Skip to content

Design: cross-org issue filing with bidirectional authorization (#672)#980

Open
ralphbean wants to merge 5 commits into
mainfrom
cross-org-issue-filing-672
Open

Design: cross-org issue filing with bidirectional authorization (#672)#980
ralphbean wants to merge 5 commits into
mainfrom
cross-org-issue-filing-672

Conversation

@ralphbean
Copy link
Copy Markdown
Contributor

@ralphbean ralphbean commented May 15, 2026

Summary

  • Design spec and ADR for cross-org issue filing, addressing Retro agent post-script needs cross-org issue filing with authorization #672
  • Introduces bidirectional config-driven authorization (send_issues_to / accept_issues_from) and a new cross-org-propose mint role
  • The mechanism is agent-agnostic: retro agent uses it first, future upstreaming agents reuse it for proposals to arbitrary upstreams

What's here

  • Design spec (docs/superpowers/specs/2026-05-14-cross-org-issue-filing-design.md): full design covering config keys, enforcement split (mint checks upstream, post-script checks downstream), workflow changes, post-script changes, failure modes, and testing
  • ADR 0037 (docs/ADRs/0037-cross-org-token-minting.md): decision record for extending the mint with config-reading capability for cross-org authorization, with open question on cross-forge federation (references ADR 0028, ADR 0029)

Key design decisions

  • Bidirectional authorization: downstream declares send_issues_to, upstream declares accept_issues_from. Both must agree.
  • Enforcement split: mint checks upstream's accept_issues_from (only entity with cross-org visibility). Post-script checks downstream's send_issues_to.
  • Config lookup order: per-repo .fullsend/config.yaml first, fall back to org .fullsend/config.yaml.
  • New mint capability: reads upstream config via App JWT for cross-org-propose requests only. All other roles stay stateless.
  • Failure mode: unauthorized proposals are skipped with a warning; remaining proposals still file.

When accepted, these living docs need updating

  • docs/architecture.md — "Decided:" block in the federation section linking to ADR 0037
  • docs/problems/security-threat-model.md — consider noting the mint's new config-reading surface

Related

ralphbean added 4 commits May 14, 2026 20:29
@ralphbean
Add design spec for cross-org issue filing (#672)
8ef9623 
Captures the design for bidirectional cross-org authorization
(send_issues_to / accept_issues_from), a new cross-org-propose mint
role, and the enforcement split between mint and post-script.

Assisted-by: Claude claude-opus-4-6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
@ralphbean
Add ADR 0037: cross-org token minting for issue proposals
45a09c3 
Proposes extending the central token mint with a cross-org-propose role
and bidirectional config-driven authorization (send_issues_to /
accept_issues_from) for cross-org issue filing.

Relates to #672.

Assisted-by: Claude claude-opus-4-6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
@ralphbean
ADR 0037: note cross-forge federation as open question
bdeb163 
Adds a consequence noting that GitLab-to-GitHub cross-org minting is a
natural extension but requires separate mint changes for OIDC issuer
validation and downstream identity.

Assisted-by: Claude claude-opus-4-6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
@ralphbean
ADR 0037: reference ADR 0028 (GitLab support) in cross-forge note
eb3c99c 
Assisted-by: Claude claude-opus-4-6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 15, 2026

fullsend review is working on this — view logs

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 15, 2026 •
edited
Loading

Site preview

Preview: https://00c9291a-site.fullsend-ai.workers.dev

Commit: c0cb81146aec509607ba782466d315b299f7b9ae

@fullsend-ai-review
Copy link
Copy Markdown

fullsend-ai-review Bot commented May 15, 2026 •
edited
Loading

Review: #980

Head SHA: c0cb811
Timestamp: 2026-05-15T00:00:00Z
Outcome: approve

Summary

Clean docs-only PR adding a design spec and ADR for cross-org issue filing, directly addressing #672. The bidirectional authorization model (downstream send_issues_to + upstream accept_issues_from) is well-designed with a sound enforcement split between mint and post-script. Both documents are internally consistent, correctly reference prior ADRs (0028, 0029), and follow repo conventions for format, numbering, and placement. No code changes, no secrets, no injection patterns detected. One medium observation below on authorization granularity — not blocking.

Findings

Medium

  • [Platform security] docs/superpowers/specs/2026-05-14-cross-org-issue-filing-design.md:29-31 — accept_issues_from uses org-level granularity: listing an org name authorizes every enrolled repo in that org to file issues in any repo in the upstream org. A compromised or malicious repo in a trusted downstream org could file issues across the entire upstream. Consider whether per-repo granularity on either side would be worth the config complexity, or at minimum document this as a known trade-off in the design spec's failure modes or the ADR's consequences.

Info

  • [Style/conventions] The PR body notes that docs/architecture.md and docs/problems/security-threat-model.md need updating when this is accepted — these are deferred correctly per ADR conventions (content frozen after acceptance). No action needed now.
  • [Correctness] ADR 0029 (central token mint) is still in "Proposed" status. ADR 0037 builds on it as a prerequisite. This dependency is appropriate and acknowledged, but acceptance of 0037 should follow acceptance of 0029.

Footer

Outcome: approve
This review applies to SHA c0cb81146aec509607ba782466d315b299f7b9ae. Any push to the PR head clears this review and requires a new evaluation.

Previous run

Review: #980

Head SHA: eb3c99c
Timestamp: 2026-05-15T00:00:00Z
Outcome: approve

Summary

This PR introduces a well-designed bidirectional authorization model for cross-org issue filing, addressing #672. The design spec and ADR 0037 are logically consistent, follow established repo conventions, and correctly extend the token mint architecture from ADR 0029. The enforcement split (mint checks upstream authorization, post-script checks downstream intent) is clean and maintains least-privilege. No security, correctness, or injection concerns were found.

Findings

Info

  • [Style] docs/superpowers/specs/2026-05-14-cross-org-issue-filing-design.md — The "Agent Prompt Changes" section mentions removing TODO(#833) warnings but doesn't detail the specific prompt text changes. This is acceptable for a design spec; the implementation PR should include the concrete diff.

  • [Platform security] docs/ADRs/0037-cross-org-token-minting.md — The accept_issues_from config uses org names as identifiers. Consider documenting behavior if an org is renamed (GitHub org renames change the login but not the node ID). Not blocking — can be addressed in implementation.

Footer

Outcome: approve
This review applies to SHA eb3c99c204af5c960df3421daa3dd84231c4a57b. Any push to the PR head clears this review and requires a new evaluation.

@ralphbean
ADR 0037: clarify that the mint fetches config via App JWT
c0cb811 
Assisted-by: Claude claude-opus-4-6 <noreply@anthropic.com>
Signed-off-by: Ralph Bean <rbean@redhat.com>
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 15, 2026

fullsend review is working on this — view logs

@ralphbean
Copy link
Copy Markdown
Contributor Author

ralphbean commented May 15, 2026 •
edited
Loading

I just had a thought (that I need to take up another day): this doesn't account for multiple mints; self-managed mints. What if the upstream you want to contribute to uses a different mint than you do? Do you need to configure their target mint url explicitly as a downstream?

Perhaps there's another option to explore here: could upstream offer a workflow that provides a way for a trusted downstream to borrow its mint? Unclear - will think on it more tomorrow.

@fullsend-ai-review fullsend-ai-review Bot mentioned this pull request May 15, 2026
Merged
ggallen added a commit to ggallen/fullsend that referenced this pull request May 15, 2026
@ggallen @claude
Renumber ADR to 0038 and fix High/Medium review findings
b66e8d9 
High issues fixed:
- Renumber ADR from 0037 to 0038 to avoid collision with PR fullsend-ai#980 which
  also uses ADR-0037 (cross-org-token-minting). Updated all references
  from ADR-0037 to ADR-0038 in both the ADR file and implementation plan.

Medium issues fixed:
- Promote atomic cache writes from TODO to Phase 1 requirement. Added
  explicit requirement to Phase 1 deliverables and updated CachePut
  comment to reference the requirement instead of vague TODO.
- Promote double-encoding mitigation from TODO to Phase 1 requirement.
  Added explicit requirement to Phase 1 deliverables specifying either
  iterative decoding (max 3 iterations) or rejection of URLs with %25.
  Updated matchesAllowedPrefix comment to reference the requirement.

Low issues (not fixed per user instruction):
- DefaultPolicy includes gitlab.com
- Placeholder import paths in illustrative code

Note: High issue about README adding pre-existing plans is about PR
description scope, not a code change needed.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
ggallen added a commit to ggallen/fullsend that referenced this pull request May 15, 2026
@ggallen @claude
Fix medium and low review findings
c2a6463 
Medium:
- Add explanatory comment to ADR documenting why it's numbered 0038
  instead of 0037 (to avoid collision with PR fullsend-ai#980 which uses ADR-0037
  for cross-org-token-minting)

Low:
- Update PR description to clarify that README change documents the new
  universal-harness-access plan alongside three pre-existing plan files
  that were previously unlisted, and to note ADR numbering rationale

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
ggallen added a commit to ggallen/fullsend that referenced this pull request May 15, 2026
@ggallen @claude
Fix medium review finding
d454b48 
Medium:
- Update HTML comment to reference ADR title "Cross-org token minting
  for issue proposals" instead of PR branch name, clarifying which ADR
  in PR fullsend-ai#980 this is avoiding collision with

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
@fullsend-ai-retro fullsend-ai-retro Bot mentioned this pull request May 15, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@fullsend-ai-review fullsend-ai-review[bot] fullsend-ai-review[bot] approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ralphbean