Bound task execution by absolute call and credential deadlines

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

scripts/task_execution_mediator.py

@@ -10,13 +10,15 @@ from dataclasses import dataclass
 from datetime import datetime,timezone
 import importlib
 import json
+import os
+import stat
 from pathlib import Path
 from urllib.parse import urlsplit
 
 from task_execution_cleanup import run_cleanup
 from task_execution_journal import Binding,Cleanup,Journal,Refused
 from task_execution_plan import Compiler,encoded,content_hash
-from task_execution_native_fixture import FixtureAdmission,NativeFixtureAdapter
+from task_execution_native_fixture import FixtureAdmission,NativeFixtureAdapter,_absolute_budget
 
 
 @dataclass(frozen=True)
@@ -43,7 +45,36 @@ def _strict_dependency():
         raise Refused('strict Secrets task execution handoff dependency unavailable') from None
 
 
+def _trusted_v2(cfg):
+    return (getattr(cfg,'authorization_policy_package',None)=='secrets-engine.task-execution.service-pilot'
+            and getattr(cfg,'authorization_policy_version',None)=='v2')
+
+
+def _read_source_bundle(descriptor):
+    # Paths/hash expectations come from independently installed owner_descriptor,
+    # never a requester-selected file lookup. No bytes or raw OS errors escape.
+    for item in descriptor['source_bundle'].values():
+        path=Path(item['path']);fd=None
+        try:
+            if not path.is_absolute() or path.resolve()!=path:raise ValueError()
+            fd=os.open(path,os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK)
+            before=os.fstat(fd)
+            if not stat.S_ISREG(before.st_mode) or before.st_nlink!=1 or before.st_mode&0o022 or not 0<before.st_size<=1048576:raise ValueError()
+            with os.fdopen(fd,'rb',closefd=False) as stream:raw=stream.read(1048577)
+            after=os.fstat(fd)
+            identity=lambda value:(value.st_dev,value.st_ino,value.st_size,value.st_mtime_ns,value.st_ctime_ns,value.st_mode,value.st_nlink)
+            if identity(before)!=identity(after) or len(raw)!=before.st_size or 'sha256:'+content_hash(raw)!=item['sha256']:raise ValueError()
+        except Exception:raise Refused('exact owner execution source bundle refused') from None
+        finally:
+            if fd is not None:os.close(fd)
+
+
+def _source_bundle(descriptor):
+    with _absolute_budget(2):_read_source_bundle(descriptor)
+
+
 def _fresh(cfg,handoff,descriptor):
+    if _trusted_v2(cfg):_source_bundle(descriptor)
     from secrets_engine.application_time import read_window,validity_bounds
     lower,upper=validity_bounds(window=read_window(cfg))
     try:
@@ -79,8 +110,9 @@ def run_native_fixture_task(*,compiler:Compiler,journal:Journal,plan_request:dic
     Strict authorization is executed here through the actual Secrets-owned module;
     an inbound TaskExecutionAuthorization or arbitrary callable is never accepted.
     This function returns closed metadata, not tokens or raw approval/decision data.
-    Positive execution requires the module's real signed PDP path; actual unadmitted
-    Access policy must still deny. Fixture policy/identity admission is independent
+    Positive execution requires the module's real signed PDP path; the retained v1
+    Access policy stays DENY-only; actual v2 successor source is separately tested
+    through its authenticated caller/fresh-source path without runtime admission. Fixture policy/identity admission is independent
     synthetic setup and cannot become production acceptance.
     """
     strict=_strict_dependency()
@@ -99,6 +131,7 @@ def run_native_fixture_task(*,compiler:Compiler,journal:Journal,plan_request:dic
             raise ValueError()
     except Exception:
         raise Refused('exact owner descriptor or provider route refused') from None
+    if _trusted_v2(secrets_cfg):_source_bundle(descriptor)
     # An independently pinned owner catalogue must match every engine field. Its
     # approval IDs are source references, never runtime authority.
     proposal=compiler.proposal()
@@ -163,6 +196,7 @@ def run_native_fixture_task(*,compiler:Compiler,journal:Journal,plan_request:dic
             # Fixture identity is independently seeded synthetic setup, not CCR38
             # provenance proof or a production service login.
             journal.transition(binding,'authenticating','grant-issuing')
+            _fresh(secrets_cfg,handoff,descriptor)
             native.materialize_grant()
             journal.transition(binding,'grant-issued','applying')
             for ordinal in range(6):