Module approval 

Helpers for verifying governed approval credentials locally.

Structs

ApprovalRefreshBootstrap

Control-plane bootstrap required to refresh trusted approval keys online.

ApprovalResolution

Derived approval state for a runtime spec after local credential verification.

TrustedApprovalKey

Trusted approval signing key material accepted by enterprise runtimes.

TrustedApprovalKeyCache

A locally persisted trusted key set plus minimal refresh metadata.

Enums

ApprovalTrustSource

Source of the trusted signing keys currently available to the runtime.

ApprovalVerificationError

Errors returned when an approval credential cannot be verified locally.

Functions

approval_credential_expires_at

Extract the credential expiry timestamp from an approval credential payload.

approval_refresh_bootstrap_from_env

Read approval-refresh bootstrap configuration from the runtime environment.

approval_spec_hash_from_canonical_spec_kv

Compute the canonical sha256:<hex> digest expected inside approval credentials.

default_approval_credential_path

Return the default local path used for a bundle-adjacent approval credential.

default_trusted_approval_key_cache_path

Return the default local cache path used for trusted signing keys next to a spec file.

discover_trusted_approval_key_paths

Return default signing-key file locations associated with a spec path.

load_approval_credential_from_bundle

Load an approval credential from an extracted deploy bundle when present.

load_runtime_trusted_approval_key_cache

Load trusted approval keys for runtime startup, refreshing from the control plane when possible.

load_trusted_approval_key_cache_from_file

Load a trusted approval key cache envelope from disk.

load_trusted_approval_key_cache_from_paths

Load trusted approval signing keys from one or more local cache files.

load_trusted_approval_keys_from_file

Load trusted approval signing keys from a json file.

load_trusted_approval_keys_from_paths

Load trusted approval signing keys from one or more json files.

refresh_runtime_trusted_approval_key_cache

Refresh trusted approval keys from the control plane and persist them into the local runtime cache.

required_approval_capabilities_for_spec_kv

Derive the approval capabilities required by a canonical spec.

resolve_runtime_approval

Resolve runtime approval presence by verifying an optional credential against the canonical spec hash, target environment, and required side-effect capabilities.

write_trusted_approval_key_cache

Persist a trusted approval key cache envelope to disk.