worker: reject wrong-org, expired and replayed WorkerLeases

CONTEXT.md

@@ -42,7 +42,7 @@ schema、Python type、threat fixture 或新的架构决策。
 | `ContextPackage` | Request-scoped, expiring online output | One Organization, ContextRun, Principal, purpose, and audience | Authorized output, not reusable authority |
 | `ContextAccessTicket` | Short-lived signed source-read capability | One Organization, identity chain, provider audience, purpose, epoch, and expiry | Authority only for its declared read audience |
 | `ActionTicket` | Short-lived signed one-effect capability | One Organization, identity chain, effect/audience/payload, epoch, and expiry | Authority only for its declared external effect |
-| `WorkerLease` | Short-lived signed one-shot work capability | One Organization, durable job, ServiceActor/workload, expiry, and nonce | Authority only for the matching job attempt |
+| `WorkerLease` | Short-lived signed one-shot work capability | One Organization, durable job, registered service workload, expiry, and nonce | Authority only for the matching job attempt |
 | `acquisition checkpoint` | Persistent monotonic acquisition progress | One Organization and ContextSource | None |
 | `publish watermark` | Persistent monotonic visibility progress | One Organization and ContextSource | None |
 
@@ -314,14 +314,18 @@ A signed, short-lived, one-shot capability for exactly one external effect.
 
 A server-minted, signed, short-lived, one-shot capability for one durable job
 attempt. 中文：WorkerLease 把 worker 权限限制到指定 Organization、job、operation 和
-ServiceActor/workload，并防 cross-job/cross-tenant replay。
+registered service workload，并防 cross-job/cross-tenant replay。
 
 - **Owner/scope:** one Organization, one durable job attempt, its declared work,
   and the registered service workload that may perform it.
 - **Lifecycle:** short-lived and one-shot; mismatch, expiry, staleness, or replay
   makes it invalid. Exact claim/redemption fields belong to the owning ADR.
 - **Invariant:** no general tenant/read/action authority and no long-lived source
   credential; rejected lease produces zero business effect.
+- **Activation note:** Issue #17 binds a registered ServicePrincipal to
+  `supply.noop` + `context-engine-worker` + `noop.complete`; this bounded carrier
+  is not the canonical ServiceActor until source/allowed-operation set, Policy
+  Epoch, and the remaining ActorContext fields exist.
 - **Do not confuse with:** queue message, durable job, lock,
   ContextAccessTicket, ActionTicket, or ServicePrincipal.
 

README.md

@@ -18,7 +18,11 @@ closed body 与通用错误证明 caller 不能注入 trusted identity；该测
 credential 并保持空包、零内容 I/O；显式 conformance 组合已证明 hostile
 CandidateIndex 只能经同一 PostgreSQL 事务的 FORCE RLS、exact EffectiveScope 与 sealed
 AuthorizationKernel 交付一个 synthetic exact-authorized Evidence/block。生产认证、durable
-Principal/Agent grants、真实 Source ACL、通用内容检索以及 worker job 行为仍为
+Principal/Agent grants、真实 Source ACL 与通用内容检索仍为 `NOT_ACTIVE`。Issue #17
+已激活唯一的 persistent no-op WorkerLease 子载体：server-minted lease 精确绑定
+Organization、job、registered ServicePrincipal binding、固定 workload/worker audience、
+过期时间与 nonce，并在 non-owner FORCE RLS 下只允许一次原子完成；该 bounded binding
+不是完整 canonical `ServiceActor`，真实 ingestion、outbox 与 publication job 仍为
 `NOT_ACTIVE`。整体计划见 [PLAN.md](./PLAN.md)。
 
 ## 开发命令
@@ -78,8 +82,10 @@ uv run context-engine-api
 uv run context-engine-worker --test-mode
 ```
 
-健康响应中的 `runtime_delivery: NOT_ACTIVE` 表示默认进程没有生产认证入口，worker 输出中的
-`job_behavior: NOT_ACTIVE` 是能力边界。当前数据库测试证明 `compose.yaml` 固定的
+健康响应中的 `runtime_delivery: NOT_ACTIVE` 表示默认进程没有生产认证入口。worker
+输出中的 `job_behavior: NOT_ACTIVE` 特指默认 CLI 尚未配置生产签名密钥来源、queue/job
+loop 或真实 ingestion/publication handler；Issue #17 的 persistent no-op 应用 seam 与
+PostgreSQL authority 已激活并由 integration suite 调用。当前数据库测试证明 `compose.yaml` 固定的
 PostgreSQL/pgvector、
 角色隔离、迁移、连接池清理，以及 Organization + current Membership-backed
 `UserActor` + `organization_record` 的事务级租户上下文、复合所有权和 FORCE RLS。
@@ -100,6 +106,21 @@ carrier 的 Continue、OpenCitation、federated discovery 与 source-native auth
 `request_not_available` 或 `citation_not_available`；unknown variant 或 caller 自报
 capability 仍为通用 422。该激活只证明 deterministic refusal，不表示 continuation、
 citation、federated/source-native Provider 或 File publication 已实现。
+Issue #17 进一步加入 Organization-owned `service_principal` 与 `worker_noop_job`，以及
+显式 versioned keyring 的 canonical HMAC-SHA256 WorkerLease。Control issuer 使用数据库
+事务时间和 server-owned bounded TTL 签出租约；若旧 lease 已按数据库时间过期，可用新
+时间与 nonce 原子 takeover，恢复“事务已提交但 token 未交付”的 crash window，且旧 token
+随后 effect 为零。worker 应用 seam 必须先以自身配置的 registered ServicePrincipal identity
+与时钟验证签名、Organization、job 和时效，再打开数据库事务；durable receiver 固定为
+`supply.noop` + `context-engine-worker` + `noop.complete`，不接受 worker call 覆盖。
+worker 无直接两张 tenant table 的 `SELECT` 或 job `UPDATE` 权限；专用 non-login definer
+function 是唯一 durable 读写边界，并在 FORCE RLS 下以数据库当前时间、key version、nonce
+digest、issued-at/expiry 做一次条件更新。有效 lease 的 effect count
+只能从 0 变为 1；wrong-org/job/audience、篡改、过期、禁用 ServicePrincipal、重放和
+并发 loser 均保持零新增 effect。该 bounded proof 不包含 Source/Resource/Revision、
+Policy Epoch、end-user delivery audience、idempotency/generation、outbox、File 或生产
+worker loop，也不发布或声称完整 canonical `ServiceActor`（其 source/allowed-set/Policy
+Epoch 尚不存在），并将完整 `ACCEPT-008` fixture 保持 `future/fail_closed`。
 
 ### 当前 HTTP exact-authorized Evidence tracer
 

applications/worker.py

@@ -4,12 +4,36 @@
 import json
 import threading
 from collections.abc import Sequence
+from typing import Protocol
 
 from engine import BUILD_IDENTIFIER
+from engine.persistence.worker_jobs import (
+    WorkerLeaseRedemption,
+    WorkerNoOpCompletion,
+)
 from engine.runtime import Runtime
 from engine.runtime.construction import required_kernel_dependencies
 
 
+class WorkerNoOpCompletionAuthority(Protocol):
+    """Application port for one verified persistent no-op completion."""
+
+    def complete_noop(
+        self, redemption: WorkerLeaseRedemption
+    ) -> WorkerNoOpCompletion: ...
+
+
+def complete_persistent_noop_job(
+    authority: WorkerNoOpCompletionAuthority,
+    redemption: WorkerLeaseRedemption,
+) -> WorkerNoOpCompletion:
+    """Execute the bounded Issue #17 worker flow through its durable authority."""
+
+    if type(redemption) is not WorkerLeaseRedemption:
+        raise TypeError("redemption must be WorkerLeaseRedemption")
+    return authority.complete_noop(redemption)
+
+
 def run(*, test_mode: bool) -> int:
     Runtime(required_kernel_dependencies())
     lifecycle = "test-complete" if test_mode else "ready"

docs/decisions/0029-bound-first-worker-lease-to-persistent-no-op-jobs.md

@@ -0,0 +1,124 @@
+---
+name: adr-0029-bound-first-worker-lease-to-persistent-no-op-jobs
+version: "1.0.0"
+description: >
+  Activate the first signed one-shot WorkerLease only for a persistent no-op
+  durable job while preserving the complete Supply lease carrier as deferred.
+---
+
+# 0029. Bound the first WorkerLease to persistent no-op jobs
+
+- Status: accepted
+- Date: 2026-07-22
+- Refines: ADR-0008, ADR-0015, ADR-0019, ADR-0027
+
+## Context
+
+The complete `WORKER-LEASE-007` contract binds every authority-bearing Supply
+dimension and checks it against current durable state. Issue #17 introduces the
+first real API/worker lease path, but it has no Source, Resource, Revision,
+Policy Epoch, idempotent business mutation, outbox, or File publication carrier.
+Treating its no-op lifecycle as proof of that complete contract would create a
+false-green release claim.
+
+The first carrier is owned by the independent worker application boundary and
+changes durable job state. It therefore needs a signed, expiring, exact-job
+capability, a registered
+least-privilege service identity, and atomic one-shot redemption rather than an
+ambient worker credential or an in-memory replay check.
+
+## Decision
+
+Issue #17 activates only a persistent no-op durable-job subcarrier under
+`WORKER-LEASE-007`.
+
+The Control-side issuer mints a versioned, domain-separated canonical token
+authenticated with standard-library HMAC-SHA256. Signing and verification
+receive an explicit, injected, versioned keyring; there is no environment
+lookup, default key, or implicit active version in the domain contract.
+Canonical encoding rejects unknown, missing, duplicate, or non-canonical fields
+before signature use. Lease issuance time comes from the database transaction,
+and the issuer applies a bounded server-owned lifetime; neither timestamp is
+accepted from an issuance request.
+
+The token binds the Issue #17 fields that exist: Organization, durable job,
+registered `ServicePrincipal` binding, workload, worker audience, the exact
+persistent no-op operation, issued-at, expiry, and nonce. The current durable
+job row is the authority for those same values. A valid signature alone never
+authorizes work. This is a bounded `ServicePrincipal` receiver binding, not the
+full canonical `ServiceActor`: Issue #17 has no source/allowed-operation set or
+Policy Epoch, so it neither publishes nor claims that broader ActorContext arm.
+
+The untrusted redemption carrier contains only the opaque token plus independent
+Organization/job routing references. Its registered ServicePrincipal identity
+and local time come from the worker authority's trusted composition, not from
+that carrier. The durable receiver dimensions are fixed to workload
+`supply.noop`, worker audience `context-engine-worker`, and operation
+`noop.complete`; the database completion function accepts none of them from the
+worker call. A local clock can reject early, while PostgreSQL transaction time
+remains the final expiry authority.
+
+Issuance and completion use separate, narrowly granted `SECURITY DEFINER`
+functions owned by a dedicated non-login, non-owner role with fixed
+`search_path`, forced RLS, and exact `session_user` checks. Control can execute
+only issuance; the worker can execute only completion and has no direct table
+`SELECT` or job `UPDATE`. The database function is the sole durable read/write
+boundary for the worker. The completion function atomically compares the
+current no-op job row, including the server-stored SHA-256 nonce digest, and
+performs the only state change. Only the expected leased state and unconsumed
+nonce may transition once; replay, expiry, tampering, wrong Organization/job,
+stale state, and concurrent losers make no new durable change. The worker never
+impersonates the triggering user.
+
+Issuance may replace a still-unconsumed lease only after its database-owned
+expiry. The takeover uses a fresh database timestamp and nonce in one conditional
+update, so a crash after the previous transaction commits but before the opaque
+token reaches the caller cannot strand the job forever. The superseded token
+then fails the current-row comparison and has effect zero; an unexpired lease
+cannot be replaced.
+
+Rejections expose one generic unavailable result. Restricted audit records only
+a safe reason category plus digests; it does not record the token, signature,
+key material, raw claims, or tenant content.
+
+Issue #17 does not bind a Policy Epoch. Its activation record therefore states
+`not-bound-issue-17`, not `organization-v0`. Source, Resource, Revision, Policy
+Epoch, end-user delivery audience, idempotency, generation, content-bearing
+mutation, outbox, and
+File publication remain `NOT_ACTIVE`. The complete `ACCEPT-008` parameterized
+fixture remains preserved as future authority and is not reported PASS by this
+bounded activation.
+
+## Rationale
+
+HMAC-SHA256 is sufficient for a server-minted/server-verified capability within
+the current trust boundary and is available without adding a cryptography
+dependency. Domain separation, canonical bytes, and explicit key versions make
+algorithm and rotation behavior testable. Durable compare-and-set redemption
+puts one-shot authority at the same transaction boundary as the only state
+change it permits. Keeping direct table mutation away from the worker role
+prevents valid database credentials and caller-authored GUC values from becoming
+an alternate completion path.
+
+## Consequences
+
+- Unit evidence can prove canonical signing, versioned-key selection, tamper
+  rejection, expiry, and generic rejection without claiming database authority.
+- Real PostgreSQL evidence is required for registered service identity,
+  database-owned lease time, expired-lease takeover, function ownership/grants,
+  denial of direct table reads and mutation, exact-row comparison, atomic
+  one-shot completion, rollback, and concurrency.
+- The real worker application seam plus PostgreSQL proves one persistent no-op
+  completion and replay rejection; default CLI smoke still proves only process
+  boot/readiness because no production key source or job loop exists yet.
+- The catalog carries a third exact activation record while retaining the full
+  `WORKER-LEASE-007` and `ACCEPT-008` oracles as accepted but deferred.
+
+## Revisit trigger
+
+Revisit before any Source/File acquisition, Resource or Revision mutation,
+Policy-Epoch/end-user-delivery-audience-bound lease, idempotent business effect,
+generation rollover,
+outbox dispatch, or publication carrier is activated. That owner must extend
+the durable-row binding and independently run the corresponding full
+`ACCEPT-008` cases; this no-op proof cannot be promoted by implication.

docs/decisions/README.md

@@ -27,6 +27,7 @@ kernel, capability separation, and publication visibility model.
 | Non-enumerating empty result | [0026 — Normalize no-authorized-Evidence](0026-normalize-no-authorized-evidence.md) | Cross-Organization, same-Organization denied, and missing candidates share one canonical empty Package and narrowly normalized comparison | Existence-specific status, shape, header, count, reason, or an unproven timing claim |
 | First revocation boundary | [0027 — Organization Policy Epoch](0027-organization-policy-epoch.md) | One internal non-owner Control transaction revokes access and advances the Organization epoch; Acquire revalidates immediately before delivery | Cleanup-defined revocation, stale-decision reuse, external admin claims, or implying future carriers are active |
 | Unavailable Runtime capabilities | [0028 — Fail-closed unavailable Runtime capabilities](0028-fail-closed-unavailable-runtime-capabilities.md) | Closed Acquire/Continue/OpenCitation wire; server-owned capability gate returns generic M0 domain refusals before content I/O | Caller-authored capability plans, fake empty success, existence detail, or claiming a real future carrier |
+| First worker lease | [0029 — Persistent no-op WorkerLease](0029-bound-first-worker-lease-to-persistent-no-op-jobs.md) | Versioned HMAC-SHA256 exact-job lease permits one atomic persistent no-op completion; the full Supply carrier remains deferred | Ambient worker identity, signature-only authority, in-memory replay defense, or claiming full `ACCEPT-008` PASS |
 | Read versus effect | [0011 — Read/write plane separation](0011-read-write-plane-separation.md) | `ContextAccessTicket` and `ActionTicket` use different audiences and are non-interchangeable | Using content/read authority to execute an external effect |
 | Publication visibility | [0018 — Immutable ContextRevision publication](0018-immutable-revision-publication.md) | `ContextResource` content is immutable `ContextRevision`/`ContextFragment` lineage; one transaction changes the active pointer | In-place content mutation, mixed old/new reads, or cleanup-defined visibility |
 | Release security catalog | [0019 — Security catalog normalization](0019-security-catalog-normalization.md) | One machine catalog contains exactly fifteen stable release IDs; overlapping labels and derived scenarios keep their safeguards without inflating the count | Parallel prose catalogs, renumbering, or treating inactive cache behavior as a canonical release family |
@@ -105,3 +106,4 @@ touched:
 - [0026 — Normalize no-authorized-Evidence](0026-normalize-no-authorized-evidence.md)
 - [0027 — Organization Policy Epoch](0027-organization-policy-epoch.md)
 - [0028 — Fail-closed unavailable Runtime capabilities](0028-fail-closed-unavailable-runtime-capabilities.md)
+- [0029 — Persistent no-op WorkerLease](0029-bound-first-worker-lease-to-persistent-no-op-jobs.md)

engine/persistence/__init__.py

@@ -22,11 +22,29 @@
     MembershipNotCurrent,
     PostgreSQLMembershipAuthority,
 )
-from engine.persistence.role_guard import assert_control_role, assert_runtime_role
+from engine.persistence.role_guard import (
+    assert_control_role,
+    assert_runtime_role,
+    assert_worker_role,
+)
 from engine.persistence.tenant_context import (
     OrganizationContextBindingError,
     organization_transaction,
 )
+from engine.persistence.worker_jobs import (
+    DEFAULT_WORKER_LEASE_TTL_SECONDS,
+    MAX_WORKER_LEASE_TTL_SECONDS,
+    PostgreSQLWorkerLeaseAuthority,
+    PostgreSQLWorkerLeaseIssuer,
+    WorkerExecutionIdentity,
+    WorkerLeaseAuthorityUnavailable,
+    WorkerLeaseIssueNotAvailable,
+    WorkerLeaseIssueRequest,
+    WorkerLeaseRedemption,
+    WorkerNoOpAuditReceipt,
+    WorkerNoOpCompletion,
+    WorkerNoOpOutcome,
+)
 
 __all__ = [
     "DatabaseConfiguration",
@@ -43,8 +61,21 @@
     "ResourceAccessRevocation",
     "OrganizationContextBindingError",
     "PostgreSQLMembershipAuthority",
+    "PostgreSQLWorkerLeaseAuthority",
+    "PostgreSQLWorkerLeaseIssuer",
+    "WorkerExecutionIdentity",
+    "WorkerLeaseAuthorityUnavailable",
+    "WorkerLeaseIssueNotAvailable",
+    "WorkerLeaseIssueRequest",
+    "WorkerLeaseRedemption",
+    "WorkerNoOpAuditReceipt",
+    "WorkerNoOpCompletion",
+    "WorkerNoOpOutcome",
+    "DEFAULT_WORKER_LEASE_TTL_SECONDS",
+    "MAX_WORKER_LEASE_TTL_SECONDS",
     "assert_runtime_role",
     "assert_control_role",
+    "assert_worker_role",
     "create_database_engine",
     "load_database_configuration",
     "load_harness_database_configurations",

engine/persistence/configuration.py

@@ -13,6 +13,7 @@
 MIGRATOR_ROLE = "context_engine_migrator"
 CONTROL_ROLE = "context_engine_control"
 ACCESS_POLICY_DEFINER_ROLE = "context_engine_access_policy_definer"
+WORKER_LEASE_DEFINER_ROLE = "context_engine_worker_lease_definer"
 RUNTIME_ROLE = "context_engine_runtime"
 WORKER_ROLE = "context_engine_worker"
 

engine/persistence/database.py

@@ -64,6 +64,7 @@ def create_database_engine(
     """Build a PostgreSQL engine whose pool reset point clears every session GUC."""
 
     options: dict[str, object] = {
+        "hide_parameters": True,
         "pool_pre_ping": True,
         "pool_reset_on_return": None,
         "pool_size": pool_size,