secrets-engine/workplans/SECRETS-WP-0014-pdp-transport-and-responder-authentication.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	flavor	depends_on	state_hub_workstream_id
SECRETS-WP-0014	workplan	Constrain PDP transport and authenticate decision responses	infotech	secrets-engine	active	codex	secrets-engine	2026-10-12	2026-10-12	implementation		7252469d-d7a5-5c18-8911-b511b8c6a736

Native owner work for CUST-WP-0080 G13. Reuses the accepted Check contract and FLEX-WP-0024 producer signature surface; does not create another PDP or grant any catalog-lane execution authority. SECRETS-WP-0013 still owns task-scoped protected execution. Transport review is complete; key admission and native rollout remain separate gates below.

Prevent the Check credential from leaving the admitted local transport

id: SECRETS-WP-0014-T01
status: done
priority: high
state_hub_task_id: "8baba9a3-3513-5f02-bafe-ed9dce743173"

Reproduced redirects (301/302/303), environment proxy forwarding, malformed URL handling, oversized-body truncation and invalid UTF-8 against the prior source. The bounded fix disables redirects and ambient proxies/global openers, requires a literal loopback bare origin before credential access, caps the complete response body and rejects invalid UTF-8 as a DecisionError. The approval consumer no longer overrides this safe default with urlopen. Synthetic local-server tests cover both entry points, all five redirect status codes and proxy forwarding. No real credentials or protected backend were touched. Source verification is recorded in the Custodian evidence directory for 2026-10-12, pdp-transport.json. This closes the source transport defects only; T02/T03 remain mandatory.

Implement independently anchored responder authentication

id: SECRETS-WP-0014-T02
status: todo
priority: high
state_hub_task_id: "877782e5-045b-5186-8b95-82e25db21a5a"

Review producer canonical signature bytes and the native pin's unsigned/signed mode. Establish independently admitted verification keys and exact issuer/pin binding with AccessEngine and Platform; an unauthenticated keys endpoint on the same responder is not a trust anchor. Reuse the native producer fixtures rather than inventing a Python canonicalization. Require valid signed envelopes on the production consumer path; prove forged allow, altered payload, unknown key, wrong issuer/pin, unsigned/downgrade, expired and rotation overlap/refusal cases. Track any temporary exception using all required SEC-DSM-EXC fields and actual approval; neither source support nor a loopback URL is that approval.

Verify the admitted native consumer and rotation path

id: SECRETS-WP-0014-T03
status: wait
priority: high
depends_on: [SECRETS-WP-0014-T02]
blocking_reason: "Requires reviewed verification-key admission, source enforcement and exact native rollout receipt; no production trust change is proposed yet."
state_hub_task_id: "85aa4c78-b66d-5201-8e31-0ed50e7eaeec"

Under an exact reviewed rollout, prove the real pin and consumer accept the admitted signer, reject forgery/downgrade, rotate without accepting removed keys, and preserve request/approval binding, lifetime and single-use consumption. Retain rollback and failure evidence. Update CUST-WP-0080 G13 only with these native receipts; do not equate passing transport tests with closure.