Repository navigation
Conversation
R6 要求签发侧能按 D-AUTH-001 v1.2.0 §3.2 签发授权类许可。分发许可的字段集
就是它的绑定集（consume() 逐字段比较），授权许可的字段集按契约是另一套且
明确禁用 operation / target_digest / params_digest（INV-02）。把两套字段合并
成一个「覆盖即可」的校验，会让缺少动作绑定的消息也通过 —— 所以新增独立原语，
两种形态互不顶替。
改动：
- 新增 lib/coordination/permit-authority-signing.js：
· buildDesktopAuthorityMessage：字段集 = §3.2 九项 + issued_at_ms；
三类动作绑定字段存在即硬拒（ERR_PERMIT_AUTHORITY_FIELD_FORBIDDEN）；
未知字段同样拒绝（消息就是它签的字段集）；
· TTL 上下界（10 s ≤ ttl ≤ 120 s，§5.1）；
· signDesktopAuthorityPermit：用批次签名句柄签规范字节；
· verifyDesktopAuthorityPermit：验签 + 指纹 pin + 撤销集合 + 双向时钟容差
（固定 2 s，允许值只吸收「本机时钟早于签发时刻」，不延长 deadline）。
- 新增 tests/coordination/permit-authority-signing.test.js（11 例）：字段集、
INV-02 硬拒、未知字段、类别固定、TTL 上下界、整数下限、验签、篡改、撤销、
过期、时钟超差与「容差不超 2 s」。
跨语言验证：签发样例用 SamHMI 侧 AutomationPermitCanonicalizer 规范化后
逐字节相同，Ed25519 验签通过、指纹一致（证据见 M-053 证据目录）。
未做（记录在案）：契约 §3.2 字段表漏列 issued_at_ms（§6/§2.1.1 需要它），
本次纳入签名并记录缺口；Windows 消费侧尚无 permit_category 分支。
任务：M-053 R6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
范围
按 D-AUTH-001 v1.2.0 §3.2 / §9.2 增加授权类许可（
desktop_authority）的签发原语。分发许可（dispatch）的字段集就是它的绑定集，两套字段不能合并校验，因此独立成模块。
lib/coordination/permit-authority-signing.js：字段集 = §3.2 九项 +issued_at_ms；携带
operation/target_digest/params_digest一律硬拒（INV-02）；未知字段同样拒绝；TTL 上下界 10 s / 120 s（§5.1）；验签含指纹 pin、撤销集合与固定 2 s 双向时钟容差。
tests/coordination/permit-authority-signing.test.js：11 例。验证
node --test tests/coordination/permit-authority-signing.test.js→ 11/11。node --test tests/coordination/permit-bridge.test.js→ 21/21（未受影响）。node scripts/check-l3-boundary.js→ 0 violations。AutomationPermitCanonicalizer规范化后逐字节相同，Ed25519 验签通过，指纹一致（M-053 证据目录）。
已知事项
issued_at_ms，但 §6（时钟判定）与 §2.1.1（投影带issuedAtMs）需要它；本实现纳入签名并记录为契约缺口，待回填。
跨机承载仍是未实现切片。
AutomationPermitVerifier）尚无permit_category分支，授权许可在真机验签路径会被判
InputInvalid；需 SamHMI 侧 MR。边界
不签名分发许可、不改既有 store 语义、不开监听、不碰生产启动 gate、不引入第二把密钥。