RAGE #52: carry delegated principal through live WebSocket dispatch #53

Merged

lost-rob0t merged 3 commits from rage/52-live-websocket-principal-provenance into main

2026-08-26 07:24:46 +00:00

lost-rob0t commented

2026-08-26 07:12:37 +00:00

(Migrated from github.com)

TDD-first follow-up to #50/#51. The live WebSocket handler currently drops the authenticated session principal/authority kind when it calls submit-command, so direct principal-isolation tests are not sufficient proof for real delegated clients.

This initial head is tests-only. It requires:

worker sessions record non-delegated/internal authority;
delegated Auto-Dig sessions record :delegated-user server-side authority;
a narrow SUBMIT-CONNECTION-COMMAND transport seam carries only server-registered connection identity into the control-plane actor path;
two delegated humans in one workspace remain isolated when commands enter through that live-transport seam;
no principal is reflected in protocol results.

Expected state: RED until production WebSocket dispatch propagates trusted connection authority. No gateway enablement should consume this branch before observed RED, minimum realization, and exact-head green CI.

TDD-first follow-up to #50/#51. The live WebSocket handler currently drops the authenticated session principal/authority kind when it calls `submit-command`, so direct principal-isolation tests are not sufficient proof for real delegated clients. This initial head is tests-only. It requires: - worker sessions record non-delegated/internal authority; - delegated Auto-Dig sessions record `:delegated-user` server-side authority; - a narrow `SUBMIT-CONNECTION-COMMAND` transport seam carries only server-registered connection identity into the control-plane actor path; - two delegated humans in one workspace remain isolated when commands enter through that live-transport seam; - no principal is reflected in protocol results. Expected state: RED until production WebSocket dispatch propagates trusted connection authority. No gateway enablement should consume this branch before observed RED, minimum realization, and exact-head green CI.