test(conformance): add offline-verifiable ACTION fixture bundles

[miyannishar]

What

Add self-contained, offline-verifiable fixture bundles for the delegation-linked action evidence cases under tests/fixtures/action/. Each bundle is a chain.json + dag.json + expected.json that a third party re-verifies with the shipped ca2a verify-dag --chain command against the committed blobs, plus a seeded generator (scripts/gen_action_fixtures.py) and a loader test.

Why

Every ACTION case (ACTION-001..016) is currently built in memory inside tests/conformance/test_profile_conformance.py, so cA2A's offline-verifiable-provenance claim is never exercised end to end from serialized files. These bundles close that gap, following @imran-siddique's direction on #164: they reuse the committed-blob pattern from tests/unit/test_committed_examples_verify.py (its _committed() helper is lifted into tests/committed_blobs.py so both suites share it), name the record file dag.json, and carry the verdict triple + trusted_root_issuer + optional at_time + reason code in expected.json.

Idea proposed by @Ahmedibrahim222 in #36. Closes #164.

The five bundles cover distinct offline verdicts: verified happy path (ACTION-001), parent-hash mismatch (ACTION-002, PROVENANCE_LINK_BROKEN), recorded authorization denial (ACTION-005/006), scope escalation (ACTION-010, SCOPE_ESCALATION), and an expired validity window replayed with --at-time (ACTION-012, CREDENTIAL_EXPIRED).

Security impact

None to the runtime, verifier, or any trust boundary: this is additive test fixtures, a generator, and a loader test. No src/ code changes. The bundles are honest about scope — the offline path covers provenance, the DAG, the chain↔record cross-check, and recorded denial outcomes, but not the holder-proof authorization-replay axis, which is not offline-replayable evidence (documented in tests/fixtures/action/README.md, pointing at the existing holder-proof note in tests/conformance/README.md).

Test plan

• pytest passes
• ruff check passes
• mypy passes
• Manual test performed (describe steps below if applicable)

Manual test steps:

pip install -e ".[dev]"
pytest tests/unit/ tests/conformance/ -q          # 602 passed, incl. the 5 bundle loader cases
python scripts/gen_action_fixtures.py --check       # bundles are byte-reproducible / in sync
ruff check src/ tests/ && ruff format --check src/ tests/
mypy src/ca2a_runtime/ src/ca2a_verify/
bandit -r src/ -c pyproject.toml
# and the shipped offline verifier, per bundle, e.g.:
ca2a verify-dag \
  --dag tests/fixtures/action/action-006-policy-denial/dag.json \
  --chain tests/fixtures/action/action-006-policy-denial/chain.json \
  --trusted-root-issuer <issuer-from-expected.json>

DCO sign-off

• I certify that I wrote or have the right to submit this contribution, and I agree to the Developer Certificate of Origin (https://developercertificate.org).

[carloshvp]

Reviewed exact head 3f10932. Requesting changes on two reproducible fixture-validation gaps below.

Independent isolated macOS/Python 3.13 validation: full suite 623 passed, 2 skipped; Ruff, mypy, Bandit and whitespace checks passed. I also invoked the installed ca2a CLI separately against all five committed bundles: the happy path and recorded denial succeed, while the parent-link, escalation and expiry cases fail with their documented codes. A separately tampered chain signature fails with INVALID_CREDENTIAL. The commit is signed off and merges cleanly against fetched main. These positives do not cover the missing-artifact and check-mode failures.

One scope clarification as well: ACTION-001's CLI output establishes verified/cross-checked provenance and leaf scope; it does not report an allowed action or an accepted controller outcome. Changing expected.json's controller_outcome to rejected leaves the loader passing, because that field is never asserted. Please distinguish scenario labels from observed offline verdicts in the fixture documentation; the existing controller-input limitation should remain explicit. No live holder-proof or controller/hardware execution was validated.

The hosted check rollup currently contains only the maintainer gate; the local suite is independent evidence, not a replacement for hosted repository checks.

[miyannishar]

Pushed 0b4ed20 addressing the review.

On the scope point: you're right that the loader never asserts authorization_decision/controller_outcome, so ACTION-001 changing controller_outcome to rejected would still pass. The fixtures README and the loader docstring now state explicitly that expected.json's verdict is the scenario's ACTION classification, not the offline verifier's output: the offline path observes only provenance_status (verified or a fail-closed code) and, for a denial, the recorded denial outcome. authorization_decision=allowed and every controller_outcome are not offline-observable, so they are documented as scenario labels and not asserted, and the controller-input limitation from the conformance README is kept explicit. No live holder-proof/controller/hardware execution is claimed.

The other two (fail on a missing committed blob; the advertised --check) are answered in their threads. Local suite still green (607 passed, 2 skipped); the hosted checks are the authoritative gate and await maintainer approval to run on this fork PR.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[carloshvp]

Re-reviewed exact head 0b4ed20. Both requested changes are addressed.

The loader now requires every pinned bundle's committed blobs when Git is available, and the required directory set cannot silently shrink. The check mode compares without rewriting and returns failure for stale/missing files. Documentation now clearly separates scenario authorization/controller labels from what the offline verifier observes.

Independent isolated macOS/Python 3.13 validation: full suite 623 passed, 2 skipped; Ruff and mypy passed. Eighteen additional adversarial checks passed: each of the three blob types missing from each of five bundles fails rather than skips, and clean/stale/missing check-mode cases preserve all input files while returning the appropriate status. Current hosted Python matrix checks also pass. Merge simulation is clean and both commits have DCO sign-offs.

Approving this exact head and resolving my two addressed threads. No live holder-proof, controller action, or hardware outcome is inferred from the fixture labels.