Skip to content

feat: audience ceiling on grants and sessions (dseg slice 4)#199

Merged
adamfgr merged 3 commits into
mainfrom
wizzo/dseg-s4-grant-ceiling
Jul 18, 2026
Merged

feat: audience ceiling on grants and sessions (dseg slice 4)#199
adamfgr merged 3 commits into
mainfrom
wizzo/dseg-s4-grant-ceiling

Conversation

@wizzoapp

@wizzoapp wizzoapp Bot commented Jul 17, 2026

Copy link
Copy Markdown

Summary

  • persist audience ceilings on pairing grants and sessions
  • sign ceilings into session and WebSocket claims and reject persisted/signed mismatches
  • allow token exchange to preserve or narrow a ceiling, never broaden it
  • revoke pre-audience grants and sessions at migration activation
  • make existing port 3773 clients request explicit private ceilings

Verification

  • vp check
  • full 15-workspace typecheck (vp run -r --concurrency-limit 1 typecheck)
  • 18 affected test files / 267 tests
  • factory pre-commit gate clean
  • explicit Codex gpt-5.5 autoreview clean

@wizzoapp
wizzoapp Bot marked this pull request as ready for review July 17, 2026 20:49

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1a3f15827e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread apps/server/src/auth/http.ts
Comment thread packages/contracts/src/auth.ts Outdated
Comment thread apps/server/src/auth/EnvironmentAuth.ts
@wizzoapp
wizzoapp Bot marked this pull request as draft July 17, 2026 21:48
@wizzoapp
wizzoapp Bot marked this pull request as ready for review July 18, 2026 00:42

@adamfgr adamfgr left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto-approved by wizzo-approve: all policy conditions verified against HEAD f256f0d.

@adamfgr
adamfgr enabled auto-merge (squash) July 18, 2026 01:37
@adamfgr
adamfgr merged commit a93d033 into main Jul 18, 2026
13 checks passed
@adamfgr
adamfgr deleted the wizzo/dseg-s4-grant-ceiling branch July 18, 2026 01:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant