Export provider-neutral authorization records and lifecycle evidence handoff

[safal207]

Goal

Add a provider-neutral export profile for ProofPath authorization decisions so downstream runtimes can join them to execution observations and response-integrity records without weakening ProofPath's pre-execution boundary.

Canonical profile: safal207/Liminal#108

Why

ProofPath already verifies intent, policy, expiry, nonce/replay state, recipient/scope constraints, and human approval before forwarding protected actions. The ecosystem now needs a stable authorization_record that other modules can consume without parsing ProofPath-specific audit internals.

Deliverables

• Define an exportable authorization_record containing at least:
  • transition/action identity;
  • canonical arguments or arguments digest;
  • policy/capability basis;
  • decision and reason codes;
  • decision time;
  • expiry/freshness bound;
  • replay/consumption state;
  • continuation state where applicable;
  • ProofPath audit/evidence references.
• Bind the record into the existing hash-chained audit and evidence bundle.
• Add a handoff contract for downstream observation_record producers.
• Allow evidence bundles to carry externally produced response_integrity_record files as optional referenced artifacts.
• Verify imported artifacts by digest and declared schema/profile without claiming ProofPath authored their verdicts.

Required fixtures

• ACCEPT with a valid unconsumed signed intent;
• HOLD for pending approval;
• BLOCK for expired intent;
• BLOCK for replayed/consumed nonce;
• ACCEPT followed by matching external observation;
• ACCEPT followed by contradicted external response-integrity verdict;
• valid response report paired with stale authorization.

Boundary

• ProofPath remains the authority producer and evidence packager.
• ProofPath does not become the post-response claim verifier.
• An imported integrity receipt must retain its original issuer/verifier identity and claim boundary.

Acceptance criteria

• A downstream verifier can reconstruct exactly what action was authorized and under which frozen context.
• Authorization records are portable without exposing secrets or full sensitive payloads.
• Evidence bundles preserve independent authority, observation, and integrity verdicts.
• Replay or expiry cannot be hidden by a valid observation or honest response.
• Fixtures align with Liminal#108.

[safal207]

Implementation started in draft PR #167:

#167

The PR adds:

• a provider-neutral authorization_record profile;
• JSON Schema for the exported record;
• eight conformance fixtures covering ACCEPT, HOLD, expiry, replay/consumption, observation handoff, external integrity failure, and historical reporting after expiry;
• a dependency-free deterministic exporter/verifier with stable SHA-256 record references.

Local validation result:

ProofPath authorization export fixtures passed: 8

The record keeps ProofPath authority separate from downstream observation and response-integrity verdicts. The PR remains draft while review and CI are pending.

[safal207]

Completed and merged via #167.

The v0.1 ProofPath authorization export now includes:

• a provider-neutral JSON Schema and canonical SHA-256 record references;
• independent deterministic generation and semantic verification;
• strict separation between intrinsic authorization state and report-time evaluation;
• external authority_state_at_report derivation without rewriting canonical evidence;
• observation and response-integrity handoff validation;
• eight conformance scenarios including approval, replay, expiry, contradiction, and historical reporting;
• a dedicated CI gate with non-persisted checkout credentials.

Rust CI, the authorization export workflow, and CodeRabbit completed successfully before merge.

Squash merge commit: b94452f6ad4c5fa5d9efe80334d358d623b97e07.