access-engine/docs/reviews/2026-10-11-secrets-execution-context-source.md

Access owner review: typed Secrets execution-context source propagation

reviewer: access-engine-owner (agent access-engine, codex) decision: approved work_item: FLEX-WP-ADHOC-2026-10-11-T02 scope: exact bounded source descriptor and request propagation only

Comment: Access INTENT.md Responsibility Boundary reserves authorization decisions to the sole PDP and places protected effects/enforcement with consumers. This source patch introduces no competing decision or generic grant service. I agree with the exact typed descriptor propagation through the four Secrets builders, its existing canonical digest and approval-free/full joins, required production human control, local catalogue fingerprint correspondence and deadline bounds. This review uses the actual already completed own-repo T02 work record, persisted before this review. Earlier owner reviews remain unchanged.

Exact source revision and verification

Review manifest /tmp/secrets-execution-context-stage/manifest.json SHA256 32a419752e4a3ed7cf8f906fc40ebbaa516b9a4d6134be2df29243ce97213e40; source baseline e24437607b67e95b4a93d49237af182ce0cc212e. Verified all six staged file hashes against that manifest before review. The table records exact candidates.

Target	Staged SHA256
/home/worsch/secrets-engine/src/secrets_engine/execution_contract.py	75323911c229cb8b49d5116706a329c3f9ec2efdbeab6bfac8dbf5b92729f14a
/home/worsch/secrets-engine/src/secrets_engine/authorization.py	0ec4c3f7304d68abd06a0d08dc459e4f1f7269da0e4258549662be9e57b39fd3
/home/worsch/secrets-engine/src/secrets_engine/approval_consume.py	2c528667d017e0d3ba18d3fc24a7856585c532b40e3c7e9364646cb629b99274
/home/worsch/secrets-engine/tests/test_execution_context.py	ab7630b7db7cf27caeec35cfad8c9fa16ce1e949111a225149b93359f011e1a9
/home/worsch/secrets-engine/docs/task-scoped-openbao-execution-contract.md	ba7f0718cc91321550985ced68175a7ca4c097c50bac8a3a8d66c3a3868a4b5f
/home/worsch/secrets-engine/workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md	231906182d8ba68f920520937c8bd3f26af50afb614bd2c7beb2cd6b2aa2391c

Independently ran the manifest's six-suite source command in /tmp/secrets-execution-context-check with bytecode/cache writes disabled: 99 passed in 0.65s. Tests exercise actual four builder functions, submitted claim-bearing request/consume formatting, detached descriptor copies and semantic mutation refusal. Existing envelope tests retain wrong package/version refusal. The execution tests use a synthetic AuthorizationStub, not a shipped PDP grant.

Binding and policy agreement

The descriptor is attached before served claim observation, retained by _expected_request, resolve_approval_observation and authorize_action, and included in canonical request context. Only context.approval is removed for approval-free hashing. Live claim pdp_digest compares to PDP's enriched approval_binding_digest; local exact submitted request compares to submitted_request_digest; enriched full request digest is passed to consume. No registry enrichment bypass or locally reconstructed unenriched issue digest is substituted. Wrong package/version still fails existing provenance validation.

Distinct action execute-ccr refuses missing descriptor, descriptors on legacy actions, non-prod/foreign tenant, catalogue fingerprint mismatch, expired deadline and unserved approval fallback. Its human_control requirement cannot vanish on a legacy bootstrap catalogue. Legacy twelve actions and existing service-jwt execution readiness refusal remain in force; no new CLI entry point or mediator is wired by these source candidates.

Actual shipped secrets-engine.catalog-lane.lifecycle v2 recognizes only the original twelve actions and service subject secrets-engine. It denies execute-ccr and human subjects. Existing apply's allowance ignores execution_contract and cannot authorize this operation. Future exact action/package/version publication and its negative fixtures require a separate Access owner review.

execution_actor service:secrets-engine is a bound descriptor string, not verified transport or initiating-principal identity. Current builder subject_id/type still come from configuration; propagation does not authenticate them. Kubernetes TokenReview correspondence binds transport principal to protected system only. An independently authenticated initiating-principal/representation contract remains required before executable integration. No mapping between service identity and initiating human is approved by this review.

Shape limits and integration gates

The descriptor is compiler input whose shape is checked, not an owner-source compiler or admitted scope. Endpoint regex permits different metadata policy and auth-role names, duplicates and varied operation ordering; it does not enforce exactly two reviewed objects or before/write/readback sequence. uses 1..12 with one cleanup reservation is a syntax ceiling, not a verified native call budget. Any well-shaped explicit-port HTTP/HTTPS origin can parse; no estate origin, server authenticity, source path/digest provenance or target body is admitted. The catalogue fingerprint is descriptor-local sorted JSON, distinct from PDP's canonical request digest. The owner compiler/mediator must reconstruct/pin all sources, exact two-object targets/bodies, native sequence, trusted initiator and budget before effects. The descriptor parser is local compiler input: before any untrusted API/file exposure, bound total/depth/size and normalize every malformed parse into a closed refusal without leaking caller contents.

Root has independently reproduced synthetic inherited Approval transport cross-origin redirect forwarding of bearer credentials; Approval owner repair is pending. This review does not assert trusted consume transport or independent confirmation integration is ready. Confirmation, one-shot durable journal, authenticated owner mediator, exact native grant and protected cleanup are outside this patch and remain mandatory before executable adoption.

Approval is limited to these exact source descriptor/propagation candidates. No new policy/action grant, verified initiating identity, credential routing/issuance, readiness activation, CLI handler, OpenBao effect or native lifecycle adoption is approved. Secrets SECRETS-WP-0013 remains active; Secrets T06 and Platform RPF35-T02 stay open. No native/credential/owner-checkout writes occurred in review.