Bound approval transport and refuse redirects and proxies

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/task-execution-consumption-contract.md

@@ -141,3 +141,51 @@ change, wrong act/target/actor/principal/purpose/digest/decision refusal, strict
 booleans/time, denied read, filtered evidence and idempotency after expiry with
 terminal revoke/supersede refusal. Staged full suite: 219 passed, one existing
 JWT short-test-key warning. No production HTTP/DB/OpenBao call or native action.
+
+
+## Transport repair proposal after local redirect counterexample
+
+The original source review above does not attest the inherited transport's
+authoritative reachability. A later synthetic two-origin counterexample proved
+that urllib's previous default followed a redirect, forwarded Authorization and
+accepted its JSON. This is retained as a failed transport outcome, not rewritten
+into a success. Bounded source repair is a new demand under
+APPROVAL-WP-ADHOC-2026-10-11-T02, without residual promotion or native admission.
+
+The staged default ApprovalHTTPClient transport uses the fixed provider-owned
+http_transport.py child via the current Python executable with -I. Request data,
+including bearer material, travels only through private process pipes, never
+argv, logs or diagnostic output. The child receives an empty environment; environment proxy settings are ignored, every
+redirect refuses without issuing another request, status must be exactly 200,
+Content-Type must be a single application/json with UTF-8 (or no charset),
+compressed/oversized/inconsistent responses refuse, and duplicate-key/non-finite/
+malformed/non-object JSON refuses. Backend/error bodies are not read or exposed.
+Public errors contain closed provider messages and numeric status only.
+
+The parent's subprocess timeout covers DNS/connect/TLS/header/body/error-close
+and process cleanup for the fixed child, which has no retry or subprocess
+descendants. It avoids SIGALRM and multiprocessing-spawn main-guard requirements
+so default SDK calls remain usable in worker threads and ordinary scripts.
+The token is read from a bounded local regular file using nonblocking/no-follow
+descriptor traversal: no symlink component, final hardlink, other-readable or
+group-writable mode, non-current/non-root owner, FIFO/directory or oversized
+credential is accepted. Restrictive current/root-owned group-readable files
+(such as 0440) are permitted; unknown projected/symlink credential layouts must
+be corrected by the custody owner, never silently followed or substituted.
+Only ASCII non-whitespace bearer content is admitted; credential errors do not
+republish paths or values. The file is reopened every request, retaining rotation.
+
+The explicit opener injection is retained solely as a trusted owner test-adapter
+seam; it does not inherit isolated/default transport admission or total deadline
+guarantees. Supplying urllib.urlopen as an injected opener recreates its own
+redirect/proxy behavior and must not be admitted as production execution
+confirmation. Native mediator implementation must use this fixed default or a
+separately reviewed equivalent; caller-selected transport code is unacceptable.
+The default code still supports HTTP for reviewed private estate routes; source
+validation does not prove TLS, the actual server origin, deployed custody/read
+scope or ingress admission. No native identity/profile is widened.
+
+After a timeout/refusal, consume remains potentially unknown and cannot be
+retried to infer absence. Fresh exact claim/PDP validation, returned original
+consumption correspondence and separate one-shot journal remain required.
+This is a transport repair only, never an execution authority or replay service.