approval-engine/docs/reviews/2026-10-11-task-execution-consumption-source-owner-review.md

Approval Engine task execution consumption source owner review

reviewer: approval-engine-owner (agent approval-engine, codex)
decision: approved
comment: >-
  Source-only provider client and consumer contract are consistent with
  approval-engine INTENT.md Purpose, What approval-engine Owns, The Claim Shape,
  and Consumption Ordering under GH-DEC-2026-003: they supply exact durable
  approval consumption facts, never a PDP verdict or execution admission.
  Reviewed from the approval-engine checkout with its AGENTS.md/INTENT.md loaded,
  after own work item APPROVAL-WP-ADHOC-2026-10-11-T01 was persisted in
  097a2f28340c0e768a327e3aff998835ff8226d0, anchor SHA256
  6765012ef84045aa02cd68782ce2182149eaae0afbdd277c86d8ba7a6a545ad9.
  Exact source revision: execution_confirmation.py SHA256
  81dd085908e2aa3cb516af8a2660f2625fe9b5d1a5f2209725c139b8b8587318;
  test_execution_confirmation.py SHA256
  a1d54e3a6bf1dff70d91cf1853280b9ae1c33e44e5f7c0227aa2d17188a246f2;
  task-execution-consumption-contract.md SHA256
  b5f0a7e0d0b7812a35c98dc31d852660ebffb23c6c657303063becb12b22ee11.
  Approval covers these immutable source artifacts only. Actual admitted
  independent Platform mediator approval:read scope, service/agent consume
  identity, credential custody and authenticated transport/ingress reachability
  are absent; this judgement supplies none of them. No grant, human approval,
  native execution, deployment, T-06 proof or broader lifecycle adoption.

Existing source facts checked against api.py, auth.py, store.py and binding.py:

• POST /v1/approvals/{id}/consume is authenticated, tenant-isolated and service/agent-scoped. BEGIN IMMEDIATE plus status CAS emits use atomically. Engine validates request-digest syntax; it does not validate a PDP decision or independently equate request_digest to the stored approval-free digest.
• GET /v1/approvals/{id} is the existing approval:read confirmation source. It exposes persisted consumption request/decision/time and native binding; the claim endpoint's consumed boolean alone does not prove that tuple.
• Same-digest retries retain the original decision and consumed_at, including after expiry. A changed retry decision cannot be substituted by the client. Different digest conflicts. Consumed is terminal; it cannot be revoked or superseded to cancel further work. Historical confirmation renews no authority.
• The new client rejects changed identifiers, mismatched original decision, malformed times and coerced booleans, rejects decision-shaped payloads, compares exact act and approval-free digest on read, and filters returned facts. It performs no protected callback, native mutation or automatic retry.

Execution requires the independent mediator to obtain and validate a fresh human-controlled claim and exact Access DecisionEnvelope before CAS, match original approval-free/full request digests and owner-compiled body/target/source context, and persist confirmed original consumption in a separate live one-shot execution journal before native work. Merely possessing provider output, a local file or idempotent success is insufficient. Unknown consume/read outcomes stop execution and permit only owner reconciliation; another protected action needs fresh exact recovery approval. Original approval/PDP/operation deadlines govern continuation; scoped cleanup is separate. The client does not attest its caller's identity or prove these mediator preconditions.

The native binding still covers only the five act fields; context execution body digests rely on Access's actual approval-free and enriched CheckRequest digests. A new execute-ccr action/package/principal representation must be owner-published and explicitly admitted. Existing apply/v2 package semantics cannot be assumed to recognize it. No other owner role is reviewed here.

Validation reviewed: unchanged source/tests match the exact hashes above; 24 focused tests and 219 full staged tests passed with the existing JWT test-key warning. Existing authenticated in-process WSGI GET checks are source evidence, not a native admitted mediator proof. Source patch check passes. The original completed source-preparation outcome is preserved. APPROVAL-WP-0002-T01/T05 and all native/adoption owner tasks remain unchanged; no residual is promoted.