Require trusted authority for actor admission records

coilyco-ops commented

2026-07-28 04:15:39 +00:00

Member

Outcome

Make actor admission depend on both authenticated identity and role-bound policy authority. A marker author, matching username, or Ward's shared automation credential alone must never be sufficient to approve issue content or mint trusted machine state.

Authority contract

Human approval requires a configured trusted collaborator identity and a director-or-broker-only mutation capability.
Machine-state records require the configured automation actor and a recognized Ward marker.
Shared automation credentials do not grant director authority to an engineer surface.
Missing author, missing policy, ambiguous identity, unrecognized marker, or unavailable authority fails closed.
One central actor classifier serves workflow, reservation, outcome, QA, redispatch, release, terminal, acknowledgement, prompt, and merge consumers.

Approval record

Record an immutable, auditable snapshot containing the canonical approved title and body, selected comment IDs, authors, timestamps, and text, plus the content hash and issue update time. A body-only issue may have zero selected comments.

Invalidate the snapshot after an issue-body edit, selected-comment edit, later untrusted comment, missing provenance, or policy mismatch before triage, dispatch, QA, merge metadata, or merge recovery consumes it.

Required negative proof

An external actor self-signs a valid-looking approval with her own login and the correct hash. Ward rejects it.
An engineer surface invokes approval with the shared automation credential. Ward rejects it before mutation.
External actors post exact-looking workflow, reservation, outcome, QA, redispatch, release, terminal, and acknowledgement markers. Every consumer rejects them as machine state.
The configured automation actor posts ordinary prose without a recognized marker. Ward does not treat it as machine state or acknowledgement.
A body-only issue can be approved and its immutable record remains auditable.
The same approval fails after each invalidating edit or identity ambiguity.

Acceptance criteria

The central classifier and mutation boundary enforce the authority contract across every machine-state consumer.
Documentation explains the public trust boundary and docs/FEATURES.md reflects the significant security capability.
Repository validation, exact-head review fixtures, and structured QA fixtures pass.

Headless execution boundary

The credential rotation tracked in coilyco-bridge/agentic-os-kai#776 is complete. Start from canonical main and do not merge or reconstruct the blocked partial PRs #1583 and #1585. Use synthetic actors, tokens, comments, and forge fixtures only. Do not inspect real credentials or iterate against live CI. A live-only failure becomes a separate interactive operator issue.

## Outcome Make actor admission depend on both authenticated identity and role-bound policy authority. A marker author, matching username, or Ward's shared automation credential alone must never be sufficient to approve issue content or mint trusted machine state. ## Authority contract * Human approval requires a configured trusted collaborator identity and a director-or-broker-only mutation capability. * Machine-state records require the configured automation actor and a recognized Ward marker. * Shared automation credentials do not grant director authority to an engineer surface. * Missing author, missing policy, ambiguous identity, unrecognized marker, or unavailable authority fails closed. * One central actor classifier serves workflow, reservation, outcome, QA, redispatch, release, terminal, acknowledgement, prompt, and merge consumers. ## Approval record Record an immutable, auditable snapshot containing the canonical approved title and body, selected comment IDs, authors, timestamps, and text, plus the content hash and issue update time. A body-only issue may have zero selected comments. Invalidate the snapshot after an issue-body edit, selected-comment edit, later untrusted comment, missing provenance, or policy mismatch before triage, dispatch, QA, merge metadata, or merge recovery consumes it. ## Required negative proof * An external actor self-signs a valid-looking approval with her own login and the correct hash. Ward rejects it. * An engineer surface invokes approval with the shared automation credential. Ward rejects it before mutation. * External actors post exact-looking workflow, reservation, outcome, QA, redispatch, release, terminal, and acknowledgement markers. Every consumer rejects them as machine state. * The configured automation actor posts ordinary prose without a recognized marker. Ward does not treat it as machine state or acknowledgement. * A body-only issue can be approved and its immutable record remains auditable. * The same approval fails after each invalidating edit or identity ambiguity. ## Acceptance criteria * The central classifier and mutation boundary enforce the authority contract across every machine-state consumer. * Documentation explains the public trust boundary and docs/FEATURES.md reflects the significant security capability. * Repository validation, exact-head review fixtures, and structured QA fixtures pass. ## Headless execution boundary The credential rotation tracked in coilyco-bridge/agentic-os-kai#776 is complete. Start from canonical main and do not merge or reconstruct the blocked partial PRs #1583 and #1585. Use synthetic actors, tokens, comments, and forge fixtures only. Do not inspect real credentials or iterate against live CI. A live-only failure becomes a separate interactive operator issue.

coilyco-ops added the

priority

P0

label

2026-07-28 04:15:39 +00:00

coilyco-ops referenced this issue

2026-07-28 04:18:22 +00:00

Close fail-open gaps in actor admission PR 1583 #1585

coilyco-ops referenced this issue

2026-07-28 04:18:37 +00:00

Add actor-aware admission for external Forgejo issues and comments #1583

coilyco-ops referenced this issue

2026-07-28 04:18:57 +00:00

Stabilize Ward for safe autonomous burndown and verified releases #1574

coilyco-ops referenced this issue

2026-07-28 04:22:42 +00:00

Close fail-open gaps in actor admission PR 1583 #1585

coilyco-ops added

and removed

labels

2026-07-29 03:47:19 +00:00

coilyco-ops added

and removed

labels

2026-07-29 06:19:15 +00:00

coilyco-ops referenced this issue

2026-07-31 08:10:26 +00:00

Replace in-container review quorum with brokered QA handoff #1255

coilyco-ops referenced this issue

2026-07-31 08:12:21 +00:00

Add actor-aware admission for external Forgejo issues and comments #1571

coilyco-ops referenced this issue

2026-07-31 08:12:55 +00:00

Evaluate the value of the trusted-owner config #1327

coilyco-ops added

and removed

labels

2026-07-31 08:29:41 +00:00

coilyco-ops referenced this issue

2026-08-05 09:52:06 +00:00

Replace in-container review quorum with brokered QA handoff #1255

coilyco-ops commented

2026-08-05 10:22:31 +00:00

Author

Member

Kai resolved the authority model on 2026-08-05.

Authoritative implementation contract

The tracker-mutation credential is broker-only. Engineer and QA containers receive a separate Git credential that cannot mutate issues, pull requests, reviews, labels, or comments.
Every tracker mutation from an agent role goes through the authenticated broker. The broker authorizes the requested record kind against the caller capability and role before posting it.
Dispatch fails closed when Ward cannot prove the agent credential lacks tracker-mutation authority. A broad shared token inside an engineer or QA container is unsupported.
Deployment supplies exact trusted-collaborator and automation-actor identities as broker launch inputs. The values are not repository policy, are not accepted from free-text record fields, and cannot be overridden from an agent container.
Remove human-feedback.ignore-authors and custom automation-markers. The fixed Ward marker family is the only machine-state vocabulary.
Add a read-only approval-plan surface that canonicalizes the issue or pull request title, body, selected comment IDs, authors, timestamps, and text, then emits the exact snapshot hash and approval-intent body.
A configured trusted collaborator posts that approval intent through her authenticated Forgejo identity. A director-authorized broker action verifies the author, exact hash, selected objects, and current update state before posting the complete immutable WARD-APPROVAL: snapshot as the configured automation actor.
The snapshot is schema-versioned and contains the exact approved content, not only IDs or hashes. Oversized or incomplete snapshots fail closed with an exact remediation rather than truncating.
Any later non-machine comment, issue or pull-request content edit, selected-comment edit, missing provenance, identity ambiguity, or authority-policy mismatch invalidates the snapshot before prompt construction, triage, dispatch, QA, merge metadata, merge, or recovery.
Content authored by a configured trusted collaborator or automation actor remains directly admissible. External issue, pull-request, linked-issue, and comment content stays absent from host one-shots and agent prompts until the exact snapshot is approved.
One central classifier returns explicit trusted-human, trusted-machine-by-record-kind, ordinary-input, and invalid classes. Every workflow, reservation, outcome, QA, redispatch, release, terminal, acknowledgement, prompt, and merge consumer uses it.
Synthetic negative fixtures must include an engineer attempting direct approval, a broad or tracker-capable engineer token, external marker forgery, self-signed approval with a correct public hash, missing authors, later comments, PR refs, and linked issues.

This is a P0 security boundary and must land before #1255. The rejected PRs #1583 and #1585 remain evidence only and must not be reused as implementation bases.

Kai resolved the authority model on 2026-08-05. ## Authoritative implementation contract * The tracker-mutation credential is broker-only. Engineer and QA containers receive a separate Git credential that cannot mutate issues, pull requests, reviews, labels, or comments. * Every tracker mutation from an agent role goes through the authenticated broker. The broker authorizes the requested record kind against the caller capability and role before posting it. * Dispatch fails closed when Ward cannot prove the agent credential lacks tracker-mutation authority. A broad shared token inside an engineer or QA container is unsupported. * Deployment supplies exact trusted-collaborator and automation-actor identities as broker launch inputs. The values are not repository policy, are not accepted from free-text record fields, and cannot be overridden from an agent container. * Remove `human-feedback.ignore-authors` and custom `automation-markers`. The fixed Ward marker family is the only machine-state vocabulary. * Add a read-only approval-plan surface that canonicalizes the issue or pull request title, body, selected comment IDs, authors, timestamps, and text, then emits the exact snapshot hash and approval-intent body. * A configured trusted collaborator posts that approval intent through her authenticated Forgejo identity. A director-authorized broker action verifies the author, exact hash, selected objects, and current update state before posting the complete immutable `WARD-APPROVAL:` snapshot as the configured automation actor. * The snapshot is schema-versioned and contains the exact approved content, not only IDs or hashes. Oversized or incomplete snapshots fail closed with an exact remediation rather than truncating. * Any later non-machine comment, issue or pull-request content edit, selected-comment edit, missing provenance, identity ambiguity, or authority-policy mismatch invalidates the snapshot before prompt construction, triage, dispatch, QA, merge metadata, merge, or recovery. * Content authored by a configured trusted collaborator or automation actor remains directly admissible. External issue, pull-request, linked-issue, and comment content stays absent from host one-shots and agent prompts until the exact snapshot is approved. * One central classifier returns explicit trusted-human, trusted-machine-by-record-kind, ordinary-input, and invalid classes. Every workflow, reservation, outcome, QA, redispatch, release, terminal, acknowledgement, prompt, and merge consumer uses it. * Synthetic negative fixtures must include an engineer attempting direct approval, a broad or tracker-capable engineer token, external marker forgery, self-signed approval with a correct public hash, missing authors, later comments, PR refs, and linked issues. This is a P0 security boundary and must land before #1255. The rejected PRs #1583 and #1585 remain evidence only and must not be reused as implementation bases.

coilyco-ops added

and removed

labels

2026-08-05 10:22:36 +00:00

coilyco-ops referenced this issue from a commit

2026-08-05 22:43:46 +00:00

feat: enforce tracker actor authority

coilyco-ops closed this issue