id: design: security binding review across adapters & relays (from #5674)

Summary

Follow-on design ticket from #5674 — its decomposition sketch names this as a separate design, and the parent's acceptance requires these tickets to be filed and linked. Filed in the 2026-11-04 gap pass (WS-F) so the design work exists and can be prioritised on its own merits; implementation timing is a separate decision, possibly months out.

What this design must settle

Replay and downgrade protection reviewed across all adapters and relays: the security binding that stops a transport downgrade becoming a security downgrade.

Context from the parent

The parent design fixes the postcard wire-format family and the transport-adapter model that carries ID over non-UDP transports and relays. The parent issue carries the surrounding decisions this ticket must not re-decide; where this ticket's answer would change a parent decision, record that explicitly rather than silently forking it.

Decision record expected

Close this design with a recorded decision (on this issue or in a doc/ record linked from it): the chosen shape, the alternatives rejected and why, and the invariants implementation must hold. If the design splits further, file the splits and link them here rather than growing this issue.

Relations

Parent: #5674. Programme: epic #2056. Filed by WS-F (2026-11-04 ID design gap & expansion pass).

CODE-1498

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-r
Session / ID: task 10218
Found via: queue claim
Task: Triage of issue id: design: security binding review across adapters & relays (from #5674) #5815 handed off to the opencode execution lane; the laptop claimant launches the bound opencode session, which drives task 10218 to its terminal state.
Expectation: claimant launches bound session.
Links: id: design: security binding review across adapters & relays (from #5674) #5815

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-a
Session / ID: task 10218
Found via: queue claim (re-claim after prior handoff park expired unbound)
Task: task 10218 (triage for issue id: design: security binding review across adapters & relays (from #5674) #5815) is assigned to the opencode execution lane again — handing off to the opencode claimant, which launches the bound session. This lane did not work the triage itself. Verified fresh: issue id: design: security binding review across adapters & relays (from #5674) #5815 is OPEN with no hard-stop labels (no held, user/owned, do-not-merge, do-not-auto-edit); parked labels already in sync.
Expectation: claimant launches the bound opencode session for task 10218; if unbound by lease/park expiry, task 10218 returns to the queue.
Links: task 10218 (repo-health-code-pilot), assigned_lane=opencode

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-n
Session / ID: task 10218
Found via: queue claim
Task: Triage id: design: security binding review across adapters & relays (from #5674) #5815: security binding review across adapters & relays — execution lane assigned opencode; handing off to the laptop opencode claimant, which launches the bound session.
Expectation: Claimant's bound opencode session triages issue id: design: security binding review across adapters & relays (from #5674) #5815 at current main and records blockers/ordering or routes the fix.
Links: task 10218 (repo-health-code-pilot)

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-b
Session / ID: task 12316
Found via: queue claim
Task: Handed off to the opencode claimant per §1b (execution lane opencode, session_id null at assignment); parked 1200s so task 12316 returns to the queue if the claimant does not bind.
Expectation: claimant launches the bound opencode session for issue id: design: security binding review across adapters & relays (from #5674) #5815 (triage).
Links: task 12316

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-z
Session / ID: task 12316
Found via: queue claim
Task: triage for issue id: design: security binding review across adapters & relays (from #5674) #5815 — handed off to the opencode execution lane per §1b; task 12316 parked 1800s for claimant pickup
Expectation: claimant launches the bound opencode session and drives task 12316 to a terminal state
Links: task 12316 (repo-health-code-pilot)

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-k
Session / ID: task 12316
Found via: queue claim
Task: task 12316 for issue id: design: security binding review across adapters & relays (from #5674) #5815 revalidated fresh (OPEN, no hard-stop labels); execution lane assigned opencode per §1b — handing off to the laptop opencode claimant, not working directly.
Expectation: claimant launches the bound opencode session and drives task 12316 to a terminal state; prior progress is recorded in the task checkpoints.

🤖 Agent note · triaged

Agent: repo queue worker (repo-worker-code), OpenChamber scheduled lane aea12c82-c5af-4e5a-9b66-f8e360f87177
Session / ID: task 12316
Found via: queue claim (repo-health-code-pilot)
Task: Re-triage of issue id: design: security binding review across adapters & relays (from #5674) #5815 under Drew's triage doctrine (code#7016) after the previous queue task was marked done with no landed evidence.

Verdict: REAL and current — no landed work; the actionable remainder is a decision record, not code.

Fresh verification 2026-11-08T13:14Z (gh REST):

Issue id: design: security binding review across adapters & relays (from #5674) #5815 is OPEN (last updated 2026-11-08T12:52Z). Labels: task/triage, status/parked, queue/parked, app/id, work/assigned, status/triaged. No hard-stop labels (held, user/owned, do-not-merge, do-not-auto-edit).
No implementing PR. search/issues for 5815 in:body type:pr returns only sibling decision records — PR docs(id): record relay and proxy protocol design (#5813) #7653 (docs(id): record relay and proxy protocol design (#5813), OPEN) and PR doc: decision record for #5811 WebSocket/WSS + HTTPS fallback adapter #7613 (decision record for #5811 WebSocket/WSS + HTTPS fallback adapter, OPEN). Neither is about this ticket.
No implementing commit. The single search/commits hit is merge e5152ad6 of branch queue/5815-3809-delayed-rebind — an unrelated ID-key rebinding change whose branch name merely contains the digits.
Parent id: design: Wire format & transport adapters — postcard schema, non-UDP carriers, relays/proxies #5674 (id: design: Wire format & transport adapters) is OPEN and itself parked/queued for triage; it is a design parent, not a fixable unit.
Sibling precedent: id: design: adapter: WebSocket/WSS + HTTPS fallback (from #5674) #5811 and id: design: relay & proxy standard protocol (from #5674) #5813 are being answered directly as doc/ decision records (PRs doc: decision record for #5811 WebSocket/WSS + HTTPS fallback adapter #7613, docs(id): record relay and proxy protocol design (#5813) #7653), so children of id: design: Wire format & transport adapters — postcard schema, non-UDP carriers, relays/proxies #5674 are worked without waiting on a parent decision record.

Actionable remainder (converted to a follow-up packet): write the decision record for the security binding review across adapters and relays — the trust boundaries and binding rules each adapter/relay must enforce — as a doc/ record linked from this issue, in the same shape as PRs #7613/#7653. Constraints from the body: do not re-decide parent #5674 decisions (record explicitly where an answer would change one); file splits rather than growing the issue; close only with a recorded decision (chosen shape, rejected alternatives, invariants).

Expectation: the follow-up design task lands the record; this triage task is complete and the issue stays OPEN until that record exists.

Links: task 12316 · issue id: design: security binding review across adapters & relays (from #5674) #5815 · parent id: design: Wire format & transport adapters — postcard schema, non-UDP carriers, relays/proxies #5674 · siblings id: design: adapter: WebSocket/WSS + HTTPS fallback (from #5674) #5811 / PR doc: decision record for #5811 WebSocket/WSS + HTTPS fallback adapter #7613, id: design: relay & proxy standard protocol (from #5674) #5813 / PR docs(id): record relay and proxy protocol design (#5813) #7653 · doctrine code#7016

Follow-up packet enqueued: task 13769 (repo-health-code-pilot, kind small_fix) — "Design record #5815: security binding review across adapters & relays", timebox 45 min.

🤖 Agent note · PR opened — decision record for #5815

Agent: queue worker (repo-worker-code), lane code-b
Session / ID: task 13769
Found via: queue claim (direct execution lane)
Record: doc/2026-11-09_design_id5815_security_binding.md in PR doc: decision record for #5815 security binding across adapters & relays #7863 — settles the trust boundaries and binding rules every adapter/relay must enforce: security binds to the ID layer (origin signature, handshake transcript, local policy floor), never to the carrier; downgrade is a classified security failure, never a silent weaker retry; relays cannot re-originate sessions.
Parent check: the record states explicitly that no id: design: Wire format & transport adapters — postcard schema, non-UDP carriers, relays/proxies #5674 decision changes; the negotiation-transcript and failure-class surfaces are recorded as interface obligations on id: design: versioning, negotiation & forward-compatibility policy (from #5674) #5809/id: design: transport negotiation & fallback ordering (from #5671) #5791, and conformance vectors as an obligation on the existing id: design: adapter conformance harness & interop matrix CI (from #5674) #5814 — no new splits filed.
Queue: task 13769 completed outcome=pr_opened. Issue id: design: security binding review across adapters & relays (from #5674) #5815 stays open until PR doc: decision record for #5815 security binding across adapters & relays #7863 merges.
Links: PR doc: decision record for #5815 security binding across adapters & relays #7863 · issue id: design: security binding review across adapters & relays (from #5674) #5815 · parent id: design: Wire format & transport adapters — postcard schema, non-UDP carriers, relays/proxies #5674 · siblings PR doc: decision record for #5811 WebSocket/WSS + HTTPS fallback adapter #7613 (id: design: adapter: WebSocket/WSS + HTTPS fallback (from #5674) #5811), PR docs(id): record relay and proxy protocol design (#5813) #7653 (id: design: relay & proxy standard protocol (from #5674) #5813)

Navigation Menu

Repository navigation

id: design: security binding review across adapters & relays (from #5674) #5815

Summary

What this design must settle

Context from the parent

Decision record expected

Relations

35 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id: design: security binding review across adapters & relays (from #5674) #5815

Description

Summary

What this design must settle

Context from the parent

Decision record expected

Relations

Activity

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

35 remaining items

developing-today commented on Nov 8, 2026

dezren39 commented on Nov 8, 2026

developing-today commented on Nov 8, 2026

developing-today commented on Nov 8, 2026

developing-today commented on Nov 8, 2026

developing-today commented on Nov 8, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions