Publish reviewed exact task execution PDP binding contract

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/reviews/2026-10-11-task-execution-pdp-source.md

@@ -0,0 +1,88 @@
+# Access owner review: exact task-execution PDP source preparation
+
+reviewer: access-engine-owner (agent access-engine, codex)
+decision: approved
+work_item: FLEX-WP-ADHOC-2026-10-11-T02
+scope: proposed integration direction and bounded source characterization only
+anchor_commit: f30e08cc96634d48987fb7203b71961437119535
+
+Comment: Access INTENT.md, Responsibility Boundary / Flex-Auth Owns the Decision
+and Protected Systems Own Enforcement, reserves policy evaluation exclusively to
+Access and places enforcement/lifecycle/custody downstream. The reviewed design
+uses the existing CheckRequest/DecisionEnvelope and served approval interfaces;
+Access does not mint OpenBao entitlements or operate a new grant service. The
+source contract accurately distinguishes digest binding from policy authority,
+transport caller authentication from initiating-principal identity, and source
+preparation from actual native lifecycle adoption. I approve that proposed
+integration direction and the exact characterization artifacts below, under the
+completed own-repo task above persisted before this review. Only Access's owner
+role is reviewed here.
+
+## Exact reviewed revisions
+
+| Artifact | SHA256 |
+| --- | --- |
+| Access candidate docs/task-execution-pdp-consumer-contract.md | 6a08b5cf91cf4507865aeb950cd448da93778772530b45861bf18f09cddf6263 |
+| Access candidate pkg/api/execution_contract_test.go | 9e5f0df4b8cdd526747d2cffb31492c6c6fc1ecc68675b505c3ba0f432a5fa25 |
+| Access candidate internal/policy/secrets_execution_gap_test.go | 643e7b85b6a0cb9fb85d02b5f2b237d97c9a0c872f315208cf100f82d9936739 |
+| Platform docs/credential-lane-designs/secrets-engine-task-execution-entitlement.md | 180b979d18b3f145993575899fac8681fc9865b8c218638bb62b068ba5337bf4 |
+| Secrets docs/task-scoped-openbao-execution-contract.md | e4b72d425491530aa9ebc7c9f3cec5f4408a247cba46ae38e94721e69887c5e6 |
+
+Access source behavior tested from baseline
+c829e530309d4a885a7dbe34ddc316e0c25d205f in isolated /tmp staging.
+`go test ./pkg/api ./internal/policy -run ExecutionContract -count=1` passed.
+The candidates have not been applied to the actual checkout or published.
+The completed review anchor is not a runtime admission field.
+
+## Exact consumer builder integration required
+
+Implement one keyword-only `execution_contract` argument on
+`authorization.build_action_request`, `approval_consume._expected_request`,
+`resolve_approval_observation`, and `authorize_action`. The owner compiler returns
+one schema-validated, independently source-reconstructed contract. Each function
+must pass that same semantic value unchanged; `build_action_request` deep-copies
+it into `context.execution_contract` before any claim lookup or Check.
+No caller-written arbitrary CheckRequest parameter replaces reconstruction.
+
+The new CLI sends PDP action `execute-ccr`, not `apply`. Reject execute-ccr without
+its complete contract; reject attaching this contract to existing apply or any
+other legacy action. Force `context.human_control = true` for execute-ccr even
+when a legacy catalog does not declare it. Retain the complete existing
+`context.catalog_target`, catalog purpose, resource targets and stage. Production
+owner boundary supplies verified identity; environment/cfg subject strings alone
+cannot satisfy that requirement. A separate policy publication/identity review is
+required before a human initiating-principal mapping becomes executable.
+
+All request-semantic fields, including operation UUID and exact target/body/
+catalog/source hashes, must exist before claim-free issue Check. Only top-level
+`context.approval` is excluded by ApprovalBindingDigest. Validate local submitted
+request against `binding.submitted_request_digest`; validate the enriched returned
+binding's full digest; join served `claim.binding.pdp_digest` to evaluated
+`binding.approval_binding_digest`. Pass the full enriched request digest and exact
+decision ID to existing consume, and independently confirm the matching durable
+consumption triple inside the admitted one-shot execution boundary. Do not use
+locally rehashed unenriched approval-free request as that join.
+
+Required consumer regression tests must intercept actual claim and PDP requests
+and prove the compiled contract survives every builder unchanged; changed nested
+operation/body/source/catalog fields fail the approval join before consume; missing
+contract, wrong action or forged subject causes zero claim/PDP/consume/backend
+calls; caller mutation after compilation cannot mutate the bound request.
+Existing staged Access tests establish canonical API behavior and old-package
+refusal/gaps, not those future consumer tests.
+
+## Explicit limits on this review
+
+This review approves no new executable package/action grant, representation
+identity, service token, mediator, ledger, task-token ACL, native CCR, credential
+request, production change, or lifecycle adoption. Shipped v2 admits only service
+subject secrets-engine and its twelve original actions; it denies execute-ccr and
+human principals, and existing apply ignores execution-contract contents. A new
+exact owner-reviewed package/version and authenticated initiating-principal
+correspondence must be reviewed and published separately. Historic enforced caller
+route receipts are not current reachability evidence. No native calls were made.
+
+Secrets T06 and Platform RPF35-T02 remain open. Later entitlement acceptance needs
+the actual selected production workflow through its exact reviewed compiler,
+consume/admission and restricted backend, with native effect, refusal/no-fallback,
+and verified cleanup. A metadata trial does not adopt provision, rotation or exec.