feat(evidence): report each definition's validitySeconds in explain

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

crates/registry-evidencectl/src/normalized.rs

@@ -203,7 +203,7 @@ pub(crate) fn inspect(root: &Path, target: Option<&Path>, command: &str) -> Resu
         .context("canonicalizing effective grants")?;
         authority = json!({"target":target.id,"effectiveGrantDigest":registry_platform_config::sha256_uri(&effective),"authorityRevision":format!("sha256:{}", hex::encode(domain_separated_sha256(b"registry.evidence.target-authority/v1\0", &canonical))),"digest":registry_platform_config::sha256_uri(&canonical),"accessProfiles":document["accessProfiles"],"effectiveCeilings":project.assertion_definitions.iter().map(|(id,d)| (id.as_str(),json!({"grantCeiling":d.grant_ceiling,"purpose":d.purpose,"subjects":d.subjects,"representations":d.representations,"subjectBinding":d.subject_binding}))).collect::<BTreeMap<_,_>>()});
     }
-    let definitions = project.assertion_definitions.iter().map(|(id, definition)| json!({"id":id,"label":definition.label,"description":definition.description,"question":definition.question,"requirement":definition.semantics.requirement,"acquisition":definition.acquisition,"derive":definition.derive,"outputs":definition.outputs,"grantCeiling":definition.grant_ceiling,"representations":definition.representations,"subjectBinding":definition.subject_binding})).collect::<Vec<_>>();
+    let definitions = project.assertion_definitions.iter().map(|(id, definition)| json!({"id":id,"label":definition.label,"description":definition.description,"question":definition.question,"requirement":definition.semantics.requirement,"acquisition":definition.acquisition,"derive":definition.derive,"outputs":definition.outputs,"grantCeiling":definition.grant_ceiling,"representations":definition.representations,"subjectBinding":definition.subject_binding,"validitySeconds":definition.validity_seconds})).collect::<Vec<_>>();
     Ok(Checked {
         report: crate::report::success(
             command,

crates/registry-evidencectl/tests/explain_sources.rs

@@ -76,3 +76,39 @@ fn malformed_project_is_refused_without_printing_private_source_values() {
     assert!(!printed.contains(CANARY), "{printed}");
     assert!(!printed.contains("Source coverage-record"), "{printed}");
 }
+
+#[test]
+fn explain_json_reports_each_definitions_validity_seconds() {
+    let temporary = tempfile::tempdir().expect("temporary project");
+    copy_tree(&project("standalone"), temporary.path());
+    let manifest = temporary.path().join("evidence.yaml");
+    let authored = fs::read_to_string(&manifest).expect("read project manifest");
+    let changed = authored.replacen("validitySeconds: 300", "validitySeconds: 900", 1);
+    assert_ne!(changed, authored, "fixture mutation must apply");
+    fs::write(&manifest, changed).expect("write project manifest");
+
+    let output = Command::new(env!("CARGO_BIN_EXE_evidencectl"))
+        .args(["--format", "json", "explain"])
+        .arg(temporary.path())
+        .output()
+        .expect("run evidencectl explain");
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    assert!(output.status.success(), "{stdout}{stderr}");
+    let report: serde_json::Value = serde_json::from_str(&stdout).expect("explain JSON report");
+    let definitions = report["assertionDefinitions"]
+        .as_array()
+        .unwrap_or_else(|| panic!("assertionDefinitions array in {stdout}"));
+    assert!(definitions.len() >= 2, "{stdout}");
+    let validities: Vec<_> = definitions
+        .iter()
+        .map(|definition| definition["validitySeconds"].as_u64())
+        .collect();
+    assert_eq!(validities[0], Some(900), "{validities:?}");
+    assert!(
+        validities[1..]
+            .iter()
+            .all(|validity| *validity == Some(300)),
+        "{validities:?}"
+    );
+}

products/evidence/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+- `evidencectl explain` JSON reports each assertion definition's
+  `validitySeconds` beside its `representations` and `subjectBinding`. The
+  field is additive; the report `apiVersion` is unchanged.
 - A normalized target document accepts an optional
   `signing.maximumAssertionValiditySeconds` (1 to 31,536,000, default 300) so a
   definition with a longer `validitySeconds`, such as a seven-day holder-bound

products/evidence/README.md

@@ -102,7 +102,9 @@ bounded source/extraction/derivation path using supplied synthetic responses.
 `explain` shows each definition's ordered source operations, preparation and
 extraction Functions, private fact names, derivation and output names, with
 connection identifiers and source limits. Sources not referenced by a definition
-are listed separately. The human report contains no source values or credentials.
+are listed separately. The JSON report's `assertionDefinitions` entries also
+carry each definition's `validitySeconds`, so a reader can compare credential
+lifetimes without compiling. The human report contains no source values or credentials.
 
 `evidencectl check --file <file>` checks one tooling file offline, including a
 client profile, local access client registration, reviewed contracts, development state or source-import document.