RAGE #50: delegated Auto-Dig user session authority #51

Merged

lost-rob0t merged 8 commits from rage/50-delegated-autodig-user-session into main

2026-08-26 07:09:06 +00:00

lost-rob0t commented

2026-08-26 06:43:44 +00:00

(Migrated from github.com)

TDD-first realization for #50, starting from exact Quasar main aa33622089b7a09745ec41f049c3e03ec3280cd1 after #43 merged the durable Auto-Dig lifecycle.

Discovery

The lifecycle handlers are merged, but current WebSocket authorization cannot expose them to an external human client:

standard sessions advertise no autodig.* commands;
scheduled-worker sessions intentionally omit autodig.run.start/pause/resume/stop;
therefore a Bixby gateway cannot truthfully invoke user lifecycle operations yet.

Observed RED

Tests-first head 539aeda30ba2194b137c6f68541cdce7c5884e39 added authorization tests specifying a generic delegated human Auto-Dig session boundary:

canonical StarIntel scope starintel.autodig.read grants only status/get/list;
starintel.autodig.control additionally grants start/pause/resume/stop;
worker-only commands remain excluded;
unrelated StarIntel scopes do not create Auto-Dig authority;
default browser and worker session behavior remains unchanged.

CI run #823 (32939424072) passed frontend/static/type/build plus existing Quasar and Auto-Dig lifecycle/reclaim suites, then failed exactly in autodig-websocket-auth-tests: the delegated registration function was absent, producing six expected failures (FUNCTION, missing session, and unrelated-scope rejection not occurring). This is the observed TDD RED.

Minimum realization

Current head 63d2867f9cb7fcab996c1df9cc89217cc7737fc5 adds only the session-level mapping needed by those tests:

REGISTER-DELEGATED-AUTODIG-USER-SESSION accepts an already-validated StarIntel principal/workspace/scope projection;
StarIntel Auto-Dig read/control scopes map to fixed Quasar lifecycle capability sets;
callers cannot supply arbitrary Quasar capabilities;
no OAuth verification/token parsing is implemented in Quasar;
worker authority remains separate and unchanged;
no credential is placed in protocol payloads by this seam.

Still required before gateway enablement

This PR is not yet the whole external-auth solution. Follow-on TDD/security work must establish the trusted adapter/authentication seam that supplies the validated principal/scopes and must enforce per-principal run isolation so two users sharing a workspace cannot inspect/control each other's runs merely by knowing runId. Missing/expired/revoked delegated authority must fail closed.

The gateway must remain fail-closed until those properties and exact-head CI are green.

TDD-first realization for #50, starting from exact Quasar main `aa33622089b7a09745ec41f049c3e03ec3280cd1` after #43 merged the durable Auto-Dig lifecycle. ## Discovery The lifecycle handlers are merged, but current WebSocket authorization cannot expose them to an external human client: - standard sessions advertise no `autodig.*` commands; - scheduled-worker sessions intentionally omit `autodig.run.start/pause/resume/stop`; - therefore a Bixby gateway cannot truthfully invoke user lifecycle operations yet. ## Observed RED Tests-first head `539aeda30ba2194b137c6f68541cdce7c5884e39` added authorization tests specifying a generic delegated human Auto-Dig session boundary: - canonical StarIntel scope `starintel.autodig.read` grants only status/get/list; - `starintel.autodig.control` additionally grants start/pause/resume/stop; - worker-only commands remain excluded; - unrelated StarIntel scopes do not create Auto-Dig authority; - default browser and worker session behavior remains unchanged. CI run #823 (`32939424072`) passed frontend/static/type/build plus existing Quasar and Auto-Dig lifecycle/reclaim suites, then failed exactly in `autodig-websocket-auth-tests`: the delegated registration function was absent, producing six expected failures (`FUNCTION`, missing session, and unrelated-scope rejection not occurring). This is the observed TDD RED. ## Minimum realization Current head `63d2867f9cb7fcab996c1df9cc89217cc7737fc5` adds only the session-level mapping needed by those tests: - `REGISTER-DELEGATED-AUTODIG-USER-SESSION` accepts an already-validated StarIntel principal/workspace/scope projection; - StarIntel Auto-Dig read/control scopes map to fixed Quasar lifecycle capability sets; - callers cannot supply arbitrary Quasar capabilities; - no OAuth verification/token parsing is implemented in Quasar; - worker authority remains separate and unchanged; - no credential is placed in protocol payloads by this seam. ## Still required before gateway enablement This PR is not yet the whole external-auth solution. Follow-on TDD/security work must establish the trusted adapter/authentication seam that supplies the validated principal/scopes and must enforce per-principal run isolation so two users sharing a workspace cannot inspect/control each other's runs merely by knowing `runId`. Missing/expired/revoked delegated authority must fail closed. The gateway must remain fail-closed until those properties and exact-head CI are green.