access-engine/docs/reviews/2026-10-11-task-execution-pdp-source.md

Access owner review: exact task-execution PDP source preparation

reviewer: access-engine-owner (agent access-engine, codex) decision: approved work_item: FLEX-WP-ADHOC-2026-10-11-T02 scope: proposed integration direction and bounded source characterization only anchor_commit: f30e08cc96

Comment: Access INTENT.md, Responsibility Boundary / Flex-Auth Owns the Decision and Protected Systems Own Enforcement, reserves policy evaluation exclusively to Access and places enforcement/lifecycle/custody downstream. The reviewed design uses the existing CheckRequest/DecisionEnvelope and served approval interfaces; Access does not mint OpenBao entitlements or operate a new grant service. The source contract accurately distinguishes digest binding from policy authority, transport caller authentication from initiating-principal identity, and source preparation from actual native lifecycle adoption. I approve that proposed integration direction and the exact characterization artifacts below, under the completed own-repo task above persisted before this review. Only Access's owner role is reviewed here.

Exact reviewed revisions

Artifact	SHA256
Access candidate docs/task-execution-pdp-consumer-contract.md	6a08b5cf91cf4507865aeb950cd448da93778772530b45861bf18f09cddf6263
Access candidate pkg/api/execution_contract_test.go	9e5f0df4b8cdd526747d2cffb31492c6c6fc1ecc68675b505c3ba0f432a5fa25
Access candidate internal/policy/secrets_execution_gap_test.go	643e7b85b6a0cb9fb85d02b5f2b237d97c9a0c872f315208cf100f82d9936739
Platform docs/credential-lane-designs/secrets-engine-task-execution-entitlement.md	180b979d18b3f145993575899fac8681fc9865b8c218638bb62b068ba5337bf4
Secrets docs/task-scoped-openbao-execution-contract.md	e4b72d425491530aa9ebc7c9f3cec5f4408a247cba46ae38e94721e69887c5e6

Access source behavior tested from baseline c829e53030 in isolated /tmp staging. go test ./pkg/api ./internal/policy -run ExecutionContract -count=1 passed. The candidates have not been applied to the actual checkout or published. The completed review anchor is not a runtime admission field.

Exact consumer builder integration required

Implement one keyword-only execution_contract argument on authorization.build_action_request, approval_consume._expected_request, resolve_approval_observation, and authorize_action. The owner compiler returns one schema-validated, independently source-reconstructed contract. Each function must pass that same semantic value unchanged; build_action_request deep-copies it into context.execution_contract before any claim lookup or Check. No caller-written arbitrary CheckRequest parameter replaces reconstruction.

The new CLI sends PDP action execute-ccr, not apply. Reject execute-ccr without its complete contract; reject attaching this contract to existing apply or any other legacy action. Force context.human_control = true for execute-ccr even when a legacy catalog does not declare it. Retain the complete existing context.catalog_target, catalog purpose, resource targets and stage. Production owner boundary supplies verified identity; environment/cfg subject strings alone cannot satisfy that requirement. A separate policy publication/identity review is required before a human initiating-principal mapping becomes executable.

All request-semantic fields, including operation UUID and exact target/body/ catalog/source hashes, must exist before claim-free issue Check. Only top-level context.approval is excluded by ApprovalBindingDigest. Validate local submitted request against binding.submitted_request_digest; validate the enriched returned binding's full digest; join served claim.binding.pdp_digest to evaluated binding.approval_binding_digest. Pass the full enriched request digest and exact decision ID to existing consume, and independently confirm the matching durable consumption triple inside the admitted one-shot execution boundary. Do not use locally rehashed unenriched approval-free request as that join.

Required consumer regression tests must intercept actual claim and PDP requests and prove the compiled contract survives every builder unchanged; changed nested operation/body/source/catalog fields fail the approval join before consume; missing contract, wrong action or forged subject causes zero claim/PDP/consume/backend calls; caller mutation after compilation cannot mutate the bound request. Existing staged Access tests establish canonical API behavior and old-package refusal/gaps, not those future consumer tests.

Explicit limits on this review

This review approves no new executable package/action grant, representation identity, service token, mediator, ledger, task-token ACL, native CCR, credential request, production change, or lifecycle adoption. Shipped v2 admits only service subject secrets-engine and its twelve original actions; it denies execute-ccr and human principals, and existing apply ignores execution-contract contents. A new exact owner-reviewed package/version and authenticated initiating-principal correspondence must be reviewed and published separately. Historic enforced caller route receipts are not current reachability evidence. No native calls were made.

Secrets T06 and Platform RPF35-T02 remain open. Later entitlement acceptance needs the actual selected production workflow through its exact reviewed compiler, consume/admission and restricted backend, with native effect, refusal/no-fallback, and verified cleanup. A metadata trial does not adopt provision, rotation or exec.