Repository navigation
design(pm-stack): one identity across the stack — SSO propagation from the public entry into every layer, roles replace asserted authorship #1253
Description
Part of epic #1184 (PM stack coherence — ideal-system design series, 2026-10-26).
Why
Today authorship on dashboard writes is caller-asserted (tracked in #941) and each layer (aggregator, Kaneo, Pad, Grist) has its own account story, so 'who did this' is unenforceable and per-person permissions don't exist. The ideal system has one identity: the Cloudflare Access identity at the public entry (#1182) propagates through every layer, and roles (owner / orchestrator / agent / read-only) are checked server-side on every write.
Design questions to answer
- Identity propagation mechanism per layer: Access JWT validation in the aggregator, and what Kaneo/Pad/Grist can accept (header trust behind the entry point, native SSO, or API-token-per-role)?
- Role model: which roles exist, what each may do (comment kinds, triage actions, dispatches, admin), and where the role mapping lives?
- Agent identity: how do fleet agents authenticate as themselves (not as Drew), and how are their actions attributed in the audit trail?
- Migration: how do existing dashboard comments/registry records map to real identities, and what happens to anonymous reads?
- Break-glass: what still works when Access or the IdP is down, without reopening asserted authorship?
Acceptance
- Design note landed in repo
doc/+ implementation issues filed and linked as sub-issues of epic(dashboard): PM stack coherence - single-URL, fresh data, triage-able, hierarchical #1184; open questions needing Drew named explicitly in the design note.
Acceptance criteria
- A design note is landed in the repo
doc/answering the design questions above: per-layer identity propagation, the role model and where the role mapping lives, agent identity/attribution, migration of existing records, and the break-glass posture. - Implementation issues are filed and linked as sub-issues of epic(dashboard): PM stack coherence - single-URL, fresh data, triage-able, hierarchical #1184.
- Open questions needing Drew are named explicitly in the design note.
- The design preserves an honest break-glass path that does not reopen caller-asserted authorship.
Metadata
Metadata
Assignees
Labels
pm-stack (Pad/Grist) in developing-today/codeLarge: multi-day or open-ended; expect staged check-insNew feature or capability requestIntake review done: acceptance criteria, links, and normalized labels addedOrdinary priority (the default)Filed directly by a humanTriaged and routed (see agent note)Queue packet kind: verify, reproduce, and route this item
Activity
developing-today commentedon Oct 27, 2026
CODE-377
dezren39 commentedon Oct 28, 2026
Intake review
Related: epic #1184 (parent) · #1182 (the Cloudflare Access entry whose identity this design propagates) · #941 (caller-asserted comment authorship — the concrete weakness this replaces) · #1255 (conversational layer, inherits this identity model).
Notes: Still live — verified this run: no merged PR implements SSO propagation; merged-PR searches return only unrelated number coincidences. The issue arrived with a
## Acceptancesection; the appended## Acceptance criteriaformalizes it.effort/l: four systems (aggregator, Kaneo, Pad, Grist) with different auth stories.Risks / suggested approach: Design-only deliverable in this issue: the acceptance bar is the landed design note plus filed, linked implementation issues — per the standing rule, a design with no implementation link is not finished work. The per-layer mechanism survey (what Kaneo/Pad/Grist can actually accept) is the long pole — do that verification before committing the design to a propagation mechanism.
— repo-fleet-monitor intake pass, 2026-10-28T03:55Z
34 remaining items
dezren39 commentedon Nov 3, 2026
🤖 Agent note · PR opened (task 4964 complete as pr_opened)
queue/4964-1253-access-authorship@8bbd39762, MERGEABLE/CLEAN, exactly 3 files +414 (access-identity.ts +221, server.ts +22, access-identity.test.ts +171). Related to design(pm-stack): one identity across the stack — SSO propagation from the public entry into every layer, roles replace asserted authorship #1253; design(pm-stack): one identity across the stack — SSO propagation from the public entry into every layer, roles replace asserted authorship #1253 stays OPEN as the design tracker (PR does not close it).gh pr createhit the GitHub secondary rate limit. This shift re-verified the branch SHA fresh, found no existing PR, and created PR feat(pm-stack): derive authors from Access JWT (#1253) #4882 — the rate limit has lifted.bunx tsc --noEmitshows 27 pre-existing unrelated diagnostics, zero in changed files.@codex reviewand disposition findings before merging.chatgpt-codex-connector commentedon Nov 3, 2026
You have reached your Codex usage limits. You can see your limits in the Codex usage dashboard.
dezren39 commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
dezren39 commentedon Nov 3, 2026
🤖 Agent note · triaged (live design task; one implementation slice already in flight)
origin/main(d4d783461): design(pm-stack): one identity across the stack — SSO propagation from the public entry into every layer, roles replace asserted authorship #1253 OPEN, epic parent epic(dashboard): PM stack coherence - single-URL, fresh data, triage-able, hierarchical #1184 OPEN, no held /user/owned/do-not-merge/do-not-auto-editlabel. No design note underdoc/matches this issue (git grepfor "one identity across the stack" / "SSO propagation" onorigin/mainreturns nothing), so the governing deliverable is not started.What the issue actually asks for
A design note in
doc/, not code: per-layer identity propagation (aggregator, Kaneo, Pad, Grist), the role model (owner / orchestrator / agent / read-only) and where role mapping lives, agent identity and attribution, migration of existing comments/registry records, and an honest break-glass path that does not reopen caller-asserted authorship. Acceptance is that note plus implementation issues filed as sub-issues of #1184, with Drew-only questions named explicitly.Verdict: live, and partially in flight — do not start the design blind
queue/4964-1253-access-authorship, task 4964) is open: config-gated Cloudflare Access JWT author derivation in the aggregator (access-identity.ts,server.ts, tests). Its body says it does not close design(pm-stack): one identity across the stack — SSO propagation from the public entry into every layer, roles replace asserted authorship #1253 and that design(pm-stack): one identity across the stack — SSO propagation from the public entry into every layer, roles replace asserted authorship #1253 stays open as the design tracker. It answers the mechanism for one layer (aggregator comment/action authors) but none of the role model, migration, agent-identity, or break-glass questions.queue/4642-941-operator-token-comments, task 4642, for aggregator(dashboard): comment API accepts self-asserted author identities — anyone can post as Drew into the orchestrator/GitHub flow (PR #920) #941) is also open and touches the samepm-stack/aggregator/src/server.tswith a different authorship mechanism (Bitwarden operator token,authorVerified, no JWT). Both PRs are live, neither is held.Ordering and blockers (recorded per the packet acceptance)
doc/2026-10-30T22-45-00Z_design_hosted_provisioning_sso_binding.md(subas the stable key, sign-in not equal to binding) so the PM-stack layer design and the hosted-ID design do not diverge.Disposition
small_fixpacket enqueued: this is an L design deliverable, the wrong shape for the queue's four kinds (this matches the sibling triage verdict on design(aggregator): conversational layer — ask and act over PM data in plain language through the same audited action path #1255). The design pass should be scheduled as a dedicated piece of work, not squeezed into a triage timebox.