coulomb/secrets-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Verify normalized task approval facts and preserve signed source types
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
This commit is contained in:
tegwick 2026-10-16 17:28:03 +02:00
parent 5a2099f400
commit 4dd004a225
18 changed files with 756 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

12
src/secrets_engine/execution_contract.py
View file

@ -153,6 +153,18 @@ def attach_execution_contract(request: dict, contract: ExecutionContract | None)
raise DecisionError('execute-ccr requires platform tenant')
if value['catalog_sha256'] != catalog_target_digest(request['context']['catalog_target']):
raise DecisionError('execution_contract catalog target does not match')
if request['subject'] != {'id':'secrets-engine','type':'service'}:
raise DecisionError('execute-ccr requires secrets-engine service subject')
# Match the producer's fixed tenant normalization before approval issue.
request['subject']['tenant'] = 'tenant:platform'
request['resource']['tenant'] = 'tenant:platform'
# Public declaration from Access ServicePilotInputs.DeclaredServiceBinding;
# bound before approval issuance, never an authentication assertion.
request['context']['service_actor_binding'] = {
'version':'proposed-service-task-caller/v1',
'transport_principal':'system:serviceaccount:secrets-engine:secrets-engine',
'subject_id':'secrets-engine','subject_type':'service','tenant':'tenant:platform',
}
request['context']['execution_contract'] = value
request['context']['human_control'] = True