docs(design): rule the user-secret scope selector and correct D8 (RIG-3655) - #1169
Open
rigel-mintaka wants to merge 2 commits into
Open
docs(design): rule the user-secret scope selector and correct D8 (RIG-3655)#1169rigel-mintaka wants to merge 2 commits into
rigel-mintaka wants to merge 2 commits into
Conversation
|
Merging to
After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here |
|
Compass engineering docs preview: https://compass-server-rig-3655-d9-s.compass-eng-docs.pages.dev Deployed from Changed pages: |
rigel-mintaka
added this pull request to stack #1188
September 12, 2026 23:02
…-3655) D9 closes the record's wire-surface open question: SetSecretRequest and DeleteSecretRequest gain a SecretScope selector defaulting to USER scope, so a credential a user sets is not resolved by another user's agents. Tenant scope stays admin-gated per D8's matrix, checked at the RPC edge where requireUser already holds the caller's role. Also corrects a factual error in D8: it claimed the two tenant-coordinate writes were already admin-gated at the door. They are not — classifyProcedure returns authenticatedOpen for both verbs and requireUser never reads UserRole. Left uncorrected, D8 plus the tenant-pinned verb would have made SetSecret reachable only by the bootstrap admin, with no role-promotion path to grant it back. Refs RIG-3655 Co-authored-by: Matt Wilkinson <matt@rigel.build>
Review found the amendment did not carry its own ruling into the normative text. The ledger-delta prose claimed DL-361 and DL-363 were amended in place when the diff left both rows untouched, so the ledger asserted the pinned tenant coordinate and D9's scope selector at once. Both clauses are now edited and marked superseded in part, in the record table and DECISIONS.md alike. A5's SetSecret and DeleteSecret bullets and the T5 task index still instructed the tenant-pinned handler D9 replaces; an implementer reading them would have built the wrong thing. The dependent DeleteSecret open question is resolved. Corrects a wrong reassurance about existing rows: a re-set writes a new user-scoped row and does NOT retire the tenant row, which keeps resolving for every other user until an admin deletes it. A regression test pins that. Restores three Global Constraints bullets an earlier edit in this branch dropped by accident. Refs RIG-3655 Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
force-pushed
the
compass-server/rig-3655-d9-scope-selector
branch
from
September 13, 2026 03:27
fb34baf to
95db14c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is part of a stack containing 2 PRs:
mainD9 closes the record's wire-surface open question: SetSecretRequest and
DeleteSecretRequest gain a SecretScope selector defaulting to USER scope, so
a credential a user sets is not resolved by another user's agents. Tenant
scope stays admin-gated per D8's matrix, checked at the RPC edge where
requireUser already holds the caller's role.
Also corrects a factual error in D8: it claimed the two tenant-coordinate
writes were already admin-gated at the door. They are not — classifyProcedure
returns authenticatedOpen for both verbs and requireUser never reads UserRole.
Left uncorrected, D8 plus the tenant-pinned verb would have made SetSecret
reachable only by the bootstrap admin, with no role-promotion path to grant it
back.
Refs RIG-3655
Co-authored-by: Matt Wilkinson matt@rigel.build