From the protocol audit (P2). 9 scopes gate 24 verbs; several sensitive verbs piggyback on generic scopes: session.set_model (cost implications), session.rotate, session.rename all ride session:send; session.export (full transcript + memory egress) rides list-class scope. Least-privilege delegation becomes load-bearing when the conductor starts delegating scopes (PR #51 design: owner → conductor → children).
Plan: add finer scopes (e.g. session:configure, session:export) with the legacy scope treated as implying them for back-compat (existing tokens keep working); update WATCHER_SCOPES/OPERATOR_SCOPES presets; audit every hasScope site in session-manager.ts against a documented verb→scope table (belongs in PROTOCOL.md, see the spec issue).
From the protocol audit (P2). 9 scopes gate 24 verbs; several sensitive verbs piggyback on generic scopes:
session.set_model(cost implications),session.rotate,session.renameall ridesession:send;session.export(full transcript + memory egress) rides list-class scope. Least-privilege delegation becomes load-bearing when the conductor starts delegating scopes (PR #51 design: owner → conductor → children).Plan: add finer scopes (e.g.
session:configure,session:export) with the legacy scope treated as implying them for back-compat (existing tokens keep working); updateWATCHER_SCOPES/OPERATOR_SCOPESpresets; audit everyhasScopesite insession-manager.tsagainst a documented verb→scope table (belongs in PROTOCOL.md, see the spec issue).