approval-engine/workplans/ADHOC-2026-10-11.md

id	type	title	domain	repo	status	owner	created	updated	flavor	state_hub_workstream_id
APPROVAL-WP-ADHOC-2026-10-11	workplan	Strict execution consume-confirmation client source preparation	infotech	approval-engine	finished	codex	2026-10-11	2026-10-11	implementation	77fca3cc-64dc-5c31-915e-999dde18eee5

Strict execution consume-confirmation client source preparation

Explicit new demand: review the Secrets/Platform metadata execute-ccr consumer contract and prepare the smallest provider client refinement using existing approval-engine authenticated consumption/read routes. This bounded reversible source preparation creates no new runtime surface or native operation. It does not promote or implement APPROVAL-WP-0002's residual adoption obligations.

Prepare and validate strict direct evidence and independent read confirmation

id: APPROVAL-WP-ADHOC-2026-10-11-T01
status: done
priority: medium
state_hub_task_id: "57b7db4f-87d5-503d-974a-af21c05cde21"

Completed source preparation: approval_engine/execution_confirmation.py adds consume_exact and confirm_consumption through existing POST consume and GET approval routes. Exact original approval/request/decision/time, native act, approval-free PDP digest and explicit declarations are checked; output is filtered to non-secret consumption metadata. No server API, identity scope, grant service, standing permission, protected callback or journal implementation was added.

INTENT basis: Purpose, What approval-engine Owns, The Claim Shape and Consumption Ordering. This remains Engine/PIP factual evidence: the caller independently validates the Access decision and retains one-shot execution admission. The source-only contract documents terminal consumption, expiry/idempotency limits, context/act digest separation and unproved identity/read reachability. It is author-qualified technical preparation, not formal delegated owner assent.

Validation: 24 new focused tests and 219 staged full tests passed. Tests prove authenticated existing-route read with no extra mutation/outbox event, refusal of changed act/digest/decision and malformed declarations/receipts, filtered output, denied read, original-decision idempotency after expiry, and terminal revoke/supersede behavior. Existing JWT short-test-key warning retained. Patch apply-check passed. Source client and test SHA256s are immutable in the staged SHA256SUMS. No production HTTP, production DB, OpenBao, credentials or native state were accessed.

The actual Platform mediator's approval:read identity, custody and ingress/ transport admission remain unproved. Production action/package/initiating principal admission remains with Access/Identity; Platform owns the execution journal and native metadata pilot; Secrets owns dispatch and strict handoff. These are existing owner obligations, outside this completed source-preparation task. No new residual adoption record is created and none is marked complete. Existing APPROVAL-WP-0002-T01/T05, SECRETS-WP-0013, SECRETS-WP-0008-T06 and RPF-WP-0035-T02 retain their original statuses and authority boundaries.

Formal review, if requested, must follow persistence of this work record in the actual owner checkout. This staged file is the proposed workrecord-before-review anchor; it does not establish a persisted anchor or approval by its presence.

Formal source owner review after persisted preparation anchor

Under the same bounded APPROVAL-WP-ADHOC-2026-10-11-T01 new-demand record, the approval-engine owner worker performed formal source judgement only after 097a2f2834 persisted the original preparation record (SHA256 6765012ef84045aa02cd68782ce2182149eaae0afbdd277c86d8ba7a6a545ad9). The preceding proposed-anchor paragraph describes that earlier stage; the persisted preparation evidence now supplies the workrecord-before-review anchor.

Decision: approved for the unchanged exact provider sourceclient, tests and source-only consumption contract. Review: docs/reviews/2026-10-11-task-execution- consumption-source-owner-review.md. Exact hashes and INTENT basis are recorded there. Original task status, validation and source-preparation outcome retained. The review does not assert actual mediator identity/read scope, custody or transport admission. Fresh claim/PDP validation, returned original consumption correspondence and a separate one-shot journal remain caller obligations. No grant, native acceptance, deployment, human approval, residual promotion or full-adoption closure was recorded.

Repair fixed-origin confirmation transport after synthetic credential redirect

id: APPROVAL-WP-ADHOC-2026-10-11-T02
status: done
priority: high

New bounded source demand, distinct from completed T01: the Custodian synthetic two-origin counterexample proved the inherited ApprovalHTTPClient default could follow cross-origin redirects, forward Authorization and accept redirected JSON. Original T01 source review and its outcome are preserved; they did not prove this transport boundary. The failure receipt is the-custodian/docs/evidence/ 2026-10-10-security-consolidation/approval-confirmation-transport-counterexample.json.

Completed staged source preparation adds fixed-provider isolated default HTTP transport with no environment proxies or redirects, exact 200/JSON/content/body limits, duplicate/nonfinite JSON refusal, closed errors and bounded whole-network request deadline including exceptional close. Process isolation retains threaded SDK support without signals or multiprocessing main-guard requirements. Protected local credential reads refuse symlink components, hardlinks, public/group-writable files, unknown owners, special files and excessive/invalid contents; token rotation through reread remains supported. Explicit test-opener injection is retained as an owner-controlled seam, not an admitted production transport.

INTENT basis: deterministic authentic approval facts, exact binding and fail-closed consumption evidence in Purpose, Claim Shape and Consumption Ordering. This source repair does not add a policy decision, grant, caller attestation, execution journal or privileged replay service.

Validation: 270 staged full tests passed, with the existing JWT test-key warning; 51 new transport cases include cross-origin GET/POST redirects (zero second-origin requests/headers), ignored environment proxies, status/content/size/JSON/error refusals, total deadline under slow headers/dribbled body/error body from a worker thread, safe exceptional close and credential-file guards. Existing PEP and exact consumption tests remain covered after their synthetic token fixture modes become explicitly private. Native credentials, custody, OpenBao or production APIs were not accessed. Immutable staged hashes are in normalized-source-manifest.json and SHA256SUMS; source patch checks against the current owner checkout.

This completed task records local source preparation only. Formal updated owner review must follow persistence of T02 in the actual owner checkout. No formal updated review is written at this preparation stage. Actual mediator read/consume identity, credential custody, transport/server identity and ingress admission are unproved. Fresh claim/PDP validation, returned original consumption tuple and a separate live one-shot execution journal remain mandatory. Existing adoption/ native obligations retain their owners/statuses; no residual is promoted.

Formal T02 transport source review after persisted preparation

The approval-engine owner worker reviewed the exact unchanged T02 staged sources from the actual owner checkout after commit 2eb045bfbf persisted its completed source-preparation anchor (SHA256 3e09a565dca3b7ffcff8bed209e39f56a158dcaa63945007a096f244b9d86088). Decision: approved for bounded source repair only. Review entry: docs/reviews/2026-10-11-confirmation-transport-repair-owner-review.md. The original T01 review, redirect failure, T02 preparation outcome, task statuses and generated identifiers remain unchanged; this is a refinement of the same bounded repair, not another claimed success.

Exact reviewed sources/tests/contract and limitations are pinned in that entry. Default transport is the reviewed fixed child; injected opener remains solely an owner-controlled test seam and is not admitted authoritative transport. No review establishes actual credential path, mediator scope/custody, server identity/ingress, deployment, native effect, new grant, residual promotion or adoption closure. Fresh claim/PDP plus original exact consumption and a separate one-shot journal remain mandatory.