P0: carry delegated principal authority through the live WebSocket dispatch path #52

New issue

Closed

opened 2026-08-26 07:11:33 +00:00 by lost-rob0t · 1 comment

lost-rob0t commented

2026-08-26 07:11:33 +00:00

(Migrated from github.com)

Consumer: starintel-labs/starintel-infra#72
Parent authority work: #50 / merged PR #51

Discovery

After merging #51, direct control-plane tests prove server-side principal isolation, but the live WebSocket path still calls quasar.control-plane:submit-command without passing the authenticated ws-connection-principal or delegated authority kind. That means the newly merged *command-principal* / *command-authority-kind* isolation context is not populated for actual WebSocket commands.

Required fix

TDD-first, preserve current browser/worker behavior and add the smallest live transport propagation seam:

a delegated-human WebSocket session must dispatch commands with its server-registered principal and :delegated-user authority kind;
standard/internal sessions must retain current non-delegated behavior;
the principal/authority kind must come only from server-side session registration, never client JSON metadata;
system.capabilities remains local to the WS boundary;
no principal/token leakage into command envelopes, results, logs, or audit payloads beyond the existing server-side audit principal field;
same-workspace cross-user Auto-Dig isolation must hold when commands enter through the live WebSocket handler, not just direct submit-command tests.

TDD gate

Add a deterministic WebSocket-dispatch test or a narrow injectable transport-level test that first fails because handle-text-message drops principal provenance, then passes only when the connection's trusted principal/authority is propagated into submit-command. Include a spoofed metadata.principal case proving client JSON cannot override trusted identity.

Exit

Exact-head CI green; browser/default and worker sessions unchanged; delegated Auto-Dig live WebSocket dispatch reaches owner handlers with the authenticated human principal.

Consumer: `starintel-labs/starintel-infra#72` Parent authority work: #50 / merged PR #51 ## Discovery After merging #51, direct control-plane tests prove server-side principal isolation, but the live WebSocket path still calls `quasar.control-plane:submit-command` without passing the authenticated `ws-connection-principal` or delegated authority kind. That means the newly merged `*command-principal*` / `*command-authority-kind*` isolation context is not populated for actual WebSocket commands. ## Required fix TDD-first, preserve current browser/worker behavior and add the smallest live transport propagation seam: - a delegated-human WebSocket session must dispatch commands with its server-registered principal and `:delegated-user` authority kind; - standard/internal sessions must retain current non-delegated behavior; - the principal/authority kind must come only from server-side session registration, never client JSON metadata; - `system.capabilities` remains local to the WS boundary; - no principal/token leakage into command envelopes, results, logs, or audit payloads beyond the existing server-side audit principal field; - same-workspace cross-user Auto-Dig isolation must hold when commands enter through the live WebSocket handler, not just direct `submit-command` tests. ## TDD gate Add a deterministic WebSocket-dispatch test or a narrow injectable transport-level test that first fails because `handle-text-message` drops principal provenance, then passes only when the connection's trusted principal/authority is propagated into `submit-command`. Include a spoofed `metadata.principal` case proving client JSON cannot override trusted identity. ## Exit Exact-head CI green; browser/default and worker sessions unchanged; delegated Auto-Dig live WebSocket dispatch reaches owner handlers with the authenticated human principal.

lost-rob0t commented

2026-08-26 07:24:57 +00:00

(Migrated from github.com)

Result: live WebSocket command submission now uses only the server-registered connection principal + authority kind; delegated Auto-Dig sessions are tagged :delegated-user, worker/default sessions stay internal, and same-workspace cross-user isolation is exercised through the transport seam. The separate trusted StarIntel credential -> delegated-session registration boundary remains #54.

RAGE closeout: tests-first PR #53 observed RED on the intended four missing provenance assertions, then added only the live transport/session authority seam. Exact candidate `a345679d9c62e9479bef6053b254c3e47a448016` passed full CI run `32942185871`: static/boundary checks, frontend tests/build, Common Lisp control-plane tests, real `quasar-web` load, dev-stack smoke, Playwright real-stack desktop/mobile/mutation/reload paths, and packaged production/security smoke. No reviews or unresolved threads remained. PR #53 merged with expected-head protection as `c1e5439b4ae84af2ba069c4b3bd363e78aef702d`. Result: live WebSocket command submission now uses only the server-registered connection principal + authority kind; delegated Auto-Dig sessions are tagged `:delegated-user`, worker/default sessions stay internal, and same-workspace cross-user isolation is exercised through the transport seam. The separate trusted StarIntel credential -> delegated-session registration boundary remains #54.