E4: Action federation

[gnanirahulnutakki]

Goal. make the only writes Sith performs be typed intents from a closed verb vocabulary — signed by the hub, re-validated independently by each spoke, executed with the spoke's own scoped identity — with gitops.open-pr as the first and safest write and no shell ever.

Phase / depends. P2 (the gitops.open-pr path) → P3 (live-mutation verbs behind full policy). Depends on: E1 (identity/tenancy), E2 (target resolution against the fleet model), E3 (Git credential + signing key custody), and E5 (every intent rides the PEP pipeline — E4 and E5 co-develop). This epic implements ADR-0004.

Features

• F4.1 — typed intent model and closed vocabulary
• F4.2 — per-verb arg schema validation
• F4.3 — gitops.open-pr (first write)
• F4.4 — signed intent dispatch
• F4.5 — per-spoke local allowlist re-validation and local execution
• F4.6 — dry-run-first execution
• F4.7 — live-mutation verbs

Exit criteria

• The write path accepts only closed-vocabulary verbs with registered, schema-validated handlers; the CI classification test is green.
• gitops.open-pr flows end-to-end and opens a real PR with zero cluster credentials in the center or the AI.
• Every dispatched intent is signed; each spoke independently verifies and re-validates against its own allowlist and executes with its own identity.
• Dry-run precedes execution for every capable verb; live-mutation verbs are gated behind the PR proof and the full policy layer.
• No shell, no free-form apply, no secret/RBAC mutation exists anywhere in the path.

---

Source: docs/EPICS.md, docs/SITH-NOTION.md · part of the Sith implementation backlog (see the master roadmap issue).

---

2026-07 research addendum (market research T3 · T4; standards §5.2)

Enforce-at-execution is the structural fix for CVE-2026-46519 (T3). That CVE (npm mcp-server-kubernetes, CVSS 8.8) enforced read-only controls only at the tools/list discovery layer, not the tools/call execution layer — a caller who knew the tool name bypassed them. Sith's per-spoke re-validation at execution (F4.5) + fail-safe allowlist are exactly the right shape. Make it a named, tested guardrail:

• F4.5 acceptance: each spoke independently re-validates every signed intent against its own allowlist at execution time (not just at dispatch/discovery), and executes with its own scoped identity; a caller that names a disallowed verb is refused at the spoke even if the center admitted it.

AI-SRE tools are governed clients of this path, not competitors (T4). The 2026 AI-SRE wave (HolmesGPT/Cleric/Komodor/kagent) all stop at "here's the fix" — read-only or action-gated. Sith is the governed executor they call: their advice becomes a typed-intent plan handed to this pipeline (plan → execute → verify), gated identically to a human. This is the moat the "advise" flood makes more valuable. See E7 #25 and E14 #46 (the brain emits the plan; it never executes).

[gnanirahulnutakki]

F4.1 foundation is scoped as #224: one typed ADR-0004 vocabulary and fail-closed verb-to-connector routing. It is deliberately side-effect-free: no argument schemas, Git call, credential, signing, dispatch, PEP write path, approval, audit write, spoke transport, or execution. F4.2 per-verb schema validation follows as a separate slice after this classification boundary is green.

[gnanirahulnutakki]

F4.1 is complete via #224 / #225.

Proof:

• merge 4567c15
• post-merge dev CI https://github.com/ArdurAI/sith/actions/runs/29580435370 green
• post-merge dev CodeQL https://github.com/ArdurAI/sith/actions/runs/29580435339 green
• security queues 0 / 0 / 0

The F4.2 research boundary is now explicit: per-verb schemas will be owned by registered handlers. Registration must atomically fail if a verb lacks a compiled exact schema; unimplemented verbs remain unregistered and therefore unexecutable. The validation engine will reject oversized/deep JSON, duplicate members, trailing data, non-object args, missing/extra schema ownership, and schema-invalid input before planning. This avoids inventing future handler contracts while preserving the fail-closed invariant. Detailed args for each verb remain part of its handler slice, starting with gitops.open-pr.

[gnanirahulnutakki]

F4.2 is in implementation on issue #226.

Scope is intentionally the governed registry boundary: every registered typed-action verb must own exactly one compiled Draft 2020-12 object schema; malformed, duplicate-key, oversized, over-deep, undeclared, or schema-invalid arguments fail before planner invocation. Handler-specific schemas remain owned by the handlers introduced in later F4 slices, so this does not invent an incomplete gitops.open-pr payload ahead of F4.3.

Pre-commit verification is green: full make ci, isolation/fuzz, 50k focused schema fuzz executions, reproducible release packaging, and the real kind-cluster suite. README reviewed; no operator-facing behavior or command changed.

[gnanirahulnutakki]

F4.2 is complete through #226 / PR #227.

The registry now requires one bounded Draft 2020-12 object schema per typed-action verb and validates strict, defensively copied arguments before any planner call. Handler-specific payload schemas remain owned by their handler slices, beginning with F4.3.

Merge proof:

• feature fa67fc5
• merge 0d4979f, with the feature commit as its second parent
• exact dev CI https://github.com/ArdurAI/sith/actions/runs/29584564460
• exact dev CodeQL https://github.com/ArdurAI/sith/actions/runs/29584564060
• post-merge security queues: 0 Dependabot / 0 code scanning / 0 secret scanning

The F4.2 checklist item is marked complete. Next unblocked slice is F4.3, but its first task is to define the concrete gitops.open-pr file-change and base-commit contract from primary Git provider semantics before implementing a handler.