gargoyle-receipts 0.4.0.dev0__py3-none-any.whl

gargoyle/approval.py

@@ -0,0 +1,260 @@
+"""Approval grants: a human's signed release of a held, high-impact call.
+
+When a Decision has requires_approval, the receipt is held until a human
+approver, using their own key on their own device, signs a grant for exactly
+that decision. A grant reuses the receipt's machinery: Ed25519 signatures
+over canonical_json. The approver's key is a different identity from the
+issuer's key.
+
+verify_grant() is pure: it checks provenance, binding to the held decision
+and request, separation of duties, and freshness. It does not consume the
+grant. Single use is stateful and belongs to whoever enforces the grant:
+the consumer (gargoyle.consumer) claims grant_id exactly once in its replay
+cache when it honors a flagged receipt, and an issuer that holds flagged
+receipts until the grant arrives consumes approval_request_id from its
+pending set (gargoyle.pending_store). verify_grant only guarantees that
+grant_id is present, so that claim cannot be skipped.
+"""
+
+from datetime import datetime, timedelta
+from typing import Any, Dict, List, Optional
+
+from gargoyle.envelope import approval_terms, canonical_json
+from gargoyle.verifier import not_after_valid
+
+
+GRANT_VERSION = "1.0"
+
+# Keys excluded from the approver-signature region. The signature covers
+# everything else - including grant_id, decision_sha256, approval_request_id,
+# not_after, and approver_key_id - so all of them are tamper-proof.
+_SIGNATURE_EXCLUDED_KEYS = ("approver_signature",)
+
+# Refusal codes.
+REF_APPROVAL_MALFORMED = "REF_APPROVAL_MALFORMED"
+REF_APPROVAL_MISSING_GRANT_ID = "REF_APPROVAL_MISSING_GRANT_ID"
+REF_APPROVAL_SIGNATURE_INVALID = "REF_APPROVAL_SIGNATURE_INVALID"
+REF_APPROVAL_KEY_UNKNOWN = "REF_APPROVAL_KEY_UNKNOWN"
+REF_APPROVAL_SOD = "REF_APPROVAL_SOD"
+REF_APPROVAL_BINDING_MISMATCH = "REF_APPROVAL_BINDING_MISMATCH"
+REF_APPROVAL_REQUEST_MISMATCH = "REF_APPROVAL_REQUEST_MISMATCH"
+REF_APPROVAL_EXPIRED = "REF_APPROVAL_EXPIRED"
+# Emitted by the caller that consumes grants, not by verify_grant: grant_id
+# already claimed, or approval_request_id not pending or not bound to this
+# decision.
+REF_APPROVAL_REPLAY = "REF_APPROVAL_REPLAY"
+REF_APPROVAL_REQUEST_UNKNOWN = "REF_APPROVAL_REQUEST_UNKNOWN"
+
+# verify_grants: the set does not meet the receipt's terms.
+REF_APPROVAL_INSUFFICIENT = "REF_APPROVAL_INSUFFICIENT"          # fewer distinct approvers than required
+REF_APPROVAL_DUPLICATE_APPROVER = "REF_APPROVAL_DUPLICATE_APPROVER"  # the same key signed twice
+REF_APPROVAL_APPROVER_NOT_ELIGIBLE = "REF_APPROVAL_APPROVER_NOT_ELIGIBLE"  # a key the receipt does not name
+
+ACCEPT_GRANT_VALID = "GRANT_VALID"
+ACCEPT_GRANTS_SUFFICIENT = "GRANTS_SUFFICIENT"
+
+# Top-level keys a usable grant must carry before verify_grant can run.
+_REQUIRED_GRANT_KEYS = (
+    "grant_version",
+    "decision_sha256",
+    "approval_request_id",
+    "grant_id",
+    "not_after",
+    "approver_key_id",
+    "approver_signature",
+)
+
+
+def build_grant(
+    *,
+    decision_sha256: str,
+    approval_request_id: str,
+    grant_id: str,
+    not_after: datetime,
+) -> Dict[str, Any]:
+    """Construct an unsigned approval grant.
+
+    - decision_sha256: the exact decision approved. It covers the target,
+      the call's fields and the policy pin, so approving action A cannot
+      authorize a different action, argument set or target.
+    - approval_request_id: the id issued with the hold. decision_sha256 is
+      the same for every issuance of a decision, so the specific request is
+      identified here.
+    - grant_id: mandatory and unique; the key claimed exactly once for
+      single use.
+    - not_after: timezone-aware expiry; a naive datetime raises ValueError.
+    """
+    if not isinstance(grant_id, str) or not grant_id:
+        raise ValueError("grant_id is mandatory and must be a non-empty string")
+    if not_after.tzinfo is None:
+        raise ValueError("not_after must be timezone-aware (UTC)")
+    return {
+        "grant_version": GRANT_VERSION,
+        "decision_sha256": decision_sha256,
+        "approval_request_id": approval_request_id,
+        "grant_id": grant_id,
+        "not_after": not_after.isoformat(),
+    }
+
+
+def sign_grant(grant: Dict[str, Any], signing_key: Any, key_id: str) -> Dict[str, Any]:
+    """Return a copy of `grant` signed with the approver's key.
+
+    `signing_key` is any object with .sign(bytes) -> bytes. The signature
+    covers everything except approver_signature, including approver_key_id,
+    so the claimed signer is bound too. The input is not modified.
+    """
+    signed = dict(grant)
+    signed["approver_key_id"] = key_id
+    region = {k: v for k, v in signed.items() if k not in _SIGNATURE_EXCLUDED_KEYS}
+    signature = signing_key.sign(canonical_json(region).encode("utf-8"))
+    signed["approver_signature"] = signature.hex()
+    return signed
+
+
+def _reject(reason: str) -> Dict[str, Any]:
+    return {"accepted": False, "reason": reason}
+
+
+def _accept(reason: str = ACCEPT_GRANT_VALID) -> Dict[str, Any]:
+    return {"accepted": True, "reason": reason}
+
+
+def verify_grant(
+    grant: Any,
+    *,
+    expected_decision_sha256: str,
+    expected_approval_request_id: str,
+    approver_public_keys: Dict[str, Any],
+    gate_key_id: str,
+    now: Optional[datetime] = None,
+    clock_skew: timedelta = timedelta(0),
+) -> Dict[str, Any]:
+    """Is `grant` a valid human release of the held decision?
+
+    Returns {"accepted", "reason"}. First failure wins:
+      1. structure                          -> REF_APPROVAL_MALFORMED
+      2. grant_id present                   -> REF_APPROVAL_MISSING_GRANT_ID
+      3. approver_key_id != gate_key_id     -> REF_APPROVAL_SOD
+      4. approver key known                 -> REF_APPROVAL_KEY_UNKNOWN
+      5. signature verifies                 -> REF_APPROVAL_SIGNATURE_INVALID
+      6. decision_sha256 matches            -> REF_APPROVAL_BINDING_MISMATCH
+      7. approval_request_id matches        -> REF_APPROVAL_REQUEST_MISMATCH
+      8. not_after present and not passed   -> REF_APPROVAL_EXPIRED
+
+    `gate_key_id` is the issuer's key id. Separation of duties is checked
+    before the signature, so a grant the issuer signed with its own key is
+    refused even when well-signed. That id check is only a backstop: the
+    real guarantee is that the issuer cannot hold an approver's private key,
+    and that `approver_public_keys` comes from a trust record the issuer's
+    operator does not control.
+
+    Single use is not enforced here; see the module docstring.
+    """
+    # 1. structural presence
+    if not isinstance(grant, dict):
+        return _reject(REF_APPROVAL_MALFORMED)
+    for k in _REQUIRED_GRANT_KEYS:
+        if k not in grant:
+            return _reject(REF_APPROVAL_MALFORMED)
+
+    # 2. mandatory grant_id
+    grant_id = grant.get("grant_id")
+    if not isinstance(grant_id, str) or not grant_id:
+        return _reject(REF_APPROVAL_MISSING_GRANT_ID)
+
+    key_id = grant.get("approver_key_id")
+    signature_hex = grant.get("approver_signature")
+    if not isinstance(key_id, str) or not isinstance(signature_hex, str):
+        return _reject(REF_APPROVAL_SIGNATURE_INVALID)
+
+    # 3. separation of duties, before the signature: an issuer-signed
+    #    approval is not oversight even if well-formed.
+    if key_id == gate_key_id:
+        return _reject(REF_APPROVAL_SOD)
+
+    # 4. known approver key
+    public_key = approver_public_keys.get(key_id)
+    if public_key is None:
+        return _reject(REF_APPROVAL_KEY_UNKNOWN)
+
+    # 5. signature verifies (duck-typed; covers everything but the signature)
+    region = {k: v for k, v in grant.items() if k not in _SIGNATURE_EXCLUDED_KEYS}
+    message = canonical_json(region).encode("utf-8")
+    try:
+        public_key.verify(bytes.fromhex(signature_hex), message)
+    except Exception:
+        return _reject(REF_APPROVAL_SIGNATURE_INVALID)
+
+    # 6. action binding
+    if grant.get("decision_sha256") != expected_decision_sha256:
+        return _reject(REF_APPROVAL_BINDING_MISMATCH)
+
+    # 7. request binding
+    if grant.get("approval_request_id") != expected_approval_request_id:
+        return _reject(REF_APPROVAL_REQUEST_MISMATCH)
+
+    # 8. freshness: not_after is mandatory, then the verifier's shared check.
+    not_after_raw = grant.get("not_after")
+    if not_after_raw is None:
+        return _reject(REF_APPROVAL_EXPIRED)
+    if not not_after_valid(not_after_raw, now=now, clock_skew=clock_skew):
+        return _reject(REF_APPROVAL_EXPIRED)
+
+    # 9. accept
+    return _accept()
+
+
+def as_grant_list(grant: Any) -> List[Any]:
+    """One grant or a list of them, as a list; None is the empty list."""
+    if grant is None:
+        return []
+    if isinstance(grant, list):
+        return grant
+    return [grant]
+
+
+def verify_grants(
+    grants: Any,
+    *,
+    envelope: Dict[str, Any],
+    approver_public_keys: Dict[str, Any],
+    now: Optional[datetime] = None,
+    clock_skew: timedelta = timedelta(0),
+) -> Dict[str, Any]:
+    """Do these grants release the flagged `envelope` under its own terms?
+
+    The receipt's `approval` member (default: one grant from any trusted
+    approver) says how many distinct approvers are required and, when it
+    lists `approvers`, which key ids count. Each grant is checked with
+    verify_grant against the receipt's decision_sha256, approval_request_id
+    and issuer_key_id; the first failing grant's reason is the answer. Then:
+    a key named by no grant more than once (REF_APPROVAL_DUPLICATE_APPROVER),
+    every key eligible (REF_APPROVAL_APPROVER_NOT_ELIGIBLE), and at least
+    `required` of them (REF_APPROVAL_INSUFFICIENT). An empty list is
+    REF_APPROVAL_INSUFFICIENT. Returns {"accepted", "reason", "grants"}
+    with the grants that were counted, so the caller can claim each one."""
+    terms = approval_terms(envelope)
+    items = as_grant_list(grants)
+    seen: List[str] = []
+    for grant in items:
+        g = verify_grant(
+            grant,
+            expected_decision_sha256=envelope["decision_sha256"],
+            expected_approval_request_id=envelope["approval_request_id"],
+            approver_public_keys=approver_public_keys,
+            gate_key_id=envelope.get("issuer_key_id"),
+            now=now,
+            clock_skew=clock_skew,
+        )
+        if not g["accepted"]:
+            return {"accepted": False, "reason": g["reason"], "grants": []}
+        key_id = grant["approver_key_id"]
+        if key_id in seen:
+            return {"accepted": False, "reason": REF_APPROVAL_DUPLICATE_APPROVER, "grants": []}
+        if terms["approvers"] is not None and key_id not in terms["approvers"]:
+            return {"accepted": False, "reason": REF_APPROVAL_APPROVER_NOT_ELIGIBLE, "grants": []}
+        seen.append(key_id)
+    if len(seen) < terms["required"]:
+        return {"accepted": False, "reason": REF_APPROVAL_INSUFFICIENT, "grants": []}
+    return {"accepted": True, "reason": ACCEPT_GRANTS_SUFFICIENT, "grants": list(items)}

gargoyle/approver_cli.py

@@ -0,0 +1,228 @@
+"""Approver CLI: the human side of an approval hold.
+
+A grant only separates duties if a human produces it out of band, with a key
+the issuing service cannot reach. This is that tool, kept minimal: it shows
+the human exactly which held decision they are releasing and, on
+confirmation, emits a signed grant.
+
+Run it as a separate process that holds the approver private key; the
+issuing service holds only the approver public key. make_grant() is the
+testable core and main() the thin CLI around it. Grants are built and signed
+by gargoyle.approval, so what this emits is exactly what verify_grant
+accepts.
+
+Two ways in. From a file or stdin: the flagged receipt (or a bare hold)
+is shown and, on confirmation, the grant is printed. Against an issuing
+service (--issuer URL, with GARGOYLE_APPROVER_TOKEN for the Bearer): every
+pending flagged receipt is fetched, shown one by one, and each confirmed
+grant is posted back, so the middleware waiting on it proceeds.
+"""
+
+import argparse
+import json
+import sys
+import uuid
+from datetime import datetime, timedelta, timezone
+from typing import Any, Dict, Optional
+
+from gargoyle.approval import build_grant, sign_grant
+
+
+def make_grant(
+    *,
+    approver_private_hex: str,
+    approver_key_id: str,
+    decision_sha256: str,
+    approval_request_id: str,
+    not_after_seconds: int = 300,
+    grant_id: Optional[str] = None,
+    now: Optional[datetime] = None,
+) -> Dict[str, Any]:
+    """Build and sign an approval grant for a held decision. The private key
+    is raw Ed25519 bytes in hex, used only here and never returned or logged.
+    grant_id defaults to a fresh uuid; it is the grant's single-use key."""
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+    signing_key = Ed25519PrivateKey.from_private_bytes(bytes.fromhex(approver_private_hex))
+    base = now if now is not None else datetime.now(timezone.utc)
+    grant = build_grant(
+        decision_sha256=decision_sha256,
+        approval_request_id=approval_request_id,
+        grant_id=grant_id or uuid.uuid4().hex,
+        not_after=base + timedelta(seconds=not_after_seconds),
+    )
+    return sign_grant(grant, signing_key, approver_key_id)
+
+
+def main(argv=None) -> int:
+    """Read the flagged receipt itself, or a bare hold (JSON with
+    approval_request_id and decision_sha256), from --pending or stdin, show
+    the human what they are releasing, and on confirmation print the signed
+    grant JSON to stdout. A receipt is preferred: it lets the human see the
+    tool, the argument hash, the principal and the target they are
+    releasing, all of which are inside the issuer's signature.
+
+    The approver key comes from the environment (GARGOYLE_APPROVER_KEY_HEX +
+    GARGOYLE_APPROVER_KEY_ID) so it is never passed on the command line. --yes
+    skips the interactive confirm (for scripted approver workflows)."""
+    import os
+
+    parser = argparse.ArgumentParser(
+        prog="approver_cli",
+        description="Emit a signed approval grant for a held decision.",
+    )
+    parser.add_argument("--pending", help="file with the flagged receipt or hold JSON; default stdin")
+    parser.add_argument("--issuer", help="issuing service URL: fetch its pending holds and post grants back")
+    parser.add_argument("--watch", type=float, metavar="SECONDS",
+                        help="with --issuer: keep polling for new holds every SECONDS and prompt for each")
+    parser.add_argument("--ttl", type=int, default=300, help="grant lifetime (s)")
+    parser.add_argument("--yes", action="store_true", help="skip the confirm prompt")
+    args = parser.parse_args(argv)
+
+    key_hex = os.environ.get("GARGOYLE_APPROVER_KEY_HEX")
+    key_id = os.environ.get("GARGOYLE_APPROVER_KEY_ID")
+    if not key_hex or not key_id:
+        print("GARGOYLE_APPROVER_KEY_HEX and GARGOYLE_APPROVER_KEY_ID must be set",
+              file=sys.stderr)
+        return 2
+
+    if args.issuer:
+        token = os.environ.get("GARGOYLE_APPROVER_TOKEN")
+        if not token:
+            print("GARGOYLE_APPROVER_TOKEN must be set to talk to the issuer", file=sys.stderr)
+            return 2
+        if not args.watch:
+            return approve_at_issuer(args.issuer, token, key_hex=key_hex, key_id=key_id,
+                                     ttl=args.ttl, yes=args.yes)
+        import time
+        print("watching %s for holds (Ctrl-C to stop)" % args.issuer, file=sys.stderr)
+        try:
+            while True:
+                approve_at_issuer(args.issuer, token, key_hex=key_hex, key_id=key_id, ttl=args.ttl, yes=args.yes)
+                time.sleep(args.watch)
+        except KeyboardInterrupt:
+            return 0
+
+    raw = open(args.pending).read() if args.pending else sys.stdin.read()
+    pending = json.loads(raw)
+    decision_sha256 = pending["decision_sha256"]
+    approval_request_id = pending["approval_request_id"]
+
+    describe(pending)
+    if not args.yes and not confirm():
+        print("aborted (no grant emitted)", file=sys.stderr)
+        return 1
+
+    grant = make_grant(
+        approver_private_hex=key_hex,
+        approver_key_id=key_id,
+        decision_sha256=decision_sha256,
+        approval_request_id=approval_request_id,
+        not_after_seconds=args.ttl,
+    )
+    print(json.dumps(grant))
+    return 0
+
+
+def describe(pending: Dict[str, Any], args: Any = None) -> None:
+    """Show the human exactly what they are releasing: everything inside the
+    issuer's signature that identifies the call, and the arguments
+    themselves when the issuer supplied them, shown only if they hash to
+    the receipt's args_sha256 (otherwise the mismatch is shown instead)."""
+    lines = ["About to APPROVE a held high-impact decision:",
+             "  decision_sha256     : %s" % pending.get("decision_sha256"),
+             "  approval_request_id : %s" % pending.get("approval_request_id")]
+    if isinstance(pending.get("approval"), dict):
+        lines.append("  approvals needed    : %s%s" % (pending["approval"].get("required"),
+                     (" from " + ", ".join(pending["approval"]["approvers"])) if pending["approval"].get("approvers") else ""))
+    rc = pending.get("request_context")
+    if isinstance(rc, dict):
+        lines += ["  tool                : %s" % rc.get("tool"),
+                  "  args_sha256         : %s" % rc.get("args_sha256"),
+                  "  principal           : %s" % rc.get("principal")]
+        if rc.get("on_behalf_of"):
+            lines.append("  on_behalf_of        : %s" % rc.get("on_behalf_of"))
+        lines += ["  target_url          : %s" % pending.get("target_url"),
+                  "  policy              : %s" % pending.get("policy"),
+                  "  not_after           : %s" % pending.get("not_after")]
+        if args is not None:
+            from gargoyle.envelope import args_sha256
+            try:
+                bound = args_sha256(args) == rc.get("args_sha256")
+            except (TypeError, ValueError):
+                bound = False
+            if bound:
+                rendered = json.dumps(args, indent=2, sort_keys=True)
+                lines += ["  arguments (bound by args_sha256):"] + ["    " + l for l in rendered.splitlines()]
+            else:
+                lines.append("  arguments           : DO NOT MATCH args_sha256; refuse this hold")
+    sys.stderr.write("\n".join(lines) + "\n")
+
+
+def confirm() -> bool:
+    sys.stderr.write("Type 'approve' to sign a grant: ")
+    sys.stderr.flush()
+    return sys.stdin.readline().strip() == "approve"
+
+
+def approve_at_issuer(issuer_url: str, token: str, *, key_hex: str, key_id: str, ttl: int = 300,
+                      yes: bool = False, http: Any = None) -> int:
+    """Fetch the issuer's pending holds, confirm each, sign and post the
+    grant. Exit 0 when every grant posted was accepted, 1 when one was
+    declined or refused, 2 when the issuer could not be reached."""
+    import requests
+
+    http = http if http is not None else requests.Session()
+    headers = {"Authorization": "Bearer " + token}
+    base = issuer_url.rstrip("/")
+    try:
+        r = http.get(base + "/pending", headers=headers, timeout=10)
+        if r.status_code != 200:
+            print("issuer refused: %s" % r.text[:200], file=sys.stderr)
+            return 2
+        pending = r.json().get("pending", [])
+    except Exception as exc:
+        print("issuer unreachable: %s" % exc, file=sys.stderr)
+        return 2
+    if not pending:
+        return 0
+    status = 0
+    for item in pending:
+        env, args_ = (item["envelope"], item.get("args")) if isinstance(item, dict) and "envelope" in item else (item, None)
+        describe(env, args_)
+        if args_ is not None:
+            from gargoyle.envelope import args_sha256
+            try:
+                if args_sha256(args_) != env["request_context"]["args_sha256"]:
+                    print("refusing %s: arguments do not match the receipt" % env["approval_request_id"], file=sys.stderr)
+                    status = 1
+                    continue
+            except (TypeError, ValueError, KeyError):
+                print("refusing %s: arguments unreadable" % env.get("approval_request_id"), file=sys.stderr)
+                status = 1
+                continue
+        if not yes and not confirm():
+            print("skipped", file=sys.stderr)
+            status = 1
+            continue
+        grant = make_grant(approver_private_hex=key_hex, approver_key_id=key_id,
+                           decision_sha256=env["decision_sha256"],
+                           approval_request_id=env["approval_request_id"], not_after_seconds=ttl)
+        try:
+            r = http.post(base + "/grants", json=grant, headers=headers, timeout=10)
+            body = r.json() if r.status_code == 200 else {"accepted": False, "reason": r.text[:200]}
+        except Exception as exc:
+            body = {"accepted": False, "reason": str(exc)}
+        if body.get("accepted"):
+            more = (body.get("required") or 1) - (body.get("collected") or 1)
+            print("granted %s%s" % (env["approval_request_id"],
+                                    "" if more <= 0 else " (%d more approver%s needed)" % (more, "" if more == 1 else "s")),
+                  file=sys.stderr)
+        else:
+            print("refused %s: %s" % (env["approval_request_id"], body.get("reason")), file=sys.stderr)
+            status = 1
+    return status
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

gargoyle/approver_trust.py

@@ -0,0 +1,95 @@
+"""Which keys may authorize an approval: signed role, not a key-id compare.
+
+verify_grant() refuses a grant signed under the issuer's own key id, but a
+key-id compare alone cannot stop an issuer-controlled key published under a
+different id. This module builds the approver trust map from the signed key
+record instead (key_record_source / root_record_source), where every key
+entry carries a `role` covered by the publisher's signature:
+
+  - Only a key whose signed role is exactly "approver" may authorize an
+    approval. An issuer key, or a key with any other or no role, is excluded
+    from the map, so a well-signed "approval" minted by the issuer is never
+    honored even under a different key id.
+  - The key must not be revoked and must be inside its signed validity
+    window, widened symmetrically by clock_skew, the same rule
+    verify_envelope applies to issuer keys.
+  - key_id != gate_key_id is kept as a cheap extra check, not the guarantee.
+
+Pure: it consumes a trust view already validated by
+key_record_source.load_key_record_from_bytes (publisher signature,
+freshness, root status) and returns the {key_id: public_key} map
+verify_grant expects. It never trusts a role it did not receive from that
+validated view.
+
+Limits. This controls where approver trust comes from. It does not prove the
+issuing process cannot reach the approver's private key; that is a
+deployment property. A key record that publishes no roles yields no approver
+keys, so a deployment using signed approver trust must publish an explicit
+approver role.
+"""
+
+from datetime import datetime, timedelta, timezone
+from typing import Any, Dict, Optional
+
+# Role tokens from the signed key-record entry's `role` field. APPROVER_ROLE is
+# the only value that makes a key eligible to authorize an approval. ISSUER_ROLE
+# is named for symmetry; like every other value it is not an approver.
+APPROVER_ROLE = "approver"
+ISSUER_ROLE = "issuer"
+
+
+def resolve_approver_keys(
+    key_record_trust_view: Any,
+    *,
+    gate_key_id: Optional[str] = None,
+    now: Optional[datetime] = None,
+    clock_skew: timedelta = timedelta(0),
+) -> Dict[str, Any]:
+    """
+    The {key_id: public_key} map of keys allowed to authorize an approval
+    grant, from a validated key-record trust view ({key_id: {public_key, role,
+    revoked, not_before, not_after}}). Pass the result to verify_grant() as
+    `approver_public_keys`.
+
+    A key is included only if all of these hold; anything else is left out,
+    never raised:
+      - its signed role is exactly "approver";
+      - it is not revoked;
+      - not_before - clock_skew <= now < not_after + clock_skew;
+      - key_id != gate_key_id (the issuer's key id).
+
+    `now` defaults to the current UTC time. A negative clock_skew would narrow
+    the window, so it raises ValueError, as key_record_source does. A non-dict
+    view, a non-dict entry, or missing key material contributes nothing.
+    """
+    if clock_skew < timedelta(0):
+        raise ValueError("clock_skew must be non-negative")
+    if not isinstance(key_record_trust_view, dict):
+        return {}
+    if now is None:
+        now = datetime.now(timezone.utc)
+
+    resolved: Dict[str, Any] = {}
+    for key_id, info in key_record_trust_view.items():
+        if not isinstance(key_id, str) or not isinstance(info, dict):
+            continue
+        # Cheap extra check; the role check below is the guarantee.
+        if gate_key_id is not None and key_id == gate_key_id:
+            continue
+        # Only a signed "approver" role is eligible. Issuer and role-less keys are
+        # excluded, which a key-id compare alone cannot do.
+        if info.get("role") != APPROVER_ROLE:
+            continue
+        if info.get("revoked") is True:
+            continue
+        public_key = info.get("public_key")
+        if public_key is None:
+            continue
+        not_before = info.get("not_before")
+        not_after = info.get("not_after")
+        if not isinstance(not_before, datetime) or not isinstance(not_after, datetime):
+            continue
+        if not (not_before - clock_skew <= now < not_after + clock_skew):
+            continue
+        resolved[key_id] = public_key
+    return resolved