Record exact execution context source agreement

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/reviews/2026-10-11-secrets-execution-context-source.md

@@ -0,0 +1,99 @@
+# Access owner review: typed Secrets execution-context source propagation
+
+reviewer: access-engine-owner (agent access-engine, codex)
+decision: approved
+work_item: FLEX-WP-ADHOC-2026-10-11-T02
+scope: exact bounded source descriptor and request propagation only
+
+Comment: Access INTENT.md Responsibility Boundary reserves authorization decisions
+to the sole PDP and places protected effects/enforcement with consumers. This
+source patch introduces no competing decision or generic grant service. I agree
+with the exact typed descriptor propagation through the four Secrets builders,
+its existing canonical digest and approval-free/full joins, required production
+human control, local catalogue fingerprint correspondence and deadline bounds.
+This review uses the actual already completed own-repo T02 work record, persisted
+before this review. Earlier owner reviews remain unchanged.
+
+## Exact source revision and verification
+
+Review manifest /tmp/secrets-execution-context-stage/manifest.json SHA256
+32a419752e4a3ed7cf8f906fc40ebbaa516b9a4d6134be2df29243ce97213e40;
+source baseline e24437607b67e95b4a93d49237af182ce0cc212e. Verified all six staged
+file hashes against that manifest before review. The table records exact candidates.
+
+| Target | Staged SHA256 |
+| --- | --- |
+| /home/worsch/secrets-engine/src/secrets_engine/execution_contract.py | 75323911c229cb8b49d5116706a329c3f9ec2efdbeab6bfac8dbf5b92729f14a |
+| /home/worsch/secrets-engine/src/secrets_engine/authorization.py | 0ec4c3f7304d68abd06a0d08dc459e4f1f7269da0e4258549662be9e57b39fd3 |
+| /home/worsch/secrets-engine/src/secrets_engine/approval_consume.py | 2c528667d017e0d3ba18d3fc24a7856585c532b40e3c7e9364646cb629b99274 |
+| /home/worsch/secrets-engine/tests/test_execution_context.py | ab7630b7db7cf27caeec35cfad8c9fa16ce1e949111a225149b93359f011e1a9 |
+| /home/worsch/secrets-engine/docs/task-scoped-openbao-execution-contract.md | ba7f0718cc91321550985ced68175a7ca4c097c50bac8a3a8d66c3a3868a4b5f |
+| /home/worsch/secrets-engine/workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | 231906182d8ba68f920520937c8bd3f26af50afb614bd2c7beb2cd6b2aa2391c |
+
+Independently ran the manifest's six-suite source command in
+/tmp/secrets-execution-context-check with bytecode/cache writes disabled:
+99 passed in 0.65s. Tests exercise actual four builder functions, submitted
+claim-bearing request/consume formatting, detached descriptor copies and semantic
+mutation refusal. Existing envelope tests retain wrong package/version refusal.
+The execution tests use a synthetic AuthorizationStub, not a shipped PDP grant.
+
+## Binding and policy agreement
+
+The descriptor is attached before served claim observation, retained by
+_expected_request, resolve_approval_observation and authorize_action, and
+included in canonical request context. Only context.approval is removed for
+approval-free hashing. Live claim pdp_digest compares to PDP's enriched
+approval_binding_digest; local exact submitted request compares to
+submitted_request_digest; enriched full request digest is passed to consume.
+No registry enrichment bypass or locally reconstructed unenriched issue digest
+is substituted. Wrong package/version still fails existing provenance validation.
+
+Distinct action execute-ccr refuses missing descriptor, descriptors on legacy
+actions, non-prod/foreign tenant, catalogue fingerprint mismatch, expired deadline
+and unserved approval fallback. Its human_control requirement cannot vanish on a
+legacy bootstrap catalogue. Legacy twelve actions and existing service-jwt
+execution readiness refusal remain in force; no new CLI entry point or mediator
+is wired by these source candidates.
+
+Actual shipped secrets-engine.catalog-lane.lifecycle v2 recognizes only the
+original twelve actions and service subject secrets-engine. It denies execute-ccr
+and human subjects. Existing apply's allowance ignores execution_contract and
+cannot authorize this operation. Future exact action/package/version publication
+and its negative fixtures require a separate Access owner review.
+
+execution_actor service:secrets-engine is a bound descriptor string, not verified
+transport or initiating-principal identity. Current builder subject_id/type still
+come from configuration; propagation does not authenticate them. Kubernetes
+TokenReview correspondence binds transport principal to protected system only.
+An independently authenticated initiating-principal/representation contract remains
+required before executable integration. No mapping between service identity and
+initiating human is approved by this review.
+
+## Shape limits and integration gates
+
+The descriptor is compiler input whose shape is checked, not an owner-source
+compiler or admitted scope. Endpoint regex permits different metadata policy and
+auth-role names, duplicates and varied operation ordering; it does not enforce
+exactly two reviewed objects or before/write/readback sequence. uses 1..12 with
+one cleanup reservation is a syntax ceiling, not a verified native call budget.
+Any well-shaped explicit-port HTTP/HTTPS origin can parse; no estate origin,
+server authenticity, source path/digest provenance or target body is admitted.
+The catalogue fingerprint is descriptor-local sorted JSON, distinct from PDP's
+canonical request digest. The owner compiler/mediator must reconstruct/pin all
+sources, exact two-object targets/bodies, native sequence, trusted initiator and
+budget before effects. The descriptor parser is local compiler input: before any
+untrusted API/file exposure, bound total/depth/size and normalize every malformed
+parse into a closed refusal without leaking caller contents.
+
+Root has independently reproduced synthetic inherited Approval transport
+cross-origin redirect forwarding of bearer credentials; Approval owner repair is
+pending. This review does not assert trusted consume transport or independent
+confirmation integration is ready. Confirmation, one-shot durable journal,
+authenticated owner mediator, exact native grant and protected cleanup are outside
+this patch and remain mandatory before executable adoption.
+
+Approval is limited to these exact source descriptor/propagation candidates. No
+new policy/action grant, verified initiating identity, credential routing/issuance,
+readiness activation, CLI handler, OpenBao effect or native lifecycle adoption is
+approved. Secrets SECRETS-WP-0013 remains active; Secrets T06 and Platform
+RPF35-T02 stay open. No native/credential/owner-checkout writes occurred in review.

workplans/ADHOC-2026-10-11.md

@@ -69,3 +69,13 @@ persisted in commit `f30e08cc96634d48987fb7203b71961437119535`: candidate
 `docs/reviews/2026-10-11-task-execution-pdp-source.md`. The review approves only
 the exact proposed integration direction and source characterization; it grants
 no package/action, native entitlement, representation identity or lifecycle adoption.
+
+
+Access-own-role independent review of the exact typed Secrets execution-context
+source manifest `32a419752e4a3ed7cf8f906fc40ebbaa516b9a4d6134be2df29243ce97213e40`
+prepared in `docs/reviews/2026-10-11-secrets-execution-context-source.md` under T02.
+Independently reproduced the 99 focused source checks. Agreement covers only
+closed descriptor/request propagation and canonical claim/PDP digest joins;
+exact owner compiler, new action/package, authenticated initiating representation,
+trusted consume transport, durable one-shot journal, mediator, native scope and
+lifecycle adoption remain unimplemented/unadmitted. Prior reviews are preserved.