RAGE #48: least-privilege Auto-Dig client service session #49

Open

lost-rob0t wants to merge 5 commits from rage/48-autodig-client-session into main

lost-rob0t commented

2026-08-26 06:25:37 +00:00

(Migrated from github.com)

Tests-first implementation for #48. Initial head intentionally specifies the missing owner-side session boundary before production code.

RED contract:

exact public lifecycle capability set including system.capabilities;
no worker claim/heartbeat/complete/fail authority;
no document/graph/workspace mutation authority;
invalid token/principal/workspace configuration fails closed;
existing WebSocket workspace enforcement remains authoritative.

This remains generic Quasar authority. No Bixby-specific commands or protocol fields are introduced.

Tests-first implementation for #48. Initial head intentionally specifies the missing owner-side session boundary before production code. RED contract: - exact public lifecycle capability set including `system.capabilities`; - no worker claim/heartbeat/complete/fail authority; - no document/graph/workspace mutation authority; - invalid token/principal/workspace configuration fails closed; - existing WebSocket workspace enforcement remains authoritative. This remains generic Quasar authority. No Bixby-specific commands or protocol fields are introduced.

nsaspy changed title from ~~WIP: RAGE #48: least-privilege Auto-Dig client service session~~ to RAGE #48: least-privilege Auto-Dig client service session

2026-08-27 19:50:34 +00:00

This pull request has changes conflicting with the target branch.

control-plane/src/autodig-websocket-session.lisp
control-plane/tests/autodig-websocket-auth-tests.lisp

View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Merge commit title

Merge pull request 'RAGE #48: least-privilege Auto-Dig client service session' (#49) from rage/48-autodig-client-session into main

Merge commit body

Reviewed-on: https://git.starintel.actor/nsaspy/quasar/pulls/49

Merge pull request 'RAGE #48: least-privilege Auto-Dig client service session' (#49) from rage/48-autodig-client-session into main

Reviewed-on: https://git.starintel.actor/nsaspy/quasar/pulls/49

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin rage/48-autodig-client-session:rage/48-autodig-client-session

git switch rage/48-autodig-client-session

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff rage/48-autodig-client-session

git switch rage/48-autodig-client-session

git rebase main

git switch main

git merge --ff-only rage/48-autodig-client-session

git switch rage/48-autodig-client-session

git rebase main

git switch main

git merge --no-ff rage/48-autodig-client-session

git switch main

git merge --squash rage/48-autodig-client-session