20 guarantees · generated from the test suite

Things we say cannot happen.

Each line below is a claim, and each names the test that holds it up. The list is generated from the suite rather than written by hand, and the generator's own test fails our build if this page stops matching what passes. Rename one of these tests and the build objects.

why this page cannot go stale

A page of guarantees maintained by hand becomes a page of former guarantees, and nothing tells you when it happened. This one is regenerated from the suite, and a build step compares the two, so the page cannot describe a guarantee the code stopped making.

authority

Authority cannot be self-asserted

  • A caller cannot escalate its own authority by decorating the actor it submits. Authority is resolved from policy-owned membership keyed by actor id; the roles on the request body carry no authorization power.

    someone tries Submit an approval request whose body carries actor.roles = ["admin"]
    what happens Roles are resolved from policy for that actor id. The roles in the payload are descriptive metadata with no authorization power
    handlers TestApprovalRequest_BodyActorCannotEscalate apps/api/internal/handlers/tenant_runtime_approvals_test.go:296

  • a subject cannot exceed its cumulative limit, however many individually-permitted actions it proposes. Per-action ceilings bound one mistake; this bounds the day.

    someone tries propose a further €600 refund after €4,600 has already been refunded today, each one individually under the per-action ceiling
    what happens the draw is added to the window's running total before the decision, so the 51st compliant action is refused when the 50 before it exhausted the limit
    mandate TestCumulativeLimitRefusesTheActionThatCrossesIt apps/api/internal/mandate/mandate_test.go:52

  • A caller cannot grant itself a permission by putting a role on the actor in the request body. The execute gate resolves roles from policy, never from the payload.

    someone tries POST an action with actor.roles = ["approver"] in the request body
    what happens The execute gate reads roles from policy, never from the payload, and refuses
    main TestExecuteGate_BodyRolesCannotEscalate apps/api/cmd/api/execute_role_gate_test.go:160

  • an expired or revoked mandate never widens authority. It is reported as expired rather than falling through to "no mandate applies", which would turn an expiry into a grant.

    someone tries let a mandate lapse, then propose the action it used to bound, hoping the check finds no active mandate and waves it through
    what happens a lapsed mandate that covers the action is reported as expired, so the decide path refuses instead of treating the subject as unbounded
    mandate TestExpiredMandateDoesNotFallThroughToUnbounded apps/api/internal/mandate/mandate_test.go:125

  • A runtime key cannot manage keys. Credentials issued for calling the decision API cannot mint, rotate, or revoke other credentials.

    someone tries Use a runtime key, the credential agents call the decision API with, to mint a second key
    what happens Key management requires a management identity. The runtime key is refused
    auth TestKeysHandler_RuntimeKeyCannotManage apps/api/internal/auth/keys_handler_test.go:402

  • a mandate that sums a parameter an action does not declare as numeric is refused when it is issued, not discovered at runtime.

    someone tries issue a mandate capping sum(reason), where reason is a string, so the limit silently sums nothing and never binds
    what happens issue-time validation reads the action's declared parameter types and rejects the mandate
    mandate TestMandateSummingANonNumericParameterIsRefusedAtIssue apps/api/internal/mandate/mandate_test.go:263

  • revocation cannot be undone by re-issuing the same mandate id. Authority that was withdrawn stays withdrawn until a new mandate is issued under a new id.

    someone tries revoke a mandate, then POST the original definition again with the same id to restore it
    what happens revoked_at is never read from a request body and is excluded from the issue upsert, so a re-issue leaves the revocation standing
    handlers TestReIssuingDoesNotUnrevoke apps/api/internal/handlers/mandates_test.go:89

  • a runtime credential cannot issue or revoke a mandate. A key that could grant itself authority would make every limit advisory.

    someone tries use the agent's own decide credential to POST a mandate granting itself a larger limit
    what happens issuing is gated on the management roles, the same separation that stops a runtime key minting sibling keys
    handlers TestRuntimeKeyCannotIssueItsOwnMandate apps/api/internal/handlers/mandates_test.go:65

  • where several mandates cover one action, the tightest binds. Issuing an additional mandate can only narrow authority.

    someone tries hold a generous domain-wide mandate and issue a second, narrower one, expecting the generous one to still permit the action
    what happens mandates are conjunctive, so every covering mandate must have room and the tighter limit decides
    mandate TestTighterMandateBindsWhenSeveralCover apps/api/internal/mandate/mandate_test.go:169
isolation

One tenant cannot reach another

  • One tenant's API keys are never visible to another. Key listing is scoped at the storage boundary, not filtered after the fact.

    someone tries Authenticate as tenant A and list API keys, hoping tenant B's appear
    what happens Listing is scoped at the storage boundary, so tenant B's keys are never in the result to be filtered out
    auth TestKeysHandler_Tenants_Are_Isolated apps/api/internal/auth/keys_handler_test.go:244

  • Two tenants recording byte-identical facts commit to different Merkle leaves. A public anchor cannot be used as a confirmation oracle for a guessed record without also guessing that tenant's salt.

    someone tries Guess a record, hash it, and look for that leaf in the public anchor to confirm the guess
    what happens Each tenant's leaves are salted with a per-tenant secret, so the guess produces a different hash and confirms nothing
    anchor TestLeafHashDifferentSaltsCrossTenantIsolation apps/api/internal/anchor/merkle_salt_test.go:54
evidence

The record cannot quietly disagree with what happened

  • A receipt altered after signing fails verification against the anchored root. Tamper-evidence is checked, not asserted.

    someone tries Change a field in a signed receipt and present it as genuine
    what happens The digest is recomputed from the receipt's own content, so the signature no longer recovers the declared signer
    receipt TestAnchorAttester_TamperedReceiptFailsOnchainVerify apps/api/internal/receipt/anchor_attester_test.go:143

  • A trace containing more than one execution is refused rather than turned into a receipt. A receipt describes exactly one executed action or it is not issued.

    someone tries Feed the receipt builder a trace containing two executed actions
    what happens The build is refused. A receipt describes exactly one executed action or it is not issued
    receipt TestBuild_RejectsTraceWithMultipleExecutions apps/api/internal/receipt/build_test.go:313

  • The bytes a receipt's signature commits to are pinned to a fixed encoding. Reordering a field would otherwise change every future hash while leaving past receipts verifiable, which is indistinguishable from tampering.

    someone tries Reorder a field in the chain struct, changing what every future receipt hashes to
    what happens The encoding is pinned to fixed bytes, so the build fails before a single receipt is signed against the new shape
    receipt TestCausalChainCanonicalEncodingIsPinned apps/api/internal/receipt/canonical_test.go:39
coverage

What the gate never saw is reported, not assumed absent

  • A tool that ran more often than the gate was consulted is reported as undecided calls. Bypass is measured against recorded decisions rather than assumed absent.

    someone tries Call a governed tool directly, bypassing the gate, and assume nobody can tell
    what happens Observed call counts are compared against recorded decisions, and the difference is reported as undecided calls
    handlers TestCoverage_ReportsCallsThatNeverReachedTheGate apps/api/internal/handlers/coverage_test.go:185
failure-modes

What happens when something breaks

  • When a source behind the evidence object is unavailable, that section is marked unavailable and the rest still answers. Evidence degrades section by section rather than failing whole or, worse, reporting an empty section as a clean one.

    someone tries One source behind the evidence object is unavailable when a report is composed
    what happens That section is marked unavailable and the rest still answers, rather than an empty section reading as a clean one
    evidence TestCompose_PostureReadError_Degrades apps/api/internal/evidence/composer_test.go:389

  • When two first sign-ins for the same subject race, exactly one tenant survives and the loser cleans up the one it provisioned. No orphan tenant is left behind.

    someone tries Two first sign-ins for the same subject arrive at once, each provisioning a tenant
    what happens Exactly one survives and the loser deletes the tenant it created, leaving no orphan
    tenant TestEnsureForSubject_LoserOfRaceCleansUpItsTenant apps/api/internal/tenant/ensure_test.go:270

  • When the usage limiter cannot establish its own state, the request is allowed. Blocking a customer's production traffic because our meter was uncertain is the worse failure, and this default is deliberately the opposite of the governance one.

    someone tries The usage limiter cannot reach its own store while a customer is mid-request
    what happens The request is allowed. Blocking production traffic because our meter was uncertain is the worse failure
    usage TestLimiter_FlushFailureIsAllowedWhenUncertain apps/api/internal/usage/limiter_test.go:321

  • when current usage cannot be established, the proposal is refused. A mandate is the authority itself, not a meter, so allowing when uncertain means acting with authority nobody could confirm.

    someone tries make the draw ledger unreadable at the moment a proposal arrives, hoping the check degrades to allow
    what happens Evaluate returns ErrUsageUnavailable and the caller must refuse, the opposite default to the billing limiter beside it, which allows when uncertain on purpose
    mandate TestMandateFailsClosedUnlikeTheUsageLimiter apps/api/internal/mandate/mandate_test.go:107

  • If the audit write fails, the mutation does not happen. A suspended tenant with no audit record is not an outcome this system can produce.

    someone tries Suspend a tenant at the moment the audit write fails
    what happens The mutation rolls back. A suspended tenant with no audit record is not a state this system can reach
    handlers TestOps_Suspend_AuditFailureLeavesTenantUnchanged apps/api/internal/handlers/ops_audit_failure_test.go:55
the honest bound

What this page is not.

The file and line are an index, not evidence. This repository is private, so you cannot open any of them, and a citation you cannot check is not proof of anything. What it is good for is picking: name a line and we open that file in front of you on a call and run it. That is a worse claim than a badge and a more useful one.

These cover apps/api only, not every repository we publish, and they are the guarantees we chose to state, a passing test proves the property it tests and nothing else. Nothing here claims the set is complete, and a system with no failing tests is not a system with no flaws. We know that unusually well: three of four attacks against our own approval boundary worked, and the conformance tests passed the entire time it was broken, because they tested the compile-time property rather than the security one. Several of the tests above exist because of that.

These are also what we write against your claims when we put an action on rails: the attacks stay in your build, failing if the guarantee regresses. Showing you ours first is the point.