coulomb/access-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind service task HTTP input to authenticated caller before evaluation
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Failing after 1m1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 16:25:55 +02:00
parent 919ce25a37
commit 4f6946bbb3
8 changed files with 590 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

32
docs/service-task-execution-contract.md
View file

@ -51,9 +51,32 @@ trusted served approval, consume confirmation or operational entitlement.
Maker tests use a synthetic TokenReviewer, not actual Kubernetes authentication.
Actual deployed TokenReview origin/CA/RBAC/audience/projection rotation and mapping
admission must be proved before runtime use. The adapter is not wired into HTTP
routes, decision engine evaluation or a native executor; source package remains
hard-closed. A forged public service_actor_binding alone remains insufficient.
admission must be proved before runtime use. The B1 source path now wires the actual service adapter into `/v1/check` only
when the exact installed service-pilot v1 package is selected. Startup requires
enforced retained `flex-auth` audience and the one exact Secrets mapping. The
actual reviewer authenticates once; the detached ServiceInput is rechecked for
caller/operation expiry at use. The single existing decision engine records only
a signed DENY on this path; unsigned output or an accidental policy allow is
withheld before recording. No native executor or Approval fact join is installed.
A forged public service_actor_binding alone remains insufficient.
Generic Check, BatchCheck, ListAllowed and CLI/HTTP evaluation cannot evaluate
`execute-ccr` under any package; the dedicated typed path is required. The exact
service pin also refuses generic calls and batch requests. This deliberately
invalidates the older separately named synthetic positive stack fixture on the
new source. Its positive proof remains historical at Access `ec21518e`, not proof
for B1. Do not add a fixture exception; a positive successor must use reviewed
B2/B3 provider joins. The literal service policy false gate is unchanged.
B1 retains the exact original request context, carried claim, submitted digest
and producer-owned canonicalization. Its bounded strict JSON decoder refuses
duplicates, trailing/unknown typed fields and oversized input. The caller's
Approval blob remains unverified and cannot enable anything. B2 requires the
Approval owner's fact contract/vector review; B3 additionally requires exact
server-owned native-act representation and the complete trusted join. Fresh
provider observations stay out of band: no refreshed context or claim replacement
may relax strict Secrets request correspondence. Access never invokes a
credential-carrying Python subprocess, consumes approval or performs the effect.
## Exact operation and independent gates
@ -129,7 +152,8 @@ bind actual compiler bytes to the whole descriptor, enforce journal phase/order,
admit grant/baseline/estate or perform an effect. Those are explicit implementation
requirements; a matching predicate and reviewed TokenReview input are insufficient.
The service adapter carries authenticated transport evidence outside the canonical
request but is not connected to HTTP evaluation/provider validation. A caller's
request. B1 connects it only to signed-DENY HTTP evaluation; provider validation and
executable eligibility remain absent. A caller's
service_actor_binding remains a public declaration independently compared by the
adapter, never a substitute for runtime provenance or exact operation authority.