Bind typed execution context across authorization requests

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade

docs/task-scoped-openbao-execution-contract.md

@@ -47,8 +47,10 @@ for the first proof; none is selected or approved by this design.
 
 ## Exact request binding
 
-Use the existing `authorization.build_action_request(entry, 'apply', ...)` shape
-and canonical digest rules. Add a reviewed `context.execution_contract` object
+Use `authorization.build_action_request(entry, 'execute-ccr', ...)` with the
+existing canonical digest rules. `apply` is a distinct legacy action: its v2
+policy ignores this metadata contract and must never stand in for execute-ccr.
+Add a reviewed `context.execution_contract` object
 before observing the claim or calling Check. Its fields are:
 
 | Field | Binding |
@@ -246,3 +248,66 @@ failure/recovery rules and native counterexamples. No success in the initial
 metadata pilot unblocks these rows by default. Full T06 adoption requires the
 actual selected engine production workflow to run through the corresponding
 reviewed entitlement, with native effect, denial/no-fallback and cleanup proof.
+
+## Source preparation: typed request propagation (2026-10-11)
+
+The staged ExecutionContract descriptor is deliberately a closed, immutable
+non-secret value. `parse` validates shape and captures JSON; every `as_dict`
+revalidates even directly constructed instances and returns a detached copy.
+It is not an owner approval, source authenticity attestation, principal
+representation or proof that the requested origin is admitted. Compiler and
+mediator must independently reconstruct and authenticate sources and bodies.
+
+The exact proposed descriptor serialization refines the table above:
+
+- Digests use `sha256:` plus 64 lowercase hexadecimal characters. UUIDs use
+  canonical lowercase hyphenated form. CCR and grant IDs must be distinct.
+- `source_bundle` has exactly engine_dispatcher, platform_mediator, typed_ccr and
+  policy_auth; each has exactly an absolute normalized `path` and `sha256`.
+  This parses paths without reading files; pin verification remains unimplemented.
+- `operations` is an ordered list of exactly method/path/payload_sha256 objects.
+  It accepts only GET/PUT metadata policy and auth-role endpoint shapes, with
+  normalized relative paths. This schema does not reconstruct bodies or prove
+  that all before/write/readback operations occur or target exactly two paths.
+  A later owner compiler must enforce those semantics before any execution.
+- `backend_origin` is an explicit-port HTTP(S) origin without credentials, path,
+  query or fragment. Syntactic acceptance creates no approved route or network
+  call. Estate pinning and server authentication remain mediator obligations.
+- `backend_budget` has exactly ttl_seconds (integer 30–120) and uses (integer
+  1–12); booleans fail. Listed calls must leave at least one cleanup use.
+  Renewal, remint and live per-call accounting remain outside this descriptor.
+- expected_before/expected_after are non-secret state digests; operation_deadline
+  is timezone-aware. Before claim, refuse expired deadlines using the existing
+  trusted-time window. After claim and Check, refuse a deadline later than either
+  served approval or decision expiry. A future mediator must recheck before every
+  effect and provide separately authorized cleanup after business expiry.
+- catalog_sha256 is a descriptor-local sorted compact JSON fingerprint of the
+  complete existing context.catalog_target, distinct from canonical PDP digests.
+  Resource catalog ID/stage, subject, tenant and purpose remain bound separately
+  through the unchanged canonical request hashing implementation.
+
+The same typed descriptor passes through build_action_request, _expected_request,
+resolve_approval_observation and authorize_action. Any contract on apply or another
+legacy action refuses. execute-ccr without a typed valid contract, prod stage or
+platform tenant refuses. execute-ccr always binds human_control=true, even on a
+legacy bootstrap catalog, and cannot use an unserved/demo fallback. Invalid or
+catalog-mismatched descriptors refuse before claim/PDP/CAS. Returned requests are
+independent copies; later caller mutation cannot change the stored descriptor.
+
+99 focused source tests pass across context propagation, the existing approval
+join, decision validation, readiness, consume and engine auth. New tests exercise
+all four actual builders, actual consume request formatting and claim-free/full
+joins; mutation of operation, CCR/grant/source/body/method/path/budget/deadline/
+estate/state/principal/purpose/catalog/tenant/stage refuses the original approval.
+Transport/PDP stand-ins deliberately supply hypothetical human control and an
+ALLOW: they prove propagation, not a shipped policy or real principal admission.
+
+No execute-ccr CLI, identity-owner verified initiating-principal interface,
+new access policy package, typed owner compiler, task-grant materializer,
+independent authenticated consume-confirmation integration, durable admission
+journal, restricted backend, per-call deadline checks or native entitlement is
+supplied by this stage. Existing cfg subject strings remain legacy provenance;
+this change does not make them verified human representation. Existing generic
+consume receipt validation limitations remain explicitly separate. service-jwt
+readiness guard/default and ordinary actions remain unchanged. T01 stays in
+progress, T03 stays wait, WP13 stays proposed, and WP8-T06 stays open.