Repository navigation
S1: runtime-bound credential isolation - #10
Merged
Merged
Conversation
Exit criteria: - acting-user tool call succeeds (e2e_s1_tool_call_as_acting_user) - out-of-grant, forged-SVID, and cross-user reuse attempts fail closed Guarantees re-run: G-2 green against OpenShell v0.0.90 + carried identity patch, SPIRE 1.15.2, and mcp-gw c2af10d9 + #1634acece3 Upstream dependencies recorded: NVIDIA/OpenShell#2012, #2184, #1970; apelogic-ai/mcp-gw#16
Revoke mint authority when deletion begins, provision and reconcile the gateway provider in every OpenShell workspace, and exercise a legitimate second runtime for cross-user isolation. Add executable pinned G-2 conformance evidence and run it through the aggregate gate.
Reconcile the OpenShell gateway attachment symmetrically so removed tools detach it and unchanged state remains mutation-free. Replace source-shape evidence with one executed upstream-focused G-2 negative test in both pinned and latest lanes, while retaining the separate S1 E2E exit criterion.
Require policy to authorize from normalized HOP-1 identity and runtime tool claims before credential resolution. Count the nested Bun execution exactly and require its validated success sentinel alongside the Rust wrapper result. Latest upstream remains a recorded finding until apelogic-ai/mcp-gw#16 lands; pinned evidence carries that patch.
Use Steward's minted subject contract, keeping acting-user email and runtime UID distinct. Give Bob matching tool authority so his request reaches the real credential broker and proves Alice's token is not returned; retain a separate unauthorized subject to assert policy denial precedes credential resolution.
lbelyaev
marked this pull request as ready for review
July 28, 2026 20:51
Keep the latest-upstream conformance step and logs visibly failed, but tolerate that specific step and record the finding as a workflow warning and job summary. Pinned CI and setup failures remain blocking.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
mcp-gwmcp-gwpatches with immutable inputs, upstream attempts, and exit conditionsWhy
S1 establishes the identity foundation required before budget exhaustion and later authority work can safely issue or consume workload credentials. The key boundary is that a token is bound to the live runtime, acting user, and declared tools, while provider credentials remain keyed to the verified issuer/subject and cannot cross between users.
Evidence
cargo xtask cicargo xtask e2e-s1(e2e_s1_tool_call_as_acting_user)cargo xtask conformance --pinned— G-2 green with exactly one executed upstream negative testsub == email == principalcontract, keepsruntime_uidseparate, authorizes Bob through policy before proving the broker cannot return Alice's credential, and separately proves a missing tool grant denies before credential resolutionThe informational latest-upstream conformance lane correctly remains red while
apelogic-ai/mcp-gw#16is open; the pinned environment carries that patch and records its removal condition.Impact
This makes S1's credential-isolation claim executable and reproducible at the pinned foundation versions. It also makes removed tool authority converge by detaching the gateway provider rather than leaving stale capability attached.