Skip to content

Policy-engine interoperability

The maintained policy-engine example demonstrates that a recipient can authenticate an InvarLock acceptance envelope and apply current policy without an InvarLock service or policy-engine plugin.

Reference

  • Surface: Standalone DSSE verification followed by OPA/Rego or CUE recipient-policy evaluation
  • Stability: Maintained example over the acceptance v2 predicate and invarlock/acceptance-policy-input-v1
  • Use this page when: Consuming an acceptance attestation without an InvarLock service or policy-engine plugin

Data flow

acceptance.dsse.json + envelope-signer public key
                  |
                  v
standalone DSSE and receipt verification
                  |
                  v
invarlock/acceptance-policy-input-v1
                  |
                  +----> OPA/Rego decision
                  |
                  +----> CUE validation

The standalone verifier checks:

  • canonical envelope, Statement, and embedded receipt representations;
  • the DSSE payload type, key ID, Ed25519 signature, and public-key fingerprint;
  • the embedded receipt digest, public key, Ed25519 signature, verifier identity, and fingerprint; and
  • agreement among the signed receipt verdict, predicate verdict, and signed signer projections.

OPA and CUE then enforce the expected predicate type and subject, allowed InvarLock release contract, active envelope signer and receipt verifier, attestation freshness, and required technical verdict.

Conformance fixtures

The committed corpus covers positive, policy-rejected, tampered-subject, untrusted-signer, stale-evidence, and unsupported-contract inputs. OPA returns an explicit allow/deny decision with reason codes. CUE treats the same positive input as valid and rejects all five negative inputs.

make acceptance-policy-interop

The exact tested tool versions live in examples/policy-engine-interop/tool-versions.json. See the example README for pinned installation commands.

Assurance boundary

Rego and CUE evaluate an authenticated projection; they do not themselves perform raw Ed25519 verification. This division is explicit in the example and its tests. The verifier is a local reference executable, not an InvarLock service or hidden plugin.

The result answers whether a portable historical technical decision is acceptable under current recipient policy. It does not replay the complete evidence pack. Use invarlock verify for full technical replay.