Wait within decision validity bounds and preserve failed preflight evidence

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

src/secrets_engine/approval_consume.py

@@ -25,6 +25,7 @@ from secrets_engine.decision_check import check_decision
 from secrets_engine.authorization import (
     build_action_request,
     validate_decision_envelope,
+    wait_for_decision_start,
 )
 from secrets_engine.errors import DecisionError
 from secrets_engine.openbao import read_strict_token_file
@@ -312,6 +313,7 @@ def authorize_action(
         request=expected_request,
         opener=pdp_opener or urlopen,
     )
+    wait_for_decision_start(envelope)
     validated = validate_decision_envelope(
         envelope,
         expected_request,

src/secrets_engine/authorization.py

@@ -10,6 +10,7 @@ import copy
 import hashlib
 import json
 import re
+import time
 import uuid
 from dataclasses import dataclass
 from datetime import datetime, timezone
@@ -399,3 +400,24 @@ def validate_decision_envelope(
         request_digest=evaluated,
         submitted_request_digest=submitted,
     )
+
+
+def wait_for_decision_start(envelope: object, *, clock=None, sleeper=None) -> None:
+    """Wait at most two seconds for an owner's future start, never waive it.
+
+    Full decision/claim validation still runs afterward against the real clock.
+    Longer skew refuses rather than holding an approval claim until it is stale.
+    """
+    current_time = clock or (lambda: datetime.now(timezone.utc))
+    sleep = sleeper or time.sleep
+    if not isinstance(envelope, dict):
+        return
+    lifetime = _required_dict(envelope, "lifetime")
+    if lifetime.get("not_before") is None:
+        return
+    start = _parse_time(lifetime["not_before"], "not_before")
+    delay = (start - current_time()).total_seconds()
+    if delay > 2:
+        raise DecisionError("flex-auth decision start exceeds bounded wait")
+    if delay > 0:
+        sleep(delay)