feat(auth): harden trusted evidence and protected objects - #4783
Draft
cea-block wants to merge 13 commits into
Draft
feat(auth): harden trusted evidence and protected objects#4783cea-block wants to merge 13 commits into
cea-block wants to merge 13 commits into
Conversation
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
cea-block
changed the title
cea-block
changed the base branch from
cea/o4-assertion-hardening
to
cea/identity-binding-lifecycle
August 4, 2026 21:20
This was referenced Aug 4, 2026
Keep extracted protected transports fail closed until their owning route inventory and client-production slices land, and update the directly affected lint and proof fixtures. Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Share the existing membership lock within buzz-db and keep the operation-receipt inspection helper test-only until its owning invalidation slice lands. Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
* commit 'f09c6ea4b9aabb4a71b4852b81102243bf328241': test(desktop): stabilize off-relay video menu fix(desktop): keep sidebar within size limit Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Trusted provider evidence and protected-object authority must be reviewed together so assertion hardening and transport enforcement share one fail-closed foundation. The migration chain must also remain executable from a fresh database without installing triggers before their function exists.
What
0031_protected_object_publications.sqlthrough0039_audio_admission_visibility.sql; authority-epoch triggers are installed by the owning downstream migration after its function definition.Risk Assessment
Medium. The affected protected paths deny ambiguous or inconsistent authority, while defaults remain disabled and unprotected behavior is unchanged. This draft does not deploy or activate enforcement.
References
cea/identity-binding-lifecycleat0b0c9cd3722bef2c2ef834c8a336f3e6057be69b.cea/o4-protected-transportsat5727152d4eece55ee621d46475372af4a74b9bb3(tree330a766cc06ae3f089daac08d0865d396a3f59f5).Generated with Codex