P20 defect — Workspace API rejects real authenticated session authority

[Techshrr]

P20-D004 — Workspace API rejects real authenticated session authority

Parent verification: #53
Verification PR: #54
Frozen case: P20-T011 — Real login session and account workflow

Classification

• Severity: P1
• Release blocking: yes
• Gate hard failure: yes
• Affected gates: G3 / G6 / G10
• Decision required: no

This is the next fail-fast P20-T011 integration defect exposed only after P20-D002's Redis login-rate checkpoint became green on the same exact-head run.

Exact discovery authority

• Exact HEAD: c7e0cceccb4380b61ce213084a236dc4c5946f52
• Workflow: P20 P0 Auth Timeline
• Run: 33288665486
• Job: 99196299445
• Evidence artifact: 9725338440
• Artifact digest: sha256:2e55479d2d700cda14d3f4f0a65ec01e1b64d7887df443095ab5e0458bcd4c00

The same job proves:

• P20-T009: PASS
• P20-T010: PASS
• account active before login
• real password login: HTTP 200
• D002 rate checkpoint: PASS (login_rate_protection_observed=true, Redis key count 2)
• real session cookie: Secure / HttpOnly / SameSite=Lax
• /api/me: HTTP 200
• repeated /api/me: HTTP 200 with session continuity
• same T009/T010 user and Workspace correlation preserved
• mock authority: false
• secret material recorded: false

Frozen failure

When the same real authenticated session calls GET /api/workspaces:

• HTTP status: 503
• error code: auth_dependency_unavailable
• workspace_api_identity_matches_t009=false

Frozen failure string:

real authenticated session is not accepted as Workspace API identity authority

Boundary diagnosis

At this exact head, internal/workspace/httpapi.go uses API.principal() with testAuthEnabled. When test auth is disabled—as required by P20 real-auth verification—the Workspace API returns 503 auth_dependency_unavailable; otherwise it reads X-GoJet-Test-* headers. Native platformapi mounts the Workspace handler independently and does not compose P15 real session authentication into the Workspace principal boundary.

Remediation constraints

1. Do not enable GOJET_TEST_AUTH_ENABLED or inject X-GoJet-Test-* authority in P20.
2. Do not weaken P15 server-side session/revocation/CSRF/Origin semantics.
3. Do not reinterpret or bypass P12 Workspace membership/RBAC authority.
4. Compose a real production principal bridge so Workspace reads the authenticated P15 session identity and then uses existing P12 membership/RBAC checks.
5. Preserve existing test-auth fixture capability only as test-only authority where predecessor workflows require it; production and P20 real-auth paths must not depend on it.
6. Add focused tests proving active real session → Workspace principal, revoked/expired/absent session rejection, tenant membership enforcement, and no test-header substitution when test auth is disabled.
7. Keep P20-D003 trusted-client-IP remediation separate.
8. T012 is not authorized until D003/D004 are closed and T011 passes on a coherent exact head.

[Techshrr]

Remediation started

Isolated remediation PR: #64

• branch: fix/p20-d004-workspace-session-authority
• base P20 HEAD: a2a2168599c0e05e5c29cc207f11052108560265
• remediation HEAD: 35c4d390863a987e928d73493b261b531fa007c4
• changed files: 7

The production Workspace path now resolves identity from the real P15 server-side session and authoritative Auth user, while predecessor test-auth fixtures retain their existing constructor. Unsafe Workspace methods are designed to pass P15 Origin + one-time CSRF before P12 membership/RBAC and business mutation logic. Incoming X-GoJet-Test-* headers are not consulted when the production resolver is installed.

D004 remains OPEN until CI, merge, and live exact-head P20-T011 verification prove the real session/Workspace correlation.

[Techshrr]

P20-D004 live remediation verification — PASS; closure-ledger coherence pending

The scoped D004 failure is now live-verified as remediated on exact P20 HEAD a307713d3a3b2746b33340fb88833ea3c38c5493.

Authority:

• workflow: P20 P0 Auth Timeline
• run: 33296332430
• job: 99216516210
• conclusion: SUCCESS
• artifact: 9727551422
• digest: sha256:ae49c9322077b65d67d7e8242bb083238513a00fa021c7b4c9f71a624531d026

The same coherent T009→T011 job proves:

• T009 PASS, exactly one owner Workspace
• T010 PASS, same user/Workspace correlation preserved
• login rate authority observed, Redis keys present
• real login HTTP 200 and /api/me HTTP 200
• /api/workspaces HTTP 200
• workspace_api_identity_matches_t009=true
• Workspace role owner
• mock authority false
• logout HTTP 200 / logged_out
• server-side session status becomes revoked
• stale cookie rejected with HTTP 410 revoked_token
• real MySQL / Redis / native platform API true
• no secret material recorded

Supporting exact-head whole-product contract:

• run 33296332382
• job 99216516054
• artifact 9727529157
• digest sha256:3fe96baf83d48db1ee16f6f786a25884562ead81ea38afcb4c388a0c55ae42e0
• Go whole-repository baseline PASS
• frontend whole-workspace baseline PASS

The defect ledger has now moved D004 to closed, producing closure-ledger HEAD 7060c59dd622439b59a86e8f66048274bc117f3d with open P0/P1/DECISION REQUIRED all zero.

Issue #62 remains OPEN only until T011 and Candidate/Traceability Freeze re-establish exact-head coherence on 7060c59.... T012 remains unauthorized until those closure-ledger checks pass.

[Techshrr]

P20-D004 final closure — exact-head coherence PASS

Closure-ledger HEAD 7060c59dd622439b59a86e8f66048274bc117f3d has now re-established both required authorities.

P20-T009→T011 real-auth timeline

• run 33296506289
• job 99216984791
• conclusion: SUCCESS
• artifact 9727590531
• digest sha256:f53332ff59256ceb7e62d49445dc5e0a404ecb0650dd28eb4ebbb926592d03f6
• T009 PASS
• T010 PASS
• T011 PASS
• /api/workspaces = 200
• workspace_api_identity_matches_t009=true
• owner Workspace preserved
• login rate authority observed
• logout = 200 logged_out
• server-side session revoked
• stale cookie = 410 revoked_token
• real MySQL / Redis / native platform API true
• mock authority false
• secret material recorded false

P20 T001-T008 Candidate and Traceability Freeze

• run 33296506415
• job 99216986158
• conclusion: SUCCESS
• artifact 9727582548
• digest sha256:0090b8ac7ddcd367a7048c11a52d454398b72061799f6bb9a1bd3f5eee23f720
• T001-T008 all PASS on the same closure-ledger HEAD
• defect/decision ledger PASS with open P0=0, P1=0, DECISION REQUIRED=0
• exact-head Go baseline PASS
• frontend typecheck + deterministic double-build inventory PASS

Therefore P20-D004 is fully closed with coherent exact-head evidence. P20-T012 is now authorized by the frozen fail-fast sequence.