informed-decision/docs/requester-workload-owner-review.md

Requester workload owner source review — 2026-10-04

Owning task: INFD-WP-0005-T05. Platform request: 2c1507b2-b361-4ef9-b5d4-3245014c7c52, thread f84637fa-2355-4971-a2dc-7f1fd01710a8. Reviewed platform source: 6b91d510395215d178d60ee8884e7fc00930a0cf, proposed CCR-2026-0032.

Source binding acceptance

The founder-approved namespace trust boundary matches the existing create-only requester registration. Accept the dedicated ESO auth identity informed-decision/informed-decision-eso, audience openbao, exact-path policy, 900-second reader limits and namespace-restricted store for owner integration. The receiving review pod keeps ServiceAccount review and UID/GID/fsGroup 10001. Accept the required read-only 0440 projected key client-secret at /var/run/secrets/informed-decision/requester/client-secret, without subPath. No new issuer registration, custody seed, scope, browser route or human act is introduced. This is source acceptance; it does not confirm live auth claims.

Implemented composition seam

informed_decision/requester.py implements RequesterTokenProvider and compose_intake. The provider reopens bounded projected custody per exchange, never strips/caches the secret or caches access tokens, and requests exactly approval:create through fixed HTTPS /token. TLS validation, five-second timeouts, response bounds, proxy suppression and redirect refusal use JSONTransport. RS256 signature verification against the fixed /jwks pins issuer, sole audience approval-engine, sub informed-decision, tenant tenant:platform, service principal, exact requester role and exact create scope. JWT lifetime must be positive and at most 900 seconds. Failure exposes only a fixed refusal string. The existing issuer is https://kc.coulomb.social; owner configuration must use that exact origin (no discovery or caller-selected URL).

compose_intake binds this callback to IntakeApprovalClient and joins the existing IntakeService ledger with a supplied TokenReview transport and reviewed registries. It starts no listener and supplies no transport implementation for TokenReview. No runtime JSON setting or deployment entrypoint consumes this factory yet.

Focused offline verification: 37 tests pass across requester, intake service and bounded transport. Synthetic projected-file replacement changes the next exchange; missing custody sends no exchange. Wrong identity, tenant, service profile, scopes, issuer, audience, signature, expiry and excessive lifetime refuse. This proves local behavior, not deployed projection or issuer rotation.

Remaining technical deliveries

1. Compose the separate private intake listener in the process lifecycle and explicit runtime config. Implement bounded, authenticated TokenReview using API-server CA validation. Review API RBAC and submitter token audience.
2. Verify ESO's actual TokenRequest permission for the dedicated auth account; retain boolean/identity receipt. Review exact private Service, NetworkPolicy, projected registries and submitter grants. Keep it absent from public ingress.
3. Build and publish the final owner image only after composition is complete; retain immutable registry manifest digest, rendered configuration digest and owner source revision. None exists for this new provider yet. Existing deployed image/config references cannot be claimed to contain it.
4. Owner acceptance of receiving verification/abort attendance remains required. This worker owns source review only, and cannot assign a human attendance role.

Bounded native proof and abort plan

Before promotion, record exact ESO auth role, effective policy and all TTL bounds; prove SecretSynced, exact file projection and safe annotation metadata with the platform maintained helper. Refuse sibling data GET, parent metadata LIST, wrong namespace/account/audience. Obtain one create-only service exchange and native approve/read/consume refusal. Keep proof to non-secret identities, counts, digests, timestamps and capability booleans.

Coordinated issuer rotation must prove the actual mounted-file refresh reaches this callback and the predecessor ceases working. File replacement in an offline test is not issuer rotation/revocation evidence. Check reader expiry/revocation, materialized credential persistence and attended admin cleanup separately. The runtime verifier/abort operator must retain these receipts; do not print a Secret, bearer token, accessor, annotations, upstream body or raw child error.

On partial failure, stop, retain non-secret actual state and reconcile; never repost an unresolved approval create. Platform abort withdraws the new projection and disables/revokes only the new ESO reader via reviewed admin custody. Target Secret removal is separate because Retain preserves it. The owner rollback uses the prior admitted image/config and closes the new private listener. Existing issuer, browser and attended requester lanes remain independent.

Human decisions

No repeated design decision is needed for this accepted boundary. The remaining human action is separate founder approval of the final concrete live packet and named verification/abort attendance, after these technical gaps are closed. No live apply, credential read, rotation, issuer mutation or deployment occurred.