Skip to content

feat(auth): install runtime status and session conformance - #4790

Draft
cea-block wants to merge 13 commits into
cea/o4-invalidation-failsafefrom
cea/o4-client-production
Draft

feat(auth): install runtime status and session conformance#4790
cea-block wants to merge 13 commits into
cea/o4-invalidation-failsafefrom
cea/o4-client-production

Conversation

@cea-block

@cea-block cea-block commented Aug 4, 2026

Copy link
Copy Markdown

Why

Protected runtime entry points need one verified-evidence resolver, bounded authorization sessions, and an authenticated status protocol so stale or conflicting authority cannot be reused across transports.

What

  • Persist current client-status projections and withdrawals and expose relay-authenticated status and discovery
  • Install the provider-neutral verified-evidence resolver across protected production routes
  • Keep JWT support as an optional provider profile rather than a runtime requirement
  • Enforce lease finalization, revocation, invalidation, delegated-relationship revision, and session non-reuse fences
  • Add the client-status and session migration sequence from 0043 through 0045
  • Document runtime conformance and operational behavior

Review guide

  • Client status: projection, withdrawal, signing, fanout, freshness, and privacy bounds
  • Evidence resolution: consistent adoption across relay, HTTP, media, Git, and audio entry points
  • Session safety: lease bounds, revocation, invalidation, delegation revision, reconnect, and reuse prevention
  • Database evolution and conformance coverage for migrations 0043 through 0045

Risk assessment

Medium. This PR changes protected runtime authorization and adds migrations. The stock relay does not install a deployment-specific authorization provider, protected behavior remains off by default, and missing or conflicting evidence denies access.

Testing

  • Runtime conformance across protected transports
  • Status publication, withdrawal, fanout, expiry, replay, and privacy cases
  • Session lease, revocation, invalidation, delegation, reconnect, and non-reuse cases
  • Fresh and incremental migration, formatting, linting, and hosted repository checks

References

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block cea-block changed the title feat(auth): expose client status and runtime reachability feat(auth): install runtime status and session conformance Aug 4, 2026
Merge the repaired O4CD parent into O4EF and update only E-owned public-projection test fixtures for the accepted O3 binding and lifecycle APIs.

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Record the corrected pre-F test fixtures in the parent while preserving O4EF's relationship identity and revision constructor arguments.

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
* commit '9244f15d00291edf0eef3353fae50d085c788845':
  test(desktop): stabilize off-relay video menu
  fix(desktop): keep sidebar within size limit

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
* commit '4b030e991f65e107aef1d011c17062606d8b1f7c':
  fix(relay): reuse git visibility fence
  test(auth): align projection worker fixture

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant