# Access owner review: typed Secrets execution-context source propagation

reviewer: access-engine-owner (agent access-engine, codex)
decision: approved
work_item: FLEX-WP-ADHOC-2026-10-11-T02
scope: exact bounded source descriptor and request propagation only

Comment: Access INTENT.md Responsibility Boundary reserves authorization decisions
to the sole PDP and places protected effects/enforcement with consumers. This
source patch introduces no competing decision or generic grant service. I agree
with the exact typed descriptor propagation through the four Secrets builders,
its existing canonical digest and approval-free/full joins, required production
human control, local catalogue fingerprint correspondence and deadline bounds.
This review uses the actual already completed own-repo T02 work record, persisted
before this review. Earlier owner reviews remain unchanged.

## Exact source revision and verification

Review manifest /tmp/secrets-execution-context-stage/manifest.json SHA256
32a419752e4a3ed7cf8f906fc40ebbaa516b9a4d6134be2df29243ce97213e40;
source baseline e24437607b67e95b4a93d49237af182ce0cc212e. Verified all six staged
file hashes against that manifest before review. The table records exact candidates.

| Target | Staged SHA256 |
| --- | --- |
| /home/worsch/secrets-engine/src/secrets_engine/execution_contract.py | 75323911c229cb8b49d5116706a329c3f9ec2efdbeab6bfac8dbf5b92729f14a |
| /home/worsch/secrets-engine/src/secrets_engine/authorization.py | 0ec4c3f7304d68abd06a0d08dc459e4f1f7269da0e4258549662be9e57b39fd3 |
| /home/worsch/secrets-engine/src/secrets_engine/approval_consume.py | 2c528667d017e0d3ba18d3fc24a7856585c532b40e3c7e9364646cb629b99274 |
| /home/worsch/secrets-engine/tests/test_execution_context.py | ab7630b7db7cf27caeec35cfad8c9fa16ce1e949111a225149b93359f011e1a9 |
| /home/worsch/secrets-engine/docs/task-scoped-openbao-execution-contract.md | ba7f0718cc91321550985ced68175a7ca4c097c50bac8a3a8d66c3a3868a4b5f |
| /home/worsch/secrets-engine/workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md | 231906182d8ba68f920520937c8bd3f26af50afb614bd2c7beb2cd6b2aa2391c |

Independently ran the manifest's six-suite source command in
/tmp/secrets-execution-context-check with bytecode/cache writes disabled:
99 passed in 0.65s. Tests exercise actual four builder functions, submitted
claim-bearing request/consume formatting, detached descriptor copies and semantic
mutation refusal. Existing envelope tests retain wrong package/version refusal.
The execution tests use a synthetic AuthorizationStub, not a shipped PDP grant.

## Binding and policy agreement

The descriptor is attached before served claim observation, retained by
_expected_request, resolve_approval_observation and authorize_action, and
included in canonical request context. Only context.approval is removed for
approval-free hashing. Live claim pdp_digest compares to PDP's enriched
approval_binding_digest; local exact submitted request compares to
submitted_request_digest; enriched full request digest is passed to consume.
No registry enrichment bypass or locally reconstructed unenriched issue digest
is substituted. Wrong package/version still fails existing provenance validation.

Distinct action execute-ccr refuses missing descriptor, descriptors on legacy
actions, non-prod/foreign tenant, catalogue fingerprint mismatch, expired deadline
and unserved approval fallback. Its human_control requirement cannot vanish on a
legacy bootstrap catalogue. Legacy twelve actions and existing service-jwt
execution readiness refusal remain in force; no new CLI entry point or mediator
is wired by these source candidates.

Actual shipped secrets-engine.catalog-lane.lifecycle v2 recognizes only the
original twelve actions and service subject secrets-engine. It denies execute-ccr
and human subjects. Existing apply's allowance ignores execution_contract and
cannot authorize this operation. Future exact action/package/version publication
and its negative fixtures require a separate Access owner review.

execution_actor service:secrets-engine is a bound descriptor string, not verified
transport or initiating-principal identity. Current builder subject_id/type still
come from configuration; propagation does not authenticate them. Kubernetes
TokenReview correspondence binds transport principal to protected system only.
An independently authenticated initiating-principal/representation contract remains
required before executable integration. No mapping between service identity and
initiating human is approved by this review.

## Shape limits and integration gates

The descriptor is compiler input whose shape is checked, not an owner-source
compiler or admitted scope. Endpoint regex permits different metadata policy and
auth-role names, duplicates and varied operation ordering; it does not enforce
exactly two reviewed objects or before/write/readback sequence. uses 1..12 with
one cleanup reservation is a syntax ceiling, not a verified native call budget.
Any well-shaped explicit-port HTTP/HTTPS origin can parse; no estate origin,
server authenticity, source path/digest provenance or target body is admitted.
The catalogue fingerprint is descriptor-local sorted JSON, distinct from PDP's
canonical request digest. The owner compiler/mediator must reconstruct/pin all
sources, exact two-object targets/bodies, native sequence, trusted initiator and
budget before effects. The descriptor parser is local compiler input: before any
untrusted API/file exposure, bound total/depth/size and normalize every malformed
parse into a closed refusal without leaking caller contents.

Root has independently reproduced synthetic inherited Approval transport
cross-origin redirect forwarding of bearer credentials; Approval owner repair is
pending. This review does not assert trusted consume transport or independent
confirmation integration is ready. Confirmation, one-shot durable journal,
authenticated owner mediator, exact native grant and protected cleanup are outside
this patch and remain mandatory before executable adoption.

Approval is limited to these exact source descriptor/propagation candidates. No
new policy/action grant, verified initiating identity, credential routing/issuance,
readiness activation, CLI handler, OpenBao effect or native lifecycle adoption is
approved. Secrets SECRETS-WP-0013 remains active; Secrets T06 and Platform
RPF35-T02 stay open. No native/credential/owner-checkout writes occurred in review.