coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Verify normalized task approval facts and preserve signed source types
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 17:28:03 +02:00
parent 5a2099f400
commit 4dd004a225
18 changed files with 756 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

37
docs/task-execution-handoff.md
View file

@ -38,7 +38,9 @@ ServiceAccount principal, `flex-auth` audience and live expiry bounding the
operation deadline. This consumes the signed PDP's caller attestation; it does
not independently perform TokenReview or promote the proposed server mapping.
Human/delegation/projected-identity flags cannot substitute for this service seam.
No service_actor_binding request propagation or source-policy activation is added.
The later typed execution builder now propagates the fixed Access public
service_actor_binding before approval issue; it is not caller authentication.
No source-policy activation is added.
`as_owner_handoff()` returns a detached non-secret mapping with:
@ -76,3 +78,36 @@ confirm original durable consumption using Approval's real provider client,
journal it, then recheck its exact Plan, owner sources, grant and deadlines before
any native operation. Neither a dataclass nor a caller-supplied boolean admits
execution. Existing generic CLI CAS behavior is otherwise unchanged.
2026-10-16 retained-registry preapproval source preparation adds
`prepare_task_approval(cfg, entry, execution_contract=contract)`. It calls the
existing signed Check client with the original claim-free typed proposal and
accepts only a signed DENY normalization record. This neither authorizes nor
consumes an operation. No registry algorithm is copied and no registry is emptied.
The detached `as_owner_handoff()` returns `original_request`,
`submitted_request_digest`, authoritative `native_binding`,
`approval_binding_digest`, normalization `decision_id`, `execution_contract`, and
signed `registry_snapshot_digest`. Exact original context (including JSON kinds),
submitted digest, recomputed evaluated digest, explicit approval-free digest,
policy/key admission, service/caller identity, decision time and deadline are
checked. Registry digest is evidence from the admitted signer; this method does
not independently grant registry/config admission. The caller uses the returned
native act and approval-free digest for normal Approval issuance and human entry.
It preserves the original proposal; final authorize_task_execution builds that
same proposal and attaches only the original issued claim. Access normalizes
again and independently joins current source facts. Changed evaluated facts or
native target refuse before CAS. A normalization DENY object/mapping is never
accepted by consume_task_execution.
Normalization decision_time must be valid and nonfuture; there is deliberately
no invented standalone normalization TTL. The DENY receipt is not permission and
cannot discharge final signed ALLOW or source validation. Expired original task/
caller bounds refuse at preparation; a stale normalization's changed evaluated
facts refuse when Access independently checks the original issued claim against
the current retained registry. Unchanged historical normalization can only supply
public issue metadata; it cannot itself produce a CAS/native admission. The actual
source-server drift proof restarts Access with changed authoritative subject
roles after preapproval and observes final refusal with no new ALLOW record, no
CAS and unconsumed Approval state.