id: design: provider security model (from #5686)

Summary

Follow-on design ticket from #5686 — its decomposition sketch names this as a separate design, and the parent's acceptance requires these tickets to be filed and linked. Filed in the 2026-11-04 gap pass (WS-F) so the design work exists and can be prioritised on its own merits; implementation timing is a separate decision, possibly months out.

What this design must settle

Impersonation, rogue providers, capability confusion, and the ceiling-composition audit for the provider model.

Context from the parent

The parent design fixes the single capability-provider model — declaration, discovery, negotiation, least-privilege grants — instantiated by ESP32/MQTT, terminal, Bevy, smartphone, and web providers. The parent issue carries the surrounding decisions this ticket must not re-decide; where this ticket's answer would change a parent decision, record that explicitly rather than silently forking it.

Decision record expected

Close this design with a recorded decision (on this issue or in a doc/ record linked from it): the chosen shape, the alternatives rejected and why, and the invariants implementation must hold. If the design splits further, file the splits and link them here rather than growing this issue.

Relations

Parent: #5686. Programme: epic #2056. Filed by WS-F (2026-11-04 ID design gap & expansion pass).

CODE-1588

Field survey filed: #5931 (capability-provider research widening, per Drew's 2026-11-04 ruling) covers the current option space relevant to this issue in §6 — security-model inputs: MCP's OAuth-centric authorization vs ID's owner-controlled grants, CapTP facet attenuation, SPIFFE identity plumbing, per-layer fit/fight analysis. It is an inventory, not a decision — the section ends with the open questions this design needs to answer.

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-u
Session / ID: task 10307
Found via: queue claim
Task: Work issue id: design: provider security model (from #5686) #5905 per task 10307 — handed off to the opencode execution lane; the laptop claimant launches the bound opencode session for task 10307. Verified fresh: issue id: design: provider security model (from #5686) #5905 is OPEN with no hard-stop labels (no held, user/owned, do-not-merge, do-not-auto-edit).
Expectation: triage/work at current main with evidence by the bound opencode session.
Links: task 10307 (repo-health-code-pilot), assigned_lane=opencode

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-o
Session / ID: task 10307
Found via: queue claim
Task: Triage issue id: design: provider security model (from #5686) #5905 (id: design: provider security model, from issue design(id): client-side capability providers — one provider model for ESP32/MQTT, terminal, Bevy, smartphone, and web #5686) — assigned to the opencode execution lane again on re-claim (attempt 2; previously handed off at 2026-11-05T12:51Z, claimant had not launched before the park/lease cycled); handed off to the laptop claimant, not worked by this lane. Issue verified OPEN this shift, no hard-stop labels.
Expectation: claimant launches the bound opencode session for task 10307.
Links: issue design(id): client-side capability providers — one provider model for ESP32/MQTT, terminal, Bevy, smartphone, and web #5686 (parent), issue epic: ID platform expansion — apps, comms, currency, hosting, boards (2026-10-28 directive, LIST 6–15) #2056 (epic)

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-v
Session / ID: task 10307
Found via: queue claim
Task: Triage: id design — provider security model (from issue design(id): client-side capability providers — one provider model for ESP32/MQTT, terminal, Bevy, smartphone, and web #5686) (issue id: design: provider security model (from #5686) #5905)
Expectation: handed off to the opencode execution lane; the laptop claimant launches the bound opencode session, which drives task 10307 to its terminal state.
Links: issue id: design: provider security model (from #5686) #5905

Triage: #5905 is an in-scope, still-open design child of #5686. Its acceptance is specific (settle impersonation, rogue-provider, capability-confusion, and ceiling-composition invariants, with alternatives and decision record); related research inputs are already filed in #5931. No PR or superseding implementation is linked. Keep this issue open for design prioritization; prior queue attempts were handoffs that never launched, so no design work was done here.

Navigation Menu

Repository navigation

id: design: provider security model (from #5686) #5905

Summary

What this design must settle

Context from the parent

Decision record expected

Relations

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id: design: provider security model (from #5686) #5905

Description

Summary

What this design must settle

Context from the parent

Decision record expected

Relations

Activity

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions