P0: authorize external human Auto-Dig lifecycle clients without collapsing gateway identity #50

New issue

Open

opened 2026-08-26 06:41:57 +00:00 by lost-rob0t · 2 comments

lost-rob0t commented

2026-08-26 06:41:57 +00:00

(Migrated from github.com)

Consumer: lost-rob0t/starintel-bixby#7
Related lifecycle owner: #41
Gateway consumer: starintel-labs/starintel-infra#72
Canonical OAuth owner: lost-rob0t/starintel-server#111

Post-merge discovery

Quasar #43 merged the durable autodig.status, autodig.run.get, autodig.run.list, autodig.run.start, autodig.run.pause, autodig.run.resume, and autodig.run.stop handlers onto current main.

However the WebSocket authorization boundary still has no session profile suitable for an external human client:

+default-capabilities+ does not include any autodig.* lifecycle commands;
register-autodig-worker-session intentionally grants only status/get/list plus worker claim/heartbeat/complete/fail and explicitly excludes start/pause/resume/stop;
therefore a Bixby gateway adapter cannot truthfully expose the merged public lifecycle through current authenticated WebSocket sessions; it would fail security.forbidden.

Goal

Add the smallest canonical Quasar authorization/delegation seam that lets a trusted external service such as starintel-bixby-gateway act for an authenticated StarIntel human principal without turning the gateway service identity into the user identity.

The design must consume StarIntel's existing OAuth/human-principal authority from starintel-server#111; Quasar must not invent a second OAuth token format, user DB, or scope model.

Required authority properties

preserve three identities distinctly: StarIntel human principal, gateway service identity, Quasar runtime/session identity;
lifecycle access must be derived from canonical StarIntel user scopes/capabilities, not caller-supplied fields;
support least-privilege read lifecycle authority separately from lifecycle control authority;
workspace/run access must remain fail-closed across users; possession of runId alone never grants access;
no bearer/access token in query strings, command payload journals, events, logs, or public protocol results;
no static capsule-wide or gateway-wide session may silently grant every Bixby user shared lifecycle authority;
the scheduled worker session remains separate and must not gain user control commands;
system.capabilities must truthfully expose only the commands granted to the authenticated/delegated user session.

ADADR design questions

Research/analyze before production code:

Whether Quasar should accept an injected/authenticated principal assertion from a trusted StarIntel adapter, or consume a generic StarIntel token-introspection/principal projection if such a canonical boundary exists.
Whether the external-user session should be minted through a trusted local registration API, handshake authenticator, or another existing Quasar extension seam.
How StarIntel scopes map to Quasar lifecycle capabilities without creating Bixby-specific capability names.
How per-principal ownership/access is represented for runs so two users in one workspace cannot inspect/control each other's runs accidentally.

TDD/security gate

Tests first must prove:

standard browser/default sessions still do not gain Auto-Dig control implicitly;
worker sessions still cannot start/pause/resume/stop;
external human read-only authority can status/get/list but cannot mutate;
external human control authority can start/pause/resume/stop only with canonical delegated authorization;
cross-user run get/control fails closed even in the same workspace;
missing/invalid/expired/revoked upstream user authority fails closed;
service identity cannot substitute itself for the human principal;
capability discovery matches the granted lifecycle surface;
no credential or raw auth context appears in protocol results/audit events.

Non-goals

no Bixby-specific protocol in Quasar;
no gateway-local lifecycle DB;
no browser/Playwright automation for runtime authority;
no direct CouchDB/RabbitMQ control path;
no weakening the existing worker fencing/lease semantics.

Exit

An external gateway can translate its frozen client contract into canonical quasar.control.v1 lifecycle commands while Quasar still observes/enforces the real delegated human authority and per-user run isolation.

Consumer: `lost-rob0t/starintel-bixby#7` Related lifecycle owner: #41 Gateway consumer: `starintel-labs/starintel-infra#72` Canonical OAuth owner: `lost-rob0t/starintel-server#111` ## Post-merge discovery Quasar #43 merged the durable `autodig.status`, `autodig.run.get`, `autodig.run.list`, `autodig.run.start`, `autodig.run.pause`, `autodig.run.resume`, and `autodig.run.stop` handlers onto current `main`. However the WebSocket authorization boundary still has no session profile suitable for an external human client: - `+default-capabilities+` does not include any `autodig.*` lifecycle commands; - `register-autodig-worker-session` intentionally grants only status/get/list plus worker claim/heartbeat/complete/fail and explicitly excludes start/pause/resume/stop; - therefore a Bixby gateway adapter cannot truthfully expose the merged public lifecycle through current authenticated WebSocket sessions; it would fail `security.forbidden`. ## Goal Add the smallest canonical Quasar authorization/delegation seam that lets a trusted external service such as `starintel-bixby-gateway` act **for an authenticated StarIntel human principal** without turning the gateway service identity into the user identity. The design must consume StarIntel's existing OAuth/human-principal authority from `starintel-server#111`; Quasar must not invent a second OAuth token format, user DB, or scope model. ## Required authority properties - preserve three identities distinctly: StarIntel human principal, gateway service identity, Quasar runtime/session identity; - lifecycle access must be derived from canonical StarIntel user scopes/capabilities, not caller-supplied fields; - support least-privilege read lifecycle authority separately from lifecycle control authority; - workspace/run access must remain fail-closed across users; possession of `runId` alone never grants access; - no bearer/access token in query strings, command payload journals, events, logs, or public protocol results; - no static capsule-wide or gateway-wide session may silently grant every Bixby user shared lifecycle authority; - the scheduled worker session remains separate and must not gain user control commands; - `system.capabilities` must truthfully expose only the commands granted to the authenticated/delegated user session. ## ADADR design questions Research/analyze before production code: 1. Whether Quasar should accept an injected/authenticated principal assertion from a trusted StarIntel adapter, or consume a generic StarIntel token-introspection/principal projection if such a canonical boundary exists. 2. Whether the external-user session should be minted through a trusted local registration API, handshake authenticator, or another existing Quasar extension seam. 3. How StarIntel scopes map to Quasar lifecycle capabilities without creating Bixby-specific capability names. 4. How per-principal ownership/access is represented for runs so two users in one workspace cannot inspect/control each other's runs accidentally. ## TDD/security gate Tests first must prove: - standard browser/default sessions still do not gain Auto-Dig control implicitly; - worker sessions still cannot start/pause/resume/stop; - external human read-only authority can status/get/list but cannot mutate; - external human control authority can start/pause/resume/stop only with canonical delegated authorization; - cross-user run get/control fails closed even in the same workspace; - missing/invalid/expired/revoked upstream user authority fails closed; - service identity cannot substitute itself for the human principal; - capability discovery matches the granted lifecycle surface; - no credential or raw auth context appears in protocol results/audit events. ## Non-goals - no Bixby-specific protocol in Quasar; - no gateway-local lifecycle DB; - no browser/Playwright automation for runtime authority; - no direct CouchDB/RabbitMQ control path; - no weakening the existing worker fencing/lease semantics. ## Exit An external gateway can translate its frozen client contract into canonical `quasar.control.v1` lifecycle commands while Quasar still observes/enforces the real delegated human authority and per-user run isolation.

lost-rob0t commented

2026-08-26 06:58:26 +00:00

(Migrated from github.com)

RAGE/TDD checkpoint:

Quasar #43 is merged on current main aa33622089b7a09745ec41f049c3e03ec3280cd1; lifecycle handlers are no longer the blocker.
PR #51 tests-first head 539aeda30ba2194b137c6f68541cdce7c5884e39 produced observed RED in CI #823 exactly because delegated Auto-Dig user-session registration did not exist, while existing lifecycle/reclaim suites stayed green.
Minimum session mapping head 63d2867f9cb7fcab996c1df9cc89217cc7737fc5 then passed exact-head CI #825 end-to-end, including Common Lisp control-plane tests, real quasar-web load, dev-stack smoke, Playwright real-stack paths, and packaged production smoke.
Next tests-first head 30a55edde78e3c73ca41d33c0a35548d49e480cb now specifies same-workspace cross-user run isolation and server-side principal provenance. It requires two StarIntel humans to reuse the same visible request ID independently, denies get/control of another user's run as autodig.run-not-found, filters list/status per principal, and proves a client-supplied metadata.principal cannot spoof the trusted principal. CI #829 is currently running; no production principal-isolation implementation will be added until that RED is observed.

Design direction remains generic Quasar authority: trusted principal/authority context must be injected server-side into the control-plane actor path, never read from client JSON. Worker authority remains separate.

RAGE/TDD checkpoint: - Quasar #43 is merged on current main `aa33622089b7a09745ec41f049c3e03ec3280cd1`; lifecycle handlers are no longer the blocker. - PR #51 tests-first head `539aeda30ba2194b137c6f68541cdce7c5884e39` produced observed RED in CI #823 exactly because delegated Auto-Dig user-session registration did not exist, while existing lifecycle/reclaim suites stayed green. - Minimum session mapping head `63d2867f9cb7fcab996c1df9cc89217cc7737fc5` then passed exact-head CI #825 end-to-end, including Common Lisp control-plane tests, real quasar-web load, dev-stack smoke, Playwright real-stack paths, and packaged production smoke. - Next tests-first head `30a55edde78e3c73ca41d33c0a35548d49e480cb` now specifies same-workspace cross-user run isolation and server-side principal provenance. It requires two StarIntel humans to reuse the same visible request ID independently, denies get/control of another user's run as `autodig.run-not-found`, filters list/status per principal, and proves a client-supplied `metadata.principal` cannot spoof the trusted principal. CI #829 is currently running; no production principal-isolation implementation will be added until that RED is observed. Design direction remains generic Quasar authority: trusted principal/authority context must be injected server-side into the control-plane actor path, never read from client JSON. Worker authority remains separate.

lost-rob0t commented

2026-08-26 07:12:56 +00:00

(Migrated from github.com)

RAGE continuation: delegated Auto-Dig user authority + principal isolation merged via PR #51 at 3acef088009137a737647b79c404dde615b96c1d after exact-head CI #837 passed and no review threads remained. Post-merge transport audit found one remaining owner-boundary gap: the live WebSocket handler still invokes submit-command without propagating the authenticated connection principal/authority kind, so direct isolation tests do not yet prove live delegated-client isolation. That gap is now tracked in #52 with tests-first PR #53 at 5c75b970eccab37a4075b3f07b585f83dcb0e949; CI is running and production code remains untouched until observed RED. Gateway Auto-Dig stays fail-closed until #52 is green and the trusted StarIntel credential/session-registration adapter is wired.

RAGE continuation: delegated Auto-Dig user authority + principal isolation merged via PR #51 at `3acef088009137a737647b79c404dde615b96c1d` after exact-head CI #837 passed and no review threads remained. Post-merge transport audit found one remaining owner-boundary gap: the live WebSocket handler still invokes `submit-command` without propagating the authenticated connection principal/authority kind, so direct isolation tests do not yet prove live delegated-client isolation. That gap is now tracked in #52 with tests-first PR #53 at `5c75b970eccab37a4075b3f07b585f83dcb0e949`; CI is running and production code remains untouched until observed RED. Gateway Auto-Dig stays fail-closed until #52 is green and the trusted StarIntel credential/session-registration adapter is wired.