Repository navigation
fix(authz): discard typed approvals from non-local ingress - #1422
Merged
TheGreatAxios merged 1 commit intoOct 15, 2026
Merged
TheGreatAxios merged 1 commit into
TheGreatAxios merged 1 commit into
Conversation
A correlation ID on the approval rail is a bearer capability: upstream deleted expectedFrom and shipped a validator seam no production layer injected into, so any message carrying a live correlation id re-granted a parked call. Approval delivery is now provenance-authenticated at the app's single inbound funnel, fail-closed on unknown mailboxes, with a forged-message receipt so probes are visible; the same policy ships as a conforming CorrelationValidator for the vendored injection point.
Contributor
|
Superseded by the comment below. |
corbits-triage
Bot
added
Triage: Needs Human Review
Triage: Ready
and removed
Triage: Needs Human Review
labels
Contributor
|
This supersedes the comment above because the rules changed: repository policy version 4 → version 16. Triage: Unsure Not yet confirmed, a maintainer will check:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
approval.granted/approval.deniedmessages are now provenance-authenticated at the app's single inbound-delivery funnel: any typed approval lacking the local approval-delivery sender + mailbox is discarded before it can correlate a parked call — fail-closed on missing mailbox — and the discard emits a structured receipt so forgery probes are visible instead of silent.expectedFromand ships aCorrelationValidatorseam no production layer injects into (the vendored agent layer has no field to carry one), so a learned ID plus a forged approval re-grantedgrantOneShotand re-dispatched the parked call. The same policy ships as a conformingCorrelationValidatorand is exercised through the vendored injection point by an e2e regression, so the delivery gate and the validator cannot drift.isLiveApproval;docs/VENDORING.mddocuments correlation IDs as bearer capabilities and the provenance model.decisionMessagenow draws its sender/mailbox from the same shared constants, so the authentic sender and the allowlist are one source of truth.agent.sendcall sites are all app-authored operator/completion flows (no ingress constructs approvals through them) — a follow-up ticket should exist if a future lane adds external feeds that buildInboundMessages foragent.send.Verification
e2e/reactor-approval-acceptance.test.tsregressed red on the untouched tree (foreign-ingressapproval.grantedwith a live correlation id accepted — the exact bypass), then green: forgery discarded, real operator approval succeeds after (correlated resume + grant + tool run + resume observed).bun run checkexit 0: full suite 8952 pass / 0 fail across 581 files (failing-test +1 test count visible in the delta).src/session/approval-provenance.test.ts(12 tests; fail-closed matrix incl. ref-less forgery discard + receipt assertions),e2e/reactor-approval-acceptance.test.ts,src/session/approval-resume.test.ts,src/session/approval-resume-interrupt.test.ts.git diff --stat -- vendor/on the branch is empty; the vendored layer is untouched.Fixes CL-10678