Harden registryctl governed live evidence validation

crates/registry-notary-core/src/model.rs

@@ -1378,6 +1378,7 @@ pub struct EvidenceFormat {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct ClaimResultView {
     pub evaluation_id: String,
     pub claim_id: String,
@@ -1398,6 +1399,7 @@ pub struct ClaimResultView {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct TargetRefView {
     #[serde(rename = "type", default, skip_serializing_if = "String::is_empty")]
     pub entity_type: String,
@@ -1409,6 +1411,7 @@ pub struct TargetRefView {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct EvidenceEntityRef {
     #[serde(rename = "type")]
     pub entity_type: String,
@@ -1435,6 +1438,7 @@ pub const PROVENANCE_GENERATED_BY_CLAIM_EVALUATION: &str = "claim_evaluation";
 /// Requester-side identity (client, actor, subject) is deliberately absent;
 /// those live in restricted audit, never on the public wire.
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct ClaimProvenance {
     pub schema_version: String,
     pub generated_by: ProvenanceGeneratedBy,
@@ -1481,6 +1485,7 @@ impl ClaimProvenance {
 /// `policy_id` here names the *evaluation* policy under which the result was
 /// produced.
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct ProvenanceGeneratedBy {
     #[serde(rename = "type")]
     pub entry_type: String,
@@ -1512,6 +1517,7 @@ pub struct ProvenanceGeneratedBy {
 /// The consumed side of a claim provenance record: how many Relay consultations
 /// contributed to the claim.
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct ProvenanceUsed {
     pub relay_consultation_count: usize,
 }

crates/registry-notary-server/src/openapi.rs

@@ -2155,6 +2155,11 @@ fn claim_result_view_schema() -> Value {
             },
             "satisfied": { "type": ["boolean", "null"] },
             "disclosure": { "type": "string" },
+            "redacted_fields": {
+                "type": "array",
+                "items": { "type": "string" },
+                "description": "Claim or top-level field names redacted from the public result. Omitted when no redaction was applied."
+            },
             "format": { "type": "string" },
             "issued_at": { "type": "string", "format": "date-time" },
             "expires_at": { "type": ["string", "null"], "format": "date-time" },
@@ -4049,6 +4054,15 @@ mod tests {
             doc["components"]["schemas"]["BatchClaimResultView"]["properties"]["value"]["type"],
             json!(["object", "array", "string", "number", "integer", "boolean", "null"])
         );
+        assert_eq!(
+            doc["components"]["schemas"]["ClaimResultView"]["properties"]["redacted_fields"]
+                ["items"]["type"],
+            json!("string")
+        );
+        assert!(!doc["components"]["schemas"]["ClaimResultView"]["required"]
+            .as_array()
+            .expect("required claim-result fields are an array")
+            .contains(&json!("redacted_fields")));
 
         let evaluate_request = &doc["components"]["schemas"]["EvaluateRequest"]["properties"];
         assert!(evaluate_request.get("subject").is_none());

crates/registryctl/src/project_authoring.rs

@@ -21,6 +21,7 @@ use registry_relay::source_plan::{
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Map, Value};
 use sha2::{Digest, Sha256};
+use time::{format_description::well_known::Rfc3339, OffsetDateTime};
 
 static PROJECT_STARTERS: include_dir::Dir<'_> =
     include_dir::include_dir!("$CARGO_MANIFEST_DIR/assets/project-starters");