feat: export provider-neutral authorization records v0.1

[safal207]

Summary

Implements the ProofPath side of the three-record trustworthy-transition contract from Liminal#108 and ProofPath#166.

This PR adds a provider-neutral authorization_record export without changing ProofPath's enforcement boundary.

Added

• docs/interop/PROOFPATH_AUTHORIZATION_RECORD_EXPORT_V0_1.md
• schemas/proofpath-authorization-record-v0.1.schema.json
• conformance/authorization-record-export-v0.1.json
• conformance/authorization-record-report-context-v0.1.json
• scripts/check_authorization_record_export.py
• scripts/verify_authorization_record_export.py
• .github/workflows/authorization-record-export.yml

State model

The canonical authorization record stores only intrinsic state:

• ACTIVE;
• PENDING_APPROVAL;
• EXPIRED;
• CONSUMED;
• BLOCKED;
• REJECTED;
• INVALID.

Report time remains external verifier context. The derived authority_state_at_report may become EXPIRED_AT_REPORT without rewriting the original authorization record or changing its SHA-256 reference.

Independent verification

The deterministic exporter reproduces canonical record bytes and references. A separate semantic verifier independently derives and checks:

• strict context shapes and digest formats;
• policy binding consistency;
• decision, continuation, approval, and consumption combinations;
• intrinsic state versus report-time authority state;
• execution eligibility and zero-side-effect expectations;
• observation timing and authorization joins;
• response-integrity joins and MATCH, MATCH_WITH_INTEGRITY_FAILURE, or HISTORICAL_ONLY outcomes.

Fixture coverage

1. accepted reversible action;
2. accepted irreversible action with approval;
3. HOLD pending approval;
4. BLOCK expired intent;
5. BLOCK replayed/consumed intent;
6. matching downstream observation handoff;
7. externally contradicted response-integrity record;
8. honest historical report after authority expiry.

Boundary

• ProofPath exports authorization evidence.
• A downstream runtime owns execution observations.
• A separate verifier owns response-integrity verdicts.
• Imported artifacts remain independently attributed.
• An honest historical report does not reactivate stale authority.

Validation

python3 scripts/check_authorization_record_export.py
python3 scripts/verify_authorization_record_export.py

Expected summaries:

ProofPath authorization export fixtures passed: 8
Independent ProofPath authorization semantics passed: 8

Relates to #166 and safal207/Liminal#108.

[coderabbitai]

Warning

Review limit reached

@safal207, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 5 minutes and 7 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: aae520c2-f400-4b55-bce1-afb7a0567392

📥 Commits

Reviewing files that changed from the base of the PR and between 4173a7c and 187e8ca.

📒 Files selected for processing (6)

• .github/workflows/authorization-record-export.yml
• conformance/authorization-record-export-v0.1.json
• docs/interop/PROOFPATH_AUTHORIZATION_RECORD_EXPORT_V0_1.md
• schemas/proofpath-authorization-record-v0.1.schema.json
• scripts/check_authorization_record_export.py
• scripts/verify_authorization_record_export.py

📝 Walkthrough

Walkthrough

Introduces the ProofPath Authorization Record Export Profile v0.1: a JSON Schema for the exported record, two conformance fixture files (export cases and report-context timestamps), an interop specification document, two Python verification scripts (check_authorization_record_export.py for canonical build/regression and verify_authorization_record_export.py for independent semantic verification), and a GitHub Actions workflow that runs both scripts on relevant path changes.

Changes

Authorization Record Export Profile v0.1

Layer / File(s)	Summary
Schema definition and interop profile doc schemas/proofpath-authorization-record-v0.1.schema.json, docs/interop/PROOFPATH_AUTHORIZATION_RECORD_EXPORT_V0_1.md	JSON Schema defines all required fields, enums, sha256Ref pattern, and additionalProperties: false; the interop doc specifies export shape, frozen identity digests, decision semantics, handoff records, and conformance invariants.
Conformance fixture data conformance/authorization-record-export-v0.1.json, conformance/authorization-record-report-context-v0.1.json	Export fixture provides metadata, seven end-to-end scenarios (ACCEPT/HOLD/BLOCK/REJECT with optional handoff), and invariant declarations; report-context fixture supplies reported_at timestamps for three handoff cases.
Canonical build and regression check script scripts/check_authorization_record_export.py	Deterministically constructs authorization/observation/integrity records using canonical JSON and SHA-256 digests, then verifies each fixture case's authorization_ref, execution_allowed, side-effect count, and current_state; CLI supports --emit-case for debugging.
Independent semantic verification script scripts/verify_authorization_record_export.py	Separately re-derives the exported record with strict enum/policy enforcement, computes current_state via derive_state() with expiry/report-timing logic, validates handoff join results (MATCH, MATCH_WITH_INTEGRITY_FAILURE, HISTORICAL_ONLY), and cross-checks report-context entries against known case IDs.
GitHub Actions CI workflow .github/workflows/authorization-record-export.yml	Path-filtered workflow (conformance JSON, schema, docs, scripts) runs both verification scripts sequentially on ubuntu-latest with Python 3.12, with read-only contents permission.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related issues

• Export provider-neutral authorization records and lifecycle evidence handoff #166 — The PR directly implements the provider-neutral authorization record export profile, fixtures, schema, and handoff verification described in that issue.
• Emit canonical authorization records from deterministic action gates pythiaLabs#204 — Both address canonical authorization record export and downstream observation/response-integrity handoff semantics at the feature level.

Poem

🐇 Hop, hop! A record's born today,
With sha256 digests to light the way.
ACCEPT or BLOCK, the fixture knows,
Canonical JSON — each case it shows.
The workflow checks, the scripts agree,
Authorization exports, now conflict-free! 🌿

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding provider-neutral authorization record export support for v0.1.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/authorization-record-export-v0.1

---

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[safal207]

@coderabbitai review

Final ready-for-review diff includes the independent semantic verifier and dedicated CI gate.

[coderabbitai]

@safal207: Understood — I’ll review the updated diff, including the independent semantic verifier and the dedicated CI gate.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

conformance/authorization-record-export-v0.1.json (1)

9-409: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add fixtures for the unexercised REJECT and INVALID paths.

The pack never covers decision == "REJECT" or consumption_state == "UNKNOWN", even though the schema exports REJECTED/INVALID and scripts/verify_authorization_record_export.py:267-291 has dedicated branches for both. Right now those verifier paths can drift without the conformance gate noticing.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@conformance/authorization-record-export-v0.1.json` around lines 9 - 409, The
authorization record export fixture set is missing coverage for the verifier
branches that handle REJECT and INVALID outcomes, so add new cases to the JSON
pack that exercise decision_context.decision as REJECT and
decision_context.consumption_state as UNKNOWN. Mirror the existing case
structure in the cases array and make sure the new fixtures align with the
dedicated paths in scripts/verify_authorization_record_export.py and the
schema’s REJECTED/INVALID states so the conformance gate detects regressions.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/authorization-record-export.yml:
- Line 30: The checkout step in the workflow currently uses actions/checkout
without disabling credential persistence, which leaves the GITHUB_TOKEN
available to later PR-controlled steps. Update the checkout invocation to set
persist-credentials to false in the workflow job so the token is not written to
.git/config while still using the existing checkout behavior.

In `@schemas/proofpath-authorization-record-v0.1.schema.json`:
- Around line 84-95: The canonical authorization record schema currently
includes the report-derived current_state value EXPIRED_AT_REPORT, which should
not be part of the exported record. Update the
proofpath-authorization-record-v0.1 schema by removing EXPIRED_AT_REPORT from
the current_state enum and keep report-time evaluation in the separate report
context instead, aligned with the canonical record contract and the
stale_authorization_honest_report and authorization-record-report-context
fixtures.

---

Nitpick comments:
In `@conformance/authorization-record-export-v0.1.json`:
- Around line 9-409: The authorization record export fixture set is missing
coverage for the verifier branches that handle REJECT and INVALID outcomes, so
add new cases to the JSON pack that exercise decision_context.decision as REJECT
and decision_context.consumption_state as UNKNOWN. Mirror the existing case
structure in the cases array and make sure the new fixtures align with the
dedicated paths in scripts/verify_authorization_record_export.py and the
schema’s REJECTED/INVALID states so the conformance gate detects regressions.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 94d86de1-df95-4b99-9e49-8d97bae1f33a

📥 Commits

Reviewing files that changed from the base of the PR and between 8fa94f2 and 4173a7c.

📒 Files selected for processing (7)

• .github/workflows/authorization-record-export.yml
• conformance/authorization-record-export-v0.1.json
• conformance/authorization-record-report-context-v0.1.json
• docs/interop/PROOFPATH_AUTHORIZATION_RECORD_EXPORT_V0_1.md
• schemas/proofpath-authorization-record-v0.1.schema.json
• scripts/check_authorization_record_export.py
• scripts/verify_authorization_record_export.py