Policy and broker example

Canonical policy bundle

The implementation keeps the editable research policy in implementation/policy/cali-policy.json. Its annotated rules cover profile identity, lifecycle state, tenant and intent matching, permitted algorithm profiles, provider classes and failure behavior. Example-specific policies remain beside their demonstrations:

• implementation/examples/apache-pqc/ demonstrates a fail-closed certificate selection transition;
• implementation/examples/apache-login-pqc/ demonstrates a local RSA-to-ML-DSA-65 Apache reload and handshake.

Each document defines a profile ID, version, status, effective time, hostname rule and ordered certificate choices. The service receives the file through CALI_POLICY_FILE.

Broker evaluation

For SelectCertificate the broker performs this sequence:

1. validate the request envelope and intent
2. compare expectedPolicy with the loaded profile and version
3. find exactly one rule for the requested hostname
4. compare approved choices with authenticated, scoped runtime capability and current key or certificate state
5. return one logical certificate reference and decision evidence

CALI_CERTIFICATE_PROFILES reports runtime capability. It does not grant permission. Policy defines what is approved. The broker requires approval and capability to match.

Live request

{
  "apiVersion": "2.0.0",
  "requestId": "apache-certificate-selection",
  "operation": "SelectCertificate",
  "intent": "apache-tls",
  "expectedPolicy": {
    "profileId": "apache-pqc-migration",
    "profileVersion": "transition-1"
  },
  "minimumConstraints": {
    "profile": "apache-pqc-migration"
  },
  "input": {
    "hostname": "localhost"
  }
}

With only ECDSA capability declared, transition policy returns certificate:apache:localhost:ecdsa. The deployment helper maps that opaque reference to local certificate files then writes an Apache include fragment atomically.

Fail closed example

When strict policy requires ML DSA but Apache declares only ECDSA, the broker returns:

{
  "error": {
    "category": "CAPABILITY_MISMATCH",
    "message": "no policy approved certificate profile is available",
    "retryable": false
  }
}

The helper does not rewrite the include fragment. Apache keeps the last approved certificate. A failed migration decision cannot turn into an automatic downgrade or an unreviewed certificate swap.

Run the tested Apache flow

git clone https://github.com/ganeshmallaya/cali-crypto-interface.git
cd cali-crypto-interface
python3 -m venv .venv
.venv/bin/python -m pip install -e '.[dev]'
sh implementation/examples/apache-pqc/run_demo.sh

The script creates short lived ECDSA and ML DSA test certificates. It starts the CALI service and Apache on loopback ports. It serves the application over HTTPS with the policy selected ECDSA certificate then activates strict ML DSA policy while Apache still declares only ECDSA capability.

Expected output:

PASS: Apache served the application with the policy selected ECDSA certificate.
PASS: Strict ML DSA policy failed because Apache did not declare ML DSA capability.
PASS: The failed decision did not change the live Apache certificate configuration.

This first case proves the policy and broker fail-closed path. The separate apache-login-pqc case exercises an ML-DSA-65 handshake in the named local environment; neither case establishes general client or public-PKI interoperability.