feat(execution): prove fixed grant and cleanup against disposable OpenBao

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

scripts/task_execution_journal.py

@@ -103,6 +103,7 @@ class Journal:
         self.db.execute("CREATE TABLE IF NOT EXISTS operations (approval TEXT PRIMARY KEY, request TEXT NOT NULL, operation TEXT UNIQUE NOT NULL, plan TEXT NOT NULL, state TEXT NOT NULL, evidence TEXT)")
         self.db.execute("CREATE TABLE IF NOT EXISTS calls (operation TEXT NOT NULL, ordinal INTEGER NOT NULL, call_digest TEXT NOT NULL, outcome TEXT NOT NULL, evidence TEXT, PRIMARY KEY(operation,ordinal))")
         self.db.execute("CREATE TABLE IF NOT EXISTS cleanup (operation TEXT NOT NULL, ordinal INTEGER NOT NULL, kind TEXT NOT NULL, call_digest TEXT NOT NULL, outcome TEXT NOT NULL, evidence TEXT, PRIMARY KEY(operation,ordinal), UNIQUE(operation,kind))")
+        self.db.execute("CREATE TABLE IF NOT EXISTS cleanup_calls (operation TEXT NOT NULL, obligation INTEGER NOT NULL, step INTEGER NOT NULL, call_digest TEXT NOT NULL, outcome TEXT NOT NULL, evidence TEXT, PRIMARY KEY(operation,obligation,step))")
         self._held = False
         self._admission = None
         self._consumed_admission = None
@@ -226,6 +227,7 @@ class Journal:
         # Readback cannot create a live admission, even for an interrupted state.
         pending = self.db.execute("SELECT COUNT(*) FROM calls WHERE operation=? AND outcome='pending'", (binding.operation_id,)).fetchone()[0]
         pending += self.db.execute("SELECT COUNT(*) FROM cleanup WHERE operation=? AND outcome='pending'", (binding.operation_id,)).fetchone()[0]
+        pending += self.db.execute("SELECT COUNT(*) FROM cleanup_calls WHERE operation=? AND outcome='pending'", (binding.operation_id,)).fetchone()[0]
         return {"state": row[3], "evidence_digest": row[4], "dispatch_allowed": False,
                 "external_outcome_unknown": bool(pending)}
 
@@ -318,6 +320,8 @@ class Journal:
             raise Refused("closed cleanup evidence required")
         try:
             self.db.execute("BEGIN IMMEDIATE")
+            if confirmed and self.db.execute("SELECT COUNT(*) FROM cleanup_calls WHERE operation=? AND obligation=? AND outcome='pending'", (binding.operation_id,ordinal)).fetchone()[0]:
+                raise Refused("pending cleanup native call cannot confirm")
             changed = self.db.execute("UPDATE cleanup SET outcome=?, evidence=? WHERE operation=? AND ordinal=? AND kind=? AND call_digest=? AND outcome='pending'",
                                       ('confirmed' if confirmed else 'unconfirmed', evidence_digest,
                                        binding.operation_id, ordinal, obligation.kind, obligation.call_digest)).rowcount
@@ -329,6 +333,41 @@ class Journal:
             if self.db.in_transaction: self.db.execute("ROLLBACK")
             raise
 
+    def before_cleanup_call(self, binding, ordinal, obligation, step, call_digest):
+        """Journal each native revoke/delete AND its independent verification."""
+        self._cleanup_admission(binding,ordinal,obligation)
+        if type(step) is not int or not 0<=step<2 or type(call_digest) is not str or not re.fullmatch(r"[0-9a-f]{64}",call_digest):
+            raise Refused("exact bounded cleanup native call required")
+        try:
+            self.db.execute("BEGIN IMMEDIATE")
+            parent=self.db.execute("SELECT kind,call_digest,outcome FROM cleanup WHERE operation=? AND ordinal=?",(binding.operation_id,ordinal)).fetchone()
+            count,pending=self.db.execute("SELECT COUNT(*),COALESCE(SUM(outcome='pending'),0) FROM cleanup_calls WHERE operation=? AND obligation=?",(binding.operation_id,ordinal)).fetchone()
+            if parent!=(obligation.kind,obligation.call_digest,'pending') or step!=count or pending:
+                raise Refused("cleanup call unadmitted, replayed or uncertain")
+            self.db.execute("INSERT INTO cleanup_calls VALUES (?,?,?,?,'pending',NULL)",(binding.operation_id,ordinal,step,call_digest))
+            self.db.execute("COMMIT");self._sync_directory()
+        except BaseException:
+            if self.db.in_transaction:self.db.execute("ROLLBACK")
+            raise
+
+    def after_cleanup_call(self,binding,ordinal,obligation,step,call_digest,evidence_digest):
+        self._cleanup_admission(binding,ordinal,obligation)
+        if (type(step) is not int or not 0<=step<2 or type(call_digest) is not str or not re.fullmatch(r"[0-9a-f]{64}",call_digest)
+                or type(evidence_digest) is not str or not re.fullmatch(r"[0-9a-f]{64}",evidence_digest)):
+            raise Refused("exact cleanup native evidence required")
+        try:
+            self.db.execute("BEGIN IMMEDIATE")
+            parent=self.db.execute("SELECT kind,call_digest,outcome FROM cleanup WHERE operation=? AND ordinal=?",(binding.operation_id,ordinal)).fetchone()
+            if parent!=(obligation.kind,obligation.call_digest,'pending'):
+                raise Refused("cleanup parent is no longer pending")
+            changed=self.db.execute("UPDATE cleanup_calls SET outcome='complete',evidence=? WHERE operation=? AND obligation=? AND step=? AND call_digest=? AND outcome='pending'",
+                                    (evidence_digest,binding.operation_id,ordinal,step,call_digest)).rowcount
+            if changed!=1:raise Refused("cleanup native confirmation mismatch")
+            self.db.execute("COMMIT");self._sync_directory()
+        except BaseException:
+            if self.db.in_transaction:self.db.execute("ROLLBACK")
+            raise
+
     def close(self):
         if hasattr(self, "db"):
             self.db.close()