Prepare closed service task execution input and policy contract

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

examples/secrets-engine-service-task-execution/policy_fixtures.yaml

@@ -0,0 +1,8 @@
+- id: unsigned-service-caller-not-authority
+  request:
+    tenant: tenant:platform
+    subject: {id: secrets-engine, type: service}
+    action: execute-ccr
+    resource: {id: catalog:test, type: secret-catalog-lane, system: secrets-engine}
+    context: {human_control: true, runtime_admission: true, verified: true}
+  expect: {effect: deny, reason: service_execution_integration_unadmitted}

examples/secrets-engine-service-task-execution/policy_package.md

@@ -0,0 +1,118 @@
+---
+id: secrets-engine.task-execution.service-pilot
+name: Secrets admitted service task execution
+namespace: secrets-engine:secret-catalog-lane
+version: v1
+status: proposed
+package: flexauth.secrets_engine.service_task_execution
+allow_ttl: 15s
+actions: [execute-ccr]
+owner: team:platform-security
+fixtures: [policy_fixtures.yaml]
+caring:
+  profile: caring-0.4.0-rc2
+  enforce: false
+activation:
+  mode: local
+---
+
+# Proposed faithful service pilot successor
+
+A separate source package for an admitted Secrets service as the initiating and
+represented principal. It imposes no universal human initiator/User/Tenant gate.
+It still requires the operation's declared human-control approval. The human
+approver is not the service caller and does not supply service authentication.
+
+Current runtime_admission is literal false because authenticated server mapping,
+served claim validation, exact PDP joins and Platform executor integration are not
+installed. Request flags cannot enable it. candidate_matches is source contract
+characterization, not authority; positive predicate tests never flip the constant.
+Raw caller metadata is not a verified identity. See docs/service-task-execution-contract.md.
+
+```rego
+runtime_admission := false
+
+default decision := {"effect": "deny", "reason": "service_execution_integration_unadmitted"}
+
+decision := {"effect": "allow", "reason": "exact_task_execution_matched"} {
+  runtime_admission
+  candidate_matches
+}
+
+hash_ok(x) { is_string(x); regex.match("^sha256:[0-9a-f]{64}$", x) }
+
+candidate_matches {
+  input.action == "execute-ccr"
+  input.tenant == "tenant:platform"
+  input.subject.id == "secrets-engine"
+  input.subject.type == "service"
+  input.resource.system == "secrets-engine"
+  input.resource.type == "secret-catalog-lane"
+  input.context.human_control == true
+  c := input.context.execution_contract
+  c.contract_version == "SECRETS-EXEC-20261011-v1"
+  c.operation == "metadata-apply-ccr"
+  c.execution_actor == "service:secrets-engine"
+  regex.match("^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", c.operation_id)
+  c.ccr_id != c.execution_grant_ccr_id
+  hash_ok(c.ccr_immutable_sha256)
+  hash_ok(c.grant_immutable_sha256)
+  hash_ok(c.catalog_sha256)
+  hash_ok(c.expected_before)
+  hash_ok(c.expected_after)
+  c.backend_budget.ttl_seconds <= 120
+  c.backend_budget.ttl_seconds >= 30
+  c.backend_budget.uses == 12
+  count(c.operations) == 6
+  c.operations[0].method == "GET"
+  c.operations[1].method == "PUT"
+  c.operations[2].method == "GET"
+  c.operations[3].method == "GET"
+  c.operations[4].method == "PUT"
+  c.operations[5].method == "GET"
+  regex.match("^sys/policies/acl/[A-Za-z0-9_-]+$", c.operations[0].path)
+  regex.match("^auth/[A-Za-z0-9_-]+/role/[A-Za-z0-9_-]+$", c.operations[3].path)
+  c.operations[0].path == c.operations[1].path
+  c.operations[1].path == c.operations[2].path
+  c.operations[3].path == c.operations[4].path
+  c.operations[4].path == c.operations[5].path
+  every_operation_hash_valid
+  b := input.context.service_actor_binding
+  count(b) == 5
+  b.version == "proposed-service-task-caller/v1"
+  b.transport_principal == "system:serviceaccount:secrets-engine:secrets-engine"
+  b.subject_id == input.subject.id
+  b.subject_type == "service"
+  b.tenant == input.tenant
+  not input.context.task_execution_projection
+  not input.context.initiator
+  not input.context.represented_principal
+  not input.context.delegation
+  input.resource.attributes.stage == "prod"
+  time.parse_rfc3339_ns(c.operation_deadline) > time.now_ns()
+  input.context.approval.schema_version == "0.1"
+  input.context.approval.kind == "approval-claim"
+  input.context.approval.issuer == "approval-engine"
+  input.context.approval.valid_now == true
+  input.context.approval.consumed == false
+  input.context.approval.reason_code == "ok"
+  input.context.approval.binding.pdp_path == true
+  hash_ok(input.context.approval.binding.pdp_digest)
+  time.parse_rfc3339_ns(input.context.approval.freshness.not_after) > time.now_ns()
+  time.parse_rfc3339_ns(input.context.approval.validity.expires_at) >= time.parse_rfc3339_ns(c.operation_deadline)
+  input.context.approval.binding.human_control == true
+}
+
+every_operation_hash_valid {
+  count([x | x := input.context.execution_contract.operations[_]; hash_ok(x.payload_sha256)]) == 6
+}
+```
+
+```rego test
+import data.flexauth.secrets_engine.service_task_execution
+
+test_unsigned_flags_cannot_enable {
+  service_task_execution.decision.effect == "deny"
+    with input as {"context": {"runtime_admission": true, "verified": true}}
+}
+```

examples/secrets-engine-service-task-execution/resource_manifest.yaml

@@ -0,0 +1,6 @@
+# Synthetic source-validation fixture only; no estate registry admission.
+resources:
+  - id: catalog:synthetic
+    system: secrets-engine
+    type: secret-catalog-lane
+    attributes: {stage: prod}