Phase 1 — Gateway core (identity, audit, secrets) #3

New Issue

wtclaude · 2026-08-08T19:36:09Z

wtclaude commented

2026-08-08 19:36:09 +00:00

Size: large · Depends on: Phase 0

The security and accountability spine. Everything later assumes it exists.

Scope

Streamable HTTP MCP server; session lifecycle and per-session state, including the rules-fetched flag that phase 2's gate depends on
Token auth → agent identity → permissions lookup; issuance, rotation, revocation via the admin API
SQLite schema carrying project_id throughout: projects, agents, tokens, permissions, audit_log
Append-only audit log written from the first request, with source attribution (user / agent / vendor)
Docker-secrets loading, structured logging, per-request timeouts
Admin API skeleton — the Web Panel's contract starts here so it isn't written twice

Exit criterion

Two agents connect under distinct authenticated identities with different permission sets; a forged clientInfo changes nothing about what either may do; every call appears in the audit log correctly attributed.

References

ADR-0003 (per-agent bearer tokens), ADR-0004 (SQLite), ADR-0007 (project_id from day one)

Review notes

clientInfo must never reach an authorization decision — display and audit only
Every query is project-scoped; a missing WHERE project_id = ? is a correctness bug
Security review required (auth + secrets)

Open item to settle

Audit log integrity: plain append-only table, or hash-chained and tamper-evident?

**Size:** large · **Depends on:** Phase 0 The security and accountability spine. Everything later assumes it exists. ## Scope - Streamable HTTP MCP server; session lifecycle and per-session state, including the **rules-fetched flag** that phase 2's gate depends on - Token auth → agent identity → permissions lookup; issuance, rotation, revocation via the admin API - SQLite schema carrying `project_id` throughout: `projects`, `agents`, `tokens`, `permissions`, `audit_log` - Append-only audit log written from the **first** request, with source attribution (user / agent / vendor) - Docker-secrets loading, structured logging, per-request timeouts - Admin API skeleton — the Web Panel's contract starts here so it isn't written twice ## Exit criterion Two agents connect under distinct authenticated identities with different permission sets; a forged `clientInfo` changes nothing about what either may do; every call appears in the audit log correctly attributed. ## References ADR-0003 (per-agent bearer tokens), ADR-0004 (SQLite), ADR-0007 (`project_id` from day one) ## Review notes - `clientInfo` must never reach an authorization decision — display and audit only - Every query is project-scoped; a missing `WHERE project_id = ?` is a correctness bug - Security review required (auth + secrets) ## Open item to settle Audit log integrity: plain append-only table, or hash-chained and tamper-evident?

wtclaude added this to the v1.0 — Agentic Bridle milestone 2026-08-08 19:36:09 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: whitlocktech/Agentic-Bridle#3