docs(product): design server-side forge-write scope enforcement (RIG-2679 B) - #601
Open
rigel-mintaka wants to merge 2 commits into
Open
docs(product): design server-side forge-write scope enforcement (RIG-2679 B)#601rigel-mintaka wants to merge 2 commits into
rigel-mintaka wants to merge 2 commits into
Conversation
…2679 B)
The deferred A8 forge-write scope control: a server-side per-account allowlist
(account_forge_scopes table) checked by requireForgeScope in every write arm of
ExecuteForgeCallAsAccount — after coordinate resolution, on create arms after
the F3 idempotency-memo check, before any provider call — rejecting out-of-scope
targets as the in-band ForgeCallError{code:"not_found"}, byte-identical to the
403/404 flatten (no probe oracle). Gated by ForgeConfig.EnforceScopes: off for
Dogfood, mandatory for Beta.
design-critic pass folded (6 findings). OQ-1 (fail-open vs fail-closed default)
deferred to Matt at freeze. Ledger row proposed (Ledger-impact declared; applied
at freeze), next free id DL-242.
Status: Draft.
Ledger-impact: deferred to freeze (adds one Comms & tools row; amends DL-200's
inherited no-scope-rejection A8 clause without superseding it).
|
Compass engineering docs preview: https://compass-server-rig-2679-forg.compass-eng-docs.pages.dev Deployed from Changed pages: |
…9 B) Review PR #601 (2 low, advisory on a design record): - L1: reword the Ledger-impact amend attribution — the A8 no-scope posture lives in DL-200's implementing comment (forge.go:16-18) tracing to the board 'Resolved decision 2' ruling, not in the DL-200 row text. - L2: name the exhaustiveness test's residual (a mis-classified write arm) and add the T2 signature cross-check (read/unimplemented sets hold only no-caller handlers) that closes it structurally, in §A3 and T2. Ledger-impact: deferred to freeze
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The deferred A8 forge-write scope control: a server-side per-account allowlist
(account_forge_scopes table) checked by requireForgeScope in every write arm of
ExecuteForgeCallAsAccount — after coordinate resolution, on create arms after
the F3 idempotency-memo check, before any provider call — rejecting out-of-scope
targets as the in-band ForgeCallError{code:"not_found"}, byte-identical to the
403/404 flatten (no probe oracle). Gated by ForgeConfig.EnforceScopes: off for
Dogfood, mandatory for Beta.
design-critic pass folded (6 findings). OQ-1 (fail-open vs fail-closed default)
deferred to Matt at freeze. Ledger row proposed (Ledger-impact declared; applied
at freeze), next free id DL-242.
Status: Draft.
Ledger-impact: deferred to freeze (adds one Comms & tools row; amends DL-200's
inherited no-scope-rejection A8 clause without superseding it).