feat: add authenticated Control Cloud ingestion API

[safal207]

What changed

Adds the first authenticated tenant-ingestion layer on top of ProofPath Control Cloud from #211.

Assured Action request
+ exact request bytes
+ tenant key identity
        ↓
HMAC-SHA256 authentication
        ↓
timestamp / nonce / idempotency / repository-scope checks
        ↓
append-only chained tenant event
        ↓
ingestion receipt
        ↓
Control Cloud dataset export and dashboard snapshot

The implementation adds:

• a dependency-free reference HTTP service and CLI;
• POST /v1/tenants/{tenant_id}/assured-actions;
• tenant and key registry with environment-only secret references;
• exact request-body SHA-256 binding;
• HMAC-SHA256 authentication with constant-time comparison;
• signed timestamp and submission timestamp binding;
• nonce replay protection;
• idempotency with exact receipt replay and content-conflict rejection;
• tenant repository-prefix enforcement;
• strict request, receipt, and registry schemas;
• append-only JSONL event semantics with chained roots;
• exclusive file locking, O_NOFOLLOW, symlink rejection, append, and fsync;
• export into the existing proofpath.control-cloud.dataset.v0.1 profile;
• a complete ingestion → dataset → Control Cloud snapshot conformance flow;
• 20 functional/mutation tests and 14 static security tests.

Request authentication

Required headers:

X-ProofPath-Key-Id
X-ProofPath-Timestamp
X-ProofPath-Nonce
X-ProofPath-Idempotency-Key
X-ProofPath-Content-SHA256
X-ProofPath-Signature

The signature binds the method, tenant-scoped path, tenant ID, key ID, timestamp, nonce, idempotency key, and SHA-256 of the exact body bytes.

An identical retry returns the exact original receipt without appending a second event. Reusing an idempotency key with different bytes or reusing a nonce with a different request fails closed.

Tenant and storage boundary

The registry stores only a secret_env reference, not secret material. Each tenant has an explicit repository-prefix allowlist.

The reference event store is:

{store}/tenants/{tenant_id}/events.jsonl
{store}/tenants/{tenant_id}/.ingest.lock

The full event chain is revalidated before append and export. Store file symlinks are rejected.

Honest provenance boundary

The API validates the supplied certificate's internal decision and authority boundary, but it does not independently verify Sigstore/GitHub attestation cryptography or re-run Deploy Guard.

A separately verified provenance result can be recorded as EXTERNAL_RESULT_BOUND; v0.1 still emits:

provenance_cryptographically_verified_by_api: false

Financial and authority boundary

Every receipt states:

financial_status: RECORDED_NOT_PAYABLE
payments_executed: false
insurance_provided: false
deployment_performed: false
authority_granted: false

This PR does not call a payment processor, bank, wallet, exchange, cloud deployment API, IAM API, or repository write API.

Conformance workflow

The workflow:

1. compiles the runtime and validates all JSON contracts;
2. runs 34 focused tests;
3. signs exact fixture bytes with a test-only tenant key;
4. ingests one Assured Action;
5. repeats it and proves no second event is appended;
6. exports the tenant dataset;
7. builds a Control Cloud snapshot from the ingested event;
8. verifies deterministic receipt and event roots;
9. keyless-attests the exact receipt;
10. keyless-attests the exact tenant event store;
11. uploads the receipt, event store, dataset, snapshot, audit export, and manifest.

Permissions are limited to:

contents: read
id-token: write
attestations: write

Production limitation

This is a reference service, not hosted production SaaS. Production still needs TLS termination, rate limits, a managed secret/key service, key rotation and revocation, transactional durable storage, backups, monitoring, tenant administration, independent attestation admission, and security review.

Stacked PR

Base: agent/proofpath-control-cloud-v0.1 / #211

No merge is performed by this PR.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8be886c3-2d8a-4f1b-b199-c48eab1dbfd7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

Validation complete

Final source head: 2b07fc3713b3d410d87247b22a4e023fd8dfb5cc

Pull-request workflow subject: b18e309946852e32b77af895127125c205a2e753

Authenticated ingestion run #2

Run 30719436834 passed on a GitHub-hosted runner.

• 20 functional/mutation tests passed.
• 14 static security tests passed.
• Exact request bytes were signed with HMAC-SHA256.
• One tenant-scoped Assured Action was authenticated and appended.
• An identical retry returned the exact same receipt.
• The idempotent retry did not append a second event.
• The tenant event chain was revalidated before export.
• The exported dataset built a valid Control Cloud snapshot.
• The exact receipt and exact tenant event-store bytes were keyless-attested.
• Authentication headers and test key material were not included in the evidence artifact.

Deterministic result:

request content digest:
sha256:5d6bd8e05ed3437c4ae1cdfb8ec0f69834b8113a65a0b4ca982ac172b18e3133

event root:
sha256:7ae34fbf3dc038a18617ea4ff3a6e96cbb658466b45454174a1daa07a3765823

receipt root:
sha256:ef208fe0f99bccfe52eec725bb10569386bb4f620bdbf4240b5cc561a94987b1

Control Cloud snapshot root:
sha256:d0bcb8c0bb1dc4a85c48f38f831c463bcf5eabf624b3aeba2a42ec352b88f5a5

Attested subjects:

receipt.json
sha256:a92e44f76a5882521d0d5fe03125002d2cb1c9a5c08cb34d6318061962eb4ea4
GitHub attestation: 38358305
Rekor log index: 2314786148

events.jsonl
sha256:a6cba7cee1de758393f4bd6e55948c91a8fc2cb937b9fe31dd6b5dc563bfc365
GitHub attestation: 38358308
Rekor log index: 2314786435

Evidence artifact:

name: proofpath-control-cloud-ingestion-30719436834
artifact ID: 8824378678
SHA-256: 64285fdc61605f16cbfa065ddccb901fd27103756ba2c7a8a21fec3cbde59ea2
size: 8427 bytes
expires: 2026-08-15T21:35:11Z

Existing stack regressions

All passed on the same final head:

• ProofPath Deploy Guard run docs: improve ProofPath reviewer positioning #38 (30719436822).
• ProofPath Control Cloud run Build Axum-based ProofPath Gateway MVP #4 (30719436836).
• Rust run #327 (30719436825): formatting, clippy, workspace tests, Compute Witness, reusable Action, Personal Agent Guard, and Agent Payment Guard.

Exact-byte correction

The first PR run successfully completed all tests, authentication, ingestion, idempotent retry, export, and snapshot construction, but failed the final expected-root assertion because two JSON fields in the committed fixture were ordered differently from the locally generated exact-byte fixture. Since the HMAC contract intentionally authenticates exact bytes, the resulting digest and roots correctly changed.

The fixture was canonicalized, and all validation evidence above comes only from the successful final head and run #2. No failed-run evidence was accepted.

Honest boundary

financial_status: RECORDED_NOT_PAYABLE
payments_executed: false
insurance_provided: false
deployment_performed: false
authority_granted: false
provenance_cryptographically_verified_by_api: false

This remains a reference service rather than hosted production SaaS. No payment processor, bank, wallet, exchange, cloud deployment API, IAM mutation, repository write, or merge was executed.