Harden the cross-company incident response effect boundary

.dockerignore

@@ -5,6 +5,7 @@ target
 **/pkg
 **/node_modules
 **/.venv
+**/.mypy_cache
 **/__pycache__
 **/.DS_Store
 **/.env

.github/workflows/ci.yml

@@ -144,6 +144,7 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
+          fetch-depth: 0
           persist-credentials: false
       - name: Start telemetry
         run: echo "AUTHS_PHASE_STARTED=$(date +%s)" >> "$GITHUB_ENV"
@@ -182,6 +183,8 @@ jobs:
           go version
           sccache --version
       - name: Run authoritative repository CI
+        env:
+          AUTHS_EVOLUTION_BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
         run: cargo xtask ci authoritative
       - name: Record authoritative telemetry
         if: always()

.github/workflows/python-sdk.yml

@@ -85,10 +85,12 @@ jobs:
           path: |
             target/binding-vectors/
             bindings/customer-journey-matrix-v1.json
+            bindings/public-topology-v1.json
             bindings/python/api/public-api.txt
             bindings/python/adapter-contracts.json
             bindings/python/external/full_workflow_consumer.py
-            bindings/python/examples/identity_quickstart.py
+            bindings/python/external/conformance_consumer.py
+            bindings/recipes/python/01_authenticate_identity.py
             bindings/python/identity-conformance-v1.json
             bindings/python/native-abi-v2.json
             bindings/python/performance-baseline.json
@@ -186,7 +188,12 @@ jobs:
         shell: bash
         working-directory: ${{ runner.temp }}
         run: >-
-          python "${{ github.workspace }}/consumer/bindings/python/examples/identity_quickstart.py"
+          python "${{ github.workspace }}/consumer/bindings/recipes/python/01_authenticate_identity.py"
+      - name: Execute installed Auths-owned conformance
+        shell: bash
+        working-directory: ${{ runner.temp }}
+        run: >-
+          python "${{ github.workspace }}/consumer/bindings/python/external/conformance_consumer.py"
       - name: Check exact package/native contracts
         shell: bash
         run: python consumer/bindings/python/tools/check_contract.py
@@ -225,7 +232,6 @@ jobs:
         run: >-
           python -m mypy --strict --warn-unused-ignores
           consumer/bindings/python/typecheck/mcp_consumer.py
-          consumer/bindings/python/typecheck/elite_consumer.py
           consumer/bindings/python/typecheck/workflow_consumer.py
           consumer/bindings/python/typecheck/mypy_negative.py
       - name: Check strict Pyright source contract

.github/workflows/sdk-recipes.yml

@@ -0,0 +1,91 @@
+name: SDK outcome recipes
+
+on:
+  pull_request:
+    paths:
+      - "bindings/recipes/**"
+      - "bindings/python/**"
+      - "bindings/typescript/**"
+      - "bindings/wasm/**"
+      - "core/**"
+      - "product/**"
+      - ".github/workflows/sdk-recipes.yml"
+      - "Cargo.lock"
+      - "Cargo.toml"
+  push:
+    branches: [main]
+    paths:
+      - "bindings/recipes/**"
+      - "bindings/python/**"
+      - "bindings/typescript/**"
+      - "bindings/wasm/**"
+      - "core/**"
+      - "product/**"
+      - ".github/workflows/sdk-recipes.yml"
+      - "Cargo.lock"
+      - "Cargo.toml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  installed-artifacts:
+    name: ten installed-artifact recipes
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-rust-cache
+        with:
+          toolchain: 1.97.1
+          targets: wasm32-unknown-unknown
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.23.1
+          cache: npm
+          cache-dependency-path: bindings/typescript/package-lock.json
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.12"
+      - run: npm ci
+        working-directory: bindings/typescript
+      - run: cargo install wasm-pack --version 0.15.0 --locked
+      - run: python -m venv .recipe-venv
+      - run: .recipe-venv/bin/python -m pip install maturin==1.9.6
+      - run: npm run build:wasm
+        working-directory: bindings/typescript
+      - run: npm run build:vectors
+        working-directory: bindings/typescript
+      - run: npm run build
+        working-directory: bindings/typescript
+      - run: mkdir -p target/recipe-artifacts
+      - run: npm pack --pack-destination ../../target/recipe-artifacts
+        working-directory: bindings/typescript
+      - run: >-
+          .recipe-venv/bin/maturin build --release --locked
+          --manifest-path bindings/python/Cargo.toml
+          --out target/recipe-artifacts
+      - run: npm ci
+        working-directory: bindings/recipes/typescript
+      - run: npm install --no-save ../../../target/recipe-artifacts/auths-dev-sdk-*.tgz
+        working-directory: bindings/recipes/typescript
+      - run: npm exec tsc -- -p tsconfig.json
+        working-directory: bindings/recipes/typescript
+      - run: .recipe-venv/bin/python -m pip install target/recipe-artifacts/auths-*.whl
+      - name: Run paired recipes and cross-language receipt verification
+        env:
+          AUTHS_RECIPE_PYTHON: ${{ github.workspace }}/.recipe-venv/bin/python
+          AUTHS_RECIPE_FIXTURE: ${{ github.workspace }}/target/binding-vectors
+        run: node bindings/recipes/tools/run.mjs | tee target/recipe-artifacts/timings.json
+      - name: Verify generated recipe pages
+        run: |
+          node bindings/recipes/tools/generate-docs.mjs
+          git diff --exit-code -- docs/product/recipes
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: sdk-recipe-timings-${{ github.run_id }}-${{ github.run_attempt }}
+          path: target/recipe-artifacts/timings.json
+          if-no-files-found: error
+          retention-days: 30

Cargo.toml

@@ -51,6 +51,7 @@ members = [
     "exchange/testkit/auths-proof-exchange-testkit",
     "product/sdk/auths-sdk",
     "product/sdk/auths-profile-kit",
+    "product/errors/auths-errors",
     "product/policy/auths-bounded-policy",
     "product/policy/auths-bounded-policy/fuzz",
     "product/integrations/auths-enforcement",
@@ -106,6 +107,7 @@ members = [
     "demos/postgresql-data-change",
     "demos/rest-api-authorization",
     "demos/identity-iroh",
+    "demos/cross-company-incident-response/edgeshield-service",
     "xtask/ci-plan",
     "xtask",
 ]
@@ -174,6 +176,7 @@ auths-cache = { version = "1.0.0-rc.1", path = "product/cache/auths-cache" }
 auths-operations = { version = "1.0.0-rc.1", path = "product/operations/auths-operations" }
 auths-sdk = { version = "1.0.0-rc.1", path = "product/sdk/auths-sdk" }
 auths-profile-kit = { version = "1.0.0-rc.1", path = "product/sdk/auths-profile-kit" }
+auths-errors = { version = "1.0.0-rc.1", path = "product/errors/auths-errors", default-features = false }
 auths-bounded-policy = { version = "1.0.0-rc.1", path = "product/policy/auths-bounded-policy", default-features = false }
 auths-enforcement = { version = "1.0.0-rc.1", path = "product/integrations/auths-enforcement" }
 auths-deployment = { version = "1.0.0-rc.1", path = "product/integrations/auths-deployment" }

architecture.toml

@@ -108,6 +108,7 @@ auths-cache = "product"
 auths-ci-plan = "tooling"
 auths-codec = "core"
 auths-composition = "core"
+auths-cross-company-incident-edgeshield-demo = "demos"
 auths-formal-refinement = "core"
 auths-github = "product"
 auths-github-demo = "demos"
@@ -118,6 +119,7 @@ auths-did-keri = "core"
 auths-did-key = "core"
 auths-did-web = "core"
 auths-enforcement = "product"
+auths-errors = "product"
 auths-evidence-assemblers = "product"
 auths-hsm-attested = "core"
 auths-lab-matrix = "demos"
@@ -288,10 +290,70 @@ forbidden_patterns = [
 ]
 
 [[binding_semantics.allowances]]
-path = "bindings/typescript/src/testkit/index.ts"
+path = "bindings/typescript/src/internal/development.ts"
 pattern = "crypto.subtle"
 status = "permanent"
-reason = "Non-production ephemeral development signer. External custody is deliberately outside the kernel, so a stand-in signer must hold a key locally; it is labelled ephemeral and ships only on the testkit entry point."
+reason = "Non-production local signer and receipt-attestor keys are mechanism state, while Rust owns every signed preimage and verification meaning."
+
+[[binding_semantics.allowances]]
+path = "bindings/typescript/src/integrations.ts"
+pattern = "getRandomValues"
+status = "permanent"
+reason = "The development composition creates local session entropy; Rust consumes the derived keys but the random source is an integration mechanism."
+
+[[binding_semantics.allowances]]
+path = "bindings/typescript/src/integrations.ts"
+pattern = "DataView"
+status = "permanent"
+reason = "The development-only key derivation length-prefixes a local role label and does not define an Auths protocol or customer evidence format."
+
+[[binding_semantics.allowances]]
+path = "bindings/typescript/src/integrations.ts"
+pattern = "crypto.subtle"
+status = "permanent"
+reason = "The development-only composition derives local deterministic mechanism keys; Rust continues to own all Auths commitments and signing preimages."
+
+[[binding_semantics.allowances]]
+path = "bindings/typescript/src/internal/development-store-node.ts"
+pattern = "getRandomValues"
+status = "permanent"
+reason = "Recoverable development state requires a local session secret; the random source is mechanism state and carries no portable Auths meaning."
+
+[[binding_semantics.allowances]]
+path = "bindings/typescript/src/internal/development-store-node.ts"
+pattern = "JSON.stringify"
+status = "permanent"
+reason = "The disposable development store encodes its private local record envelope; signed and semantic Auths bytes remain Rust-owned and opaque."
+
+[[binding_semantics.allowances]]
+path = "bindings/typescript/src/internal/development-store-node.ts"
+pattern = "crypto.subtle"
+status = "permanent"
+reason = "The disposable development store hashes private local record names; it does not create a protocol commitment or verification result."
+
+[[binding_semantics.allowances]]
+path = "bindings/typescript/src/internal/receipt-attestation.ts"
+pattern = "JSON.stringify"
+status = "permanent"
+reason = "The development receipt signer serializes a bounded private attestation envelope around Rust-owned receipt claims and is not a protocol codec."
+
+[[binding_semantics.allowances]]
+path = "bindings/typescript/src/profiles/mcp/index.ts"
+pattern = "JSON.stringify"
+status = "permanent"
+reason = "MCP handler results are bounded provider payloads; Rust owns the action, execution and receipt commitments rather than this provider representation."
+
+[[binding_semantics.allowances]]
+path = "bindings/python/python/auths/integrations.py"
+pattern = "hashlib"
+status = "permanent"
+reason = "The Python development composition hashes private local record names and derives mechanism keys without defining portable Auths semantics."
+
+[[binding_semantics.allowances]]
+path = "bindings/python/python/auths/integrations.py"
+pattern = "secrets."
+status = "permanent"
+reason = "The Python development composition creates local session and file entropy; the values are mechanism state and never Auths protocol meaning."
 
 [[binding_semantics.allowances]]
 path = "bindings/typescript/src/profiles/mcp/index.ts"