Authority evidence

authority

Experimental authority-evidence boundary models.

SafeReference module-attribute

SafeReference = Annotated[str, StringConstraints(min_length=1, max_length=255), AfterValidator(_validate_safe_reference)]

ActionType

Bases: ExperimentalModel

A host-defined action name with an explicit contract version.

namespace instance-attribute

namespace: ActionNamespace

name instance-attribute

name: ActionName

version instance-attribute

version: Annotated[int, Field(ge=1)]

ConfirmingAuthority

Bases: ExperimentalModel

kind class-attribute instance-attribute

kind: Literal['confirming_authority'] = 'confirming_authority'

reference instance-attribute

reference: SafeReference

ExperimentalModel

Bases: BaseModel

Strict, immutable base for the experimental public contract.

model_config class-attribute instance-attribute

model_config = ConfigDict(extra='forbid', strict=True, frozen=True)

AuthorityDecision

Bases: StrEnum

APPROVE class-attribute instance-attribute

APPROVE = 'approve'

REJECT class-attribute instance-attribute

REJECT = 'reject'

AuthorityBinding

Bases: ExperimentalModel

Security-relevant dimensions an authority record must match exactly.

tenant_reference instance-attribute

tenant_reference: SafeReference

action_type instance-attribute

action_type: ActionType

proposal_instance_reference instance-attribute

proposal_instance_reference: SafeReference

semantic_effect_reference instance-attribute

semantic_effect_reference: SafeReference

proposal_commitment instance-attribute

proposal_commitment: SafeReference

required_audience instance-attribute

required_audience: SafeReference

required_channel_assurance instance-attribute

required_channel_assurance: SafeReference

AuthorityValidationFailure

Bases: StrEnum

BINDING_MISMATCH class-attribute instance-attribute

BINDING_MISMATCH = 'binding_mismatch'

EXPIRED class-attribute instance-attribute

EXPIRED = 'expired'

NOT_YET_VALID class-attribute instance-attribute

NOT_YET_VALID = 'not_yet_valid'

AuthorityValidationResult

Bases: ExperimentalModel

valid instance-attribute

valid: bool

failure class-attribute instance-attribute

failure: AuthorityValidationFailure | None = None

AuthorityEvidence

Bases: ExperimentalModel

A bound authority decision; it is not authorization by itself.

kind class-attribute instance-attribute

kind: Literal['bound_decision'] = 'bound_decision'

domain class-attribute instance-attribute

domain: Literal['threvo.actions.authority-evidence'] = 'threvo.actions.authority-evidence'

schema_version class-attribute instance-attribute

schema_version: Literal['internal/v0'] = 'internal/v0'

tenant_reference instance-attribute

tenant_reference: SafeReference

action_type instance-attribute

action_type: ActionType

proposal_instance_reference instance-attribute

proposal_instance_reference: SafeReference

semantic_effect_reference instance-attribute

semantic_effect_reference: SafeReference

authority instance-attribute

authority: ConfirmingAuthority

audience class-attribute instance-attribute

audience: tuple[SafeReference, ...] = Field(min_length=1)

decision instance-attribute

decision: AuthorityDecision

proposal_commitment instance-attribute

proposal_commitment: SafeReference

channel_assurance instance-attribute

channel_assurance: SafeReference

issued_at instance-attribute

issued_at: AwareDatetime

expires_at instance-attribute

expires_at: AwareDatetime

expiry_follows_issue_time

expiry_follows_issue_time() -> AuthorityEvidence

validate_authority_evidence

validate_authority_evidence(evidence: AuthorityEvidence, *, binding: AuthorityBinding, now: AwareDatetime) -> AuthorityValidationResult

Validate server-bound evidence without treating it as sufficient policy.

authority_evidence_matches_binding

authority_evidence_matches_binding(evidence: AuthorityEvidence, *, binding: AuthorityBinding) -> bool

Check proposal binding dimensions without evaluating time or sufficiency.