[abrichr]

This PR makes the lifecycle soak's scripted approvals count the way a person's do: each one is signed by a fixture-only approver key that belongs to the run. It follows OpenAdaptAI/OpenAdapt#1513, which has merged.

Why

Since #1486, a person's approval counts only when a key on the signed approver roster signs it. The harness still wrote unsigned answers that claimed a cloud_aal2 sign-in. In the final soak (#1513, production-2026-10-25-final), the one approval request, on item 26 after the relabel repair, was refused (auth_method_unverified). The gate stopped before saving (gate_error), and the item was entered by hand.

What changes

• Per-run approver (benchmark/lifecycle_proof/approver.py):
  • a throwaway Ed25519 key, generated under the run directory (approver-keys/) with a random passphrase kept beside it, owner-only;
  • a one-entry roster that the key roots;
  • a deployment.yaml that pins approvers.root_public_key and the key directory. It is read only after its bytes match the recorded SHA-256 (pin_deployment_bytes, the same check as --config-sha256). The run gate uses the same config.
• Pinning: every approval store the proof or the soak creates takes its pin only from that config (config_only=True), never from OPENADAPT_APPROVER_ROOT.
• Signing: ScriptedPerson (the proof) and OperatorPerson (the soak) sign every answer with that key. If an answer is refused, the ledger records person_answer_refused with its code before the gate stops. Before, the item just ended as a bare gate_error.
• Ledger: a fixture_approver row with the public root and the config digest only. The key and passphrase never leave the run directory, which is never committed.

No real person's key is used, and no product code changes.

Tests

tests/test_lifecycle_fixture_approver.py:

• the old unsigned scripted answer is refused (auth_method_unverified), and so is an unsigned answer with no sign-in claim;
• the fixture approver's signed answer passes answer_refusal against the config-pinned store, and the store reports it approved;
• ScriptedPerson signs; with no approver, it logs person_answer_refused and the request stays waiting;
• an edited deployment.yaml is refused;
• reopening the run gets the same root and digest. The ledger fields carry no key material, and the passphrase file is owner-only.

Locally: those tests, test_lifecycle_benchmark.py and test_human_approval_verified.py (31 passed); ruff, ruff format and mypy are clean.

Not covered

• No real-app run yet. No soak has run with this change, and these tests don't drive OpenEMR. The next soak's admission and first approval will exercise it.
• Self-repair approvals. SelfRepair opens its own repair-approval store without a pin (openadapt_flow/repair/self_repair.py). A self-repair that needs a person's approval would still be refused, failing closed. The final soak never reached that path. Fixing it means SelfRepair taking a pinned store, which is product code and out of scope here.

🤖 Generated with Claude Code