# Access owner source contract and readiness receipt

reviewer: access-engine owner (agent access_task_execution_policy, Codex)
disposition: bounded source contract acknowledged; executable readiness refused
work_item: FLEX-WP-ADHOC-2026-10-11-T04

The completed own source-preparation anchor was persisted before this receipt:
Access commit 1d3a8727f50d4e855e5ddda9f8746d0f2dabbc12, exact
workplans/ADHOC-2026-10-11.md SHA256
4df32aafda0339a073bc2a512eef8d0db6686617ce6027ed554b3f5c68e4f2c6.
All eight staged hashes were rechecked against immutable source manifest
/tmp/access-execute-ccr-stage/manifest.json SHA256
e7a36575c1e521613cc6092371058833d7f43b6739c3cee5b0929cb90c708d88.
The source maker and this owner-role reviewer are the same agent: this receipt
is not an independent code review or foreign issuer/provider acceptance.

## Bounded source agreement

Access INTENT Responsibility Boundary reserves policy decisions to the sole PDP,
authentication to the identity layer, and protected effects to the consumer.
The separate proposed secrets-engine.task-execution v1 package/action execute-ccr
preserves that boundary: it neither overwrites lifecycle v2 nor translates apply
into scoped task execution. Its literal owner_admission=false keeps the entire
package closed today, including requests asserting verified, human_control or
owner_admission. No consumer boolean can enable it.

The actual Secrets immutable descriptor and existing canonical full/approval-free
digest joins are the appropriate input for exact operation/CCR/grant/catalogue,
source, ordered target/body plan, expected states, budget and deadline binding.
The candidate policy models one two-object GET/PUT/GET plan, not arbitrary
apply/provision/exec. Independent Platform source/body compiler and native ACL
scope remain required; shape/hash matching never establishes owner-source trust.

The source-only cryptographic verifier reuses existing KeyCape RS256 human
access-token claim fields out of band. It uses owner-selected issuer/audience/
public-key pins and trusted server time; rejects service subjects, foreign or
registration-only tenant provenance, missing/stale MFA, expiry/future activation,
wrong issuer/audience/key/signature and ambiguous JSON. It returns opaque identity
only. It is not wired into HTTP evaluation, issues no key/token, selects no real
client, accepts no native issuer and makes no authorization decision.

## Readiness refusal and owner dependencies

No authenticated initiating-human channel, admitted User/Tenant PIP retrieval,
transport-to-human representation or server projection exists in this patch.
The proposed task_execution_projection is an internal integration sketch, not an
accepted public identity claim. Raw human JWTs must not enter CheckRequest,
context, audit/decision records or receipts. Server implementation must reject or
discard caller projection fields, independently verify KeyCape identity, acquire
User membership/canonical-user facts and Tenant lifecycle facts through their
actual authenticated interfaces, and impose the earliest freshness/lifetime
ceiling. Service TokenReview proves transport only. Approval's human approver is
not automatically the initiating human; a registration tenant is not membership.

This receipt does not accept anything on KeyCape, User Engine, Tenant Engine,
Approval Engine, Platform or Secrets Engine's behalf. Actual client/audience,
issuer/key admission, PIP transport and freshness contracts, and representation
must receive their owners' acceptance and integration evidence. Removal of the
hard refusal requires a separately reviewed versioned source successor, never
an unsigned flag, helm value or literal flip in a runtime test.

Served approval claim validation and exact issue/full/submitted digest joins,
trusted consume confirmation, owner compiler, durable journal and task grant/
cleanup mediation remain required independently. Existing SECRETS-WP-0013 and
RPF-WP-0035-T12 drive integration; no clone driver or operational closure is
introduced. Native lifecycle adoption and standing service authority stay false.

## Actual source verification

Maker command in isolated staged Access source:
GOCACHE=/tmp/access-taskexecution-go-cache go test -json
./internal/taskexecution ./internal/policy ./pkg/api.
Terminal exit zero: 118 passing Go test events, including 24 new parent/subtest
events, zero failures. Log /tmp/access-execute-ccr-stage/test-results.jsonl.
Actual Secrets Python ExecutionContract.parse and canonical request/approval-free
digest functions produce the same complete synthetic descriptor and digests as
Go. OPA candidate allow and mutation denials use an isolated in-memory package
with the hard false literal replaced for the test alone. The actual staged
package remains false and denies all requests. These synthetic results prove
source semantics/interoperability, not provider facts or an available runtime
allow path. The cross-repo generator currently relies on the estate's Secrets
virtualenv, and is not claimed to be a portable standalone fixture.

No native call, credential retrieval, package activation, foreign owner checkout
write or privileged-action trial occurred. Exact source publication and independent
code verification remain with the coordinator before adoption.