Skip to content

Reproduce an interrupted authorization budget

Availability: v0.6.0 source tree. This example runs from a source checkout, not from a release archive. Run 16 concurrent proposals against a shared four-attempt budget, kill the producer, and inspect the retained charges and unknown outcomes after restart.

This example uses real Opaque authority and review stores, signatures, and an actual SIGKILL. Requester identities, reviewer signing, policy, provider state and local effect markers are synthetic. It makes no model or external API calls and requires no private enterprise source or production credentials.

Run the example

Use macOS or Linux with Git and the repository's Rust toolchain. The example landed in PR #132 and is in the v0.6.0 source tree. For an exact reproducible source checkout:

git clone https://github.com/opaque-dev/opaque.git opaque-scope-recovery
cd opaque-scope-recovery
git checkout --detach 0ff3de0290ca348a170980d8c1dfad13d84d7862

Then run:

export OPAQUE_EXAMPLE_OUT="$(mktemp -d)/scope-recovery"
cargo run --locked -p opaque --example scope-recovery -- "$OPAQUE_EXAMPLE_OUT"
cargo build --locked -p opaque --bin opaque-evidence

The output directory must be new and absolute. It is created with owner-only permissions. The example prints its checked results and checkpoint digest; keep that digest for the verification command below.

Follow one run

  1. A synthetic reviewer signs a scope allowing four attempts. The review store verifies the signature and materializes the grant.
  2. Sixteen workers simultaneously propose distinct actions under that same scope and requester identity. Exactly four reservations consume capacity; twelve fail with budget exhaustion. These workers do not implement delegated agent identities or a distributed fleet.
  3. Three dispatch claims create synthetic local effect files. One records api_accepted, one records a simulated lost acknowledgment as unknown, and one remains unfinished at the crash boundary.
  4. The producer revokes the scope. The fourth reservation cannot claim dispatch.
  5. The parent sends SIGKILL to the producer process. Reopening the ledger records both unfinished reservations/claims as unknown and preserves every charge.
  6. The example signs the before/after snapshots, verifies their continuity, verifies the retained review signature, and rejects deliberately altered export bytes.

The checked final state is four charged attempts, one API acceptance, three unknown outcomes, and a revoked scope. An unknown reservation may have caused no provider effect. It still consumes its attempt budget.

Inspect without the producer

Use the emitted checkpoint digest as RETAINED_CHECKPOINT_SHA256:

target/debug/opaque-evidence verify-scope-reviews \
  --enrollment "$OPAQUE_EXAMPLE_OUT/producer.json" \
  --checkpoint "$OPAQUE_EXAMPLE_OUT/checkpoint.json" \
  --export "$OPAQUE_EXAMPLE_OUT/scope.json" \
  --receipts "$OPAQUE_EXAMPLE_OUT/review-receipts.json" \
  --broker-public-key "$(cat "$OPAQUE_EXAMPLE_OUT/review-broker-public-key.txt")" \
  --expected-checkpoint-sha256 "$RETAINED_CHECKPOINT_SHA256"

This command needs only public keys and exported records. It needs neither the producer's private keys nor its SQLite databases. In this synthetic example the keys and reference come from the same run. A real relying party must enroll keys and retain references through its independent trust process.

before-crash.json records the pre-crash ledger frontier. Both checkpoints are signed after the reproduction; this does not simulate a custodian independently receiving the first checkpoint before the crash. The scope evidence guide covers stopped-broker export and linked checkpoint creation for an actual deployment.

What remains to qualify

The example does not exercise the broker RPC/HTTPS connector, an AX runtime, enterprise supervision, independent custody administration, or native human review. Reviewer signatures are generated by the synthetic harness; verification does not prove human presence. Local effect files do not establish provider idempotency or business completion. This is a reproducible core behavior check, not a production capacity test or independent customer evaluation.

For enrolled human review and the fixed support API contract, follow the scoped support workflow.