docs(design): fix 1 Kilo + 5 CodeRabbit security findings on cross-user-collab spec#2024
Conversation
…s-user-collab spec CR #1 — Add replay protection, canonical serialization, audience binding, freshness window, and persistent replay cache to envelope handshake (line 124). CR #2 — Add peer-token vs. project-level authorization: contact identity authenticates the route family, but per-operation project membership, policy, and channel membership are independently enforced (line 131). CR jaylfc#3 — Add fail-closed runtime checks on every delegated request: verify current sponsor-contact status and project membership at call time, not just at token issuance; purge outbox and unclaim in-flight tasks on revoke (line 255). CR jaylfc#4 — Require non-null, owner-validated, immutable project_id claim in minted JWTs for project_tasks and canvas_read scopes (line 251). CR jaylfc#5 — Require atomic uniqueness constraint on (contact_id, channel_id, remote_msg_id) in chat_messages, insert-before-ack, treat conflicts as successful duplicates (line 328). Kilo #1 — Clarify project.visibility as a future schema addition (projects.visibility TEXT DEFAULT 'private'), not an existing column on hub posts (line 524).
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (2)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
Code Review SummaryStatus: No Issues Found | Recommendation: Merge This is a docs-only PR that clarifies the cross-user-collaboration design spec in response to the 6 prior review findings (1 Kilo + 5 CodeRabbit). The added prose correctly and consistently captures:
No functional, security, or logic defects were introduced. The changes are confined to prose and accurately reflect the intended security posture. Minor cosmetic punctuation/line-wrap inconsistencies (e.g. em-dash vs hyphen, the wrapped line 559) are stylistic only and do not affect correctness. Files Reviewed (1 file)
Reviewed by hy3:free · Input: 36.5K · Output: 1.5K · Cached: 106.1K |
* docs(design): cross-user collaboration spec (contacts, human collaborators, agent delegation, human DM) Flagship epic: add another taOS user as a contact (hub friend edge), invite them as a human project collaborator, receive their delegated agents (normal external-selfjoin identities tagged with a sponsor contact), and chat human-to-human over an instance-to-instance peer channel. Rides the shipped invite/consent/registry rails; rejects registry-abuse and bus-federation. Phased plan with a pilot-first path (hogne) and lanes for lead/hognek/fleet. Awaiting owner decisions (section 10). * docs(design): add Milestone F - collaborator community view (stats, leaderboard, live kanban, community chat) When a user collaborates on a remote project, their Projects app gets a rich read-mostly community view (a mini social-GitHub for the shared project) so they see their contribution/involvement and feel part of the team. Introduces a scoped read-only project projection served over the peer channel (never direct API access, never sensitive fields) - the read counterpart to the write-delegation in Milestone D. Refines Decision 2: rich read surface, still zero board/file write for the human. Member-scoped in v1; public view a later toggle on the same machinery. * docs(design): address 1 Kilo + 5 CodeRabbit security findings on cross-user-collab spec (#2024) CR #1 — Add replay protection, canonical serialization, audience binding, freshness window, and persistent replay cache to envelope handshake (line 124). CR #2 — Add peer-token vs. project-level authorization: contact identity authenticates the route family, but per-operation project membership, policy, and channel membership are independently enforced (line 131). CR #3 — Add fail-closed runtime checks on every delegated request: verify current sponsor-contact status and project membership at call time, not just at token issuance; purge outbox and unclaim in-flight tasks on revoke (line 255). CR #4 — Require non-null, owner-validated, immutable project_id claim in minted JWTs for project_tasks and canvas_read scopes (line 251). CR #5 — Require atomic uniqueness constraint on (contact_id, channel_id, remote_msg_id) in chat_messages, insert-before-ack, treat conflicts as successful duplicates (line 328). Kilo #1 — Clarify project.visibility as a future schema addition (projects.visibility TEXT DEFAULT 'private'), not an existing column on hub posts (line 524). Co-authored-by: Hogne <227774406+hognek@users.noreply.github.com> --------- Co-authored-by: hognek <hognek@gmail.com> Co-authored-by: Hogne <227774406+hognek@users.noreply.github.com>
2 participants
Task: t_ad230474. Fixes findings on #2011.
Addresses all 6 bot findings from the #2011 review:
CodeRabbit findings
ts(300s), and persistent replay cache keyed by(contact_id, kind, nonce).project_idmust verify activemember_kind="human"membership, beyond just contact identity.project_tasksandcanvas_readgrants carry non-null, owner-validated, immutableproject_idin the minted JWT.(contact_id, channel_id, remote_msg_id), insert-before-ack, conflict = successful duplicate.Kilo finding
project.visibilityclarification (line 524): Changed from implying an existing column to explicitly noting it as a future schema addition (projects.visibility TEXT DEFAULT 'private').Tests: N/A (docs-only, no code changes).