All runbooks
runbookuapiredacted view

UAPI Sixty-Ninth Wedge - Identity-Gated Route Evidence Receipt

Fixture-only identity-gated route evidence packet receipt for UAPI one-login route authorization boundaries.

Updated 2026-06-23·Freshness: Reference·Sensitive tokens or credentials were hidden before display.

UAPI Sixty-Ninth Wedge - Identity-Gated Route Evidence Receipt

Fixture-only identity-gated route evidence packet receipt for UAPI one-login route authorization boundaries.

Promotion Metadata

  • Source feedback id: 243
  • Source feedback ids: 243
  • Promotion request id: 162
  • Feedback category: beneficial
  • Feedback source: ai-lane
  • Feedback created at: 2026-06-23T04:55:05.797540+00:00
  • Target slug: [REDACTED:high-entropy]
  • Review state: review
  • Reviewer note: AI lane auto-promoted redacted feedback into internal catalog context.

Source Feedback Body

Feedback 243

  • Product: uapi
  • Category: beneficial
  • Related slug: ``
  • Source: ai-lane
  • Created at: 2026-06-23T04:55:05.797540+00:00

UAPI Sixty-Ninth Wedge - Identity-Gated Route Evidence Receipt

Date: 2026-06-23

Authority: fixture_only_no_execution

Summary

Added a fixture-only identity-gated route evidence packet that converts GLM Wave 5 A identity/routing findings into schema-backed tests. The packet models one-login route authorization evidence without activating routes, using credentials, starting listeners, calling providers, writing ledgers, or approving operator gates.

Added

  • IdentityGatedRouteEvidencePacket schema definition.
  • Fixture packet: fixtures/identity-gated-route-evidence.v0.json.
  • Validator: [REDACTED:high-entropy].py.
  • Unit tests: [REDACTED:high-entropy].py.

Denial Cases

  • Human principal cannot act as service token for service-only route evidence.
  • AI service token cannot approve an operator gate.
  • Device context is denied when the requested route is outside device allowlist.
  • Stale or revoked sessions are denied.
  • Missing route scopes are denied.
  • Approved gate decisions are denied under do-not-activate authority.
  • Revoked service tokens and token route-allowlist mismatch are rejected.

Verification

  • PYTHONPATH=src python3 -m unittest tests.test_identity_gated_route_evidence tests.test_fixture_schema tests.test_validate_fixtures_cli tests.test_acceptance_summary_cli tests.test_readiness_report tests.test_continuation_packet
  • bash scripts/uapi-fixture-check.sh
  • git diff --check

Result: PASS. Full fixture gate reports 23 schema packets, 112 schema cases, 20 strict positive cases, 80 expected failure envelopes, 12 structured packets, and 202 unit tests.

Safety

No backend dispatch, hardware execution, provider calls, credential use, service listener, route activation, ledger writes, or Explorer export were performed.