Bind credential exec to exact owner inputs and approval digest

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

catalog/glas-claude-agent-dev-anthropic.yaml

@@ -17,6 +17,14 @@ consumers:
   purpose: Owner-admitted glas-harness agt run through the reviewed local profile;
     no caller-facing key fetch
 workload_delivery: []
+delivery_config:
+  exec_owner:
+    status: pending
+    owner: rein-aharness MessagesOwner with sand-boxer runtime boundary
+    reason: Exact installed metered-once runtime is proved; native holder review,
+      immutable owner configuration and private state/profile/service admission
+      remain SECRETS-WP-0009-T03 and HFACT-WP-0001-T03/T04. No arbitrary child may
+      receive this key while the owner binding is pending.
 delivery_modes:
 - exec-env
 - read-check

docs/evidence/2026-09-10-exec-owner-approval-exercise.json

@@ -0,0 +1,57 @@
+{
+  "schema_version": 1,
+  "target": "disposable local processes; synthetic credentials",
+  "started_at": "2026-09-10T07:15:53.047975+00:00",
+  "keycape_image": "forgejo.coulomb.social/coulomb/key-cape@sha256:7ff54c54e63ee172ae9e6e7fd2da96e427352f712343d74626ee6fe0f6f82611",
+  "approval_engine_commit": "62233c7c52447a6065055933a9c7cc1cfe3059eb",
+  "flex_auth_commit": "88b354377c8e26b162f1234e673072f1c06dcd89",
+  "keycape_contract_commit": "324b5e056dcfd5c6336750cd7a7b7f8c5ca2255f",
+  "consumer_source_sha256": {
+    "approval_auth.py": "6f3b033e7928e1c527bc19f5a1e01bf243540769a8646bd8cd47268da25637b5",
+    "approval_consume.py": "9ccc6997fd4c1c82af8cf3dd440daf7b695d6272bb302eb083b73a2fe3674345",
+    "approval_claim.py": "54dd469e4e3ac9472c4e21222d5a08f70723a63f01904a35922fcc0a07a41541",
+    "authorization.py": "0656589832b7218cc1603890e93a3e09513af8b59694f279defa764a1edb30c9",
+    "config.py": "2f2f1b60664d89bbb806aed0c768378923062077740e1f96e4c359238eb06955",
+    "service_auth.py": "653723ef5babce2157771416d93cb15cdbb7caca3c45509c3730520c55e4515c",
+    "cli.py": "1147d0e60850cfc38ee21e8564f51656d364ddc3cd8d6353a0c2dd6a0b78b8ec",
+    "catalog.py": "7e77c89a2543e3759f1322aca9b9167b904bb30e1aec867c4415dfde4bddd5fa",
+    "exec_owner.py": "10c21e7e37dd3d0aad41c4bb15df8f4a69c22d9046105a981a9613a91cd4c145",
+    "exec_delivery.py": "b142b60d875acf3dea1ba3ae99182a7ed7328d955dee5be2d12c977fc5646e8e",
+    "routing.py": "9d5050d7494a207394ce8251d8aac574ca0c08e3252639b5f05b373d6e35a076"
+  },
+  "limitations": [
+    "standalone Flex Auth source, not deployed pin",
+    "local Approval Engine source, not deployed image",
+    "no live custody or client-side read grant",
+    "no OpenBao effect or model execution"
+  ],
+  "checks": {
+    "operator_issued_and_approved_via_verified_jwt": true,
+    "wrong_action_refused_before_consume": true,
+    "producer_origin_join_with_carried_claim": true,
+    "actual_consumer_claim_check_consume": true,
+    "same_digest_retry_idempotent": true,
+    "different_digest_refused": true,
+    "spent_claim_refused": true,
+    "operator_consume_scope_denied_by_issuer": true,
+    "wrong_secret_refused": true,
+    "no_access_token_file_created": true,
+    "registry_override_accepts_exact_submission": true,
+    "same_enriched_result_different_submission_refused": true,
+    "real_dual_control_denial_then_claim_check_consume": true,
+    "exec_owner_substitution_refused_before_consume_backend": true,
+    "exec_owner_changed_environment_replay_refused_by_real_pdp_join": true,
+    "exec_owner_real_cli_consumes_before_fixture_backend": true,
+    "exec_owner_actual_child_excludes_parent_credentials": true,
+    "exec_owner_digest_preserved_by_real_evaluator": true
+  },
+  "flex_auth_binary_sha256": "c7a1f35aa2cd7cf2733272923ace7fc4b4e55171db4ef8f3d0d6629183dcf1fa",
+  "producer_input_sha256": {
+    "policy_package.md": "657fa9312c9dcabee059ec31c89ee13396fe9aa54d852edc9e6559a74bbc139a",
+    "registry_snapshot.json": "37fba44ec0e0fd9b1e17a05ad1b7e4f9bb6ec9e0fc0bb3133e8af2ac6f832d7c"
+  },
+  "exec_owner_scope": "Synthetic recipient/backend with real KeyCape, Approval Engine, Flex Auth and Secrets Engine CLI; not native custody or human approval proof",
+  "status": "passed",
+  "cleanup_complete": true,
+  "finished_at": "2026-09-10T07:16:09.750288+00:00"
+}

docs/exec-owner-binding.md

@@ -0,0 +1,93 @@
+# Bind native exec delivery to its reviewed recipient
+
+SECRETS-WP-0009-T03. Implemented 2026-09-10. This constrains delivery; it is not
+an approval or proof of native credential access.
+
+Previously `exec` consumed approval for a catalog/action/field, then accepted an
+arbitrary child command and copied the invoking engine's full environment. The
+factory recipient is now a pinned metered owner outside the sandbox. A different
+command or inherited engine credential would violate that boundary.
+
+Catalog `delivery_config.exec_owner` is optional for existing lanes. The Claude
+factory lane explicitly requires it and currently declares `status: pending`,
+`owner` and `reason`. Pending means no exec: refusal precedes approval consumption,
+backend opening and secret retrieval. Routing stays unready even if custody exists.
+
+A reviewed binding uses exactly these keys:
+
+| Key | Required content |
+| --- | --- |
+| `status` | `configured`; this describes configuration, not authorization |
+| `owner` | Named trusted recipient |
+| `command` | Exact argv; absolute executable, no caller-selected additional arguments |
+| `cwd` | Exact private owner directory |
+| `environment` | Complete non-secret environment; no inheritance from the engine |
+| `files` | Absolute path → `{sha256: <64 lowercase hex>, private: <boolean>}` |
+
+The executable and every absolute file argument require pins. Include the exact
+owner JSON and all immutable files it references, such as the spend-policy and
+accepted profile/descriptor configuration. Mutable ledgers are private state,
+not immutable file pins. The runtime owner retains whole-artifact and operational
+profile verification; hashing an interpreter alone does not verify its packages.
+
+File checks refuse symlinks, nonregular inputs, untrusted owners, group/world
+writable paths and ancestors, changed bytes and exposed private inputs. Root-owned
+sticky temporary ancestors are allowed for contained proof. The working directory
+is private. The engine and configured owner UID remain trusted: this does not
+protect against that same trusted UID replacing files between checks and launch.
+Runtime and native service admission must preserve this trust boundary.
+
+Only exec-env is allowed with this binding. The child receives the fixed environment
+plus the selected declared field; loader overrides and engine/provider auth
+variables cannot be supplied as fixed environment configuration. No values belong
+in the catalog. Queue/service credentials, if needed by the owner, require their
+separate admitted custody path. Child stdin is closed; stdout/stderr retain the
+existing value redactor. An arbitrary encoding by a malicious recipient is not
+made safe by redaction; the recipient itself must be trusted and admitted.
+
+SHA-256 of the complete canonical binding is carried as
+`context.exec_owner_sha256` on the `exec` CheckRequest. The existing producer digest
+and approval join bind it without introducing another decision type. Changing
+command, file pins, environment, cwd or owner changes the request and requires new
+exact-action approval. Local checks run before approval/backend, again before
+retrieval, and after retrieval before launch; the admitted digest must still match.
+Configured bindings still pass existing approval, consume, lane-state and scoped
+backend checks. Other actions and lanes without this opt-in retain their contracts.
+
+## Factory activation input
+
+Use the installed artifact and paths in
+`prj-helixforge-factory/evidence/2026-09-10-runtime-placement.json`. The intended argv:
+
+```text
+<protected-runtime>/bin/python3 -I -B -m rein_aharness.cli metered-once --owner-config <private-owner-config>
+```
+
+Do not use the rolling CLI alias or a persistent claim loop. Complete and pin the
+private owner configuration, profile and spend inputs under HFACT-WP-0001-T01/T04;
+bind the required worker environment explicitly. Then review the MessagesOwner
+holder under this task and the existing native action/reader gates. The provider
+key stays in the metered owner; the workload receives the opaque local route token.
+The historical sandbox-helper child-key route is not this holder admission.
+
+## Verification
+
+The full suite passed 361 tests, including a real child with a synthetic key,
+fixed environment, closed stdin, redaction and substituted/config-changed refusal.
+The disposable integration exercise passed 18 checks using the pinned KeyCape
+image, actual Approval Engine and compiled Flex Auth, including five new owner
+checks: substituted argv refusal before consume/backend, changed-environment
+replay refusal, consume-before-backend, isolated child environment and preserved
+recipient digest. OpenBao and recipient are fixtures in this exercise. The
+historical combined operator identity is a synthetic test issuer fixture, not a
+request to restore CCR-2026-0020 or evidence of real human approval.
+
+```bash
+uv run --extra dev --with 'PyJWT[crypto]>=2.7,<3' python tools/exercise_approval_identity.py \
+  --keycape-source ../key-cape --approval-engine-source ../approval-engine \
+  --flex-auth-source ../flex-auth --exec-owner --receipt /tmp/<new-receipt>.json
+```
+
+Receipt: `docs/evidence/2026-09-10-exec-owner-approval-exercise.json`.
+Native custody, exact operator group/file delivery, real human/audit/service path,
+accepted factory configuration and paid execution remain open.

docs/glas-claude-delivery.md

@@ -5,6 +5,13 @@ railiance-platform CCR-2026-0016; implementation/activation record SECRETS-WP-00
 KV custody is already confirmed at version 2. Do not provision or rotate it as
 part of native read-lane adoption.
 
+2026-09-10: the factory continuation uses a metered MessagesOwner outside the
+sandbox. Its exact runtime is installed and synthetically proved on Railiance.
+The catalog now blocks exec with an explicit pending recipient binding until the
+native holder and immutable configuration are admitted. See
+[exec owner binding](exec-owner-binding.md). The older transport description
+below records the original child-key route; it cannot admit the metered holder.
+
 The generated plan checks existing mount `platform`, creates policy and AppRole
 `se-prod-glas-claude-agent-dev-anthropic`, and grants read only on
 `platform/data/workloads/glas-harness/claude-agent-dev`. Field ANTHROPIC_API_KEY
@@ -37,7 +44,7 @@ catalog and service-jwt selection. No real value was requested.
 
 Activation depends on SECRETS-WP-0007-T04 (exact production actions) and
 SECRETS-WP-0008-T02/T06 (decision consumption and service authority). Require
-canonical ActionAuthorization for each protected action, successful consume,
+canonical validated DecisionEnvelope for each protected action, successful consume,
 and exact scoped backend authority. This draft cannot authorize itself; an
 operator browser token or unsafe-demo flag is not a runtime substitute.
 

src/secrets_engine/authorization.py

@@ -105,6 +105,12 @@ def build_action_request(
             "context": {"purpose": purpose},
         }
     )
+    if action == "exec":
+        from secrets_engine.exec_owner import owner_digest
+
+        digest = owner_digest(entry)
+        if digest is not None:
+            request["context"]["exec_owner_sha256"] = digest
     return request
 
 

src/secrets_engine/catalog.py

@@ -360,6 +360,16 @@ def validate_entry(data: dict[str, Any], *, source: str = "<memory>") -> Catalog
                     f"{source}: high-risk lanes require {lifecycle_name}.owner"
                 )
 
+    delivery_config = data.get("delivery_config", {})
+    if not isinstance(delivery_config, dict):
+        raise CatalogError(f"{source}: delivery_config must be a mapping")
+    if "exec_owner" in delivery_config:
+        from secrets_engine.exec_owner import validate_exec_owner
+
+        validate_exec_owner(delivery_config["exec_owner"])
+        if "exec-env" not in modes or set(modes) - {"exec-env", "read-check"}:
+            raise CatalogError(f"{source}: exec_owner permits only exec-env and read-check")
+
     # npm-config delivery must declare WHERE it publishes (registry + scope), so
     # the registry is catalog data, never hardcoded in the engine.
     if "npm-config" in modes:

src/secrets_engine/cli.py

@@ -542,9 +542,12 @@ def cmd_wrap(cfg: Config, args) -> int:
 
 def cmd_exec(cfg: Config, args) -> int:
     from secrets_engine.exec_delivery import exec_with_secret
+    from secrets_engine.exec_owner import validate_delivery_target
     entry = get_entry(cfg.catalog_dir, args.catalog)
     field = args.field or (entry.fields[0] if entry.fields else "")
     session_detail: dict[str, object] = {}
+    # Refuse a substituted recipient before consuming approval or opening Bao.
+    owner_digest = validate_delivery_target(entry, field, args.command, args.mode)
     command_name = args.command[0] if args.command else ""
     with _privileged_evidence(
         cfg,
@@ -555,6 +558,7 @@ def cmd_exec(cfg: Config, args) -> int:
             "mode": args.mode,
             "field": field,
             "session": session_detail,
+            "exec_owner_sha256": owner_digest,
         },
     ) as evidence:
         # require approval + readiness before running.
@@ -575,6 +579,7 @@ def cmd_exec(cfg: Config, args) -> int:
                 args.command,
                 mode=args.mode,
                 session_evidence=session_detail,
+                expected_owner_digest=owner_digest,
             )
         evidence.finish(f"exit-{rc}")
     return rc

src/secrets_engine/exec_delivery.py

@@ -27,6 +27,7 @@ from typing import Iterator
 
 from secrets_engine.catalog import CatalogEntry
 from secrets_engine.errors import DeliveryError
+from secrets_engine.exec_owner import owner_binding, validate_delivery_target
 from secrets_engine.openbao import OpenBaoClient
 from secrets_engine.publication_policy import PublicationPolicy, resolve
 from secrets_engine.redact import redact_text
@@ -180,6 +181,7 @@ def exec_with_secret(
     mode: str = "auto",
     policy_dir=None,
     session_evidence: dict[str, object] | None = None,
+    expected_owner_digest: str | None = None,
 ) -> int:
     """Run `command` with the lane's secret injected for the child only.
 
@@ -192,6 +194,10 @@ def exec_with_secret(
             f"field '{field}' not declared in lane '{entry.id}' fields {entry.fields}"
         )
 
+    binding_digest = validate_delivery_target(entry, field, command, mode)
+    if expected_owner_digest is not None and binding_digest != expected_owner_digest:
+        raise DeliveryError("exec owner binding changed after action admission")
+
     declared = set(entry.delivery_modes)
     if mode == "auto":
         if "npm-config" in declared:
@@ -219,7 +225,12 @@ def exec_with_secret(
         value = _fetch_value(
             client, entry, field, session_evidence=session_evidence
         )
-    child_env = dict(os.environ)
+    # Recheck after retrieval too: a config changed during auth/read cannot be
+    # launched with a value authorized for the previous recipient.
+    if validate_delivery_target(entry, field, command, mode) != binding_digest:
+        raise DeliveryError("exec owner binding changed during credential retrieval")
+    binding = owner_binding(entry)
+    child_env = dict(binding["environment"]) if binding is not None else dict(os.environ)
 
     if mode == "npm-config":
         npm = entry.npm
@@ -241,6 +252,8 @@ def exec_with_secret(
         # Inject under a conventional name derived from the field.
         env_name = field.upper()
         child_env[env_name] = value
+        if binding is not None:
+            return _spawn(command, child_env, value, cwd=binding["cwd"])
         return _spawn(command, child_env, value)
 
     if mode == "exec-file":
@@ -252,7 +265,7 @@ def exec_with_secret(
     raise DeliveryError(f"unsupported delivery mode '{mode}'")
 
 
-def _spawn(command: list[str], env: dict[str, str], secret: str) -> int:
+def _spawn(command: list[str], env: dict[str, str], secret: str, *, cwd: str | None = None) -> int:
     """Spawn the child, stream redacted output, propagate signals, ensure cleanup."""
     try:
         proc = subprocess.Popen(
@@ -261,6 +274,8 @@ def _spawn(command: list[str], env: dict[str, str], secret: str) -> int:
             stdout=subprocess.PIPE,
             stderr=subprocess.STDOUT,
             text=True,
+            cwd=cwd,
+            stdin=subprocess.DEVNULL if cwd is not None else None,
         )
     except FileNotFoundError as e:
         raise DeliveryError(f"command not found: {command[0]}") from e

src/secrets_engine/exec_owner.py

@@ -0,0 +1,124 @@
+"""Catalog-bound child delivery. Configuration constrains a grant; it grants none.
+
+The engine and configured owner UID remain trusted. These checks do not fence a
+malicious process with that same UID or replace runtime/profile verification.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import stat
+from typing import Any
+
+from secrets_engine.errors import CatalogError, DeliveryError
+
+
+def _text(value: object) -> bool:
+    return isinstance(value, str) and bool(value.strip()) and "\0" not in value
+
+
+def _absolute(value: object) -> bool:
+    return _text(value) and Path(value).is_absolute() and str(Path(value)) == value and ".." not in Path(value).parts
+
+
+def validate_exec_owner(value: object) -> dict[str, Any]:
+    if not isinstance(value, dict) or not _text(value.get("owner")):
+        raise CatalogError("delivery_config.exec_owner requires a named owner")
+    if value.get("status") == "pending":
+        if set(value) != {"status", "owner", "reason"} or not _text(value.get("reason")):
+            raise CatalogError("pending exec_owner requires only status, owner and reason")
+        return value
+    required = {"status", "owner", "command", "cwd", "environment", "files"}
+    if value.get("status") != "configured" or set(value) != required:
+        raise CatalogError("configured exec_owner requires exact command/cwd/environment/files")
+    command = value["command"]
+    if not isinstance(command, list) or not command or not all(_text(x) for x in command) or not _absolute(command[0]):
+        raise CatalogError("exec_owner command must be an exact argv with an absolute executable")
+    if not _absolute(value["cwd"]):
+        raise CatalogError("exec_owner cwd must be an absolute canonical directory")
+    env = value["environment"]
+    if not isinstance(env, dict) or not all(
+        isinstance(k, str) and re.fullmatch(r"[A-Z_][A-Z0-9_]*", k)
+        and isinstance(v, str) and "\0" not in v for k, v in env.items()
+    ):
+        raise CatalogError("exec_owner environment must be an explicit string mapping")
+    # The fixed environment is non-secret source configuration, not a way to
+    # carry the invoking engine's credentials or loader injection into the child.
+    if any(k.startswith(("LD_", "DYLD_", "PYTHON", "BAO_", "VAULT_", "SECRETS_ENGINE_", "ANTHROPIC_", "CLAUDE_")) for k in env):
+        raise CatalogError("exec_owner environment contains a forbidden credential/loader variable")
+    files = value["files"]
+    if not isinstance(files, dict) or command[0] not in files:
+        raise CatalogError("exec_owner files must pin the executable")
+    for path, spec in files.items():
+        if not _absolute(path) or not isinstance(spec, dict) or set(spec) != {"sha256", "private"}:
+            raise CatalogError("exec_owner files require canonical paths and sha256/private")
+        if not isinstance(spec["sha256"], str) or not re.fullmatch(r"[0-9a-f]{64}", spec["sha256"]) or type(spec["private"]) is not bool:
+            raise CatalogError("exec_owner file pin must have an exact SHA-256 and boolean private")
+    for arg in command[1:]:
+        if arg.startswith("/") and arg not in files:
+            raise CatalogError("exec_owner absolute file arguments must have file pins")
+    return value
+
+
+def owner_binding(entry) -> dict[str, Any] | None:
+    config = entry.delivery_config
+    if "exec_owner" not in config:
+        return None
+    return validate_exec_owner(config["exec_owner"])
+
+
+def owner_digest(entry) -> str | None:
+    binding = owner_binding(entry)
+    if binding is None:
+        return None
+    return hashlib.sha256(json.dumps(binding, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode()).hexdigest()
+
+
+def _check_path(path: Path, *, directory: bool = False, private: bool = False) -> None:
+    """No symlink or untrusted writable ancestor; root-owned sticky /tmp is safe."""
+    for candidate in [*reversed(path.parents), path]:
+        info = candidate.lstat()
+        leaf = candidate == path
+        is_dir = not leaf or directory
+        if not (stat.S_ISDIR(info.st_mode) if is_dir else stat.S_ISREG(info.st_mode)):
+            raise DeliveryError("exec owner path is not a regular file/directory")
+        if info.st_uid not in {0, os.getuid()}:
+            raise DeliveryError("exec owner path has an untrusted owner")
+        sticky_root = not leaf and info.st_uid == 0 and bool(info.st_mode & stat.S_ISVTX)
+        if info.st_mode & 0o022 and not sticky_root:
+            raise DeliveryError("exec owner path is writable by another identity")
+        if leaf and private and info.st_mode & 0o077:
+            raise DeliveryError("exec owner private path is accessible by another identity")
+
+
+def validate_delivery_target(entry, field: str, command: list[str], mode: str) -> str | None:
+    binding = owner_binding(entry)
+    if binding is None:
+        return None
+    if binding["status"] != "configured":
+        raise DeliveryError("exec owner binding is pending; no delivery is admitted")
+    if mode not in {"auto", "exec-env"} or "exec-env" not in entry.delivery_modes:
+        raise DeliveryError("exec owner requires exec-env delivery")
+    if field not in entry.fields or field.upper() in binding["environment"]:
+        raise DeliveryError("exec owner field is undeclared or conflicts with fixed environment")
+    if command != binding["command"]:
+        raise DeliveryError("command differs from the catalog-bound exec owner")
+    try:
+        _check_path(Path(binding["cwd"]), directory=True, private=True)
+        for name, pin in binding["files"].items():
+            path = Path(name)
+            _check_path(path, private=pin["private"])
+            fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+            with os.fdopen(fd, "rb") as source:
+                if not stat.S_ISREG(os.fstat(source.fileno()).st_mode):
+                    raise DeliveryError("exec owner file changed type")
+                if hashlib.file_digest(source, "sha256").hexdigest() != pin["sha256"]:
+                    raise DeliveryError("exec owner file digest differs from catalog")
+        if not os.access(command[0], os.X_OK):
+            raise DeliveryError("exec owner executable is not executable")
+    except OSError as exc:
+        raise DeliveryError("exec owner path is unavailable or unsafe") from exc
+    return owner_digest(entry)

src/secrets_engine/routing.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 from dataclasses import dataclass, asdict
 from pathlib import Path
+import shlex
 from typing import Any
 
 from secrets_engine.catalog import CatalogEntry
@@ -78,8 +79,17 @@ def route_lane(
 
     approved = not entry.approval_required() or (decision is not None and decision.is_approved())
     ready = approved and metadata_applied and value_present
+    from secrets_engine.exec_owner import owner_binding
 
-    if not approved:
+    binding = owner_binding(entry)
+    owner_pending = binding is not None and binding["status"] == "pending"
+    if owner_pending:
+        ready = False
+
+    if owner_pending:
+        missing = "configured exec owner command, private inputs and environment"
+        next_command = f"secrets-engine catalog show {entry.id}"
+    elif not approved:
         missing = f"approved decision for '{decision_ref}'"
         next_command = f"secrets-engine decision inspect {decision_ref or entry.id}"
     elif not metadata_applied:
@@ -112,7 +122,8 @@ def route_lane(
     else:
         missing = ""
         if {"exec-env", "npm-config"}.intersection(entry.delivery_modes):
-            next_command = f"secrets-engine exec --catalog {entry.id} -- <command...>"
+            command = shlex.join(binding["command"]) if binding is not None else "<command...>"
+            next_command = f"secrets-engine exec --catalog {entry.id} -- {command}"
         else:
             next_command = (
                 f"secrets-engine verify {entry.id} --positive --negative "

tests/test_exec_owner.py

@@ -0,0 +1,167 @@
+import copy
+import hashlib
+import os
+from pathlib import Path
+import shutil
+from types import SimpleNamespace
+
+import pytest
+
+from secrets_engine import cli, exec_delivery
+from secrets_engine.authorization import build_action_request, request_digest, validate_decision_envelope
+from secrets_engine.catalog import load_entry, validate_entry
+from secrets_engine.errors import CatalogError, DecisionError, DeliveryError
+from secrets_engine.exec_owner import owner_digest
+from tests.test_action_authorization import _envelope
+from tests.test_catalog import VALID
+from tests.test_lane_state import _cfg
+
+
+@pytest.fixture
+def bound(tmp_path):
+    private = tmp_path / "owner"
+    private.mkdir(mode=0o700)
+    executable = private / "dash"
+    shutil.copyfile("/bin/dash", executable)
+    executable.chmod(0o700)
+    script = private / "owner.sh"
+    script.write_text('''test "$API_TOKEN" = synthetic-owner-value || exit 10
+test -z "$PARENT_CREDENTIAL" || exit 11
+test -z "$BAO_TOKEN" || exit 12
+test -z "$SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE" || exit 13
+test -z "$PYTHONPATH" || exit 14
+read ignored && exit 15
+printf '%s\\n' "$API_TOKEN"
+printf 'owner-child-ok\\n'
+pwd
+''')
+    script.chmod(0o600)
+    data = copy.deepcopy(VALID)
+    data["delivery_config"] = {"exec_owner": {
+        "status": "configured", "owner": "fixture-owner",
+        "command": [str(executable), str(script)], "cwd": str(private),
+        "environment": {"PATH": "/usr/bin:/bin", "LANG": "C.UTF-8"},
+        "files": {str(f): {"sha256": hashlib.sha256(f.read_bytes()).hexdigest(), "private": True} for f in [executable, script]},
+    }}
+    return data, private, script
+
+
+def test_actual_bound_child_gets_only_selected_secret_and_fixed_environment(bound, monkeypatch, capsys):
+    data, private, _ = bound
+    entry = validate_entry(data)
+    for name in ["PARENT_CREDENTIAL", "BAO_TOKEN", "SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE", "PYTHONPATH"]:
+        monkeypatch.setenv(name, "parent-sensitive-fixture")
+    monkeypatch.setattr(exec_delivery, "_fetch_value", lambda *a, **k: "synthetic-owner-value")
+    assert exec_delivery.exec_with_secret(object(), entry, "api_token", data["delivery_config"]["exec_owner"]["command"], mode="exec-env", expected_owner_digest=owner_digest(entry)) == 0
+    output = capsys.readouterr().out
+    assert "owner-child-ok" in output and str(private) in output
+    assert "synthetic-owner-value" not in output and "parent-sensitive-fixture" not in output
+    assert os.environ["BAO_TOKEN"] == "parent-sensitive-fixture"
+
+
+@pytest.mark.parametrize("change", ["command", "extra_arg", "config", "symlink", "private_mode", "parent_mode", "mode", "field"])
+def test_bound_refusals_happen_before_fetch(bound, monkeypatch, change):
+    data, private, script = bound
+    entry = validate_entry(data)
+    command = list(data["delivery_config"]["exec_owner"]["command"])
+    mode, field = "exec-env", "api_token"
+    if change == "command": command[0] = "/bin/sh"
+    elif change == "extra_arg": command.append("--other")
+    elif change == "config": script.write_text("changed")
+    elif change == "symlink":
+        saved = script.with_suffix(".saved")
+        script.rename(saved); script.symlink_to(saved)
+    elif change == "private_mode": script.chmod(0o640)
+    elif change == "parent_mode": private.chmod(0o770)
+    elif change == "mode": mode = "exec-file"
+    elif change == "field": field = "wrong"
+    monkeypatch.setattr(exec_delivery, "_fetch_value", lambda *a, **k: pytest.fail("must refuse before read"))
+    with pytest.raises(DeliveryError):
+        exec_delivery.exec_with_secret(object(), entry, field, command, mode=mode)
+
+
+def test_config_changed_during_fetch_does_not_launch(bound, monkeypatch):
+    data, _, script = bound
+    entry = validate_entry(data)
+    def fetch(*a, **k):
+        script.write_text("changed during fetch")
+        return "synthetic-owner-value"
+    monkeypatch.setattr(exec_delivery, "_fetch_value", fetch)
+    monkeypatch.setattr(exec_delivery, "_spawn", lambda *a, **k: pytest.fail("must not launch"))
+    with pytest.raises(DeliveryError, match="digest"):
+        exec_delivery.exec_with_secret(object(), entry, "api_token", data["delivery_config"]["exec_owner"]["command"])
+
+
+def test_binding_changed_after_approval_refuses_before_fetch(bound, monkeypatch):
+    data, _, _ = bound
+    entry = validate_entry(data)
+    expected = owner_digest(entry)
+    entry.delivery_config["exec_owner"]["environment"]["LANG"] = "C"
+    monkeypatch.setattr(exec_delivery, "_fetch_value", lambda *a, **k: pytest.fail("must not read"))
+    with pytest.raises(DeliveryError, match="after action admission"):
+        exec_delivery.exec_with_secret(object(), entry, "api_token", data["delivery_config"]["exec_owner"]["command"], expected_owner_digest=expected)
+
+
+def test_pending_real_catalog_refuses_before_approval_and_backend(tmp_path, monkeypatch):
+    entry = load_entry(Path(__file__).resolve().parents[1] / "catalog/glas-claude-agent-dev-anthropic.yaml")
+    monkeypatch.setattr(cli, "get_entry", lambda *a: entry)
+    for name in ["_require_lane_approval", "_open_backend"]:
+        monkeypatch.setattr(cli, name, lambda *a, **k: pytest.fail("no approval consume or backend"))
+    with pytest.raises(DeliveryError, match="pending"):
+        cli.cmd_exec(_cfg(tmp_path), SimpleNamespace(field=None, catalog=entry.id, command=["/bin/echo"], mode="exec-env"))
+
+
+def test_configured_command_refusal_precedes_approval_and_backend(bound, monkeypatch, tmp_path):
+    data, _, _ = bound
+    entry = validate_entry(data)
+    monkeypatch.setattr(cli, "get_entry", lambda *a: entry)
+    for name in ["_require_lane_approval", "_open_backend"]:
+        monkeypatch.setattr(cli, name, lambda *a, **k: pytest.fail("no approval consume or backend"))
+    with pytest.raises(DeliveryError, match="catalog-bound"):
+        cli.cmd_exec(_cfg(tmp_path), SimpleNamespace(field=None, catalog=entry.id, command=["/bin/echo"], mode="exec-env"))
+
+
+@pytest.mark.parametrize("changed", ["command", "cwd", "environment", "files", "owner"])
+def test_changed_recipient_cannot_replay_prior_decision(bound, changed):
+    data, private, script = bound
+    entry = validate_entry(data)
+    def request(e): return build_action_request(e, "exec", subject_id="agent:fixture", subject_type="Agent", purpose="owner-proof", fields=["api_token"], request_id="fixture-owner-proof")
+    before = request(entry)
+    envelope = _envelope(before)
+    other = copy.deepcopy(data)
+    binding = other["delivery_config"]["exec_owner"]
+    if changed == "command": binding["command"].append("--other")
+    elif changed == "cwd": binding["cwd"] = str(private / "other")
+    elif changed == "environment": binding["environment"]["LANG"] = "C"
+    elif changed == "files": binding["files"][str(script)]["sha256"] = "1" * 64
+    else: binding["owner"] = "another-owner"
+    after = request(validate_entry(other))
+    assert request_digest(before) != request_digest(after)
+    with pytest.raises(DecisionError):
+        validate_decision_envelope(envelope, after, accepted_policy_packages={"secrets-engine.catalog-lane.lifecycle"}, accepted_policy_versions={"v2"})
+    assert "exec_owner_sha256" not in request(validate_entry(VALID))["context"]
+
+
+@pytest.mark.parametrize("change", ["null", "unknown", "relative", "missing_pin", "null_private", "preload", "credential", "other_mode"])
+def test_invalid_binding_is_not_a_catalog_fallback(bound, change):
+    data, _, _ = bound
+    binding = data["delivery_config"]["exec_owner"]
+    if change == "null": data["delivery_config"]["exec_owner"] = None
+    elif change == "unknown": binding["extra"] = True
+    elif change == "relative": binding["command"][0] = "python3"
+    elif change == "missing_pin": binding["files"] = {}
+    elif change == "null_private": next(iter(binding["files"].values()))["private"] = None
+    elif change == "preload": binding["environment"]["LD_PRELOAD"] = "/tmp/loader"
+    elif change == "credential": binding["environment"]["SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE"] = "/tmp/credential"
+    else: data["delivery_modes"].append("exec-file")
+    with pytest.raises(CatalogError): validate_entry(data)
+
+
+def test_pending_owner_never_advertises_ready(tmp_path, monkeypatch):
+    from secrets_engine import routing
+    entry = load_entry(Path(__file__).resolve().parents[1] / "catalog/glas-claude-agent-dev-anthropic.yaml")
+    monkeypatch.setattr(routing, "resolve_decision", lambda **k: SimpleNamespace(status="approved", review_url="", is_approved=lambda: True))
+    client = SimpleNamespace(is_reachable=lambda: True, read_policy=lambda p: "policy", approle_exists=lambda r: True, kv_fields_present=lambda *a: {"ANTHROPIC_API_KEY": True})
+    result = routing.route_lane(entry, hub_url="", repo_root=tmp_path, client=client)
+    assert not result.ready and "exec owner" in result.missing
+    assert "<command" not in result.next_command

tools/exercise_approval_identity.py

@@ -12,11 +12,13 @@ import base64
 import copy
 import hashlib
 import http.server
+import io
 import ipaddress
 import json
 import os
 from pathlib import Path
 import secrets
+import shutil
 import socket
 import ssl
 import subprocess
@@ -24,6 +26,7 @@ import sys
 import tempfile
 import threading
 import time
+from contextlib import contextmanager, redirect_stdout
 from datetime import datetime, timedelta, timezone
 from urllib.error import HTTPError
 from urllib.parse import urlencode
@@ -83,7 +86,7 @@ def exercise(args):
         "keycape_contract_commit": commit(args.keycape_source),
         "consumer_source_sha256": {
             name: hashlib.sha256((ROOT / "src/secrets_engine" / name).read_bytes()).hexdigest()
-            for name in ("approval_auth.py", "approval_consume.py", "approval_claim.py", "authorization.py", "config.py", "service_auth.py", "cli.py")
+            for name in ("approval_auth.py", "approval_consume.py", "approval_claim.py", "authorization.py", "config.py", "service_auth.py", "cli.py", "catalog.py", "exec_owner.py", "exec_delivery.py", "routing.py")
         },
         "limitations": ["standalone Flex Auth source, not deployed pin", "local Approval Engine source, not deployed image",
                         "no live custody or client-side read grant", "no OpenBao effect or model execution"],
@@ -327,6 +330,88 @@ def exercise(args):
                 cli._require_lane_approval(cfg, destroy_entry, "destroy")
                 assert engine.claim("synthetic-destroy")["consumed"]
                 receipt["checks"]["real_dual_control_denial_then_claim_check_consume"] = True
+                if args.exec_owner:
+                    from secrets_engine.errors import DeliveryError
+                    from secrets_engine.exec_owner import owner_digest
+                    from types import SimpleNamespace
+
+                    # Synthetic recipient and backend, real engine CLI, exact
+                    # producer digest, JWT claim/consume, spawn and environment.
+                    owner_dir = root / "exec-owner"
+                    owner_dir.mkdir(mode=0o700)
+                    executable = owner_dir / "dash"
+                    shutil.copyfile("/bin/dash", executable)
+                    executable.chmod(0o700)
+                    script = owner_dir / "owner.sh"
+                    private_write(script, 'test "$API_TOKEN" = synthetic-owner-value || exit 10\n'
+                                  'test -z "$SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE" || exit 11\n'
+                                  'test -z "$BAO_TOKEN" || exit 12\n'
+                                  'printf "owner-delivery-ok\\n"\n')
+                    raw["approval"]["authorization_id"] = "synthetic-owner-delivery"
+                    raw["delivery_config"] = {"exec_owner": {
+                        "status": "configured", "owner": "synthetic-metered-owner",
+                        "command": [str(executable), str(script)], "cwd": str(owner_dir),
+                        "environment": {"PATH": "/usr/bin:/bin", "LANG": "C.UTF-8"},
+                        "files": {str(p): {"sha256": hashlib.sha256(p.read_bytes()).hexdigest(), "private": True}
+                                  for p in [executable, script]},
+                    }}
+                    owner_entry = validate_entry(raw)
+                    req = _expected_request(cfg, owner_entry, "exec", fields=("api_token",))
+                    owner_request_digest = pdp.bind_request(req)
+                    operator_request("/v1/approvals", {
+                        "id": "synthetic-owner-delivery", "binding": {"action": "secrets.exec", "target": {"id": owner_entry.id, "stage": "prod"},
+                            "actor": "service:approval-engine-operator", "principal": "synthetic-operator", "purpose": "disposable identity proof"},
+                        "validity": {"not_before": (now - timedelta(minutes=1)).isoformat(), "expires_at": (now + timedelta(minutes=10)).isoformat()},
+                        "pdp_digest": owner_request_digest, "pdp_path": True}, "approval:create")
+                    operator_request("/v1/approvals/synthetic-owner-delivery/entries", {}, "approval:approve")
+                    backend_calls = []
+                    class Backend:
+                        @contextmanager
+                        def approle_session(self, role):
+                            assert role == owner_entry.role_name
+                            yield SimpleNamespace(client=self)
+                        def _run(self, command):
+                            assert command == ["kv", "get", "-format=json", f"{owner_entry.mount}/{owner_entry.path}"]
+                            return SimpleNamespace(returncode=0, stdout=json.dumps({"data": {"data": {"api_token": "synthetic-owner-value"}}}))
+                    @contextmanager
+                    def open_fixture_backend(*_args):
+                        assert engine.claim("synthetic-owner-delivery")["consumed"]
+                        backend_calls.append("after-consume")
+                        yield Backend()
+                    command = raw["delivery_config"]["exec_owner"]["command"]
+                    cli_args = SimpleNamespace(catalog=owner_entry.id, field="api_token", mode="exec-env", command=command)
+                    with patch.object(cli, "get_entry", return_value=owner_entry), patch.object(cli, "_open_backend", open_fixture_backend):
+                        substituted = SimpleNamespace(**vars(cli_args))
+                        substituted.command = ["/bin/echo", "substitute"]
+                        try:
+                            cli.cmd_exec(cfg, substituted)
+                        except DeliveryError:
+                            assert not engine.claim("synthetic-owner-delivery")["consumed"] and not backend_calls
+                        else:
+                            raise AssertionError("substitute recipient accepted")
+                        original_env = raw["delivery_config"]["exec_owner"]["environment"]["LANG"]
+                        raw["delivery_config"]["exec_owner"]["environment"]["LANG"] = "C"
+                        try:
+                            cli.cmd_exec(cfg, cli_args)
+                        except DecisionError:
+                            assert not engine.claim("synthetic-owner-delivery")["consumed"] and not backend_calls
+                        else:
+                            raise AssertionError("changed owner replay accepted")
+                        raw["delivery_config"]["exec_owner"]["environment"]["LANG"] = original_env
+                        output = io.StringIO()
+                        with redirect_stdout(output), patch.dict(os.environ, {"BAO_TOKEN": "synthetic-parent-only", "SECRETS_ENGINE_APPROVAL_CLIENT_SECRET_FILE": str(root / "approval.secret")}):
+                            assert cli.cmd_exec(cfg, cli_args) == 0
+                        assert "owner-delivery-ok" in output.getvalue() and "synthetic-parent-only" not in output.getvalue()
+                    assert backend_calls == ["after-consume"]
+                    assert pdp.last_decision["binding"]["context"]["exec_owner_sha256"] == owner_digest(owner_entry)
+                    receipt["checks"].update({
+                        "exec_owner_substitution_refused_before_consume_backend": True,
+                        "exec_owner_changed_environment_replay_refused_by_real_pdp_join": True,
+                        "exec_owner_real_cli_consumes_before_fixture_backend": True,
+                        "exec_owner_actual_child_excludes_parent_credentials": True,
+                        "exec_owner_digest_preserved_by_real_evaluator": True,
+                    })
+                    receipt["exec_owner_scope"] = "Synthetic recipient/backend with real KeyCape, Approval Engine, Flex Auth and Secrets Engine CLI; not native custody or human approval proof"
         finally:
             if api_server:
                 api_server.shutdown()
@@ -350,6 +435,7 @@ def main():
     parser.add_argument("--approval-engine-source", required=True, type=Path)
     parser.add_argument("--flex-auth-source", required=True, type=Path)
     parser.add_argument("--receipt", required=True, type=Path)
+    parser.add_argument("--exec-owner", action="store_true", help="also prove catalog-bound child delivery against the actual approval/PDP chain")
     args = parser.parse_args()
     if args.receipt.exists():
         raise SystemExit("receipt path must be new")

workplans/SECRETS-WP-0009-glas-claude-native-delivery.md

@@ -7,7 +7,7 @@ repo: secrets-engine
 status: blocked
 owner: codex
 created: "2026-09-05"
-updated: "2026-09-09"
+updated: "2026-09-10"
 state_hub_workstream_id: "40ccc3b4-d046-5a58-8649-e7935f45c974"
 ---
 
@@ -49,6 +49,7 @@ synthetic exec-env transport proof passed; no real secret was read.
 id: SECRETS-WP-0009-T03
 status: wait
 priority: high
+blocking_reason: "Recipient binding now implemented and proved with the real local approval/PDP chain. Complete exact private owner configuration and native MessagesOwner holder admission, CCR-2026-0019 operator reader, human/audit/service path and scoped live delivery. CCR-2026-0020 was cancelled by its owner."
 state_hub_task_id: "f8069c8a-ad6b-5d0b-9a36-c2326699437d"
 ```
 
@@ -196,3 +197,32 @@ receipt: docs/evidence/2026-09-09-replay-contract-exercise.json. The former PDP
 double limitation is resolved for component conformance. T03 remains wait for
 current deployed PDP adoption, separately admitted client-side/audit custody,
 actual Approval Engine deployment, and the scoped native OpenBao delivery proof.
+
+
+### 2026-09-10 exact recipient enforcement
+
+The factory runtime is now installed on workstation and Railiance at digest
+`5371156d2027dde6e8f140cc0a1833c4e90b8c75b3bec862e05f06a957f5fd34`;
+consume project evidence `2026-09-10-runtime-placement.json`. Native delivery
+review exposed an unclosed local boundary: exec accepted any argv and inherited
+all parent environment after catalog/action approval.
+
+Implemented optional catalog exec_owner with exact command, private cwd, fixed
+non-secret environment and file pins. The factory catalog is explicitly pending
+and refuses before approval/backend. The complete binding digest travels in the
+existing CheckRequest context and producer/approval join. Changes before or during
+retrieval refuse launch; the actual child has closed stdin and receives no inherited
+engine auth environment. Existing action/consume/state/backend gates remain.
+
+361 tests passed. The extended disposable actual KeyCape/Approval Engine/Flex Auth
+exercise passed all 18 checks, including changed-recipient replay refusal and
+consume-before-synthetic-backend followed by actual child execution. Receipt:
+`docs/evidence/2026-09-10-exec-owner-approval-exercise.json`; contract:
+`docs/exec-owner-binding.md`. Synthetic backend/key/recipient and test operator
+identity only; no native secret read, human approval or paid execution.
+
+T03 remains wait for configured/pinned owner inputs and holder admission, wanted
+CCR-2026-0019 operator-group/file-delivery return, INFD-WP-0001-T07/T08 real human
+approval, audit custody and deployed services/PDP/native delivery. CCR-2026-0020
+was cancelled on owner withdrawal; do not wait for or recreate its presenter.
+No runtime artifact rebuild is needed for this credential-engine change.