2593 lines
103 KiB
Diff
2593 lines
103 KiB
Diff
diff --git a/docs/access-claim-fact-reader.md b/docs/access-claim-fact-reader.md
|
||
new file mode 100644
|
||
index 0000000..40f7016
|
||
--- /dev/null
|
||
+++ b/docs/access-claim-fact-reader.md
|
||
@@ -0,0 +1,135 @@
|
||
+# Thin Access Approval fact reader — owner source contract proposal
|
||
+
|
||
+Owner scope: Approval Engine / PIP. Work: APPROVAL-WP-0005-T01, selected source
|
||
+subset of APPROVAL-WP-0002-T01/T05 under CUST-WP-0080. This interprets the existing
|
||
+claim schema 0.1, not a new API/schema/signature or policy grant. Access's B2
|
||
+implementation stays DENY until its separately reviewed complete successor.
|
||
+
|
||
+## Authoritative source and guarantee
|
||
+
|
||
+Only server-installed, independently admitted provider origin and transport may
|
||
+GET `/v1/approvals/{id}/claim`, with least-scope `approval:read` credential and
|
||
+exact admitted store tenant. No caller URL/opener/key/verified flag, redirects,
|
||
+environment proxy, caller JSON or public same-channel key bootstrap can supply
|
||
+this provenance. Owner transport must enforce total deadline/size, exact 200
|
||
+application/json UTF-8, no encoding, duplicate-key/nonfinite/malformed JSON
|
||
+refusal, no retry and bounded errors without bearer/body leakage. Provider
|
||
+unavailability refuses this source join. Never invoke a credential-carrying
|
||
+Python subprocess as the Go adapter; reuse Go's existing transport boundary.
|
||
+
|
||
+At the provider observation, `valid_now: true` AND `binding.human_control: true`
|
||
+means the configured required count of distinct entries is met and every entry
|
||
+has verified `principal_type=human`. `/entries` obtains identities/types only from
|
||
+its authenticator, rejects non-human binds for this declaration, and persists
|
||
+UNIQUE(approval_id, subject_id); `_evaluate` repeats the threshold/human check.
|
||
+It does NOT mean required_count is two, requester/actor/principal is human,
|
||
+directory-derived tenant membership, a particular MFA/assurance level, policy
|
||
+eligibility, uncompromised source, native issuer admission, or continuing
|
||
+validity after the observation. Consumer trusts this owner evaluation instead
|
||
+of fetching identities/counting approvers or revalidating human JWTs. Native
|
||
+issuer/profile acceptance is still T01, not established by synthetic vectors.
|
||
+
|
||
+## Minimal typed fact validation
|
||
+
|
||
+The submitted claim and fetched observation must each satisfy existing schema
|
||
+0.1 with exact JSON types; `human_control` must be present and exactly true on
|
||
+this lane despite being historically optional in the generic schema. Require
|
||
+schema_version=0.1, kind=approval-claim, issuer=approval-engine, exact expected
|
||
+approval UUID, state=valid, valid_now=true, consumed=false, reason_code=ok,
|
||
+pdp_path=true and non-null lowercase sha256 pdp_digest. Reject decision-shaped
|
||
+keys and unknown schema members (except optional informational yields_to).
|
||
+The signed/requesting service must never become a human approver by inference.
|
||
+
|
||
+At one captured UTC validation instant now, require zoned RFC3339 timestamps,
|
||
+positive integral ttl_seconds, observed_at<=now<not_after and
|
||
+not_after=observed_at+ttl_seconds. Require not_before<=now<expires_at. Do not
|
||
+invent skew or extend TTL; a separately admitted clock policy is needed to
|
||
+relax the zero-skew default. The provider default TTL is 30 seconds but source
|
||
+configuration may differ; an Access-owned maximum may only shorten it.
|
||
+
|
||
+Compare exact five-field act against the owner-derived normalized proposed act,
|
||
+including all nested target values; no action vocabulary translation is owned
|
||
+here. Recompute native binding.digest from those five fields and require exact
|
||
+served and expected digest correspondence. Match pdp_digest to Access's actual
|
||
+ApprovalBindingDigest over the exact normalized original request (excludes only
|
||
+top-level context.approval). Preserve execution_contract and all other context.
|
||
+Never substitute full request_digest, native act digest or a guessed Go digest.
|
||
+The PDP digest proves correspondence, not decision authenticity or approval
|
||
+source authenticity. Registry/normalization changes must fail or reissue.
|
||
+
|
||
+## Original request is immutable; fresh observation stays out-of-band
|
||
+
|
||
+The original submitted context.approval must remain byte/value-equivalent under
|
||
+Access's existing canonical request rules. Do not replace it, update freshness,
|
||
+change binding/declarations, or manufacture an evaluated refreshed request.
|
||
+Validate its own original freshness/validity too; a newly fetched observation
|
||
+cannot rescue a stale original claim. Require all non-freshness authority facts
|
||
+to match between the submitted and fetched claims: schema/kind/issuer/id,
|
||
+state/valid_now/consumed/reason_code, binding and validity. Optional yields_to
|
||
+is informational only. Each native binding is independently recomputed.
|
||
+Freshness is validated separately on both observations; a later observation
|
||
+may have a later freshness window without changing the signed request.
|
||
+
|
||
+Return a package-private/server-created typed observation handle only after
|
||
+these checks. Access may bind its source identity/revision, observed_at,
|
||
+not_after, fetched-claim content digest and validation time into owner-produced
|
||
+signed provenance separately from unchanged request_digest and
|
||
+approval_binding_digest. This does not require changing the Approval schema;
|
||
+Access owns the minimal existing provenance representation and signer contract.
|
||
+An HTTP caller cannot instantiate this handle or set its verified state.
|
||
+
|
||
+Suggested Go boundary, for Access to implement in its existing process:
|
||
+`ApprovalFactSource.Observe(ctx, approvalID) (Observation, error)` reads only
|
||
+provider bytes plus source provenance; a separate package-private validator
|
||
+joins Observation with the immutable normalized request, submitted claim and
|
||
+captured validation time. The handle retains detached raw provider bytes and
|
||
+strict parsed numbers (json.Number), not caller-installable validation flags.
|
||
+Neither this reader nor its validator evaluates policy. Access's existing
|
||
+single policy evaluator consumes the verified factual handle without rewriting
|
||
+the request. Callers may not supply a ready-made Observation on the HTTP body.
|
||
+
|
||
+Effective input deadline is the minimum of ORIGINAL submitted freshness,
|
||
+fetched freshness, approval expiry, authenticated caller expiry and operation/
|
||
+decision deadlines. No equality at an expiry boundary is accepted. Refetching
|
||
+does not renew the original full request. Revocation/use may race a read; the
|
||
+PEP still performs one original exact consume CAS before effect and retains
|
||
+the same live Platform journal admission, deadlines and unknown-outcome rules.
|
||
+Access never consumes or executes. Historical confirm_consumption cannot
|
||
+substitute for this fresh predecision source validation.
|
||
+
|
||
+## Go canonicalization and golden vectors
|
||
+
|
||
+`examples/access-claim-reader-vectors.json` contains producer-generated native
|
||
+canonical UTF-8 bytes/digests and source lifecycle observations, plus explicitly
|
||
+mutated refusal fixtures. Python dict equality and Go decoding numbers into
|
||
+float64 lose authority distinctions: True/1, 1/1.0 and integers above 2^53 differ.
|
||
+Go default json.Marshal additionally escapes HTML/U+2028 differently. Retain
|
||
+number tokens with UseNumber and implement/test compatibility with Approval's
|
||
+existing Python json.dumps(sort_keys=True,separators=(',', ':'),ensure_ascii=False)
|
||
+format; do not silently normalize types or hash whole binding/freshness.
|
||
+UseNumber preserves number tokens but is NOT a canonicalizer: producer parsing
|
||
+of `1e-7` emits `1e-07`, `1e20` emits `1e+20`, `1.0` remains distinct from `1`,
|
||
+and negative floating zero emits `-0.0`. A signed typed Go envelope alone does
|
||
+not preserve or authenticate Python's original numeric representation.
|
||
+
|
||
+These finite vectors are a minimum, not proof of a complete Python float/string
|
||
+port. A thin pilot may fail closed on unsupported numeric/string domains only
|
||
+if its actual owner-compiled operation contract excludes those values and Access
|
||
+declares/tests that boundary. It may not silently change the global Approval
|
||
+algorithm or accept a digest without checking the proposed act. Required vectors
|
||
+cover bool/int/float distinction, large integer, Unicode/HTML/U+2028, reordered
|
||
+keys, nested containers, exponent formatting and negative floating zero. These
|
||
+are authoritative producer vectors for the domains shown, not arbitrary new
|
||
+restrictions on current pilot metadata. No currently authoritative narrow numeric
|
||
+restriction was established by this review, so it cannot be presumed. If a
|
||
+small shared producer-owned Go canonicalization helper becomes necessary, scope
|
||
+it explicitly to the actual consumer need and test against these producer bytes;
|
||
+do not invent a second unverified serialization algorithm in the adapter. This
|
||
+review provides vectors only, not that runtime implementation. The Go owner must
|
||
+return exact accepted/refused vector results and transport negatives
|
||
+(redirect/proxy/duplicate/size/deadline).
|
||
+
|
||
+The superseded service-http-join-proposal-r1 B3 refreshed-evaluation wording is
|
||
+changes-requested for this immutable-context path. B2's source reader can proceed
|
||
+against this proposal after Access's own design/conformance review. No foreign
|
||
+owner assent, policy activation, live credential or native acceptance is implied.
|
||
diff --git a/docs/reviews/2026-10-16-access-claim-fact-reader-owner-review.json b/docs/reviews/2026-10-16-access-claim-fact-reader-owner-review.json
|
||
new file mode 100644
|
||
index 0000000..bc5bad1
|
||
--- /dev/null
|
||
+++ b/docs/reviews/2026-10-16-access-claim-fact-reader-owner-review.json
|
||
@@ -0,0 +1,15 @@
|
||
+{
|
||
+ "reviewer": "approval-engine-owner (agent approval-engine, codex)",
|
||
+ "decision": "changes_requested",
|
||
+ "comment": "INTENT Purpose and exact binding/claim boundary: B2 can reuse existing GET claim schema0.1 and verified human-control predicate without republishing approver identities. Superseded B3 refreshed evaluated-request/context design cannot satisfy the exact original strict handoff; retain original context/full and approval-free digests and verify fresh provider observation out-of-band. Work APPROVAL-WP-0005-T01; source base eece796b8bbee19551f6aa07ad389cbf83cabcdb. No policy activation, issuer admission, foreign owner assent or native acceptance.",
|
||
+ "reviewed_artifact": "/home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-16/access-native-source/service-http-join-proposal-r1.json",
|
||
+ "reviewed_sha256": "e0f8f12c48faf2331cf366591028577beffe617250d7005dcaf2a8b7396535fc",
|
||
+ "owner_contract": "docs/access-claim-fact-reader.md",
|
||
+ "owner_contract_sha256": "3dfb7987a4d9fe461b917cfa5bae7beef61bc4d9a4561fdded3e90128f5966de",
|
||
+ "required_returns": [
|
||
+ "Access own B2 contract/conformance review and exact native canonicalization parity; original submitted context/digests retained",
|
||
+ "Owner-admitted read identity/store tenant and trusted provider transport separate from source fixture tests",
|
||
+ "Actual runtime source integration and original consumer/journal/cas path before any policy eligibility successor"
|
||
+ ],
|
||
+ "native_accepted": false
|
||
+}
|
||
diff --git a/examples/access-claim-reader-vectors.json b/examples/access-claim-reader-vectors.json
|
||
new file mode 100644
|
||
index 0000000..81caf34
|
||
--- /dev/null
|
||
+++ b/examples/access-claim-reader-vectors.json
|
||
@@ -0,0 +1,2305 @@
|
||
+{
|
||
+ "producer_revision": "eece796b8bbee19551f6aa07ad389cbf83cabcdb",
|
||
+ "fixture_only": true,
|
||
+ "source": "Engine.claim with fixed synthetic identities; mutated consumer refusal cases explicitly labeled; no native identity admission",
|
||
+ "schema_version": "0.1",
|
||
+ "claim_cases": [
|
||
+ {
|
||
+ "name": "fresh_out_of_band_observation_unchanged_original",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": true,
|
||
+ "reason": "matching_valid_facts_original_digest_unchanged"
|
||
+ },
|
||
+ {
|
||
+ "name": "requested",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "requested",
|
||
+ "valid_now": false,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "requested"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "insufficient_distinct_humans",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "requested",
|
||
+ "valid_now": false,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "requested"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "foreign_issuer",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "foreign",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "foreign_id",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "22222222-2222-4222-8222-222222222222",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "nonhuman_control",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": false
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "legacy_missing_human_control",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "human_control_integer",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": 1
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "wrong_pdp_digest",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:abababababababababababababababababababababababababababababababab",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "null_pdp_digest",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": null,
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "undeclared_pdp_path",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": false,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "valid_now_integer",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": 1,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "wrong_native_digest",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:abababababababababababababababababababababababababababababababab",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "wrong_act",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "other",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "future_observation",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:06+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "inconsistent_ttl",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 31,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "zero_ttl",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 0,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "naive_observation",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "original_observation_expired_even_when_provider_fresh",
|
||
+ "validation_time": "2026-08-29T12:00:30+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "refetch_cannot_extend_original_freshness",
|
||
+ "validation_time": "2026-08-29T12:00:30+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:30+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:01:00+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "consumed_source",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "consumed",
|
||
+ "valid_now": false,
|
||
+ "consumed": true,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:05+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:35+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "consumed"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "expired_after_consumption_preserves_consumed_true",
|
||
+ "validation_time": "2026-08-30T12:00:00+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "valid",
|
||
+ "valid_now": true,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "ok"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "11111111-1111-4111-8111-111111111111",
|
||
+ "state": "expired",
|
||
+ "valid_now": false,
|
||
+ "consumed": true,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-30T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-30T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "expired"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "source_fact_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "source_revoked",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "6302eb08-215e-4a17-8e6f-66717874c6af",
|
||
+ "state": "revoked",
|
||
+ "valid_now": false,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "revoked"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "6302eb08-215e-4a17-8e6f-66717874c6af",
|
||
+ "state": "revoked",
|
||
+ "valid_now": false,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "revoked"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "terminal_source_refusal"
|
||
+ },
|
||
+ {
|
||
+ "name": "source_superseded",
|
||
+ "validation_time": "2026-08-29T12:00:05+00:00",
|
||
+ "submitted_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "8c8f9c0f-b2dd-4a1f-964a-54ac7022803b",
|
||
+ "state": "superseded",
|
||
+ "valid_now": false,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "superseded"
|
||
+ },
|
||
+ "observed_claim": {
|
||
+ "schema_version": "0.1",
|
||
+ "kind": "approval-claim",
|
||
+ "yields_to": "net-kingdom taxonomy request-claim schema (statute §17; unassigned)",
|
||
+ "issuer": "approval-engine",
|
||
+ "approval_id": "8c8f9c0f-b2dd-4a1f-964a-54ac7022803b",
|
||
+ "state": "superseded",
|
||
+ "valid_now": false,
|
||
+ "consumed": false,
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "digest": "sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b",
|
||
+ "pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "pdp_path": true,
|
||
+ "human_control": true
|
||
+ },
|
||
+ "freshness": {
|
||
+ "observed_at": "2026-08-29T12:00:00+00:00",
|
||
+ "ttl_seconds": 30,
|
||
+ "not_after": "2026-08-29T12:00:30+00:00"
|
||
+ },
|
||
+ "validity": {
|
||
+ "not_before": "2026-08-29T11:00:00+00:00",
|
||
+ "expires_at": "2026-08-29T15:00:00+00:00"
|
||
+ },
|
||
+ "reason_code": "superseded"
|
||
+ },
|
||
+ "expected_binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "id": "lane-openbao-root",
|
||
+ "stage": "prod"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "expected_pdp_digest": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
|
||
+ "expected_accept": false,
|
||
+ "reason": "terminal_source_refusal"
|
||
+ }
|
||
+ ],
|
||
+ "native_binding_vectors": [
|
||
+ {
|
||
+ "input_target_json": "{\"value\":true}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "value": true
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"value\":true}}",
|
||
+ "native_digest": "sha256:e1f537daa849e5da023efb5f3d62cc33d94cce20f9ca9c5a708c76e225fd702f"
|
||
+ },
|
||
+ {
|
||
+ "input_target_json": "{\"value\":1}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "value": 1
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"value\":1}}",
|
||
+ "native_digest": "sha256:3a3d2da6267e4b917505a7c2247e6ce36fd8ee074eef37251bcc66839b602332"
|
||
+ },
|
||
+ {
|
||
+ "input_target_json": "{\"value\":1.0}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "value": 1.0
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"value\":1.0}}",
|
||
+ "native_digest": "sha256:21c2cdb9b161071ebfe361e50703511b2abf6c6f327f153282d247aa92c3898e"
|
||
+ },
|
||
+ {
|
||
+ "input_target_json": "{\"value\":false}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "value": false
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"value\":false}}",
|
||
+ "native_digest": "sha256:278cbcd013f7923db5258dd860f911d688505a8259f15ccb77983b044f312c74"
|
||
+ },
|
||
+ {
|
||
+ "input_target_json": "{\"value\":0}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "value": 0
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"value\":0}}",
|
||
+ "native_digest": "sha256:e691b8fb55d4bf82a310dee37c045331100c8031e26ea6f51bdcceeeb3b1f20e"
|
||
+ },
|
||
+ {
|
||
+ "input_target_json": "{\"value\":-0.0}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "value": -0.0
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"value\":-0.0}}",
|
||
+ "native_digest": "sha256:eccde458c686bff67506bb2d94c750e648a311bf23967cb22b37f11e84b6844f"
|
||
+ },
|
||
+ {
|
||
+ "input_target_json": "{\"value\":1e-7}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "value": 1e-07
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"value\":1e-07}}",
|
||
+ "native_digest": "sha256:779042b6c0e675f6aacdcd3a02199aab66f534bb84dd410a95c18657afae563c"
|
||
+ },
|
||
+ {
|
||
+ "input_target_json": "{\"value\":1e-6}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "value": 1e-06
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"value\":1e-06}}",
|
||
+ "native_digest": "sha256:d021f402231fcd59e764b31e6f08a5298ebb328dfd93da58ecde8feb11fde0b5"
|
||
+ },
|
||
+ {
|
||
+ "input_target_json": "{\"value\":1e20}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "value": 1e+20
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"value\":1e+20}}",
|
||
+ "native_digest": "sha256:14270ffca4ab10e9d9302d52e988b4aa3e2facd494c12a60e2edafef70277a20"
|
||
+ },
|
||
+ {
|
||
+ "input_target_json": "{\"value\":1e21}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "value": 1e+21
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"value\":1e+21}}",
|
||
+ "native_digest": "sha256:75a60a595b2578430b0be466b6bf9a46b62ddc99bbbcebd7fa0e8d22e3078c0a"
|
||
+ },
|
||
+ {
|
||
+ "input_target_json": "{\"value\":2.5e-7}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "value": 2.5e-07
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"value\":2.5e-07}}",
|
||
+ "native_digest": "sha256:50af37ff75a3e7a22629e746f814995c0c2cd96adb7f1ed5b26999b71d0ac498"
|
||
+ },
|
||
+ {
|
||
+ "input_target_json": "{\"value\":9007199254740993}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "value": 9007199254740993
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"value\":9007199254740993}}",
|
||
+ "native_digest": "sha256:765360dc5a1d949bd114c6b749d83069123d8b4b6b1d939f831428a800f50dab"
|
||
+ },
|
||
+ {
|
||
+ "input_target_json": "{\"html\":\"<>&\", \"unicode\":\"é雪😀\", \"separator\":\"\\u2028\\u2029\"}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "html": "<>&",
|
||
+ "unicode": "é雪😀",
|
||
+ "separator": "
"
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"html\":\"<>&\",\"separator\":\"
\",\"unicode\":\"é雪😀\"}}",
|
||
+ "native_digest": "sha256:c203d934743e2954342038a3746b6c37a0f3101e886ef855b1c6ad824adf5dea"
|
||
+ },
|
||
+ {
|
||
+ "input_target_json": "{\"b\":[true,1,1.0,null,{\"z\":\"x\",\"a\":\"y\"}],\"a\":{}}",
|
||
+ "binding": {
|
||
+ "action": "secrets.kv.destroy",
|
||
+ "target": {
|
||
+ "b": [
|
||
+ true,
|
||
+ 1,
|
||
+ 1.0,
|
||
+ null,
|
||
+ {
|
||
+ "z": "x",
|
||
+ "a": "y"
|
||
+ }
|
||
+ ],
|
||
+ "a": {}
|
||
+ },
|
||
+ "actor": "agt-secrets-engine",
|
||
+ "principal": "bernd",
|
||
+ "purpose": "rotate-exposed-key"
|
||
+ },
|
||
+ "canonical_binding_utf8": "{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"a\":{},\"b\":[true,1,1.0,null,{\"a\":\"y\",\"z\":\"x\"}]}}",
|
||
+ "native_digest": "sha256:56306505c882af6edfae5f3d2a5b42e92737a0859236fe5574a21d1874655d51"
|
||
+ }
|
||
+ ],
|
||
+ "transport_cases": [
|
||
+ {
|
||
+ "name": "duplicate_valid_now",
|
||
+ "status": 200,
|
||
+ "content_type": "application/json",
|
||
+ "body_utf8": "{\"schema_version\":\"0.1\",\"kind\":\"approval-claim\",\"yields_to\":\"net-kingdom taxonomy request-claim schema (statute §17; unassigned)\",\"issuer\":\"approval-engine\",\"approval_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"valid\",\"valid_now\":true,\"consumed\":false,\"binding\":{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"id\":\"lane-openbao-root\",\"stage\":\"prod\"},\"digest\":\"sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b\",\"pdp_digest\":\"sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\",\"pdp_path\":true,\"human_control\":true},\"freshness\":{\"observed_at\":\"2026-08-29T12:00:05+00:00\",\"ttl_seconds\":30,\"not_after\":\"2026-08-29T12:00:35+00:00\"},\"validity\":{\"not_before\":\"2026-08-29T11:00:00+00:00\",\"expires_at\":\"2026-08-29T15:00:00+00:00\"},\"reason_code\":\"ok\",\"valid_now\":false}",
|
||
+ "expected_accept": false
|
||
+ },
|
||
+ {
|
||
+ "name": "nonfinite_json",
|
||
+ "status": 200,
|
||
+ "content_type": "application/json",
|
||
+ "body_utf8": "{\"schema_version\":\"0.1\",\"kind\":\"approval-claim\",\"yields_to\":\"net-kingdom taxonomy request-claim schema (statute §17; unassigned)\",\"issuer\":\"approval-engine\",\"approval_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"valid\",\"valid_now\":true,\"consumed\":false,\"binding\":{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"id\":\"lane-openbao-root\",\"stage\":\"prod\"},\"digest\":\"sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b\",\"pdp_digest\":\"sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\",\"pdp_path\":true,\"human_control\":true},\"freshness\":{\"observed_at\":\"2026-08-29T12:00:05+00:00\",\"ttl_seconds\":NaN,\"not_after\":\"2026-08-29T12:00:35+00:00\"},\"validity\":{\"not_before\":\"2026-08-29T11:00:00+00:00\",\"expires_at\":\"2026-08-29T15:00:00+00:00\"},\"reason_code\":\"ok\"}",
|
||
+ "expected_accept": false
|
||
+ },
|
||
+ {
|
||
+ "name": "redirect",
|
||
+ "status": 302,
|
||
+ "location": "https://foreign.example/claim",
|
||
+ "expected_accept": false,
|
||
+ "required_secondary_requests": 0
|
||
+ },
|
||
+ {
|
||
+ "name": "wrong_media_type",
|
||
+ "status": 200,
|
||
+ "content_type": "text/plain",
|
||
+ "body_utf8": "{\"schema_version\":\"0.1\",\"kind\":\"approval-claim\",\"yields_to\":\"net-kingdom taxonomy request-claim schema (statute §17; unassigned)\",\"issuer\":\"approval-engine\",\"approval_id\":\"11111111-1111-4111-8111-111111111111\",\"state\":\"valid\",\"valid_now\":true,\"consumed\":false,\"binding\":{\"action\":\"secrets.kv.destroy\",\"actor\":\"agt-secrets-engine\",\"principal\":\"bernd\",\"purpose\":\"rotate-exposed-key\",\"target\":{\"id\":\"lane-openbao-root\",\"stage\":\"prod\"},\"digest\":\"sha256:0982954d4ecbaad0c7368c207ec530e51d7508c3304b67c10885d112175f929b\",\"pdp_digest\":\"sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd\",\"pdp_path\":true,\"human_control\":true},\"freshness\":{\"observed_at\":\"2026-08-29T12:00:05+00:00\",\"ttl_seconds\":30,\"not_after\":\"2026-08-29T12:00:35+00:00\"},\"validity\":{\"not_before\":\"2026-08-29T11:00:00+00:00\",\"expires_at\":\"2026-08-29T15:00:00+00:00\"},\"reason_code\":\"ok\"}",
|
||
+ "expected_accept": false
|
||
+ },
|
||
+ {
|
||
+ "name": "provider_unavailable",
|
||
+ "status": 503,
|
||
+ "expected_accept": false
|
||
+ },
|
||
+ {
|
||
+ "name": "declared_body_over_limit",
|
||
+ "status": 200,
|
||
+ "content_length": 1048577,
|
||
+ "consumer_limit_bytes": 1048576,
|
||
+ "expected_accept": false
|
||
+ },
|
||
+ {
|
||
+ "name": "environment_proxy_configured",
|
||
+ "required_environment_proxy_requests": 0,
|
||
+ "expected_accept": false,
|
||
+ "note": "If fixed origin is unavailable, proxy cannot supply a replacement fact."
|
||
+ }
|
||
+ ]
|
||
+}
|
||
diff --git a/tests/test_access_claim_vectors.py b/tests/test_access_claim_vectors.py
|
||
new file mode 100644
|
||
index 0000000..72e5191
|
||
--- /dev/null
|
||
+++ b/tests/test_access_claim_vectors.py
|
||
@@ -0,0 +1,42 @@
|
||
+"""Producer facts/canonical vectors only; not a Go consumer acceptance test."""
|
||
+import json
|
||
+from pathlib import Path
|
||
+
|
||
+import jsonschema
|
||
+
|
||
+from approval_engine.binding import binding_digest, canonical_binding, canonical_json
|
||
+from approval_engine.store import Engine
|
||
+from tests.conftest import FROZEN, binding, validity
|
||
+
|
||
+ROOT = Path(__file__).resolve().parents[1]
|
||
+VECTORS = json.loads((ROOT / "examples/access-claim-reader-vectors.json").read_text())
|
||
+
|
||
+
|
||
+def test_native_vectors_match_actual_producer_bytes_and_digest():
|
||
+ for case in VECTORS["native_binding_vectors"]:
|
||
+ act = binding(target=json.loads(case["input_target_json"]))
|
||
+ assert act == case["binding"]
|
||
+ assert canonical_json(canonical_binding(act)).decode() == case["canonical_binding_utf8"]
|
||
+ assert binding_digest(act) == case["native_digest"]
|
||
+ digests = [v["native_digest"] for v in VECTORS["native_binding_vectors"]]
|
||
+ assert len(set(digests)) == len(digests)
|
||
+
|
||
+
|
||
+def test_positive_claim_vector_matches_actual_provider_and_schema():
|
||
+ case = VECTORS["claim_cases"][0]
|
||
+ engine = Engine(clock=lambda: FROZEN)
|
||
+ obj = engine.create(binding(), validity(), approval_id=case["submitted_claim"]["approval_id"],
|
||
+ required_count=2, pdp_digest=case["expected_pdp_digest"],
|
||
+ pdp_path=True, human_control=True)
|
||
+ engine.add_entry(obj.id, "human:one", principal_type="human")
|
||
+ assert engine.claim(obj.id)["valid_now"] is False
|
||
+ engine.add_entry(obj.id, "human:two", principal_type="human")
|
||
+ assert engine.claim(obj.id) == case["submitted_claim"]
|
||
+ from datetime import timedelta
|
||
+ engine.clock = lambda: FROZEN + timedelta(seconds=5)
|
||
+ assert engine.claim(obj.id) == case["observed_claim"]
|
||
+ assert case["submitted_claim"]["freshness"] != case["observed_claim"]["freshness"]
|
||
+ schema = json.loads((ROOT / "schemas/approval_claim.schema.json").read_text())
|
||
+ jsonschema.Draft202012Validator(schema, format_checker=jsonschema.FormatChecker()).validate(
|
||
+ case["observed_claim"])
|
||
+ engine.close()
|
||
diff --git a/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md b/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md
|
||
index 856ebc7..2a95d0d 100644
|
||
--- a/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md
|
||
+++ b/workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md
|
||
@@ -26,6 +26,12 @@ state_hub_workstream_id: "4fa25ad5-f5d0-5592-aa59-085f8ee3edaf"
|
||
|
||
# APPROVAL-WP-0002 — Production readiness and consumer adoption
|
||
|
||
+2026-10-16 additional scoped demand before Access B2 implementation:
|
||
+CUST-WP-0080 selects T01/T05's authoritative claim/human-control/freshness and
|
||
+exact-source consumer contract review and producer fixtures only, tracked in
|
||
+APPROVAL-WP-0005. Existing residual/native statuses and authority gates remain;
|
||
+this does not activate other residual work, a consumer policy or live transport.
|
||
+
|
||
Move the completed first-cut engine spine into an authenticated, durable,
|
||
observable production service and prove one PEP integration end to end. This is
|
||
the residual production scope deliberately excluded from APPROVAL-WP-0001.
|
||
diff --git a/workplans/APPROVAL-WP-0005-access-claim-fact-contract.md b/workplans/APPROVAL-WP-0005-access-claim-fact-contract.md
|
||
new file mode 100644
|
||
index 0000000..777a9e6
|
||
--- /dev/null
|
||
+++ b/workplans/APPROVAL-WP-0005-access-claim-fact-contract.md
|
||
@@ -0,0 +1,49 @@
|
||
+---
|
||
+id: APPROVAL-WP-0005
|
||
+type: workplan
|
||
+title: "Review thin Access claim fact reader contract and producer vectors"
|
||
+domain: infotech
|
||
+repo: approval-engine
|
||
+status: active
|
||
+flavor: planning
|
||
+owner: codex
|
||
+topic_slug: netkingdom
|
||
+created: "2026-10-16"
|
||
+updated: "2026-10-16"
|
||
+depends_on: []
|
||
+---
|
||
+
|
||
+CUST-WP-0080 explicitly selects the necessary Approval-WP-0002-T01/T05 source
|
||
+contract subset for the Access service HTTP B2 join. Scope is owner review and
|
||
+producer fixtures only, before any consumer implementation. No broad residual
|
||
+activation, runtime client, trust admission, policy eligibility or live action.
|
||
+
|
||
+## Review authoritative claim guarantees and publish thin consumer vectors
|
||
+
|
||
+```task
|
||
+id: APPROVAL-WP-0005-T01
|
||
+status: done
|
||
+priority: high
|
||
+```
|
||
+
|
||
+INTENT basis: factual exact-bound approval claims supplied to Access, never a
|
||
+second PDP. Source contract documents verified human-control semantics and their
|
||
+issuer admission limit, both original/subsequent observation bounds, exact
|
||
+native/PDP correspondence and immutable original submitted context. Producer
|
||
+vectors cover current lifecycle and canonical types. The superseded proposal's
|
||
+request-refresh design requires change; fresh facts are verified out-of-band.
|
||
+
|
||
+## Independently integrate owner contract and coordinate Access reader conformance
|
||
+
|
||
+```task
|
||
+id: APPROVAL-WP-0005-T02
|
||
+status: todo
|
||
+priority: high
|
||
+```
|
||
+
|
||
+Coordinator reviews/integrates these source records. Access owns the thin Go
|
||
+reader/normalization and conformance implementation under FLEX-WP-0024-T06;
|
||
+Secrets owns strict immutable handoff and Platform owns provider origin/custody
|
||
+and final client pin. Native issuer/profile and served-PEP obligations remain
|
||
+live under APPROVAL-WP-0002-T01/T05, with audit under T04. No new native residual
|
||
+is created, promoted or marked complete by these source-only fixtures.
|