Broker Crossing Authority (Preview)

The Unix authority_broker carrier gives a governed non-agent ota run or ota up one independently authorized, atomically consumed lease for one exact semantic work unit.

The repository still declares only governance.crossing_authority.authority_id. Broker location, verifier keys, descriptor delivery, attestation policy, and timing bounds stay in the administrator-owned fixed system store.

• routine safe execution needs no crossing authority
• zero or multiple matching protected bindings refuse rather than guessing
• the broker lease is hidden from the caller and cannot be copied into repository configuration
• one successful consumption cannot authorize a second invocation
• ordinary workflow readiness timeout and runner-derived closure/effect/resource breadth are bound into the exact semantic scope
• grant-required runtime and lifecycle proof remain pre-side-effect refused in this preview

The first carrier is Unix-only and reads one fixed Linux trust store. Repository files, environment variables, policy, workflow fields, and CLI flags cannot redirect it.

• the store and every canonical parent must be root-owned and not group/world writable
• symlinks, non-regular files, duplicate authority IDs, duplicate binding identities, malformed records, and unknown fields fail closed
• the binding fixes the inherited Unix descriptor, expected broker origin, protocol version, verifier keys, issuer/audience, message domains, and wait/lease limits
• the first profile requires required_administrator_claims: []; claim extensions refuse until Ota defines canonical validation semantics
• the launcher supplies an already-connected Unix stream; Ota verifies it and sets FD_CLOEXEC before sending a challenge

/etc/ota/  crossing-brokers.json    broker identity, verifier keys, launcher FD, attestation and timing policy

{  schema_version: 1,  bindings: [{    identity: "sha256:<canonical binding digest>",    authority_id: "platform-release-authority",    broker_id: "platform-crossing-broker",    origin: "https://broker.example.internal",    server_name: "broker.example.internal",    protocol_version: "ota-crossing-broker/v1",    transport_authentication: {      kind: "mtls",      trust_bundle_identity: "sha256:<broker trust bundle>",      credential_source_identity: "launcher:workload-session/v1"    },    credential_delivery: {      kind: "launcher_session_fd",      descriptor: 3,      session_audience: "ota-crossing-broker"    },    broker_verifiers: [{      key_id: "broker-2026-01",      algorithm: "ed25519",      public_key: "<base64url public key>"    }],    attestation: {      issuer: "runner-launcher",      audience: "ota-crossing-broker",      trust_bundle_identity: "sha256:<launcher trust bundle>",      verifiers: [{        key_id: "launcher-2026-01",        algorithm: "ed25519",        public_key: "<base64url public key>"      }],      maximum_age_seconds: 180,      maximum_clock_skew_seconds: 5,      key_rotation_overlap_seconds: 300,      mandatory_protocol_claims: [        "binding_identity", "challenge_nonce_commitment", "invocation_id",        "work_unit_identity", "semantic_scope_identity", "runner_principal",        "channel_delivery", "authenticated_origin", "authority_mounts"      ],      required_administrator_claims: []    },    message_domains: {      challenge_request: "ota-crossing-broker/challenge-request/v1",      attestation_response: "ota-crossing-broker/attestation-response/v1",      authorization_request: "ota-crossing-broker/authorization-request/v1",      authorization_decision: "ota-crossing-broker/authorization-decision/v1",      lease_issuance: "ota-crossing-broker/lease-issuance/v1",      lease_consume: "ota-crossing-broker/lease-consume/v1",      lease_consume_response: "ota-crossing-broker/lease-consume-response/v1"    },    maximum_approval_wait_seconds: 120,    minimum_post_approval_freshness_seconds: 30,    maximum_lease_seconds: 300  }]}

• dry-run returns authority_carrier: authority_broker and decision: requires_live_authorization; it creates no transaction and consumes no lease
• routine execution automatically uses the one protected binding matching authority_id
• optional --grant platform-release-authority only confirms or disambiguates that non-secret label; it never supplies a lease or approval token
• agent refusal remains authoritative and cannot be bypassed by broker authority

governance:  crossing_authority:    authority_id: platform-release-authority

ota run publish --dry-run --json

ota run publishota up --workflow release

• task processes and child commands do not inherit the launcher descriptor
• deterministic admission failures refuse before broker consumption; provisioning belongs to the authorized work unit and starts only after lease consumption
• denial, timeout, interruption, stale attestation, changed scope, revocation, expiry, replay, or ambiguous consume outcome refuses before selected work
• a later approval cannot revive a locally cancelled request
• the broker consume response is bound to the exact pending transaction identity

derive exact semantic work unit  -> verify protected binding and launcher channel  -> send nonce-bound challenge  -> verify launcher attestation  -> verify signed authorization and prepared lease  -> durably create pending crossing transaction  -> atomically consume lease for that transaction  -> start selected work  -> finalize and archive terminal evidence

Successful receipts use transaction schema v2 and retain the carrier-specific evidence needed to re-verify the crossing later.

• binding, attestation, nonce, work-unit, signed decision, prepared lease, and broker revision identities
• signed consume request/response and consume time
• exact contract, semantic scope, crossing family/classification, and bounded actor mode
• selected workflow instance and ordered prerequisite-instance closure, plus scope breadth with closure node/edge counts, effect categories, and hashed resource identities/counts; archive verification re-derives them
• the archived binding is a public verification snapshot and never contains the protected live launcher descriptor
• signed protocol payloads use bounded public-safe invocation, principal, and authority-mount labels; raw paths, descriptors, credentials, and secret provider material are excluded
• pending and terminal transaction identities, state, outcome, and finalization
• ota receipt --history --json rejects missing consumption, carrier substitution, replay, scope drift, altered signatures, and incomplete cleanup

• launcher_attested_one_use means Ota verified the signed launcher protocol and atomic broker consumption; it does not invent provider claims absent from the attestation
• the first adapter supports Unix launcher-session delivery only, not direct task-accessible mTLS keys or provider tokens
• governed runtime and lifecycle proof refuse before start until one terminal transaction can cover their complete invocation and cleanup sets
• hosted broker pressure, interruption/recovery pressure, and stronger provider-attested boundary claims remain V11.7 completion gates
• Ota does not operate the broker, issue approvals, own organization signing keys, or prevent raw-shell bypass outside adopted Ota execution chokepoints