authenticate_response(authenticated.authenticated_json.encode(),trust=trust,verifier=pathlib.Path('/tmp/secrets-trusted-successor-verifier'))==authenticated
|
||||
saved=record.read_bytes();assert json.loads(saved)==response
|
||||
from secrets_engine.errors import DecisionError
|
||||
negative={}
|
||||
for case in ['missing-service-binding','changed-descriptor','changed-native-target','expired-original']:
|
||||
changed=copy.deepcopy(request)
|
||||
if case=='missing-service-binding':del changed['context']['service_actor_binding']
|
||||
elif case=='changed-descriptor':changed['context']['execution_contract']['expected_after']='sha256:'+'b'*64
|
||||
elif case=='changed-native-target':changed['resource']['attributes']['synthetic_extra']=1.0
|
||||
else:changed['context']['approval']['freshness']['not_after']='2000-01-01T00:00:00Z'
|
||||
refused_case,_=check(changed)
|
||||
assert refused_case!=200 and record.read_bytes()==saved,case
|
||||
negative[case]=True
|
||||
tampered=raw.replace(b'"effect":"allow"',b'"effect":"deny"')
|
||||
assert tampered!=raw
|
||||
try:authenticate_response(tampered,trust=trust,verifier=cfg.pdp_verifier)
|
||||
except DecisionError:negative['tampered-signature']=True
|
||||
else:raise AssertionError('tampered envelope accepted')
|
||||
# Real elapsed time, no injected clock or consumer waiver: provider receipts
|
||||
# use whole seconds, so this proof sequences CAS after the signed start's
|
||||
# next whole second. Fast-CAS precision mismatch remains separately reported.
|
||||
signed_start=datetime.fromisoformat(handoff['decision_not_before'].replace('Z','+00:00'))
|
||||
earliest_receipt=signed_start.replace(microsecond=0)+timedelta(seconds=1)
|
||||
delay=(earliest_receipt-datetime.now(timezone.utc)).total_seconds()
|
||||
if delay>0:time.sleep(delay)
|
||||
consumption=consume_task_execution(cfg,authorization)
|
||||
assert consumption.idempotent is False and consumption.request_digest==handoff['request_digest'] and consumption.decision_id==handoff['decision_id']
|
||||
from approval_engine.execution_confirmation import ExecutionConfirmationClient
|
||||
confirmed=ExecutionConfirmationClient(cfg.approval_url,approvaltoken).confirm_consumption(aid,handoff['request_digest'],handoff['decision_id'],expected_binding=handoff['native_binding'],expected_pdp_digest=handoff['approval_binding_digest'])
|
||||
assert confirmed['request_digest']==handoff['request_digest'] and confirmed['decision_id']==handoff['decision_id']
|
||||
try:consume_task_execution(cfg,authorization)
|
||||
except DecisionError:negative['prepared-replay']=True
|
||||
else:raise AssertionError('prepared replay accepted')
|
||||
write(OUT/'negative-cases.json',(json.dumps(negative,indent=2)+'\n').encode(),0o644)
|
||||
write(OUT/'handoff.json' ,(json.dumps(handoff,indent=2)+'\n').encode(),0o644)
|
||||
# Consumed provider state cannot be rescued by the original carried claim.
|
||||
|
||||
refused,_=check(request);assert refused!=200 and record.read_bytes()==saved
|
||||
for name,value in [('request.json',request),('response.json',response),('source-record.json',json.loads(saved)),('original-approval-claim.json',claim)]:write(OUT/name,(json.dumps(value,indent=2)+'\n').encode(),0o644)
|
||||
receipt={'scope':'disposable synthetic only','actual_source':'Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine','actual_access':'production serve binary from frozen B2/B3 temporal R2','allow':True,'original_context_unchanged':True,'published_digest_match':True,'returned_source_record_match':True,'actual_source_consumed_refused':True,'actual_strict_prepare_and_consume':True,'no_record_after_refusal':True,'native_admission':False,'files_sha256':{p.name:digest(p.read_bytes()) for p in OUT.iterdir() if p.suffix=='.json'}}
|
||||
write(OUT/'receipt.json',(json.dumps(receipt,indent=2)+'\n').encode(),0o644);print(json.dumps(receipt,indent=2))
|
||||
finally:
|
||||
child.terminate();child.wait(timeout=5);source.shutdown();consumer.shutdown();review.shutdown();engine.close()
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
"scope": "disposable synthetic only",
|
||||
"actual_source": "Approval App over TLS with authenticated create, configured synthetic human entry, read; actual SQLite engine",
|
||||
"actual_access": "production serve binary from frozen B2/B3 R1",
|
||||
"allow": true,
|
||||
"original_context_unchanged": true,
|
||||
"published_digest_match": true,
|
||||
"returned_source_record_match": true,
|
||||
"actual_source_consumed_refused": true,
|
||||
"actual_strict_prepare_and_consume": true,
|
||||
"no_record_after_refusal": true,
|
||||
"native_admission": false,
|
||||
"files_sha256": {
|
||||
"negative-cases.json": "sha256:1bef572773c34f87a3c6587dbc60ebeb2835c01125f690e8d2f5b0d70a6abadd",
|
||||
"receipt.json": "sha256:ef67d3235ac36e01f03c6b49e73f106f4fb328e954d71a6cfd84e1d8baac3b28",
|
||||
"source-record.json": "sha256:3d85490777303e032ce371ec0e7de514ea8b5825ad9b9437e7ff06414551e7bd",
|
||||
"handoff.json": "sha256:6156a5378ddfdd583ccafde75063165ead5e8df8c7114c94c3c4e44d637d813f",
|
||||
"response.json": "sha256:3d85490777303e032ce371ec0e7de514ea8b5825ad9b9437e7ff06414551e7bd",
|
||||
"original-approval-claim.json": "sha256:ecb921ebc1d836ab2a8fff9ec185011cdaf28f7c9341778107cae4605fc5f0e2",
|
||||
"request.json": "sha256:c4d9c5fe344185a7361b605db0df9b9018cae03a2b54818fad33b8a131c67aa5"
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue