RAGE #54: mint bounded delegated Auto-Dig sessions #60

Open

lost-rob0t wants to merge 8 commits from rage/54-delegated-autodig-session-registration into main

lost-rob0t commented

2026-08-26 08:12:49 +00:00

(Migrated from github.com)

Implements #54 TDD-first after #50/#52 landed.

TDD sequence:

tests first require trusted-caller rejection, wildcard/capability injection rejection, one-time consumption, bounded expiry, fixed StarIntel-scope -> Quasar-capability mapping, service-secret rejection, private-route-only behavior, and no registration-secret reflection;
minimum implementation adds short-lived one-time delegated session metadata and atomic handshake consumption;
a separate private Clack registration endpoint /internal/v1/autodig/delegated-session is now implemented and must be started explicitly with a non-empty service secret + fixed trusted service identity;
the endpoint accepts only principal, explicit workspaces, canonical StarIntel scopes and bounded TTL; caller-supplied Quasar capabilities reject;
no Bixby protocol or Samsung OAuth parsing is added to Quasar.

Security boundary:

StarIntel human principal, trusted gateway/service identity, and Quasar delegated session remain separate;
registration uses a secret header, not network location as authority;
the service secret is never accepted in a command body, never returned, and is constant-time compared after length equality;
wildcard workspaces reject;
delegated WebSocket sessions remain tagged :delegated-user, preserving per-principal run isolation from #51/#53;
session handshake tokens are one-time and at most 60 seconds;
no raw StarIntel bearer token is consumed or stored by Quasar.

Remaining integration work is in the consumer/deployment boundary: wire infra #72 to this private registration endpoint, provision the service secret out-of-store, and translate the frozen Bixby routes to canonical quasar.control.v1 commands. Do not enable that consumer until this PR is exact-head green and merged.

Consumer: starintel-labs/starintel-infra#72
Refs #54.

Implements #54 TDD-first after #50/#52 landed. TDD sequence: - tests first require trusted-caller rejection, wildcard/capability injection rejection, one-time consumption, bounded expiry, fixed StarIntel-scope -> Quasar-capability mapping, service-secret rejection, private-route-only behavior, and no registration-secret reflection; - minimum implementation adds short-lived one-time delegated session metadata and atomic handshake consumption; - a separate private Clack registration endpoint `/internal/v1/autodig/delegated-session` is now implemented and must be started explicitly with a non-empty service secret + fixed trusted service identity; - the endpoint accepts only principal, explicit workspaces, canonical StarIntel scopes and bounded TTL; caller-supplied Quasar capabilities reject; - no Bixby protocol or Samsung OAuth parsing is added to Quasar. Security boundary: - StarIntel human principal, trusted gateway/service identity, and Quasar delegated session remain separate; - registration uses a secret header, not network location as authority; - the service secret is never accepted in a command body, never returned, and is constant-time compared after length equality; - wildcard workspaces reject; - delegated WebSocket sessions remain tagged `:delegated-user`, preserving per-principal run isolation from #51/#53; - session handshake tokens are one-time and at most 60 seconds; - no raw StarIntel bearer token is consumed or stored by Quasar. Remaining integration work is in the consumer/deployment boundary: wire infra #72 to this private registration endpoint, provision the service secret out-of-store, and translate the frozen Bixby routes to canonical `quasar.control.v1` commands. Do not enable that consumer until this PR is exact-head green and merged. Consumer: starintel-labs/starintel-infra#72 Refs #54.

nsaspy changed title from ~~WIP: RAGE #54: mint bounded delegated Auto-Dig sessions~~ to RAGE #54: mint bounded delegated Auto-Dig sessions

2026-08-27 19:50:35 +00:00

This pull request has changes conflicting with the target branch.

systems/quasar-tests.asd

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title

Merge pull request 'RAGE #54: mint bounded delegated Auto-Dig sessions' (#60) from rage/54-delegated-autodig-session-registration into main

Merge commit body

Reviewed-on: https://git.starintel.actor/nsaspy/quasar/pulls/60

Merge pull request 'RAGE #54: mint bounded delegated Auto-Dig sessions' (#60) from rage/54-delegated-autodig-session-registration into main

Reviewed-on: https://git.starintel.actor/nsaspy/quasar/pulls/60

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin rage/54-delegated-autodig-session-registration:rage/54-delegated-autodig-session-registration

git switch rage/54-delegated-autodig-session-registration

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff rage/54-delegated-autodig-session-registration

git switch rage/54-delegated-autodig-session-registration

git rebase main

git switch main

git merge --ff-only rage/54-delegated-autodig-session-registration

git switch rage/54-delegated-autodig-session-registration

git rebase main

git switch main

git merge --no-ff rage/54-delegated-autodig-session-registration

git switch main

git merge --squash rage/54-delegated-autodig-session-registration