P0: expose trusted delegated Auto-Dig session registration for StarIntel adapters #54

New issue

Open

opened 2026-08-26 07:20:27 +00:00 by lost-rob0t · 1 comment

lost-rob0t commented

2026-08-26 07:20:27 +00:00

(Migrated from github.com)

Consumer: starintel-labs/starintel-infra#72
Depends on: #50, #52

Problem

Quasar now owns canonical delegated-human Auto-Dig capability mapping and per-principal run isolation, but register-delegated-autodig-user-session is only an in-process function. The infra-owned Bixby gateway cannot safely consume that owner boundary until a trusted private adapter can register a short-lived Quasar session from an already authenticated StarIntel principal/scopes.

Do not make Quasar validate arbitrary Samsung/Bixby tokens and do not let public callers choose Quasar capabilities.

Required owner boundary

TDD-first, design and implement the smallest private/trusted registration seam that can be called by a StarIntel service adapter and that:

accepts only a server-authenticated StarIntel principal, validated canonical scopes, and explicit allowed workspace(s);
maps scopes exclusively through register-delegated-autodig-user-session / canonical fixed capability mapping;
mints or accepts a bounded opaque one-time/short-lived session token suitable for Quasar WebSocket handshake;
never returns or logs the StarIntel bearer token;
cannot be called from the public browser/Bixby-facing interface;
rejects unrelated scopes, wildcard workspace escalation, caller-supplied Quasar command lists, missing/empty principal, and stale/expired registration;
preserves correlation/audit identity without exposing principal data in command result envelopes;
has an explicit deployment/authentication mechanism for the trusted StarIntel service caller (e.g. local/private service credential or mutually authenticated internal boundary) rather than network location alone.

TDD/security gate

Cover unauthorized registration, capability injection, workspace wildcard injection, scope narrowing, token replay/expiry, two principals sharing a workspace, and successful session use through the live WebSocket path from #52.

Exit

The infra gateway can obtain a narrow Quasar delegated session using an already-validated StarIntel human identity without DB/RabbitMQ/UI/browser shortcuts or gateway-local lifecycle authority. Exact-head CI green before merge.

Consumer: `starintel-labs/starintel-infra#72` Depends on: #50, #52 ## Problem Quasar now owns canonical delegated-human Auto-Dig capability mapping and per-principal run isolation, but `register-delegated-autodig-user-session` is only an in-process function. The infra-owned Bixby gateway cannot safely consume that owner boundary until a trusted private adapter can register a short-lived Quasar session from an already authenticated StarIntel principal/scopes. Do not make Quasar validate arbitrary Samsung/Bixby tokens and do not let public callers choose Quasar capabilities. ## Required owner boundary TDD-first, design and implement the smallest private/trusted registration seam that can be called by a StarIntel service adapter and that: - accepts only a server-authenticated StarIntel principal, validated canonical scopes, and explicit allowed workspace(s); - maps scopes exclusively through `register-delegated-autodig-user-session` / canonical fixed capability mapping; - mints or accepts a bounded opaque one-time/short-lived session token suitable for Quasar WebSocket handshake; - never returns or logs the StarIntel bearer token; - cannot be called from the public browser/Bixby-facing interface; - rejects unrelated scopes, wildcard workspace escalation, caller-supplied Quasar command lists, missing/empty principal, and stale/expired registration; - preserves correlation/audit identity without exposing principal data in command result envelopes; - has an explicit deployment/authentication mechanism for the trusted StarIntel service caller (e.g. local/private service credential or mutually authenticated internal boundary) rather than network location alone. ## TDD/security gate Cover unauthorized registration, capability injection, workspace wildcard injection, scope narrowing, token replay/expiry, two principals sharing a workspace, and successful session use through the live WebSocket path from #52. ## Exit The infra gateway can obtain a narrow Quasar delegated session using an already-validated StarIntel human identity without DB/RabbitMQ/UI/browser shortcuts or gateway-local lifecycle authority. Exact-head CI green before merge.

lost-rob0t commented

2026-08-26 08:18:37 +00:00

(Migrated from github.com)

RAGE implementation is now in draft PR #60 at exact head dc00fff2fe6d6d017a97a5292146f476ad3866a8.

Current slice is no longer only in-process: it adds a separately started private Clack registration endpoint at /internal/v1/autodig/delegated-session, authenticated by a configured service secret and fixed trusted service identity. The request accepts only principal, explicit workspaces, canonical StarIntel scopes, and bounded TTL; caller-selected Quasar capabilities and wildcard workspaces reject. Minted WebSocket handshake sessions are tagged :delegated-user, one-time, and <=60s, preserving #51/#53 per-principal enforcement.

Tests were committed before implementation and cover unauthorized registration, capability/workspace injection, expiry/replay, private-route-only behavior, and secret non-reflection. Exact-head CI is currently executing; no green claim yet. Consumer infra #72 must remain fail-closed until #60 is green/merged/deployed.

RAGE implementation is now in draft PR #60 at exact head `dc00fff2fe6d6d017a97a5292146f476ad3866a8`. Current slice is no longer only in-process: it adds a separately started private Clack registration endpoint at `/internal/v1/autodig/delegated-session`, authenticated by a configured service secret and fixed trusted service identity. The request accepts only principal, explicit workspaces, canonical StarIntel scopes, and bounded TTL; caller-selected Quasar capabilities and wildcard workspaces reject. Minted WebSocket handshake sessions are tagged `:delegated-user`, one-time, and <=60s, preserving #51/#53 per-principal enforcement. Tests were committed before implementation and cover unauthorized registration, capability/workspace injection, expiry/replay, private-route-only behavior, and secret non-reflection. Exact-head CI is currently executing; no green claim yet. Consumer infra #72 must remain fail-closed until #60 is green/merged/deployed.