Reconcile T03 verification and complete guarded native execution

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

scripts/t03-native-execution.py

@@ -63,7 +63,36 @@ def health():
   require(rows,'llm_connect_health_target_missing');result[kind]=rows
  return result
 
-def admin(directory,negative):
+def verify_session_cleanup(client):
+ # Keep the explicit scoped token in memory: close() clears session.client.token,
+ # which otherwise makes a subsequent CLI call use the attended admin helper.
+ from urllib.request import Request,build_opener,ProxyHandler,HTTPRedirectHandler
+ from urllib.error import HTTPError
+ class NoRedirect(HTTPRedirectHandler):
+  def redirect_request(self,*a,**k):return None
+ with client.approle_session(ROLE) as session:
+  probe_token=session.client.token
+  probes=['platform/data/workloads/secrets-engine/approval-client','platform/metadata/workloads/activity-core']
+  require(all(session.client.token_capabilities(p,token=probe_token)==['deny'] for p in probes),'unrelated_path_authority')
+ try:
+  require(session.revocation_succeeded,'session_revocation_failed')
+  req=Request(client.addr+'/v1/auth/token/lookup-self',headers={'X-Vault-Token':probe_token})
+  try:
+   with build_opener(ProxyHandler({}),NoRedirect()).open(req,timeout=20) as response:
+    raise ValueError('revoked_token_still_usable')
+  except HTTPError as error:
+   require(error.code==403,'revocation_probe_not_definitive')
+ finally:
+  del probe_token
+ return {'unrelated_path_denied':True,'session_revocation_verified':True,'revoked_token_lookup_status':403}
+
+def resume_receipt():
+ prior=json.loads((ROOT/'docs/evidence/2026-09-15-t03-native-execution.json').read_text())
+ require(prior.get('phase')=='verify_attempt_started' and prior.get('failure_code')=='revoked_token_still_usable','unexpected_prior_failure')
+ require(prior.get('actions')==[{'action':'apply','approval_id':IDS['apply'],'exit_code':0,'limits':{'token_ttl':900,'token_max_ttl':1800,'secret_id_ttl':900,'secret_id_num_uses':1,'token_num_uses':8}}],'prior_apply_not_verified')
+ return prior
+
+def admin(directory,negative,resume=False):
  require(not RECEIPT.exists(),'existing_execution_receipt_requires_reconciliation')
  receipt={'status':'failed','phase':'preflight','observed_at':datetime.now(timezone.utc).isoformat(),'actions':[]}
  forwards=[]
@@ -93,14 +122,28 @@ def admin(directory,negative):
   fd=os.open(directory/'pdp-caller',os.O_WRONLY|os.O_CREAT|os.O_EXCL,0o600)
   with os.fdopen(fd,'w') as out:out.write(run(*KUBE,'-n','secrets-engine','create','token','secrets-engine','--audience=flex-auth','--duration=10m').strip())
   # Validate real claims and exact current decisions before any consumption.
-  for action in IDS:
+  actions=('exec',) if resume else tuple(IDS)
+  for action in actions:
    auth=authorize_action(configs[action],entries[action],action,fields=() if action=='apply' else tuple(entries[action].fields),policy_targets=(ROLE,),auth_targets=(ROLE,))
    require(auth is not None,'native_authorization_missing')
   receipt['phase']='all_claims_and_pdp_checks_passed';save(receipt)
   client=OpenBaoClient.resolve('http://127.0.0.1:18200')
   existing=client.read_policy(ROLE)
-  require(existing is None and not client.approle_exists(ROLE),'existing_native_objects_require_reconciliation')
-  for action in IDS:
+  if resume:
+   prior=resume_receipt()
+   plan=build_plan(entries['apply'],'prod')
+   require(existing is not None and existing.strip()==plan.policy_hcl.strip(),'applied_policy_drift')
+   role=bao('read','-format=json','auth/approle/role/'+ROLE)['data']
+   require(all(role.get(k)==v for k,v in prior['actions'][0]['limits'].items()) and role.get('token_policies')==[ROLE],'applied_role_drift')
+   code="import json;from approval_engine.store import Engine;e=Engine('/data/approvals.sqlite');print(json.dumps({k:e.claim(v) for k,v in "+repr(IDS)+".items()}))"
+   claims=json.loads(run(*KUBE,'-n','approval-engine','exec','statefulset/approval-engine','--','python','-c',code))
+   require(all(claims[a]['consumed'] and claims[a]['approval_id']==IDS[a] for a in ('apply','verify')) and claims['exec']['valid_now'] and not claims['exec']['consumed'],'resume_approval_state_mismatch')
+   receipt['prior_receipt']='2026-09-15-t03-native-execution.json'
+   receipt['completed_actions_not_replayed']=['apply','verify']
+   receipt['supplemental_cleanup']=verify_session_cleanup(client);save(receipt)
+  else:
+   require(existing is None and not client.approle_exists(ROLE),'existing_native_objects_require_reconciliation')
+  for action in actions:
    receipt['phase']=action+'_attempt_started';save(receipt)
    if action=='apply':argv=['apply',LANE,'--stage','prod','--auth','env']
    elif action=='verify':argv=['verify',LANE,'--auth','env','--negative-token-file',str(negative)]
@@ -116,12 +159,7 @@ def admin(directory,negative):
     limits={'token_ttl':900,'token_max_ttl':1800,'secret_id_ttl':900,'secret_id_num_uses':1,'token_num_uses':8}
     require(all(role.get(k)==v for k,v in limits.items()) and role.get('token_policies')==[ROLE],'role_limits_mismatch');row['limits']=limits
    elif action=='verify':
-    with client.approle_session(ROLE) as session:
-     probes=['platform/data/workloads/secrets-engine/approval-client','platform/metadata/workloads/activity-core']
-     require(all(session.client.token_capabilities(p,token=session.client.token)==['deny'] for p in probes),'unrelated_path_authority')
-    require(session.revocation_succeeded,'session_revocation_failed')
-    require(session.client._run(['token','lookup','-format=json']).returncode!=0,'revoked_token_still_usable')
-    row.update(unrelated_path_denied=True,session_revocation_verified=True)
+    row.update(verify_session_cleanup(client))
    else:
     result=json.loads(output.getvalue());require(result=={'result':'authenticated','http_status':200},'key_check_result_invalid');row['key_check']=result
    receipt['actions'].append(row);receipt['phase']=action+'_completed';save(receipt)
@@ -142,12 +180,16 @@ def admin(directory,negative):
   receipt['owner_forwards_closed']=True;save(receipt)
 
 if __name__=='__main__':
- p=argparse.ArgumentParser();p.add_argument('mode',choices=['preflight','admin']);p.add_argument('--directory',type=Path);p.add_argument('--negative-token-file',type=Path);a=p.parse_args()
+ p=argparse.ArgumentParser();p.add_argument('mode',choices=['preflight','admin','resume-exec']);p.add_argument('--directory',type=Path);p.add_argument('--negative-token-file',type=Path);a=p.parse_args()
  try:
   if a.mode=='preflight':
    with tempfile.TemporaryDirectory() as t:prepare(Path(t))
    print('Three frozen requests and pinned recipient passed; native claims checked at execution.')
-  else:admin(a.directory,a.negative_token_file)
+  else:
+   if a.mode=='resume-exec':
+    resume_receipt()
+    RECEIPT=ROOT/'docs/evidence/2026-09-16-t03-resume-exec.json'
+   admin(a.directory,a.negative_token_file,resume=a.mode=='resume-exec')
  except Exception:
   if a.mode=='preflight':raise
   raise SystemExit(1) from None