P0: add least-privilege Auto-Dig client service session #48

New issue

Open

opened 2026-08-26 06:24:54 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-26 06:24:54 +00:00

(Migrated from github.com)

Consumer: starintel-labs/starintel-infra#72
Parent lifecycle: #41
Bixby epic: lost-rob0t/starintel-bixby#1

Problem

Auto-Dig lifecycle is now canonical on Quasar main, but the WebSocket authority boundary has no production session class suitable for a non-browser external client that must invoke the public lifecycle commands. The existing standard/browser session intentionally lacks Auto-Dig commands, while register-autodig-worker-session intentionally grants worker-only commands and does not grant autodig.run.start/pause/resume/stop.

The StarIntel Bixby gateway must not reuse a browser token, gain worker claim/lease authority, run Quasar in insecure-development mode, or invent a parallel HTTP compatibility layer.

Smallest correct owner-side extension

Add a separately registered least-privilege Auto-Dig client service session whose capabilities are exactly:

system.capabilities
autodig.status
autodig.run.get
autodig.run.list
autodig.run.start
autodig.run.pause
autodig.run.resume
autodig.run.stop

It MUST NOT receive worker claim/heartbeat/complete/fail commands, document/graph mutation commands, or browser-wide capabilities.

The session token is an upstream service credential supplied at deployment/runtime, never a Bixby user token and never committed to Git. Workspace authorization must be explicit; a gateway deployment may be allowed * only when the gateway deterministically maps authenticated StarIntel human principals to isolated workspace IDs before sending commands.

TDD/security gate

Tests first proving:

public lifecycle client session advertises exactly the intended capability set;
worker-only capabilities are absent;
ordinary document/graph mutations are absent;
invalid/empty principal, token, or workspace configuration fails closed;
explicit workspace list is enforced by the existing WebSocket authorization layer;
no insecure-development fallback is required;
session secret is not logged or returned in protocol responses.

Keep this generic Quasar service-session authority. Do not mention Samsung in protocol fields or add Bixby-specific commands.

Consumer: `starintel-labs/starintel-infra#72` Parent lifecycle: #41 Bixby epic: `lost-rob0t/starintel-bixby#1` ## Problem Auto-Dig lifecycle is now canonical on Quasar `main`, but the WebSocket authority boundary has no production session class suitable for a non-browser external client that must invoke the public lifecycle commands. The existing standard/browser session intentionally lacks Auto-Dig commands, while `register-autodig-worker-session` intentionally grants worker-only commands and does not grant `autodig.run.start/pause/resume/stop`. The StarIntel Bixby gateway must not reuse a browser token, gain worker claim/lease authority, run Quasar in insecure-development mode, or invent a parallel HTTP compatibility layer. ## Smallest correct owner-side extension Add a separately registered least-privilege Auto-Dig **client service session** whose capabilities are exactly: - `system.capabilities` - `autodig.status` - `autodig.run.get` - `autodig.run.list` - `autodig.run.start` - `autodig.run.pause` - `autodig.run.resume` - `autodig.run.stop` It MUST NOT receive worker claim/heartbeat/complete/fail commands, document/graph mutation commands, or browser-wide capabilities. The session token is an upstream service credential supplied at deployment/runtime, never a Bixby user token and never committed to Git. Workspace authorization must be explicit; a gateway deployment may be allowed `*` only when the gateway deterministically maps authenticated StarIntel human principals to isolated workspace IDs before sending commands. ## TDD/security gate Tests first proving: - public lifecycle client session advertises exactly the intended capability set; - worker-only capabilities are absent; - ordinary document/graph mutations are absent; - invalid/empty principal, token, or workspace configuration fails closed; - explicit workspace list is enforced by the existing WebSocket authorization layer; - no insecure-development fallback is required; - session secret is not logged or returned in protocol responses. Keep this generic Quasar service-session authority. Do not mention Samsung in protocol fields or add Bixby-specific commands.