tegwick
0d554dcea2
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 237582@bnt-lap001 Assistant-Session: f2b3d9f1-8fb9-4b9c-bc2b-837ec5dfc826
105 lines
4.5 KiB
Markdown
105 lines
4.5 KiB
Markdown
---
|
|
id: USER-WP-0037
|
|
type: workplan
|
|
title: "Read-only account authority for Hub integration"
|
|
domain: communication
|
|
repo: user-engine
|
|
status: blocked
|
|
owner: codex
|
|
topic_slug: communication
|
|
created: "2026-09-28"
|
|
updated: "2026-09-28"
|
|
related:
|
|
- HUB-WP-0012
|
|
state_hub_workstream_id: "54d99faf-4c53-5927-a82c-feca41de2cf3"
|
|
---
|
|
|
|
# Hub authority lookup
|
|
|
|
Owner-side implementation for HUB-WP-0012. Source work is authorized; real
|
|
workload grants, root entitlements and deployment acceptance remain separate.
|
|
|
|
## Existing account lookup without provisioning
|
|
|
|
```task
|
|
id: USER-WP-0037-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "eb4c1a6c-3cf2-5195-9388-cb9db3190197"
|
|
```
|
|
|
|
Add an authorized service lookup for exact issuer/subject and scoped tenant.
|
|
Authorize the caller separately before target lookup. Unknown identities never
|
|
provision; return current global/scoped account state without roles or profile
|
|
PII. Preserve source observation time and identity/account references.
|
|
|
|
Implemented `UserEngineService.lookup_account_authority` with the separate
|
|
`account.authority.read` action and a digest-bound issuer/subject/tenant resource.
|
|
Caller identity is distinct from the target. Missing tenant-account state is
|
|
explicit `None`, not active. AccountAuthority contains no root grant, token roles
|
|
or profile/email data. Authorization denial may emit the existing audit record;
|
|
this operation does not provision or mutate domain records.
|
|
|
|
Validation: `make test` ran 270 tests successfully (eight optional skips), including
|
|
six new lookup checks; layer conformance passed. No HTTP endpoint, live grant or
|
|
production deployment was added. T02/T03 retain those outstanding owner gates.
|
|
|
|
## Root entitlement and mapping disposition
|
|
|
|
```task
|
|
id: USER-WP-0037-T02
|
|
status: wait
|
|
blocked_on: message-from:net-kingdom
|
|
blocking_reason: "Specify with NetKingdom the root-grant custody/revocation and platform:root to tenant:platform mapping."
|
|
priority: high
|
|
state_hub_task_id: "23a5c211-277b-561e-a4b3-0f8e99537cac"
|
|
```
|
|
|
|
With NetKingdom, specify explicit current root-grant custody/revocation and
|
|
platform:root to tenant:platform mapping. Do not derive a grant from JWT roles,
|
|
a username, or Hub's configured root subject. Define retainable evidence for
|
|
account and entitlement observations.
|
|
|
|
Blocked 2026-09-28: this is a NetKingdom canon decision, not a user-engine
|
|
implementation choice. `net-kingdom/docs/platform-root-custody.md` covers
|
|
OpenBao/king-credential bootstrap custody but does not yet define how a
|
|
workload-facing root-grant fact is derived, represented, or revoked for a
|
|
consumer like the Hub. Requested via State Hub message
|
|
`379d266b-b738-4772-82c0-318e67a50bc8` to `net-kingdom`. `AccountAuthority`
|
|
deliberately still carries no root-grant field pending that decision.
|
|
|
|
## Authenticated workload transport and private acceptance
|
|
|
|
```task
|
|
id: USER-WP-0037-T03
|
|
status: wait
|
|
depends_on: [USER-WP-0037-T02]
|
|
blocked_on: message-from:net-kingdom
|
|
blocking_reason: "Real caller credentials are admitted through their owner after the T02 contract."
|
|
priority: high
|
|
state_hub_task_id: "c5d67725-c685-50f6-9db8-28114a34014b"
|
|
```
|
|
|
|
Expose a narrowly scoped read API with an independently authenticated Hub
|
|
workload, policy action account.authority.read, exact target binding and no
|
|
end-user bearer forwarding. Add HTTP schema and denial/no-provisioning tests,
|
|
then admit real caller credentials through their owner and verify withdrawal,
|
|
outages and private Hub integration. A service method alone is not this gate.
|
|
|
|
Implemented 2026-09-28: `POST /api/v1/platform/account-authority/lookup`
|
|
(`src/user_engine/web.py`), gated by a dedicated `hub_authority_caller` /
|
|
`hub_authority_token` pair distinct from `trusted_proxy_secret` and end-user
|
|
OIDC claims — a bearer mismatch or unconfigured route denies/404s before any
|
|
domain lookup runs. Wired in `runtime.py` behind
|
|
`USER_ENGINE_HUB_AUTHORITY_TOKEN` (+ `_ISSUER`/`_SUBJECT`/`_TENANT`), unset by
|
|
default so the route stays absent until provisioned. Schema, denial, and
|
|
no-provisioning tests: `tests/test_web_account_authority.py` (7 tests, all
|
|
green against `make test`, 277 tests total).
|
|
|
|
Blocked 2026-09-28 on the remaining half of this gate: admitting a *real*
|
|
Hub workload credential is a credential-routing matter
|
|
(`.claude/rules/credential-routing.md`) — OpenBao/ops-warden issue it, this
|
|
repo only consumes it. Requested via State Hub message
|
|
`f3bcc516-7241-4050-ba52-5723bb174936` to `state-hub`. Withdrawal, outage,
|
|
and private-integration verification with the real credential are still
|
|
owed once it exists.
|