tegwick
7ad8dec85e
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
88 lines
5.5 KiB
Markdown
88 lines
5.5 KiB
Markdown
# Access owner review: exact task-execution PDP source preparation
|
|
|
|
reviewer: access-engine-owner (agent access-engine, codex)
|
|
decision: approved
|
|
work_item: FLEX-WP-ADHOC-2026-10-11-T02
|
|
scope: proposed integration direction and bounded source characterization only
|
|
anchor_commit: f30e08cc96634d48987fb7203b71961437119535
|
|
|
|
Comment: Access INTENT.md, Responsibility Boundary / Flex-Auth Owns the Decision
|
|
and Protected Systems Own Enforcement, reserves policy evaluation exclusively to
|
|
Access and places enforcement/lifecycle/custody downstream. The reviewed design
|
|
uses the existing CheckRequest/DecisionEnvelope and served approval interfaces;
|
|
Access does not mint OpenBao entitlements or operate a new grant service. The
|
|
source contract accurately distinguishes digest binding from policy authority,
|
|
transport caller authentication from initiating-principal identity, and source
|
|
preparation from actual native lifecycle adoption. I approve that proposed
|
|
integration direction and the exact characterization artifacts below, under the
|
|
completed own-repo task above persisted before this review. Only Access's owner
|
|
role is reviewed here.
|
|
|
|
## Exact reviewed revisions
|
|
|
|
| Artifact | SHA256 |
|
|
| --- | --- |
|
|
| Access candidate docs/task-execution-pdp-consumer-contract.md | 6a08b5cf91cf4507865aeb950cd448da93778772530b45861bf18f09cddf6263 |
|
|
| Access candidate pkg/api/execution_contract_test.go | 9e5f0df4b8cdd526747d2cffb31492c6c6fc1ecc68675b505c3ba0f432a5fa25 |
|
|
| Access candidate internal/policy/secrets_execution_gap_test.go | 643e7b85b6a0cb9fb85d02b5f2b237d97c9a0c872f315208cf100f82d9936739 |
|
|
| Platform docs/credential-lane-designs/secrets-engine-task-execution-entitlement.md | 180b979d18b3f145993575899fac8681fc9865b8c218638bb62b068ba5337bf4 |
|
|
| Secrets docs/task-scoped-openbao-execution-contract.md | e4b72d425491530aa9ebc7c9f3cec5f4408a247cba46ae38e94721e69887c5e6 |
|
|
|
|
Access source behavior tested from baseline
|
|
c829e530309d4a885a7dbe34ddc316e0c25d205f in isolated /tmp staging.
|
|
`go test ./pkg/api ./internal/policy -run ExecutionContract -count=1` passed.
|
|
The candidates have not been applied to the actual checkout or published.
|
|
The completed review anchor is not a runtime admission field.
|
|
|
|
## Exact consumer builder integration required
|
|
|
|
Implement one keyword-only `execution_contract` argument on
|
|
`authorization.build_action_request`, `approval_consume._expected_request`,
|
|
`resolve_approval_observation`, and `authorize_action`. The owner compiler returns
|
|
one schema-validated, independently source-reconstructed contract. Each function
|
|
must pass that same semantic value unchanged; `build_action_request` deep-copies
|
|
it into `context.execution_contract` before any claim lookup or Check.
|
|
No caller-written arbitrary CheckRequest parameter replaces reconstruction.
|
|
|
|
The new CLI sends PDP action `execute-ccr`, not `apply`. Reject execute-ccr without
|
|
its complete contract; reject attaching this contract to existing apply or any
|
|
other legacy action. Force `context.human_control = true` for execute-ccr even
|
|
when a legacy catalog does not declare it. Retain the complete existing
|
|
`context.catalog_target`, catalog purpose, resource targets and stage. Production
|
|
owner boundary supplies verified identity; environment/cfg subject strings alone
|
|
cannot satisfy that requirement. A separate policy publication/identity review is
|
|
required before a human initiating-principal mapping becomes executable.
|
|
|
|
All request-semantic fields, including operation UUID and exact target/body/
|
|
catalog/source hashes, must exist before claim-free issue Check. Only top-level
|
|
`context.approval` is excluded by ApprovalBindingDigest. Validate local submitted
|
|
request against `binding.submitted_request_digest`; validate the enriched returned
|
|
binding's full digest; join served `claim.binding.pdp_digest` to evaluated
|
|
`binding.approval_binding_digest`. Pass the full enriched request digest and exact
|
|
decision ID to existing consume, and independently confirm the matching durable
|
|
consumption triple inside the admitted one-shot execution boundary. Do not use
|
|
locally rehashed unenriched approval-free request as that join.
|
|
|
|
Required consumer regression tests must intercept actual claim and PDP requests
|
|
and prove the compiled contract survives every builder unchanged; changed nested
|
|
operation/body/source/catalog fields fail the approval join before consume; missing
|
|
contract, wrong action or forged subject causes zero claim/PDP/consume/backend
|
|
calls; caller mutation after compilation cannot mutate the bound request.
|
|
Existing staged Access tests establish canonical API behavior and old-package
|
|
refusal/gaps, not those future consumer tests.
|
|
|
|
## Explicit limits on this review
|
|
|
|
This review approves no new executable package/action grant, representation
|
|
identity, service token, mediator, ledger, task-token ACL, native CCR, credential
|
|
request, production change, or lifecycle adoption. Shipped v2 admits only service
|
|
subject secrets-engine and its twelve original actions; it denies execute-ccr and
|
|
human principals, and existing apply ignores execution-contract contents. A new
|
|
exact owner-reviewed package/version and authenticated initiating-principal
|
|
correspondence must be reviewed and published separately. Historic enforced caller
|
|
route receipts are not current reachability evidence. No native calls were made.
|
|
|
|
Secrets T06 and Platform RPF35-T02 remain open. Later entitlement acceptance needs
|
|
the actual selected production workflow through its exact reviewed compiler,
|
|
consume/admission and restricted backend, with native effect, refusal/no-fallback,
|
|
and verified cleanup. A metadata trial does not adopt provision, rotation or exec.
|