[P0-24] Expose authenticated target-lease HTTP APIs and enforce leases in target execution #32

New issue

Open

opened 2026-07-22 00:14:33 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-07-22 00:14:33 +00:00

(Migrated from github.com)

ARDR refresh — 2026-08-29

Canonical research/design have been refreshed against the current implemented lease-store stack.

Research: lost-rob0t/starintel-auto-research/roam/research/star-server/STAR-RESEARCH-032-authenticated-target-lease-http-execution.org — READY_FOR_DESIGN; operator research approval recovered from Auto-Research #157.
Design: lost-rob0t/starintel-auto-research/roam/design/star-server/STAR-SERVER-032-authenticated-target-lease-http-execution.org — DESIGN_READY_FOR_OPERATOR_REVIEW.
Implementation authorization: PENDING / AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL.

Current implementation reality

Do not redesign the lease backend. Current server already has the backend-neutral lease protocol, Valkey adapter, contract tests, and real-Valkey integration/hardening. The remaining #32 gap is the integration layer above that implementation.

Remaining bounded scope

Add one authenticated target-lease application service shared by HTTP and embedded Common Lisp callers.
Apply principal/capability/scope, idempotency, correlation, disclosure, and one propagated absolute deadline before/around existing lease-store operations.
Project typed service outcomes through the current versioned HTTP/capability API boundary; do not create a parallel version convention.
For targets whose policy requires locking, create immutable server-side execution authority from validated current lease state before local/Rabbit dispatch. Caller-supplied lease fields are never authority.
Add one real fenced side-effect acceptance seam proving stale generation N cannot mutate/publish authoritatively after N+1 exists.
Prove local and Rabbit paths carry equivalent authority semantics.
Leave the exhaustive expiry/crash/reacquire/failover matrix to #33, using the seams created here.

Proposed implementation slices — ALL PENDING OPERATOR APPROVAL

Slice 1 — pure application-service contract

Fake existing lease store only; no HTTP/network.

Mandatory RED: unauthorized service-call context attempts acquire. Untouched current server must fail because no target-lease application service exists. GREEN must return typed authorization denial and prove fake-store invocation count is zero.

Sibling fixture: authorized embedded call returns the same typed service result later projected by HTTP.

Slice 2 — authorization/idempotency/deadline

exact targets:lease + target/program/dataset/actor scope;
idempotency request binding and mismatched-key rejection;
one absolute deadline;
known timeout vs unknown mutation outcome.

Slice 3 — HTTP projection

Stable projections for acquired/renewed/released/found/listed, conflict, stale/precondition, hidden/not-found, unauthorized/forbidden, invalid, overload, backend unavailable, known timeout, and unknown outcome. No Valkey/backend/private-owner leakage.

Slice 4 — target dispatch authority

Required-lock target without server-created authority fails before local actor send or Rabbit publish. A caller-provided fake fencing token must not satisfy the gate.

Slice 5 — fenced effect acceptance

RED scenario:

worker A owns fence N and stalls
worker B reacquires N+1
B effect accepted
A later submits effect with N
A effect rejected; authoritative mutation count unchanged

Slice 6 — local/Rabbit equivalence

Equivalent immutable authority, stale-work classification, and bounded settlement behavior.

Acceptance

existing lease protocol/Valkey code remains storage authority;
HTTP and embedded calls use one service contract;
unauthorized calls do not reach the store;
required-lock targets cannot dispatch without current server-created authority;
local/Rabbit execution semantics match;
stale generation cannot make an authoritative effect after a newer fence;
#33 can exercise full race/recovery behavior through these seams;
no new StarLang syntax, Prolog authority, or second lease control plane.

Implementation authorization

PENDING / AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL

Research approval/design readiness/issue state do not authorize RAGE implementation.

## ARDR refresh — 2026-08-29 Canonical research/design have been refreshed against the current implemented lease-store stack. - Research: `lost-rob0t/starintel-auto-research/roam/research/star-server/STAR-RESEARCH-032-authenticated-target-lease-http-execution.org` — `READY_FOR_DESIGN`; operator research approval recovered from Auto-Research #157. - Design: `lost-rob0t/starintel-auto-research/roam/design/star-server/STAR-SERVER-032-authenticated-target-lease-http-execution.org` — `DESIGN_READY_FOR_OPERATOR_REVIEW`. - **Implementation authorization: PENDING / AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL.** ## Current implementation reality Do not redesign the lease backend. Current server already has the backend-neutral lease protocol, Valkey adapter, contract tests, and real-Valkey integration/hardening. The remaining #32 gap is the integration layer above that implementation. ## Remaining bounded scope 1. Add one authenticated target-lease application service shared by HTTP and embedded Common Lisp callers. 2. Apply principal/capability/scope, idempotency, correlation, disclosure, and one propagated absolute deadline before/around existing lease-store operations. 3. Project typed service outcomes through the current versioned HTTP/capability API boundary; do not create a parallel version convention. 4. For targets whose policy requires locking, create immutable server-side execution authority from validated current lease state before local/Rabbit dispatch. Caller-supplied lease fields are never authority. 5. Add one real fenced side-effect acceptance seam proving stale generation N cannot mutate/publish authoritatively after N+1 exists. 6. Prove local and Rabbit paths carry equivalent authority semantics. 7. Leave the exhaustive expiry/crash/reacquire/failover matrix to #33, using the seams created here. ## Proposed implementation slices — ALL PENDING OPERATOR APPROVAL ### Slice 1 — pure application-service contract Fake existing lease store only; no HTTP/network. **Mandatory RED:** unauthorized service-call context attempts acquire. Untouched current server must fail because no target-lease application service exists. GREEN must return typed authorization denial and prove fake-store invocation count is zero. Sibling fixture: authorized embedded call returns the same typed service result later projected by HTTP. ### Slice 2 — authorization/idempotency/deadline - exact `targets:lease` + target/program/dataset/actor scope; - idempotency request binding and mismatched-key rejection; - one absolute deadline; - known timeout vs unknown mutation outcome. ### Slice 3 — HTTP projection Stable projections for acquired/renewed/released/found/listed, conflict, stale/precondition, hidden/not-found, unauthorized/forbidden, invalid, overload, backend unavailable, known timeout, and unknown outcome. No Valkey/backend/private-owner leakage. ### Slice 4 — target dispatch authority Required-lock target without server-created authority fails before local actor send or Rabbit publish. A caller-provided fake fencing token must not satisfy the gate. ### Slice 5 — fenced effect acceptance RED scenario: ```text worker A owns fence N and stalls worker B reacquires N+1 B effect accepted A later submits effect with N A effect rejected; authoritative mutation count unchanged ``` ### Slice 6 — local/Rabbit equivalence Equivalent immutable authority, stale-work classification, and bounded settlement behavior. ## Acceptance - existing lease protocol/Valkey code remains storage authority; - HTTP and embedded calls use one service contract; - unauthorized calls do not reach the store; - required-lock targets cannot dispatch without current server-created authority; - local/Rabbit execution semantics match; - stale generation cannot make an authoritative effect after a newer fence; - #33 can exercise full race/recovery behavior through these seams; - no new StarLang syntax, Prolog authority, or second lease control plane. ## Implementation authorization `PENDING / AWAITING_OPERATOR_IMPLEMENTATION_APPROVAL` Research approval/design readiness/issue state do not authorize RAGE implementation.