secrets-engine/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	related	state_hub_workstream_id
SECRETS-WP-0014	workplan	Constrain PDP transport and authenticate decision responses	infotech	secrets-engine	active	codex	secrets-engine	2026-10-12	2026-10-21	implementation		CUST-WP-0082 FLEX-WP-0024 GEXEC-WP-0001 SECRETS-WP-0013	7252469d-d7a5-5c18-8911-b511b8c6a736

Native owner work for G13, now tracked as CUST-WP-0082-T06. CUST-WP-0080 finished on 2026-10-19 and transferred its T21 native acceptance obligation to WP-82 without implementing it. Reuses the accepted Check contract and FLEX-WP-0024 producer signature surface; does not create another PDP or grant any catalog-lane execution authority. SECRETS-WP-0013 still owns task-scoped protected execution. Transport review is complete; key admission and native rollout remain separate gates below.

2026-10-21 review against gated-executor (GEXEC-WP-0001, accepted on railiance01 2026-10-20): the estate now has a working, founder-held exact-byte approval mechanism (ssh-keygen -Y, runtime-unwritable allowed_signers, per-purpose namespace). T02's open "independent admission" gap had no concrete anchor before this; it now reuses that pattern. T02 closes at source scope. The founder's actual signature over the real producer trust file is split out as human-gated T04, and T03's native rollout depends on it.

Prevent the Check credential from leaving the admitted local transport

id: SECRETS-WP-0014-T01
status: done
priority: high
state_hub_task_id: "8baba9a3-3513-5f02-bafe-ed9dce743173"

Reproduced redirects (301/302/303), environment proxy forwarding, malformed URL handling, oversized-body truncation and invalid UTF-8 against the prior source. The bounded fix disables redirects and ambient proxies/global openers, requires a literal loopback bare origin before credential access, caps the complete response body and rejects invalid UTF-8 as a DecisionError. The approval consumer no longer overrides this safe default with urlopen. Synthetic local-server tests cover both entry points, all five redirect status codes and proxy forwarding. No real credentials or protected backend were touched. Source verification is recorded in the Custodian evidence directory for 2026-10-12, pdp-transport.json. This closes the source transport defects only; T02/T03 remain mandatory.

Implement independently anchored responder authentication

id: SECRETS-WP-0014-T02
status: done
priority: high
state_hub_task_id: "877782e5-045b-5186-8b95-82e25db21a5a"

Review producer canonical signature bytes and the native pin's unsigned/signed mode. Establish independently admitted verification keys and exact issuer/pin binding with AccessEngine and Platform; an unauthenticated keys endpoint on the same responder is not a trust anchor. Reuse the native producer fixtures rather than inventing a Python canonicalization. Require valid signed envelopes on the production consumer path; prove forged allow, altered payload, unknown key, wrong issuer/pin, unsigned/downgrade, expired and rotation overlap/refusal cases. Track any temporary exception using all required SEC-DSM-EXC fields and actual approval; neither source support nor a loopback URL is that approval.

2026-10-16 source preparation: production authorize_action now requires an independently admitted local trust file and installed verifier before approval/PDP credential reads. The Go helper vendors exact producer API/signature sources, checks source hashes, authenticates the original response and returns only its verified typed interpretation. Signed evaluator/mode and exact package/version/ artifact digest are bound to admitted public keys. Unknown/unsigned/altered responses refuse; existing request/approval/lifetime/CAS checks remain required. Native replay, real producer signing and consumer-boundary tests cover downgrade, issuer/pin, request joins, and distinct-key overlap/removal. Build/install and source update procedures are documented in verifier/README.md.

This is an isolated source implementation awaiting integration/independent review. No production verification keys, native pin signed-mode change, trust admission, owner assent or rollout has occurred. T02 stays progress because independent key admission remains part of its scope; T03 stays wait. WP13 execution and identity-only CCR38 are unchanged. Custodian source/verification handoff: docs/changes/netkingdom-target-2026-10-16/decision-auth/ in the Custodian repo.

2026-10-16 packaging preparation: scripts/build_release_bundle.py and its separate offline installer deliver the existing wheel plus the reviewed producer verifier together into a new owner-controlled prefix. Source/hash drift checks, artifact/toolchain receipts and a narrow fixed-helper launcher remove the silent wheel-only deployment gap. Disposable build/install tests prove deterministic artifacts, signed HTTP consumption and missing/tampered artifact refusal; they do not admit packages, keys or a production prefix. T02 remains progress and T03 wait; no native installation, trust change or protected entitlement is claimed.

2026-10-21 founder admission anchor (closes T02 source scope): load_trust now refuses any trust file without a sibling <trust>.sig. The signature must be made with ssh-keygen -Y sign -n secrets-engine-pdp-trust by exactly one principal in /etc/secrets-engine/admission/allowed_signers, and is verified over the exact bytes that are parsed. That anchor and directory must not be writable by, or owned by, the running UID (gated-executor rule), which closes the same-UID trust self-admission path recorded above. src/secrets_engine/founder_admission.py; operator procedure docs/founder-admission.md. Tests cover unsigned, edited after signing, wrong namespace (including gexec-approval), unknown signer key, runtime-owned or group-writable anchor and missing anchor, plus re-signed rotation overlap/removal in the existing signature and installed-bundle tests. No production key, anchor installation or trust admission occurred. That work is T04.

Admit the real producer verification key by founder signature

id: SECRETS-WP-0014-T04
status: wait
priority: high
needs_human: true
decision_id: "e4eee965-d09f-445b-a84e-dddf58edbdbd"
depends_on: [SECRETS-WP-0014-T02]
blocking_reason: "Needs Access's real producer kid/public key/custody receipt (FLEX-WP-0024) and the founder's signature over the exact trust file; the anchor install under /etc needs root."
state_hub_task_id: "0bd876a7-5ca0-54a1-b013-027cacb0365a"

Install /etc/secrets-engine/admission/allowed_signers (root-owned) with the founder's approver public key, the same key that signs gexec approvals. Write the exact pdp-trust.json for the real producer kid/key and pin. The founder signs it in namespace secrets-engine-pdp-trust. Record only the principal, key fingerprint and trust-file hash. This is founder action, not worker work. A local signature test is not admission.

2026-10-21: decision e4eee965 resolved by the founder as approved in principle. The approach is accepted. The remaining gate is the founder's actual signature over the real trust file once FLEX-WP-0024-T06 delivers the key.

2026-10-21 upstream path (read-only survey; Access repo is access-engine). No key exists yet. The order is:

1. Founder resolves decision 18731e84, the CCR-2026-0050 custody scope; that unblocks RPF-WP-0035-T14. Access approved its side in railiance-platform b3f12b2.
2. Platform creates the key (CAS0, KV v1) and emits signer-cas-receipt.v1.
3. Founder gives the go on FLEX-WP-0024-T07 (decision 4fab263d) for the attended R2 signer window, kid flex-auth-lifecycle-20261016-r1.
4. Access runs tools/prepare_signer_public_receipt.py, which writes the exact pdp-trust.json bytes.
5. This task: founder signature and root anchor install. Access's trust-file projection matches decision_signature.load_trust: the same seven keys, 32-byte base64url keys, and the same namespace. Its pin is access-engine docs/native-signer-public-pin.json. No format work remains here.

Verify the admitted native consumer and rotation path

id: SECRETS-WP-0014-T03
status: wait
priority: high
depends_on: [SECRETS-WP-0014-T02, SECRETS-WP-0014-T04]
blocking_reason: "Requires the founder-signed key admission (T04) and an exact native rollout receipt; source enforcement is done (T02)."
state_hub_task_id: "85aa4c78-b66d-5201-8e31-0ed50e7eaeec"

Under an exact reviewed rollout, prove the real pin and consumer accept the admitted signer, reject forgery/downgrade, rotate without accepting removed keys, and preserve request/approval binding, lifetime and single-use consumption. Retain rollback and failure evidence. Update CUST-WP-0082-T06 (G13) only with these native receipts; do not equate passing transport tests with closure.

2026-10-16 native preparation (no rollout): docs/proposals/native-cli-admission/ now scopes the existing CLI/lifecycle signer stage, exact delegated PEP denominator, independent key/policy admission, owner-controlled bundle/config placement and rotation/rollback refusal. Canonical ff1a13d (packaging plus strict handoff) was rebuilt in an isolated clean checkout; artifact receipts are in Custodian decision-native-preparation/. Production kid/public fingerprint/custody receipt, producer candidate OCI and actual runtime/config placement remain missing. The empty-key trust template deliberately refuses. No install, key read, caller mint, protected effect, policy switch or trust admission occurred. T02 remains progress, T03 wait; task source/live obligations remain separately in SECRETS-WP-0013.

2026-10-16 trusted successor source preparation: refreshed exact API/sign source from frozen Access B2/B3 R1 proposal (patch SHA-256 sha256:6079ed2ff40b131aa2c5efc8d33608ecb3475c8158f0486b44ec4469e9f222c1). Producer DecodeEnvelope preserves signed numeric lexemes; strict CAS retains and reauthenticates original producer JSON. Existing request/claim/native/caller joins remain mandatory; signed source observation additionally binds the native digest and caps decision lifetime. Fourteen Approval owner vectors, legacy signatures, tamper/unknown provenance and source deadline refusals are locally checked. Actual ApprovalApp-to-Access v2 signed response verifies with the consumer helper; actual source revocation refuses. Actual builder-to-v2 strict positive execution is separately blocked on missing owner-reviewed service_actor_binding mapping; no caller context injection or equality relaxation hides that gap. Artifacts: Custodian decision-trusted-successor/. T02 remains progress, T03 wait; no package/key/policy/native admission or runtime installation occurred.

2026-10-16 successor R2 source preparation resolves the preceding builder gap: only typed prod/platform execute-ccr with exact secrets-engine service subject emits Access's fixed five-field public service_actor_binding before approval issue. Subject/resource platform tenants are explicit before issue, matching the producer's existing normalization and native act; lifecycle requests are unchanged. Original carried context is still immutable. Actual builder -> Approval App -> Access v2 signed ALLOW -> strict preparation/CAS -> independent Approval confirmation GET passes with synthetic scoped identities/trust. Missing declaration, descriptor/ native changes, stale original claim, signature tamper and replay refuse. The operation deadline is explicit whole seconds within v2's 15-second allow TTL; no deadline is extended or waived. This resolves source correspondence only; T02 remains progress/T03 wait, with no native trust/grant/policy admission.

2026-10-16 temporal successor source proof: Access B2/B3 R2 replaces its earlier 15s lifetime with the exact immutable operation deadline, bounded by its 120s hard cap, original/fresh source and caller bounds, and post-I/O backend TTL+5s fit. Verifier API/sign bytes are unchanged; source provenance records R2. Secrets runtime and strict entire-operation deadline checks are unchanged. Contract prose now states the actual fixed backend TTL and conservative fit rather than dynamic TTL recomputation, and permits native token expiry earlier than operation deadline. The actual source proof uses explicit synthetic Approval freshness120/backendTTL30/ operationdeadline60, without a consumer timing waiver or native admission.

Temporal proof precision observation: Approval consumption receipts use whole seconds while Access R2 not_before preserves subsecond precision. Fast CAS can therefore refuse receipt-before-start even though live calls are correctly ordered. The positive proof explicitly waits real time until the next whole second before CAS, without injected clocks or relaxed checks. Fast-CAS failure is retained for owner resolution; no Secrets runtime change conceals the seam.

2026-10-16 retained-registry successor source preparation adds only the existing signed Check/DENY preapproval flow. The original typed service proposal is sent unchanged; normalized native act and evaluated approval-free digest from the admitted producer record are used for normal Approval issuance. The original proposal then receives only the original issued claim. Final Check re-normalizes against retained owner registry/source facts, so authoritative drift refuses before CAS. No local registry algorithm, new endpoint, empty-registry workaround or consumer digest waiver is used. Signed DENY preparation has no independent permission/freshness window and cannot consume or execute; current caller and operation bounds are checked, and final signed ALLOW/source checks remain mandatory. Exact original JSON kinds and requested-target subsets refuse bool/int/float substitution while allowing extra authoritative registry facts. Actual provider proof preparation is separately waiting on frozen Access source and Approval's timestamp/transaction-clock repair; source native/trust/custody and actual task admission remain open. T02 remains progress and T03 wait; no native adoption is claimed.

2026-10-16 canonical native CLI release preparation: published4dd004a was built twice offline from a clean isolated checkout, with identical artifacts/manifest sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e. Disposable installation uses its fixed helper and empty native trust refuses before caller access. Exact invocation/config/delivery candidates, public signer provenance requirements, native lifecycle allow/deny capture, rotation/removal and isolated-transport outage probes are reviewable in Custodian decision-native-preparation/r2/. Real public kid/key/custody, candidate signed producer/log/storage, native UID/prefix/config/caller/Approval delivery and each actual handler/backend entitlement remain missing. No seed/token read, mint, production installation/trust/policy change or effect occurred. Native effect coverage remains0/11 across10handlers; T02 progress/T03 wait and task-native WP13/WP8 gates remain open. Published Access receipt-tool2b064ee and verified source APIs do not substitute for the separately reviewed hardened native image.

2026-10-16 owner public-source selection for preparatory installation: select runtime4dd004a/documentation3718e60 and the canonical offline release manifest sha256:105dcebe6f03e9799f91ea75175e20500df2aa7f08b5e32d39c1c367593ca47e, with public empty-key consumer baseline sha256:72521ff7729f8ddf5176092f3949cd50ac5f9241b0a5d1d30f3c63ce1d83091b. Select the fresh owner-controlled release prefix /home/worsch/.local/share/secrets-engine/releases/4dd004a22501-105dcebe6f03 and config revision /home/worsch/.config/secrets-engine/native-lifecycle/lifecycle-20261016-pre-key-r1. Use the existing offline installer and fixed-helper CLI; verify the complete owner-controlled parent chain and artifact set before installation. This closes public runtime/config selection only; actual home installation is not yet made. Fresh isolated install/help, ten catalog rows and real installed authorize_action empty-key refusal before caller/socket access passed. All53 runtime source hashes and complete consumerR1/PlatformP4/AccessrolloutR2 manifests matched. P4/R2 binds the same baseline/policy/caller, projection8ce375f and separately pinned chartdc0420/ image84c78e0 OCI digest09a83b2. The historical P1/failed400 finding is superseded only for this exact new source join, with old receipts preserved. Secrets owns consumer/trust; Access workload/Helm; Platform custody/GitOps sync; cluster runtime/storage/PV; founder the attended disposition. No native assent is supplied: founder/expiry/approvedCCR/window remain null. Public custody return, independent key-bearing successor admission, named-pod/runtime receipt, bounded caller delivery and lifecycle capture/export scope remain outstanding. Approval, backend/effects/readback/cleanup/WP13 grants remain separate. T02 stays progress, T03 wait; TSA01/02/03 remain open, protected acceptance0/11sites across10handlers. No credential/kubeconfig/private custody read, caller mint, live action, actual home install or new authority occurred. Exact review/proof and concrete install step: Custodian secrets-native-admission-next/ within the2026-10-16 target wave.

2026-10-16 actual inert local preparation: coordinator installed the selected bundle through the unchanged owner offline installer into the exact selected fresh release prefix and copied all17 selected public configuration files0600 under the exact selected pre-key revision, with new private directories0700. The bounded coordinator runner checked53 runtime source hashes and complete bundle/config hashes before writing; installed CLI help and ten catalog rows passed. Actual installed authorize_action with the exact selected environment refused missing admitted keys before caller or socket access; its audit hook would forbid either. Backend and Approval remain blank, no caller was created, no key was admitted, no effects were authorized and same-UID code isolation remains unestablished. Non-secret observed installation receipt SHA-256 1ab9c271dfb236f09c4528ae18897381f5e404541708bf36f50c41c77d183ba0 is Custodian secrets-native-admission-next/actual-prekey-install.json within the 2026-10-16 target wave. This supersedes only the preceding historical statement that actual local installation was not yet made. Native custody/rollout/caller/ trust/Approval/effect gates and T02progress/T03wait remain unchanged; accepted protected sites remain0/11 across10handlers, TSA01/02/03 open.