secrets-engine/workplans/SECRETS-WP-0013-task-scoped-openbao-execution.md

id	type	title	domain	repo	status	flavor	owner	topic_slug	created	updated	depends_on	state_hub_workstream_id
SECRETS-WP-0013	workplan	Design and prove task-scoped protected OpenBao execution	infotech	secrets-engine	proposed	planning	codex	netkingdom	2026-10-11	2026-10-16		5e38aecc-85ca-5f55-94c6-9fbb08604819

Execution-contract direction remains proposed; the narrow local readiness guard is now reviewed, published and verified in the owner checkout. No native execution authority or general entitlement adoption is inferred. Existing SECRETS-WP-0008-T06 remains open for actual adoption. CCR38 is an unchanged identity-only login and is not a protected execution entitlement.

Define the exact mediated execution contract

id: SECRETS-WP-0013-T01
status: wait
needs_human: false
blocked_on: message-from:railiance-platform
blocking_reason: "Independent Platform mediated-contract review and identity/approval/PDP owner returns remain required; D3 wrapped primitive source is implemented, no native entitlement is inferred."
priority: high
state_hub_task_id: "b2f0d462-a542-518b-a26b-b7ec07b3c7c1"

Design SECRETS-EXEC-20261011-v1 in docs/task-scoped-openbao-execution-contract.md binds action, target, payload/source digests, initiating identity, exact PDP/CAS, owner-held ephemeral two-path token, bounded TTL/uses, durable admission and cleanup. Independent Platform/Secrets Engine/identity/approval/PDP owner returns are required. No foreign review is written by this draft.

2026-10-11 source-only preparation: typed execution_contract is staged through all four request builders. The new descriptor is restricted to execute-ccr, requires prod/platform/human control and binds the catalog fingerprint before claim. Existing apply/other actions cannot borrow this descriptor. 99 focused source checks verify propagation, canonical approval/full consume joins, immutable copies and changed-binding refusals. Detailed schema/limitations are in the execution-contract document. No source owner assent, initiating-principal admission, new policy package, ledger/mediator/backend or native acceptance is claimed. Independent source review remains required. Task statuses are unchanged.

2026-10-11: D3 response-wrapped primitive now verifies native creation path and bounded TTL/accessor, rejects overwrite/symlink/shared-parent paths, and reserves/fsyncs the private recipient before mint. Backend/write uncertainty retains a non-replayable reservation. Disposable OpenBao proves one successful unwrap and native consumed-token HTTP400 denial, not a production lane or entitlement. Separate delivery contracts cannot reuse metadata execute-ccr authority. Source design is ready for independent owner review; RPF-IN-0012 requests the Platform return. Identity/approval/PDP returns and the complete native mediated path remain open; no founder decision or foreign owner assent is fabricated.

Prevent consumption without execution readiness

id: SECRETS-WP-0013-T02
status: done
priority: high
state_hub_task_id: "4ad61917-506d-5c12-a715-3d336e6b95e0"

Completed the narrow local implementation and source-verification obligation. Secrets Engine source commit 97dfa5ea8f was published through the root's C17 source-publication record. Independent Platform source acknowledgment is published in 46f5c956b52524d9d8177002bb60020c7e558039 and railiance-platform/docs/reviews/2026-10-11-secrets-execution-readiness-v2-platform-review.json. The root verified all 36 focused guard/auth/consume/privileged-evidence checks in the actual owner checkout; Platform's independent source review passed 58 checks. Current published CLI/auth/test hashes match those accepted exact sources.

Configured auto and explicit service-jwt refuse the ten guarded backend handlers before claim/PDP/CAS/login/backend work because no task-execution backend exists. Named bootstrap/env paths retain their existing approval/stance gates; login-self probes remain available. The unchanged ambient route/readiness surface is outside this guard's scope and is not service-JWT adoption. Task completion covers only this local fail-closed guard, its source review/publication and source verification. T01 remains progress, T03 remains wait with qualified dependencies, WP13 remains proposed, and SECRETS-WP-0008-T06 remains open for actual protected execution adoption/native effect, denial/no-fallback and cleanup evidence. No task-scoped backend entitlement, provider default flip, founder native go or native acceptance is claimed.

Implement and prove one native metadata action

id: SECRETS-WP-0013-T03
status: wait
depends_on: [SECRETS-WP-0013-T01, RPF-WP-0035-T12]
wait_reason: "Wait for independent execution-contract acceptance and Platform task-scoped entitlement design/materialization, then exact founder native go."
priority: high
state_hub_task_id: "5f8f7c41-5921-543f-a7c6-0b1350ea6d82"

After T01 independent owner acceptance, implement the narrow execute-ccr surface, Platform task-grant mediator, bound policy package and admission ledger. Select an actual unexecuted approved metadata CCR, exact founder go and attended owner custody. Prove real protected effect, sibling/body/refusal/replay counterexamples and confirmed revocation/cleanup. No applied CCR38 replay or broad default flip. Native metadata proof does not certify provision/exec delivery or all T06 scope.

2026-10-11 source revision v2: qualified T03 dependencies point to the owning design and Platform execution-entitlement task. WP13 owns the missing task-scoped execution seam; WP8-T06 retains production adoption and its full workflow proof. Source publication and fixture checks do not imply native acceptance. Original v1 stage remains unchanged.

2026-10-11 completed bounded source preparation within T01: repaired the actual Python/Go canonical request digest mismatch for valid Unicode/HTML purpose and nested strings, optional maps and decoded numeric formatting. Full request and approval-free request bindings retain the opaque sha256 prefix; catalogue, claim-binding and body fingerprints remain distinct and unchanged. Real Access Go-oracle cases and unchanged canonical/replay/approval/descriptor fixtures pass. This is source preparation awaiting independent technical review/publication, not a formal owner assent, policy deployment or native execution milestone. T01 remains progress; T03 and SECRETS-WP-0008-T06 remain open. Detailed limitations and retained failed test observations are in the source preparation receipt.

2026-10-16 bounded source handoff preparation: task_execution_handoff.py uses the actual serving approval/mandatory signed Check path and retained detached artifacts to check exact descriptor/request/native approval/caller/lifetime joins, then performs one strict exact-response CAS only after Platform journal admission. It accepts no inbound boolean/mapping/authorizer callback and grants no native execution. Platform independently confirms durable consumption with the actual Approval provider client before native dispatch. Focused local HTTP/native Go producer-signature source checks cover altered joins/caller/grant, missing fields, coercion/idempotence, expiry, signer removal and replay refusal. No service binding propagation, policy gate flip, identity mapping admission or production trust/key change was made. Independent source integration/review and actual whole-provider proof remain required. T01/T03 and WP8-T06 retain their open native obligations.

2026-10-16 retained-registry successor source preparation adds only the existing signed Check/DENY preapproval flow. The original typed service proposal is sent unchanged; normalized native act and evaluated approval-free digest from the admitted producer record are used for normal Approval issuance. The original proposal then receives only the original issued claim. Final Check re-normalizes against retained owner registry/source facts, so authoritative drift refuses before CAS. No local registry algorithm, new endpoint, empty-registry workaround or consumer digest waiver is used. Signed DENY preparation has no independent permission/freshness window and cannot consume or execute; current caller and operation bounds are checked, and final signed ALLOW/source checks remain mandatory. Exact original JSON kinds and requested-target subsets refuse bool/int/float substitution while allowing extra authoritative registry facts. Actual provider proof preparation is separately waiting on frozen Access source and Approval's timestamp/transaction-clock repair; source native/trust/custody and actual task admission remain open. T01/T03 and WP8-T06 are not closed.