access-engine/docs/reviews/2026-10-11-task-execution-provider-source.md

Access owner source contract and readiness receipt

reviewer: access-engine owner (agent access_task_execution_policy, Codex) disposition: bounded source contract acknowledged; executable readiness refused work_item: FLEX-WP-ADHOC-2026-10-11-T04

The completed own source-preparation anchor was persisted before this receipt: Access commit 1d3a8727f5, exact workplans/ADHOC-2026-10-11.md SHA256 4df32aafda0339a073bc2a512eef8d0db6686617ce6027ed554b3f5c68e4f2c6. All eight staged hashes were rechecked against immutable source manifest /tmp/access-execute-ccr-stage/manifest.json SHA256 e7a36575c1e521613cc6092371058833d7f43b6739c3cee5b0929cb90c708d88. The source maker and this owner-role reviewer are the same agent: this receipt is not an independent code review or foreign issuer/provider acceptance.

Bounded source agreement

Access INTENT Responsibility Boundary reserves policy decisions to the sole PDP, authentication to the identity layer, and protected effects to the consumer. The separate proposed secrets-engine.task-execution v1 package/action execute-ccr preserves that boundary: it neither overwrites lifecycle v2 nor translates apply into scoped task execution. Its literal owner_admission=false keeps the entire package closed today, including requests asserting verified, human_control or owner_admission. No consumer boolean can enable it.

The actual Secrets immutable descriptor and existing canonical full/approval-free digest joins are the appropriate input for exact operation/CCR/grant/catalogue, source, ordered target/body plan, expected states, budget and deadline binding. The candidate policy models one two-object GET/PUT/GET plan, not arbitrary apply/provision/exec. Independent Platform source/body compiler and native ACL scope remain required; shape/hash matching never establishes owner-source trust.

The source-only cryptographic verifier reuses existing KeyCape RS256 human access-token claim fields out of band. It uses owner-selected issuer/audience/ public-key pins and trusted server time; rejects service subjects, foreign or registration-only tenant provenance, missing/stale MFA, expiry/future activation, wrong issuer/audience/key/signature and ambiguous JSON. It returns opaque identity only. It is not wired into HTTP evaluation, issues no key/token, selects no real client, accepts no native issuer and makes no authorization decision.

Readiness refusal and owner dependencies

No authenticated initiating-human channel, admitted User/Tenant PIP retrieval, transport-to-human representation or server projection exists in this patch. The proposed task_execution_projection is an internal integration sketch, not an accepted public identity claim. Raw human JWTs must not enter CheckRequest, context, audit/decision records or receipts. Server implementation must reject or discard caller projection fields, independently verify KeyCape identity, acquire User membership/canonical-user facts and Tenant lifecycle facts through their actual authenticated interfaces, and impose the earliest freshness/lifetime ceiling. Service TokenReview proves transport only. Approval's human approver is not automatically the initiating human; a registration tenant is not membership.

This receipt does not accept anything on KeyCape, User Engine, Tenant Engine, Approval Engine, Platform or Secrets Engine's behalf. Actual client/audience, issuer/key admission, PIP transport and freshness contracts, and representation must receive their owners' acceptance and integration evidence. Removal of the hard refusal requires a separately reviewed versioned source successor, never an unsigned flag, helm value or literal flip in a runtime test.

Served approval claim validation and exact issue/full/submitted digest joins, trusted consume confirmation, owner compiler, durable journal and task grant/ cleanup mediation remain required independently. Existing SECRETS-WP-0013 and RPF-WP-0035-T12 drive integration; no clone driver or operational closure is introduced. Native lifecycle adoption and standing service authority stay false.

Actual source verification

Maker command in isolated staged Access source: GOCACHE=/tmp/access-taskexecution-go-cache go test -json ./internal/taskexecution ./internal/policy ./pkg/api. Terminal exit zero: 118 passing Go test events, including 24 new parent/subtest events, zero failures. Log /tmp/access-execute-ccr-stage/test-results.jsonl. Actual Secrets Python ExecutionContract.parse and canonical request/approval-free digest functions produce the same complete synthetic descriptor and digests as Go. OPA candidate allow and mutation denials use an isolated in-memory package with the hard false literal replaced for the test alone. The actual staged package remains false and denies all requests. These synthetic results prove source semantics/interoperability, not provider facts or an available runtime allow path. The cross-repo generator currently relies on the estate's Secrets virtualenv, and is not claimed to be a portable standalone fixture.

No native call, credential retrieval, package activation, foreign owner checkout write or privileged-action trial occurred. Exact source publication and independent code verification remain with the coordinator before adoption.