Add proposed task execution policy and initiating identity contract

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

examples/secrets-engine-task-execution/policy_fixtures.yaml

@@ -0,0 +1,16 @@
+- id: unsigned-provider-refused
+  request:
+    tenant: tenant:platform
+    subject: {id: secrets-engine, type: service}
+    action: execute-ccr
+    resource: {id: catalog:test, type: secret-catalog-lane, system: secrets-engine}
+    context: {human_control: true, verified: true, owner_admission: true}
+  expect: {effect: deny, reason: initiating_provider_unadmitted}
+- id: legacy-action-cannot-borrow-task-policy
+  request:
+    tenant: tenant:platform
+    subject: {id: secrets-engine, type: service}
+    action: apply
+    resource: {id: catalog:test, type: secret-catalog-lane, system: secrets-engine}
+    context: {human_control: true}
+  expect: {effect: deny, reason: initiating_provider_unadmitted}

examples/secrets-engine-task-execution/policy_package.md

@@ -0,0 +1,113 @@
+---
+id: secrets-engine.task-execution
+name: Secrets exact task execution
+namespace: secrets-engine:secret-catalog-lane
+version: v1
+status: proposed
+package: flexauth.secrets_engine.task_execution
+allow_ttl: 15s
+actions: [execute-ccr]
+owner: team:platform-security
+fixtures: [policy_fixtures.yaml]
+caring:
+  profile: caring-0.4.0-rc2
+  enforce: false
+activation:
+  mode: local
+---
+
+# Proposed task execution contract
+
+Source only. The owner-admission constant is false because no authenticated
+initiating-principal projection or User/Tenant membership provider has been
+admitted. Request flags, even `verified=true`, cannot change that constant.
+Activating this package today denies every request. It does not replace lifecycle
+v2. Any successor that changes owner_admission requires review of the actual
+server injection boundary and authoritative providers, not a values switch.
+
+The candidate predicate models the future join, not a trustworthy caller claim.
+It is exercised with synthetic server projections in tests. Raw human tokens
+must never enter CheckRequest/context/decision records. See the accompanying
+source verifier and provider contract; neither is wired into HTTP evaluation.
+
+```rego
+owner_admission := false
+
+default decision := {"effect": "deny", "reason": "initiating_provider_unadmitted"}
+
+decision := {"effect": "allow", "reason": "exact_task_execution_matched"} {
+  owner_admission
+  candidate_matches
+}
+
+hash_ok(x) { is_string(x); regex.match("^sha256:[0-9a-f]{64}$", x) }
+
+candidate_matches {
+  input.action == "execute-ccr"
+  input.tenant == "tenant:platform"
+  input.subject.id == "secrets-engine"
+  input.subject.type == "service"
+  input.resource.system == "secrets-engine"
+  input.resource.type == "secret-catalog-lane"
+  input.context.human_control == true
+  c := input.context.execution_contract
+  c.contract_version == "SECRETS-EXEC-20261011-v1"
+  c.operation == "metadata-apply-ccr"
+  c.execution_actor == "service:secrets-engine"
+  regex.match("^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", c.operation_id)
+  c.ccr_id != c.execution_grant_ccr_id
+  hash_ok(c.ccr_immutable_sha256)
+  hash_ok(c.grant_immutable_sha256)
+  hash_ok(c.catalog_sha256)
+  hash_ok(c.expected_before)
+  hash_ok(c.expected_after)
+  c.backend_budget.ttl_seconds <= 120
+  c.backend_budget.ttl_seconds >= 30
+  c.backend_budget.uses == 12
+  count(c.operations) == 6
+  c.operations[0].method == "GET"
+  c.operations[1].method == "PUT"
+  c.operations[2].method == "GET"
+  c.operations[3].method == "GET"
+  c.operations[4].method == "PUT"
+  c.operations[5].method == "GET"
+  regex.match("^sys/policies/acl/[A-Za-z0-9_-]+$", c.operations[0].path)
+  regex.match("^auth/[A-Za-z0-9_-]+/role/[A-Za-z0-9_-]+$", c.operations[3].path)
+  c.operations[0].path == c.operations[1].path
+  c.operations[1].path == c.operations[2].path
+  c.operations[3].path == c.operations[4].path
+  c.operations[4].path == c.operations[5].path
+  every_operation_hash_valid
+  p := input.context.task_execution_projection
+  p.version == "proposed-task-execution-projection/v1"
+  p.principal_type == "human"
+  p.subject != ""
+  p.tenant == input.tenant
+  p.tenant_source == "directory"
+  p.mfa == true
+  p.transport_principal == "system:serviceaccount:secrets-engine:secrets-engine"
+  p.execution_contract_digest == concat("", ["sha256:", crypto.sha256(json.marshal(c))])
+  p.resource_id == input.resource.id
+  p.membership_source == "user-engine"
+  p.tenant_state_source == "tenant-engine"
+  p.member_active == true
+  p.tenant_active == true
+  p.not_after_ns > time.now_ns()
+  p.not_after_ns <= time.parse_rfc3339_ns(c.operation_deadline)
+  input.context.approval.kind == "approval-claim"
+  input.context.approval.binding.human_control == true
+}
+
+every_operation_hash_valid {
+  count([x | x := input.context.execution_contract.operations[_]; hash_ok(x.payload_sha256)]) == 6
+}
+```
+
+```rego test
+import data.flexauth.secrets_engine.task_execution
+
+test_unsigned_admission_flags_cannot_open {
+  task_execution.decision == {"effect": "deny", "reason": "initiating_provider_unadmitted"}
+    with input as {"context": {"verified": true, "owner_admission": true, "human_control": true}}
+}
+```