fix(authz): keep credentials within their agent and repo grants

[justinhelmer]

A credential granted three agents and one repo could run any unrestricted agent or use another repo. Agent and repo gates now use the policy table and effective grants, so credential scope survives bound people and delegation.

Why: The open-unless-restricted helpers bypassed the documented credential ceiling. Human code access must stay open by default without granting additional repository memory rights.

Where to look

1. Dispatch gates ConfigStore authorizes the resolved actor through the canonical agent and repo policy rows.
2. Human baselines Compile unrestricted agents and code repos for humans while credentials keep explicit grants.
3. Delegation arithmetic Intersect code access separately from explicit repository ownership, with case normalization.
4. Repository policy repo:use reads compiled code access; repository memory retains explicit ownership.
5. Store parity Bounded repo complements exclude missing repos in wire and SQLite filters.
6. Scope regressions Parsed service scope, human defaults, bound admins, mixed delegation and memory ceilings.
7. Operator migration Grant machine callers their intended agents and repos explicitly before rollout.

Feedback wanted: Check code-access and memory-ownership separation, mixed delegation, and persisted filter compatibility.

Risk: Machine credentials that relied on implicit open access need explicit agent and repo grants before rollout. Human defaults and explicit memory ownership are preserved. The parent owns configuration and deployment; this PR changes source only.

Verified: Scoped authorization/config/memory/command tests, 64 admission, 51 dispatcher and 72 SQLite cases passed; types, lint, format, specs, hygiene and coverage passed. All 44 screenshot pixels unchanged.

Decisions (2)

• Compile human openness in the existing policy model. Separating code access from explicit ownership preserves memory rights. A principal-kind bypass escapes credential ceilings; global restrictions move credential safety into config. Config keeps its existing three literal axes.
• Enforce the documented credential contract. This is a security fix without a major-release marker. Migration guidance names the explicit grants needed by callers that depended on the bypass. No config, credential, deployment or smoke probe is changed here.

Validation (4 criteria)

Criterion	Proof
Service scope is exact on an unrestricted deployment	Parsed ConfigStore and resolved HTTP actor deny Coding and foreign repos, allow the three granted agents and fixture repo.
Bound credentials and delegation remain bounded	Bound-admin, relay, reversed and nested delegation cases; finite/complement intersection matrix.
Human memory rights are preserved	Human open code access denies unowned repo memory; explicit owners and admin/CLI authority remain admitted.
Point and store decisions agree	Point/predicate/wire differential plus 72 SQLite routes; case, missing repo, malformed complement and parameter cap regressions.

🤖 Generated with Claude Code

[coreplane-switchboard]

No verdict submitted — not approving.

Caution

No verdict · head d0cd949 · the run ended without a submit_verdict call

Full review

Exact-head review is blocked: PR #2799 is now at 83ba72b, but this run’s bound worktree remains at d0cd949 and lacks the amended commit. No verdict was published; the worktree needs refreshing to the new head before this review can finish.

[coreplane-switchboard]

LGTM: No major defects found at the frozen head; one minor browser-baseline spec contradiction remains.

Note

Approved · head 83ba72b · 1 finding: 1 minor

Severity	Finding	Where
minor	F1 Spec contradiction — web-chat.md item 11: catalogue-free browser actors now retain code access	docs/reference/specs/web-chat.md:58

Full review

F1 (high confidence): Item 11 still promises browser actors hold “nothing with no catalogue.” grantsTable now retains unrestricted agent actions and open code access without command groups, explicitly asserted in src/config.test.ts:643–649. Update the web-chat criterion to distinguish catalogue-dependent command grants from the preserved code-access baseline.

Test-guard dispositions: the coverage-test retitle and describe rename are refactor, verification intact; the assertion-count reduction accompanies retirement of the two shortcut helpers. Their unrestricted-machine behavior is explicitly retired by authorization item 9. Human open/restricted access, admin access and case matching remain independently proved in config.test.ts and scopedCredentialPolicy.test.ts; wildcard coverage remains in authorize.test.ts and the policy-row tests.

[github-actions]

Auto-approved: coreplane-switchboard[bot] reviewed this PR and posted an LGTM verdict (see its review). This repository opted in through its REVIEW_BOT_LOGIN and REVIEW_BOT_ID variables.

[polylane]

Warning

Polylane could not verify the production impact of this pull request.

Fail-closed gate change verified: coreplane-infra switchboard's cron and coordinator run no agents, human baselines stay open, so no in-repo identity breaks. The PR's machine-caller re-granting risk is self-declared but unconfirmable from the secret config.

View the full analysis →

Also considered · 1 plausible, 3 refuted

• Plausible · Credential-ceiling enforcement fails a machine credential that runs unrestricted agents or uses open repos · possible, moderate
• Refuted · Scheduled self-improvement pass loses agent or repo access · SELF_IMPROVEMENT_GRANTS = { friction:read, friction:write, channels: all, repos: empty }; the cron runs friction propose, admitted by the friction:read/write rows which this change does not touch — it never reaches agent:run or repo:use.
• Refuted · Ship coordinator child spawns lose agent access · policy.ts documents the child a spawn starts is authorized as the requesting user the parent record names, not as the coordinator identity; that user is a slack: human whose baseline still compiles openAgents, so agent access is unchanged.
• Refuted · Run-history repo filter SQL change breaks visibility parity · the worker lowercases both the column and the filter values, so case is normalized regardless of the sender's version; repos-not-in is only emitted by new code, and existing run-read rows do not emit complements — the differential test (runs.test.ts 'repo complement filters…') asserts point/wire/SQLite parity.

Analysed against 7 cloud accounts and 1 repository

• Cloud accounts: coreplane-prod, baseberry-uat, coreplane-infra, coreplane, coreplane-gtm, 251714435813, Polylane
• Repository: coreplanelabs/switchboard

Polylane could not find the cloud resources this repository manages, so this review looked at the entire cloud account. Connect this repository to its resources and the next review will focus on exactly what this code deploys to.

_{Polylane analysed 83ba72b for production impact. You can ask follow-ups by mentioning @polylane in a comment.}

Rate this review: 👍 helpful · 👎 not helpful · 😕 confusing