tegwick
24c1f56f00
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
86 lines
5.2 KiB
Markdown
86 lines
5.2 KiB
Markdown
# Access owner source contract and readiness receipt
|
|
|
|
reviewer: access-engine owner (agent access_task_execution_policy, Codex)
|
|
disposition: bounded source contract acknowledged; executable readiness refused
|
|
work_item: FLEX-WP-ADHOC-2026-10-11-T04
|
|
|
|
The completed own source-preparation anchor was persisted before this receipt:
|
|
Access commit 1d3a8727f50d4e855e5ddda9f8746d0f2dabbc12, exact
|
|
workplans/ADHOC-2026-10-11.md SHA256
|
|
4df32aafda0339a073bc2a512eef8d0db6686617ce6027ed554b3f5c68e4f2c6.
|
|
All eight staged hashes were rechecked against immutable source manifest
|
|
/tmp/access-execute-ccr-stage/manifest.json SHA256
|
|
e7a36575c1e521613cc6092371058833d7f43b6739c3cee5b0929cb90c708d88.
|
|
The source maker and this owner-role reviewer are the same agent: this receipt
|
|
is not an independent code review or foreign issuer/provider acceptance.
|
|
|
|
## Bounded source agreement
|
|
|
|
Access INTENT Responsibility Boundary reserves policy decisions to the sole PDP,
|
|
authentication to the identity layer, and protected effects to the consumer.
|
|
The separate proposed secrets-engine.task-execution v1 package/action execute-ccr
|
|
preserves that boundary: it neither overwrites lifecycle v2 nor translates apply
|
|
into scoped task execution. Its literal owner_admission=false keeps the entire
|
|
package closed today, including requests asserting verified, human_control or
|
|
owner_admission. No consumer boolean can enable it.
|
|
|
|
The actual Secrets immutable descriptor and existing canonical full/approval-free
|
|
digest joins are the appropriate input for exact operation/CCR/grant/catalogue,
|
|
source, ordered target/body plan, expected states, budget and deadline binding.
|
|
The candidate policy models one two-object GET/PUT/GET plan, not arbitrary
|
|
apply/provision/exec. Independent Platform source/body compiler and native ACL
|
|
scope remain required; shape/hash matching never establishes owner-source trust.
|
|
|
|
The source-only cryptographic verifier reuses existing KeyCape RS256 human
|
|
access-token claim fields out of band. It uses owner-selected issuer/audience/
|
|
public-key pins and trusted server time; rejects service subjects, foreign or
|
|
registration-only tenant provenance, missing/stale MFA, expiry/future activation,
|
|
wrong issuer/audience/key/signature and ambiguous JSON. It returns opaque identity
|
|
only. It is not wired into HTTP evaluation, issues no key/token, selects no real
|
|
client, accepts no native issuer and makes no authorization decision.
|
|
|
|
## Readiness refusal and owner dependencies
|
|
|
|
No authenticated initiating-human channel, admitted User/Tenant PIP retrieval,
|
|
transport-to-human representation or server projection exists in this patch.
|
|
The proposed task_execution_projection is an internal integration sketch, not an
|
|
accepted public identity claim. Raw human JWTs must not enter CheckRequest,
|
|
context, audit/decision records or receipts. Server implementation must reject or
|
|
discard caller projection fields, independently verify KeyCape identity, acquire
|
|
User membership/canonical-user facts and Tenant lifecycle facts through their
|
|
actual authenticated interfaces, and impose the earliest freshness/lifetime
|
|
ceiling. Service TokenReview proves transport only. Approval's human approver is
|
|
not automatically the initiating human; a registration tenant is not membership.
|
|
|
|
This receipt does not accept anything on KeyCape, User Engine, Tenant Engine,
|
|
Approval Engine, Platform or Secrets Engine's behalf. Actual client/audience,
|
|
issuer/key admission, PIP transport and freshness contracts, and representation
|
|
must receive their owners' acceptance and integration evidence. Removal of the
|
|
hard refusal requires a separately reviewed versioned source successor, never
|
|
an unsigned flag, helm value or literal flip in a runtime test.
|
|
|
|
Served approval claim validation and exact issue/full/submitted digest joins,
|
|
trusted consume confirmation, owner compiler, durable journal and task grant/
|
|
cleanup mediation remain required independently. Existing SECRETS-WP-0013 and
|
|
RPF-WP-0035-T12 drive integration; no clone driver or operational closure is
|
|
introduced. Native lifecycle adoption and standing service authority stay false.
|
|
|
|
## Actual source verification
|
|
|
|
Maker command in isolated staged Access source:
|
|
GOCACHE=/tmp/access-taskexecution-go-cache go test -json
|
|
./internal/taskexecution ./internal/policy ./pkg/api.
|
|
Terminal exit zero: 118 passing Go test events, including 24 new parent/subtest
|
|
events, zero failures. Log /tmp/access-execute-ccr-stage/test-results.jsonl.
|
|
Actual Secrets Python ExecutionContract.parse and canonical request/approval-free
|
|
digest functions produce the same complete synthetic descriptor and digests as
|
|
Go. OPA candidate allow and mutation denials use an isolated in-memory package
|
|
with the hard false literal replaced for the test alone. The actual staged
|
|
package remains false and denies all requests. These synthetic results prove
|
|
source semantics/interoperability, not provider facts or an available runtime
|
|
allow path. The cross-repo generator currently relies on the estate's Secrets
|
|
virtualenv, and is not claimed to be a portable standalone fixture.
|
|
|
|
No native call, credential retrieval, package activation, foreign owner checkout
|
|
write or privileged-action trial occurred. Exact source publication and independent
|
|
code verification remain with the coordinator before adoption.
|