fix(docs): H3-1137 use Go 1.26.10

docs/getting-started/docker-compose.yaml

@@ -531,7 +531,7 @@ services:
   # Generate hybrid post-quantum KAS keys (X-Wing, P256+ML-KEM-768, P384+ML-KEM-1024).
   # Uses a Go image to build and run the keygen from the platform source.
   generate-pqc-keys:
-    image: golang:1.25-alpine
+    image: golang:1.26.10-alpine@sha256:27f2d3b83cfc5803c8078f8e730af0f7c431bf067afaec8f60a36fb763187cba
     volumes:
       - keys:/keys
     depends_on:

specs/policy/attributes/attributes.openapi.yaml

@@ -199,7 +199,7 @@ paths:
       summary: GetEntitleableAttributesByFqns
       description: |-
         Returns only entitlement-relevant information (rule, value identity, ordered
-         definition values, and subject mappings) for the requested attribute value
+         definition values, subject mappings, and dynamic mappings) for the requested attribute value
          FQNs, for server-side decisioning / entitlement resolution.
       operationId: policy.attributes.AttributesService.GetEntitleableAttributesByFqns
       parameters:
@@ -1216,6 +1216,88 @@ components:
         - booleanOperator
       additionalProperties: false
       description: A collection of Conditions evaluated by the boolean_operator provided
+    policy.DynamicValueMapping:
+      type: object
+      properties:
+        id:
+          type: string
+          title: id
+        attributeDefinition:
+          title: attribute_definition
+          description: the Attribute Definition whose values are entitled dynamically
+          $ref: '#/components/schemas/policy.Attribute'
+        valueResolver:
+          title: value_resolver
+          description: the dynamic resolver matched against the requested resource value segment
+          $ref: '#/components/schemas/policy.DynamicValueResolver'
+        subjectConditionSet:
+          title: subject_condition_set
+          description: |-
+            optional static pre-gate on the entity, evaluated with normal SubjectConditionSet
+             semantics (no dynamic overload). When present, both the gate and the resolver must
+             pass for entitlement.
+          $ref: '#/components/schemas/policy.SubjectConditionSet'
+        actions:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.Action'
+          title: actions
+          description: the actions permitted by subjects in this mapping
+        namespace:
+          title: namespace
+          description: the namespace containing this mapping
+          $ref: '#/components/schemas/policy.Namespace'
+        metadata:
+          title: metadata
+          $ref: '#/components/schemas/common.Metadata'
+      title: DynamicValueMapping
+      additionalProperties: false
+      description: |-
+        Dynamic Value Mapping: a Policy assigning permitted action(s) to
+        dynamically-requested values under an Attribute Definition. It raises entitlement
+        authority from a concrete Attribute Value to the Attribute Definition: at decision time
+        the value_resolver compares the requested resource value segment against the entity
+        representation, avoiding pre-provisioning a value + subject mapping per discrete value.
+
+        Combination semantics: multiple dynamic value mappings on the same definition are OR-ed (any
+        match entitles); within a mapping, the optional subject_condition_set's subject sets are AND-ed
+        (every set must pass), matching subject mapping evaluation.
+
+        Coexistence: a definition with a dynamic value mapping cannot also carry value-level subject
+        mappings, and values under such a definition cannot be added to a registered resource's action
+        attribute values (those values resolve at decision time, so they are not meaningful as static
+        registered-resource entitlements).
+    policy.DynamicValueResolver:
+      type: object
+      properties:
+        subjectExternalSelectorValue:
+          type: string
+          title: subject_external_selector_value
+          description: |-
+            a selector for a field value on a flattened Entity Representation (such as from
+             idP/LDAP), e.g. ".patientAssignments[]"
+        operator:
+          not:
+            enum:
+              - 2
+          title: operator
+          description: |-
+            how the requested resource value segment is compared against each value the selector
+             resolves from the entity representation. NOT_IN is unsupported because dynamic resolution
+             is existential over the resolved entity values. IN_CONTAINS is substring-based and
+             over-matches by design (e.g. "admin" matches "superadmin", "admin-readonly"); prefer IN
+             unless substring matching is genuinely intended.
+          $ref: '#/components/schemas/policy.SubjectMappingOperatorEnum'
+      title: DynamicValueResolver
+      required:
+        - subjectExternalSelectorValue
+        - operator
+      additionalProperties: false
+      description: |-
+        Dynamic Value Resolver: the dynamic half of a DynamicValueMapping. It resolves a selector
+        against the entity representation, then tests whether any resolved entity value matches the
+        requested resource value segment under the operator. The match is inherently existential over
+        the resolved entity values.
     policy.KasPublicKey:
       type: object
       properties:
@@ -2268,9 +2350,11 @@ components:
         the subject mappings needed to resolve entitlements. Hierarchy definitions
         additionally carry their ordered values with subject mappings, for hierarchy
         rule propagation. It does not return KAS keys, grants, resource mappings,
-        obligations, or metadata. A value that does not exist under a definition with
-        allow_traversal is returned with its definition and an empty value identity (no
-        value_id, no subject mappings).
+        obligations, or metadata. Missing policy values retain their active parent
+        definition with an empty value identity. Persisted inactive values retain
+        their identity and inactive state. Unknown or inactive parents are omitted.
+        Dynamic mappings are scoped to the returned definitions. The PDP decides
+        whether the returned policy entitles the request.
     policy.attributes.GetEntitleableAttributesByFqnsResponse:
       type: object
       properties:
@@ -2338,6 +2422,12 @@ components:
              namespaced-policy decisioning and registered-resource matching. Only the
              identity is populated; grants, keys, and metadata are not.
           $ref: '#/components/schemas/policy.Namespace'
+        dynamicValueMappings:
+          type: array
+          items:
+            $ref: '#/components/schemas/policy.DynamicValueMapping'
+          title: dynamic_value_mappings
+          description: Dynamic mappings for this definition, for evaluation by the PDP.
       title: EntitleableDefinition
       additionalProperties: false
       description: |-
@@ -2360,6 +2450,10 @@ components:
             $ref: '#/components/schemas/policy.SubjectMapping'
           title: subject_mappings
           description: subject mappings used to resolve entitlements for this value
+        active:
+          title: active
+          description: Present for persisted values. Missing policy values have no active state.
+          $ref: '#/components/schemas/google.protobuf.BoolValue'
       title: EntitleableValue
       additionalProperties: false
       description: An attribute value plus the subject mappings that entitle it.

specs/policy/dynamicvaluemapping/dynamic_value_mapping.openapi.yaml

@@ -1230,7 +1230,7 @@ components:
           type: string
           title: namespace_id
           format: uuid
-          description: 'Optional: namespace ID or FQN for the mapping'
+          description: 'Required: namespace ID or FQN for the mapping'
         namespaceFqn:
           type: string
           title: namespace_fqn

tests/sdk-examples/go/go.mod

@@ -1,6 +1,6 @@
 module github.com/opentdf/docs/examples
 
-go 1.25.0
+go 1.26.10
 
 require (
 	github.com/opentdf/platform/lib/ocrypto v0.10.0