From 7687ac2dda2eed62a174ee4ee660a34c8f8e6b67 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 11 Oct 2026 16:28:54 +0200 Subject: [PATCH] Record exact execution context source agreement Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade --- ...-10-11-secrets-execution-context-source.md | 99 +++++++++++++++++++ workplans/ADHOC-2026-10-11.md | 10 ++ 2 files changed, 109 insertions(+) create mode 100644 docs/reviews/2026-10-11-secrets-execution-context-source.md diff --git a/docs/reviews/2026-10-11-secrets-execution-context-source.md b/docs/reviews/2026-10-11-secrets-execution-context-source.md new file mode 100644 index 0000000..9bd24d2 --- /dev/null +++ b/docs/reviews/2026-10-11-secrets-execution-context-source.md @@ -0,0 +1,99 @@ +# Access owner review: typed Secrets execution-context source propagation + +reviewer: access-engine-owner (agent access-engine, codex) +decision: approved +work_item: FLEX-WP-ADHOC-2026-10-11-T02 +scope: exact bounded source descriptor and request propagation only + +Comment: Access INTENT.md Responsibility Boundary reserves authorization decisions +to the sole PDP and places protected effects/enforcement with consumers. This +source patch introduces no competing decision or generic grant service. I agree +with the exact typed descriptor propagation through the four Secrets builders, +its existing canonical digest and approval-free/full joins, required production +human control, local catalogue fingerprint correspondence and deadline bounds. +This review uses the actual already completed own-repo T02 work record, persisted +before this review. Earlier owner reviews remain unchanged. + +## Exact source revision and verification + +Review manifest /tmp/secrets-execution-context-stage/manifest.json SHA256 +32a419752e4a3ed7cf8f906fc40ebbaa516b9a4d6134be2df29243ce97213e40; +source baseline e24437607b67e95b4a93d49237af182ce0cc212e. Verified all six staged +file hashes against that manifest before review. The table records exact candidates. + +| Target | Staged SHA256 | +| --- | --- | +| /home/worsch/secrets-engine/src/secrets_engine/execution_contract.py | 75323911c229cb8b49d5116706a329c3f9ec2efdbeab6bfac8dbf5b92729f14a | +| /home/worsch/secrets-engine/src/secrets_engine/authorization.py | 0ec4c3f7304d68abd06a0d08dc459e4f1f7269da0e4258549662be9e57b39fd3 | +| /home/worsch/secrets-engine/src/secrets_engine/approval_consume.py | 2c528667d017e0d3ba18d3fc24a7856585c532b40e3c7e9364646cb629b99274 | +| /home/worsch/secrets-engine/tests/test_execution_context.py | ab7630b7db7cf27caeec35cfad8c9fa16ce1e949111a225149b93359f011e1a9 | +| /home/worsch/secrets-engine/docs/task-scoped-openbao-execution-contract.md | ba7f0718cc91321550985ced68175a7ca4c097c50bac8a3a8d66c3a3868a4b5f | +| /home/worsch/secrets-engine/workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | 231906182d8ba68f920520937c8bd3f26af50afb614bd2c7beb2cd6b2aa2391c | + +Independently ran the manifest's six-suite source command in +/tmp/secrets-execution-context-check with bytecode/cache writes disabled: +99 passed in 0.65s. Tests exercise actual four builder functions, submitted +claim-bearing request/consume formatting, detached descriptor copies and semantic +mutation refusal. Existing envelope tests retain wrong package/version refusal. +The execution tests use a synthetic AuthorizationStub, not a shipped PDP grant. + +## Binding and policy agreement + +The descriptor is attached before served claim observation, retained by +_expected_request, resolve_approval_observation and authorize_action, and +included in canonical request context. Only context.approval is removed for +approval-free hashing. Live claim pdp_digest compares to PDP's enriched +approval_binding_digest; local exact submitted request compares to +submitted_request_digest; enriched full request digest is passed to consume. +No registry enrichment bypass or locally reconstructed unenriched issue digest +is substituted. Wrong package/version still fails existing provenance validation. + +Distinct action execute-ccr refuses missing descriptor, descriptors on legacy +actions, non-prod/foreign tenant, catalogue fingerprint mismatch, expired deadline +and unserved approval fallback. Its human_control requirement cannot vanish on a +legacy bootstrap catalogue. Legacy twelve actions and existing service-jwt +execution readiness refusal remain in force; no new CLI entry point or mediator +is wired by these source candidates. + +Actual shipped secrets-engine.catalog-lane.lifecycle v2 recognizes only the +original twelve actions and service subject secrets-engine. It denies execute-ccr +and human subjects. Existing apply's allowance ignores execution_contract and +cannot authorize this operation. Future exact action/package/version publication +and its negative fixtures require a separate Access owner review. + +execution_actor service:secrets-engine is a bound descriptor string, not verified +transport or initiating-principal identity. Current builder subject_id/type still +come from configuration; propagation does not authenticate them. Kubernetes +TokenReview correspondence binds transport principal to protected system only. +An independently authenticated initiating-principal/representation contract remains +required before executable integration. No mapping between service identity and +initiating human is approved by this review. + +## Shape limits and integration gates + +The descriptor is compiler input whose shape is checked, not an owner-source +compiler or admitted scope. Endpoint regex permits different metadata policy and +auth-role names, duplicates and varied operation ordering; it does not enforce +exactly two reviewed objects or before/write/readback sequence. uses 1..12 with +one cleanup reservation is a syntax ceiling, not a verified native call budget. +Any well-shaped explicit-port HTTP/HTTPS origin can parse; no estate origin, +server authenticity, source path/digest provenance or target body is admitted. +The catalogue fingerprint is descriptor-local sorted JSON, distinct from PDP's +canonical request digest. The owner compiler/mediator must reconstruct/pin all +sources, exact two-object targets/bodies, native sequence, trusted initiator and +budget before effects. The descriptor parser is local compiler input: before any +untrusted API/file exposure, bound total/depth/size and normalize every malformed +parse into a closed refusal without leaking caller contents. + +Root has independently reproduced synthetic inherited Approval transport +cross-origin redirect forwarding of bearer credentials; Approval owner repair is +pending. This review does not assert trusted consume transport or independent +confirmation integration is ready. Confirmation, one-shot durable journal, +authenticated owner mediator, exact native grant and protected cleanup are outside +this patch and remain mandatory before executable adoption. + +Approval is limited to these exact source descriptor/propagation candidates. No +new policy/action grant, verified initiating identity, credential routing/issuance, +readiness activation, CLI handler, OpenBao effect or native lifecycle adoption is +approved. Secrets SECRETS-WP-0013 remains active; Secrets T06 and Platform +RPF35-T02 stay open. No native/credential/owner-checkout writes occurred in review. diff --git a/workplans/ADHOC-2026-10-11.md b/workplans/ADHOC-2026-10-11.md index 7d4b85d..ff652e1 100644 --- a/workplans/ADHOC-2026-10-11.md +++ b/workplans/ADHOC-2026-10-11.md @@ -69,3 +69,13 @@ persisted in commit `f30e08cc96634d48987fb7203b71961437119535`: candidate `docs/reviews/2026-10-11-task-execution-pdp-source.md`. The review approves only the exact proposed integration direction and source characterization; it grants no package/action, native entitlement, representation identity or lifecycle adoption. + + +Access-own-role independent review of the exact typed Secrets execution-context +source manifest `32a419752e4a3ed7cf8f906fc40ebbaa516b9a4d6134be2df29243ce97213e40` +prepared in `docs/reviews/2026-10-11-secrets-execution-context-source.md` under T02. +Independently reproduced the 99 focused source checks. Agreement covers only +closed descriptor/request propagation and canonical claim/PDP digest joins; +exact owner compiler, new action/package, authenticated initiating representation, +trusted consume transport, durable one-shot journal, mediator, native scope and +lifecycle adoption remain unimplemented/unadmitted. Prior reviews are preserved.