feat(prism): integrate mic.sc sign-in and session-bound inference - #3
Open
q1 wants to merge 7 commits into
Open
Conversation
added 7 commits
September 4, 2026 23:58
Fork-Feature: mic-identity Upstream: no
Fork-Feature: prism Upstream: no
Preserve independent environment authorization, renew service credentials per request, and reject shared-key compatibility paths in identity mode. Fork-Feature: mic-identity Upstream: no
Add hosted onboarding without environment grants, fresh identity and paired-service access, scoped routing controls, and explicit stale or unsupported states across the clients. Fork-Feature: mic-identity Upstream: no
Use session-bound authorization for service clients and per-thread coding brokers, with independent environment access and revocation fencing. Fork-Feature: mic-identity Upstream: no
Fork-Feature: mic-identity Upstream: no
Fork-Feature: mic-identity Upstream: no
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
q1code could display mic.sc Prism access, but used the wrong Clerk token type and could not carry a user's authorization into inference or a coding session. This connects the application to the merged session-aware contract: sign in, discover the selected host, send an ordinary-user request, and manage routing with the exact granted permissions.
The feature remains off by default. Hosted web can sign in without an environment connection; desktop and native clients preserve their independent environment authorization. Native identity and renewal survive navigation. Ordinary users receive model identifiers and inference controls, without provider-account details.
Claude and Codex coding threads use separate loopback brokers with renewable, session/host-bound credentials. The server stamps opaque broker references on authorized turns, so queued work cannot borrow a replacement credential. Account changes, environment revocation and disconnect invalidate the matching broker. Identity-mode failures never automatically retry under local provider credentials; explicit direct routing remains available. Admin host pairing/selection/revocation and routing acknowledgment/readback use named APIs rather than a generic management proxy.
Validation (green full CI, final commit
cf7daf46ccdd70a6908bcab239a6dad9434ab535):Download the screenshots and acceptance results · Green browser QA run
The artifact contains eight images: signed-out, ordinary-user desktop/mobile (including the response), admin routing, offline, revoked-stream and unpaired-host states. Chromium passed all eight scenarios on the latest PR head. Authentication and provider fixtures are synthetic. No screenshots or credentials are committed.
Remaining acceptance limits: the live development authority has no selected host and rejects the local browser origin. Real Clerk browser/native sign-in, actual provider/harness execution and Mac/Swift qualification remain pending. The merged backend still lacks model eligibility/count/warning aggregates, account lifecycle/reserve/advanced settings adapters and atomic settings revisions. Host-side preparation is required for the UI pairing challenge. These controls are kept explicitly unavailable; this PR does not claim complete stack deployment. Grok's compatible inference API is supported; its coding harness and other native harnesses retain direct routes.
No release, production service replacement, infrastructure apply or cutover is included.
Implemented and reviewed with GPT-6-Astra Ultra in the Codex/T3 Code harness, with focused peer-agent review and primary-agent browser QA.