88 lines
8.5 KiB
JSON
88 lines
8.5 KiB
JSON
{
|
|
"schema": "access-engine.service-http-join-source-proposal.v1",
|
|
"work_item": "FLEX-WP-0024-T06 with SECRETS-WP-0013/RPF-WP-0035-T12 coordination",
|
|
"state": "source design for coordinator/owner review before implementation; no policy code or false-gate change in current patch",
|
|
"problem": "Current /v1/check authenticates protected-system representation only and sends caller-supplied CheckRequest directly into Engine.Check. ServicePilotInputs.Prepare authenticates exact subject mapping but has no HTTP caller. Current source service policy correctly returns DENY. Signing authenticates Access output, not the provenance of caller-supplied Approval facts.",
|
|
"reuse": {
|
|
"caller": "Existing callerauth KubernetesTokenReviewer and ServicePilotInputs: actual TokenReview principal/audience/expiry, fixed service mapping and canonical detached request; no second human initiator auth for service pilot.",
|
|
"approval": "Existing Approval Engine GET /v1/approvals/{id}/claim fact contract. Approval valid_now plus declared binding.human_control true carries owner-verified distinct human approver requirement; do not duplicate KeyCape human token verification in Access.",
|
|
"request_digest": "Existing api.NewDecisionBindingFor, api.ApprovalBindingDigest and registry normalization remain authoritative; no new native Approval digest algorithm.",
|
|
"consumer_effect": "Existing Secrets/Platform strict handoff and original-consumption confirmation/journal remain authoritative; Access never consumes approval or invokes backend effect.",
|
|
"transport": "Owner-admitted exact Approval origin and existing authenticated channel/TLS mechanisms. No caller-selected URL/key/source, no same-channel public trust bootstrap and no unsigned identity flag."
|
|
},
|
|
"minimal_slices": [
|
|
{
|
|
"id": "B1",
|
|
"purpose": "Wire actual exact service caller on HTTP while retaining signed DENY",
|
|
"expected_files": [
|
|
"cmd/access-engine/main.go",
|
|
"cmd/access-engine/main_test.go",
|
|
"internal/taskexecution/service_input.go",
|
|
"internal/taskexecution/service_input_test.go"
|
|
],
|
|
"change": "For exact execute-ccr pilot requests on an owner-configured service-task pin, invoke ServicePilotInputs.Prepare using installed TokenReviewer instead of treating generic system authorization as subject authentication. Reuse one review result, not two parallel auth claims. Carry returned immutable Caller via callerauth.WithRecord and detached submitted request. Keep lifecycle path unchanged and pilot runtime_admission false. Missing service adapter/config refuses, never falls through to generic Check.",
|
|
"checks": [
|
|
"Actual disposable HTTP with controlled TokenReview endpoint verifies correct caller produces signed DENY",
|
|
"Missing/foreign/expired token, wrong subject/type/tenant, public binding spoof/extra members, human/delegation flags, unknown transport expiry and operation deadline after token expiry refuse before evaluation",
|
|
"Warn/disabled mode cannot instantiate task path; explicit retained flex-auth audience; source migration alias behavior tested deliberately",
|
|
"Task BatchCheck/ListAllowed/CLI generic entrypoints cannot bypass dedicated service-input path"
|
|
],
|
|
"gate": "No eligibility/allow or backend effect; this first slice alone never completes integration."
|
|
},
|
|
{
|
|
"id": "B2",
|
|
"purpose": "Add a thin typed Approval fact reader with owner golden vectors, still DENY",
|
|
"expected_files": [
|
|
"internal/taskexecution/approval_fact.go",
|
|
"internal/taskexecution/approval_fact_test.go",
|
|
"docs/service-task-execution-contract.md"
|
|
],
|
|
"change": "Introduce server-installed ApprovalFactSource interface whose implementation reads only the fixed published claim endpoint using an admitted authenticated origin and least-scope read identity. No Go SDK exists in Approval owner source today; agree minimal Go transport/typed fact-validation contract with Approval owner before copying logic. Keep response bounds, deadlines, no redirects/proxies, exact id, schema/issuer/status/validity/freshness/human_control and fail-closed malformed/unavailable behavior. Never invoke Python SDK as a credential-carrying subprocess or create a new runtime.",
|
|
"checks": [
|
|
"Run real disposable Approval API with synthetic identity over owner-admitted local channel; compare owner-produced claim vectors",
|
|
"Refuse foreign origin/issuer/id, stale/future/consumed/non-human-control claim, oversized/duplicate/malformed JSON, redirects, body drift and unavailable provider",
|
|
"Owner contract confirms binding.human_control plus valid_now guarantees verified human approver count; requester service is never relabeled as human approver"
|
|
],
|
|
"gate": "No new Approval authority, schema, signature algorithm or policy grant; hard DENY remains."
|
|
},
|
|
{
|
|
"id": "B3",
|
|
"purpose": "Join server-owned facts into one existing PDP evaluation under reviewed eligibility successor",
|
|
"expected_files": [
|
|
"internal/decision/engine.go",
|
|
"internal/taskexecution/service_input.go",
|
|
"cmd/access-engine/main.go",
|
|
"examples/secrets-engine-service-task-execution/policy_package.md"
|
|
],
|
|
"change": "Use an unforgeable-by-HTTP typed service/fact input to the existing decision engine. Reject task action via generic Check/Batch/List/CLI paths; specialized entry validates immutable source evidence, normalizes with existing registry, compares served approval act fields and approval-free PDP digest to normalized request, then uses the single existing policy evaluator. Preserve exact submitted request digest separately from evaluated server-refreshed Approval fact. Retain caller/provider provenance and policy/registry/source versions in signed record. Remove the structural false gate only in an independently reviewed complete successor; never expose a runtime enable boolean or a request context verified flag.",
|
|
"checks": [
|
|
"Preapproval may reuse a signed denied /v1/check binding for exact approval-free digest; it grants no effect. Owner normalization/registry drift between issue and use must refuse or require fresh approval",
|
|
"Source-fetched claim may refresh its freshness object; submitted_request_digest still binds unchanged original request while evaluated request_digest binds owner-fetched facts; compare approval-free pdp_digest without rewriting historical claims",
|
|
"Exact action/actor/principal/purpose/resource fields and human_control must match; consumed state refused before decision; all task lifetime bounds no later than caller/approval/operation expiry",
|
|
"Separate source policy retains ordinary lifecycle behavior; single-package-per-process deployment choice must be explicit and cannot quietly replace existing lifecycle pin",
|
|
"Consumer obtains exact decision then performs original single-use CAS, Platform independently confirms original triplet and executes journal-bound six-call metadata operation; Access performs no consume/effect"
|
|
],
|
|
"gate": "Blocked until Approval source/channel, exact descriptor ownership and full eligibility implementation are independently reviewed; future native deployment/policy admission remains separate."
|
|
}
|
|
],
|
|
"nonchanges_now": [
|
|
"No implementation of B1/B2/B3 in this source patch",
|
|
"No edits to current human/task policy or literal runtime_admission false",
|
|
"No new broker, runtime, namespace, grants or credentials",
|
|
"No universal human initiating identity requirement for admitted service pilot",
|
|
"No approval consume from Access and no consumer policy evaluation"
|
|
],
|
|
"approval_contract_source_evidence": [
|
|
"approval-engine/docs/approval-claim.md",
|
|
"approval-engine/approval_engine/store.py claim/_evaluate",
|
|
"approval-engine/approval_engine/pep.py ApprovalHTTPClient.claim",
|
|
"access-engine/docs/service-task-execution-contract.md",
|
|
"access-engine/internal/taskexecution/service_input.go",
|
|
"access-engine/cmd/access-engine/main.go newServeMuxWithCallerAuth"
|
|
],
|
|
"review_questions_for_owners": [
|
|
"Approval owner: minimal Go claim-validation vector contract and authenticated-origin admission, including exact source assertion of verified human-control count",
|
|
"Access owner: exact existing pilot source pin/package selection and generic-entrypoint guard before provider wiring",
|
|
"Secrets/Platform owners: enriched/approval-free digest preparation and exact immutable descriptor/custody source correspondences; no request relabeling or claim rewrite"
|
|
]
|
|
}
|