test(agent-harness): cover model gateway security boundaries

[iscekic]

No new behavior — this change adds tests only.

---

Summary

The new security suite adds 34 cases for existing authorization, request validation, stream limits, error redaction, and cancellation; production behavior and deployed contracts remain unchanged.
It reuses the existing operation fixture and private helpers to test the composed POST gateway against mocked storage and upstream transport.
These checks establish delegation and error boundaries, not live provider calls or ledger writes.

Files

• apps/web/src/lib/agent-harness/model-gateway-security.test.ts — adds the isolated security cases. Checks missing capabilities, revoked grants, stale generations, blocked users, modified messages, mismatched identifiers, and mismatched audience, operation, version, dispatch, digest, or target scopes. Rejections stop before inference with non-retryable access_revoked errors; the authorization group also checks no-store. Rejects blank/null models, zero/fractional max_tokens, malformed JavaScript Object Notation (JSON), and empty requests with 400, and oversized multibyte requests with 413. These validation failures prevent upstream requests; malformed request errors remain non-retryable and omit private text. Rejects malformed stream data, invalid content shapes, and wrong upstream media with 422 without forwarding private data. Oversized frames produce 413, and empty streams retain 200 with an empty body. Covers Hypertext Transfer Protocol (HTTP) and stream errors: 400/404 map to invalid_input, 401/403 to access_revoked, 402 to limit_exceeded, and 408/429/503 to retryable storage_unavailable. HTTP failures retain their status; stream errors retain status 200, and both omit secrets and [DONE]. A failed read after progressive output emits retryable 503, closes the stream, aborts upstream work, and excludes tokens from responses and console logs. Already-aborted requests return 499 without inference; deadlines emit sanitized 503, abort the upstream request, and cancel its stream.

Tests: 1 test file added, model-gateway-security.test.ts (+279/−0 lines), with 34 focused cases.
Generated: 0 files changed.

---

Verification

No manual verification is reported for this test-only level; it changes no runtime or visual behavior.
Full-stack end-to-end (E2E) verification remains pending.

Visual Changes

Visual Changes: N/A

Reviewer Notes

Recorded checks and scope

• The supplied review records 34 passing focused cases and 61 passing cases across both gateway suites.
• Scoped format, lint, import-boundary, and whitespace checks passed. The added file matches the reviewed preservation hash.
• The suites test the composed gateway with mocks; they establish delegation and error boundaries, not live provider calls or ledger writes.
• This description round did not rerun product checks. No current-head continuous integration (CI) pass or final section acceptance is claimed.
• Worker composition remains a22; live proof remains a32 and the final tip E2E loop.

Human steps

No human action is required before merge or after merge for this test-only level.

Notes

• This test-only level has no runtime or visual changes; full-stack E2E remains pending.
• Font-scaling variants, including large text and dynamic type: owner-descoped.
• Light, dark, and other theme variants, including variant-only geometry: owner-descoped.
• Visual contrast, scaled-text layout, and screen-reader presentation checks: owner-descoped.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. shared-agent-harness-3bb0 — chore(agent-harness): register workspaces and enforce CI boundaries #5632
2. shared-agent-harness-3bb0-s2 — feat(agent-harness): define portable domain and snapshots #5637
3. shared-agent-harness-3bb0-s3 — feat(agent-harness): define commands tools and permission policy #5639
4. shared-agent-harness-3bb0-s4 — feat(agent-harness): share client state and cursor recovery #5643
5. shared-agent-harness-3bb0-s5 — feat(agent-harness): persist command intents and execution receipts #5647
6. shared-agent-harness-3bb0-s6 — feat(db): add harness ingress grants and retirement fences #5655
7. shared-agent-harness-3bb0-s7 — feat(agent-harness): deliver legacy history and project durable text #5659
8. shared-agent-harness-3bb0-s8 — feat(agent-harness): authorize durable grants and registered clients #5662
9. shared-agent-harness-3bb0-s9 — feat(agent-harness): fence retirement and retry payload cleanup #5667
10. shared-agent-harness-3bb0-s10 — feat(agent-harness): persist authoritative state in SQLite #5675
11. shared-agent-harness-3bb0-s11 — feat(agent-harness): admit durable runs and revisioned commands #5678
12. shared-agent-harness-3bb0-s12 — feat(agent-harness): recover queued runs and stream checkpointed steps #5688
13. shared-agent-harness-3bb0-s13 — feat(agent-harness): resolve interactions and dispatch tools sequentially #5693
14. shared-agent-harness-3bb0-s14 — feat(agent-harness): fence designated client tool execution #5697
15. shared-agent-harness-3bb0-s15 — feat(agent-harness): synchronize durable snapshots and legacy history #5701
16. shared-agent-harness-3bb0-s16 — feat(agent-harness): reuse authorized invitations with durable replay #5704
17. shared-agent-harness-3bb0-s17 — feat(integrations): bound repository transport for harness reads #5710
18. shared-agent-harness-3bb0-s18 — feat(integrations): expose bounded authorized repository reads #5714
19. shared-agent-harness-3bb0-s19 — feat(agent-harness): expose named authorized resource reads #5718
20. shared-agent-harness-3bb0-s20 — feat(sessions): bound history transport for harness reads #5724
21. shared-agent-harness-3bb0-s21 — feat(agent-harness): read scoped Cloud Agent context and progress #5726
22. shared-agent-harness-3bb0-s22 — fix(agent-harness): preserve ordered Cloud Agent dispatch identity #5731
23. shared-agent-harness-3bb0-s23 — feat(agent-harness): hand coding work to authorized Cloud Agent sessions #5733
24. shared-agent-harness-3bb0-s24 — feat(agent-harness): authorize scoped MCP gateway connections #5737
25. shared-agent-harness-3bb0-s25 — feat(agent-harness): bound MCP gateway transport in the Worker #5740
26. shared-agent-harness-3bb0-s26 — feat(agent-harness): execute validated remote MCP tools #5743
27. shared-agent-harness-3bb0-s27 — refactor(exa): share provider dispatch and usage recording #5746
28. shared-agent-harness-3bb0-s28 — feat(agent-harness): authorize bounded web provider requests #5747
29. shared-agent-harness-3bb0-s29 — feat(agent-harness): normalize web sources and preserve citations #5749
30. shared-agent-harness-3bb0-s30 — feat(agent-harness): define closed internal operation contracts #5753
31. shared-agent-harness-3bb0-s31 — feat(agent-harness): authorize internal maintenance operations #5754
32. shared-agent-harness-3bb0-s32 — feat(agent-harness): authorize named Kilo operation dispatch #5755
33. shared-agent-harness-3bb0-s33 — feat(agent-harness): authorize internal provider operations #5757
34. shared-agent-harness-3bb0-s34 — feat(agent-harness): secure the internal operations endpoint #5758
35. shared-agent-harness-3bb0-s35 — feat(agent-harness): bound and sanitize model streams #5767
36. shared-agent-harness-3bb0-s36 — feat(agent-harness): secure billed model inference #5776
37. shared-agent-harness-3bb0-s37 — test(agent-harness): cover model gateway security boundaries #5777 ← this PR (tip)

[iscekic]

Closing: the owner stopped this workflow section. The branch is retained.