Add fail-closed SotyHub OIDC job boundary

[descambiado]

What changed

• adds dedicated /execution/service/* routes for SotyHub service-to-service calls
• verifies Google OIDC signatures before enforcing exact issuer, audience, service-account email, numeric subject, time window, and route
• accepts only the immutable offline forensics/hash_calculator canary with network_mode=none and evidence_read
• binds the SotyHub request, operation, authorization, usage scope, source manifest, BOFA key, profile, and worker image digest into the signed JobSpec
• adds atomic one-use source-manifest claims and worker replay rejection
• signs worker receipts with a separate one-job Ed25519 key and verifies receipt tamper resistance
• updates the locked-down worker fixture, OCI workflow, environment template, and integration documentation

Why

SotyHub needs a machine-to-machine bridge into BOFA without forwarding Firebase user tokens, introducing standing BOFA credentials, or enabling cloud mutation. This PR creates that narrow identity and evidence boundary while keeping actual dispatch disabled.

Operational boundary

• dispatch_performed=false
• no service account has been created or pinned
• no receiver is deployed
• no cloud resource, external target, network-active capability, privileged execution, or mutation is enabled
• the previously published worker digest predates receipt signing and is not represented as compatible with this change
• local Docker Desktop did not become ready, so no container canary is claimed; deterministic in-process and worker-contract canaries pass

Validation

• tools/verify_sotyhub_service_identity.py
• tools/verify_execution_fabric.py
• tools/verify_worker_protocol.py
• tools/verify_worker_oci.py
• tools/verify_execution_api.py
• Python syntax compilation without bytecode
• Flake8 import/unused-symbol checks and project-config checks on new files
• git diff --check

Follow-up before merge or deployment

CI and review must pass. Deployment, sender identity creation, live OIDC exchange, image publication, and any managed dispatcher remain separate explicit decisions.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f55abaa685

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Do not return executable envelopes from preflight

Every successful call to this endpoint returns result["envelope"], even though the source-manifest hash is only claimed by /execution/service/jobs. Repeating preflight therefore produces independently signed JobSpecs with unique manifest IDs and digests; each can pass the worker's digest-based replay check and execute without ever creating the promised one-use source claim. Return only the policy decision and unsigned manifest here, reserving signed envelope issuance for the endpoint that atomically claims the source hash.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Move JWKS resolution off the async event loop

On a cache miss or attacker-supplied unknown kid, verify() calls the synchronous PyJWKClient.get_signing_key_from_jwt() and may perform an outbound HTTPS refresh. Because this dependency is async but invokes it directly, that network operation blocks the entire event loop; unauthenticated requests with rotating kid values can occupy all API workers while JWKS requests complete or time out. Run verification in a worker thread or use a nonblocking, bounded key-cache path.

Useful? React with 👍 / 👎.