# Access owner review: exact task-execution PDP source preparation

reviewer: access-engine-owner (agent access-engine, codex)
decision: approved
work_item: FLEX-WP-ADHOC-2026-10-11-T02
scope: proposed integration direction and bounded source characterization only
anchor_commit: f30e08cc96634d48987fb7203b71961437119535

Comment: Access INTENT.md, Responsibility Boundary / Flex-Auth Owns the Decision
and Protected Systems Own Enforcement, reserves policy evaluation exclusively to
Access and places enforcement/lifecycle/custody downstream. The reviewed design
uses the existing CheckRequest/DecisionEnvelope and served approval interfaces;
Access does not mint OpenBao entitlements or operate a new grant service. The
source contract accurately distinguishes digest binding from policy authority,
transport caller authentication from initiating-principal identity, and source
preparation from actual native lifecycle adoption. I approve that proposed
integration direction and the exact characterization artifacts below, under the
completed own-repo task above persisted before this review. Only Access's owner
role is reviewed here.

## Exact reviewed revisions

| Artifact | SHA256 |
| --- | --- |
| Access candidate docs/task-execution-pdp-consumer-contract.md | 6a08b5cf91cf4507865aeb950cd448da93778772530b45861bf18f09cddf6263 |
| Access candidate pkg/api/execution_contract_test.go | 9e5f0df4b8cdd526747d2cffb31492c6c6fc1ecc68675b505c3ba0f432a5fa25 |
| Access candidate internal/policy/secrets_execution_gap_test.go | 643e7b85b6a0cb9fb85d02b5f2b237d97c9a0c872f315208cf100f82d9936739 |
| Platform docs/credential-lane-designs/secrets-engine-task-execution-entitlement.md | 180b979d18b3f145993575899fac8681fc9865b8c218638bb62b068ba5337bf4 |
| Secrets docs/task-scoped-openbao-execution-contract.md | e4b72d425491530aa9ebc7c9f3cec5f4408a247cba46ae38e94721e69887c5e6 |

Access source behavior tested from baseline
c829e530309d4a885a7dbe34ddc316e0c25d205f in isolated /tmp staging.
`go test ./pkg/api ./internal/policy -run ExecutionContract -count=1` passed.
The candidates have not been applied to the actual checkout or published.
The completed review anchor is not a runtime admission field.

## Exact consumer builder integration required

Implement one keyword-only `execution_contract` argument on
`authorization.build_action_request`, `approval_consume._expected_request`,
`resolve_approval_observation`, and `authorize_action`. The owner compiler returns
one schema-validated, independently source-reconstructed contract. Each function
must pass that same semantic value unchanged; `build_action_request` deep-copies
it into `context.execution_contract` before any claim lookup or Check.
No caller-written arbitrary CheckRequest parameter replaces reconstruction.

The new CLI sends PDP action `execute-ccr`, not `apply`. Reject execute-ccr without
its complete contract; reject attaching this contract to existing apply or any
other legacy action. Force `context.human_control = true` for execute-ccr even
when a legacy catalog does not declare it. Retain the complete existing
`context.catalog_target`, catalog purpose, resource targets and stage. Production
owner boundary supplies verified identity; environment/cfg subject strings alone
cannot satisfy that requirement. A separate policy publication/identity review is
required before a human initiating-principal mapping becomes executable.

All request-semantic fields, including operation UUID and exact target/body/
catalog/source hashes, must exist before claim-free issue Check. Only top-level
`context.approval` is excluded by ApprovalBindingDigest. Validate local submitted
request against `binding.submitted_request_digest`; validate the enriched returned
binding's full digest; join served `claim.binding.pdp_digest` to evaluated
`binding.approval_binding_digest`. Pass the full enriched request digest and exact
decision ID to existing consume, and independently confirm the matching durable
consumption triple inside the admitted one-shot execution boundary. Do not use
locally rehashed unenriched approval-free request as that join.

Required consumer regression tests must intercept actual claim and PDP requests
and prove the compiled contract survives every builder unchanged; changed nested
operation/body/source/catalog fields fail the approval join before consume; missing
contract, wrong action or forged subject causes zero claim/PDP/consume/backend
calls; caller mutation after compilation cannot mutate the bound request.
Existing staged Access tests establish canonical API behavior and old-package
refusal/gaps, not those future consumer tests.

## Explicit limits on this review

This review approves no new executable package/action grant, representation
identity, service token, mediator, ledger, task-token ACL, native CCR, credential
request, production change, or lifecycle adoption. Shipped v2 admits only service
subject secrets-engine and its twelve original actions; it denies execute-ccr and
human principals, and existing apply ignores execution-contract contents. A new
exact owner-reviewed package/version and authenticated initiating-principal
correspondence must be reviewed and published separately. Historic enforced caller
route receipts are not current reachability evidence. No native calls were made.

Secrets T06 and Platform RPF35-T02 remain open. Later entitlement acceptance needs
the actual selected production workflow through its exact reviewed compiler,
consume/admission and restricted backend, with native effect, refusal/no-fallback,
and verified cleanup. A metadata trial does not adopt provision, rotation or exec.