Skip to content

feat(auth): enforce protected routing and fail-safe invalidation - #4789

Draft
cea-block wants to merge 15 commits into
cea/o4-protected-transportsfrom
cea/o4-invalidation-failsafe
Draft

feat(auth): enforce protected routing and fail-safe invalidation#4789
cea-block wants to merge 15 commits into
cea/o4-protected-transportsfrom
cea/o4-invalidation-failsafe

Conversation

@cea-block

@cea-block cea-block commented Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Why

Every protected route needs a complete route inventory and durable invalidation state so no transport can continue authorizing after its authority becomes stale or unavailable.

What

  • Enforce protected-route classification at the shared router boundary
  • Persist monotonic invalidation floors, idempotent operation receipts, and authority epochs
  • Propagate invalidation across relay instances and enter a deny-protected mode when authority cannot be trusted
  • Apply server-owned enrollment and typed provider-installation provenance
  • Add the invalidation and authority migration sequence from 0040 through 0042
  • Reuse the same visibility fence across protected Git and related storage paths

Review guide

  • Route inventory and default-deny handling for unclassified protected requests
  • Invalidation storage, authority epochs, operation receipts, and database triggers
  • Cross-relay publication and subscription behavior, restoration, and deny-protected mode
  • Relay, workflow, and storage consumers of the shared invalidation fence

Risk assessment

Medium. This PR changes protected routing and invalidation across relay instances. Protected requests deny when routing or invalidation authority is absent, ambiguous, or stale, and the behavior remains off by default.

Testing

  • Protected-route inventory and method-classification cases
  • Invalidation ordering, replay, duplicate, restoration, and cross-relay cases
  • Fresh and incremental migration coverage through 0042
  • Trigger, visibility, workflow, formatting, linting, and hosted repository checks

References

@cea-block
fix(relay): enforce protected route inventory
787cd32 
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block
feat(auth): converge invalidation and fail-safe mode
56b4904 
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
This was referenced Aug 4, 2026
Draft
Draft
@cea-block cea-block changed the title feat(auth): converge invalidation and fail-safe mode feat(auth): enforce protected routing and fail-safe invalidation Aug 4, 2026
@cea-block
cea-block changed the base branch from cea/o4-route-inventory to cea/o4-protected-transports August 4, 2026 21:20
cea-block added 13 commits August 4, 2026 17:01
@cea-block
fix(auth): propagate O4 stack compile repairs
84a75c2 
Merge the repaired O4AB interfaces into O4CD, then update only the stale provider test adapters and public delegated-admission diagnostics required by hosted CI.

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block
chore(auth): advance O4CD over repaired O4AB
b073d32 
Record the repaired protected-transport parent while retaining O4CD's production operation-receipt API instead of its temporary lower-slice test adapter.

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block
fix(auth): keep F delegation fixtures in O4EF
b0bda99 
Use the pre-F three-argument delegation constructor in O4CD while retaining the other compiler-directed provider test adapters.

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block
fix(auth): advance O4CD over fail-closed O4AB
a0e43a0 
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block
chore(auth): advance O4CD over lint-clean O4AB
ae8aa9c 
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block
fix(auth): complete O4CD compile and migration adapters
0065c68 
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block
fix(auth): order O4CD authority migrations
2b8e29e 
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block
fix(db): align O4CD migrator count
f920fc7 
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block
fix(db): close protected schema dependencies
36ae719 
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block
fix(schema): propagate visibility prerequisites
4945511 
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block
chore(auth): merge updated protected transports parent
9244f15 
* commit '0e275c727a40cf521a966fae2270c47af8432f17':
  test(desktop): stabilize off-relay video menu
  fix(desktop): keep sidebar within size limit

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block
chore(auth): merge projection fixture repair
7a82852 
* commit 'cd9bf88be7177638e870497e5d6b55ef18f989f9':
  test(auth): align projection worker fixture

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
@cea-block
fix(relay): reuse git visibility fence
4b030e9 
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cea-block