From 4026dfec60e322f1eccd2f95bd886e63f42c8283 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 14 Nov 2026 06:22:54 +0000 Subject: [PATCH] Record the service SVID authentication decision in the Go plan The operator chose one service authentication mode on 2026-11-14 ("One auth mode can fire off", PRIVILEGED_BACKEND_AUTH_DESIGN option 2). privileged-auth stops saying no mechanism is selected: it becomes the decided migration that removes bearer and TokenReview code inside files without moving the net/peertls or identity/auth owners. The Runtime proxy grant to the Sessions binary names its service SVID. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01AYUnw7BD5YA1NAuqjeKKSm --- agentplane-organization/README.md | 8 ++++---- agentplane-organization/evidence.json | 3 ++- agentplane-organization/go-plan.json | 24 ++++++++++++------------ 3 files changed, 18 insertions(+), 17 deletions(-) diff --git a/agentplane-organization/README.md b/agentplane-organization/README.md index 8e370fd88b8..a5dc323235d 100644 --- a/agentplane-organization/README.md +++ b/agentplane-organization/README.md @@ -30,8 +30,8 @@ time. Tracks name it where their placement depends on it. with `?`. - `OPEN DIRECTION`: the move depends on a service decision nobody has made. Code under it stays where it is. -- `DEFERRED …`: an operator-deferred contract decision. Authentication and - protobuf namespace choices stay separate from ordinary organization moves. +- `DEFERRED …`: an operator-deferred contract decision. Protobuf namespace + choices stay separate from ordinary organization moves. - `retain`: the package keeps a specific responsibility and dependency boundary. It remains in scope. Retention does not mean every file in it is permanently settled or that the package has passed behavior acceptance for a new design. @@ -41,8 +41,8 @@ time. Tracks name it where their placement depends on it. Stages run in order of certainty. Stage 1 deletes leftovers; stage 2 fixes layout in components no service decision touches; stage 3 follows directions the operator agreed; stage 4 extracts responsibilities behind a local contract; -stage 5 waits on open service decisions; stage 6 holds deferred authentication -and protobuf contracts. A file moves or is renamed once: an in-component move +stage 5 waits on open service decisions; stage 6 holds the service +authentication migration, which moves no files, and deferred protobuf contracts. A file moves or is renamed once: an in-component move waits for any agreed or open boundary change that would move the same file again. Line-level cleanups stay in the task DAG's cleanup section; this plan only orders them before the moves that would carry them. diff --git a/agentplane-organization/evidence.json b/agentplane-organization/evidence.json index 5ed3b48e9f8..4f5ea1d5dc0 100644 --- a/agentplane-organization/evidence.json +++ b/agentplane-organization/evidence.json @@ -9935,7 +9935,8 @@ "The Notification Service probably splits into an inbox-holding service plus GitHub webhook processing as an actor adding messages to inboxes; the subscribe-to-a-source seam covering Actions and GitHub is unclear.", "Journals sounds like where History should eventually go; naming approved: Journal for what a harness or process emits, stored verbatim; Thread for the messaging object with editable messages. The migration is not approved work.", "The runtime-dials-Gateway connection mode was removed and the Gateway Lease is no longer particularly useful.", - "Service authentication will be made consistent; the scheme is not picked." + "Service authentication will be made consistent; the scheme is not picked.", + "Later the same day: \"One auth mode can fire off\" (PRIVILEGED_BACKEND_AUTH_DESIGN option 2: service SVIDs over mTLS for every service call; decision record in #16342)." ], "verified_at_devel": [ "runner_gateway/environments, lifecycle, internal/management and internal/view import no Gateway or Dispatcher package.", diff --git a/agentplane-organization/go-plan.json b/agentplane-organization/go-plan.json index c85285e8443..30791565d4a 100644 --- a/agentplane-organization/go-plan.json +++ b/agentplane-organization/go-plan.json @@ -100,7 +100,7 @@ "title": "Runtime calls from the Sessions binary", "status": "PROPOSED", "today": "The Dispatcher's `ProxyRunner` already calls the proxy over gRPC. The proxy admits `CreateSession`, `SubmitInput`, `ChangeModel`, `ChangeReasoningEffort` and `InterruptTurn` only from the combined Gateway/Dispatcher account, proven at startup to belong to the serving Pod (`dispatcherAccount`).", - "proposal": "The Environments proxy grants those methods to the Sessions binary's workload identity instead, and callers address the Environments Service. After gateway-connection-lease-removal; receivers before senders.", + "proposal": "The Environments proxy grants those methods to the Sessions binary's service SVID instead, per the service authentication decision, and callers address the Environments Service. After gateway-connection-lease-removal; receivers before senders.", "evidence_paths": [ "agentplane/runner_gateway/dispatcher/runner_client.go", "agentplane/runner_gateway/main.go", @@ -5964,7 +5964,7 @@ "decision": "retain", "target_paths": [], "reason": "Thirty-one production packages use this transport implementation; the accepted package home is net even while privileged authentication design remains deferred.", - "gate": "Keep peertls under net; defer mechanism decisions and preserve URI/EKU/rotation checks.", + "gate": "Keep peertls under net; the service SVID migration extends it in place; preserve URI/EKU/rotation checks.", "evidence_paths": [ "agentplane/net/peertls/BUILD.bazel", "agentplane/net/peertls/client_tls.go", @@ -11310,7 +11310,7 @@ "how": [ "After gateway-connection-lease-removal, re-inventory `internal/gateway`: the proxy, the Executor, peer authentication and Sandbox/Pod validation remain.", "Move it whole into the Environments binary as `environments/internal/runtimeproxy` (package `gateway` becomes `runtimeproxy`), served by the every-replica listener EnvironmentService brings (target binaries cut line: serving).", - "Grant the proxy's mutating methods to the Sessions binary's workload identity in place of the same-Pod account proof (`dispatcherAccount`), receivers before senders (cut line: Runtime calls).", + "Grant the proxy's mutating methods to the Sessions binary's service SVID (privileged-auth) in place of the same-Pod account proof (`dispatcherAccount`), receivers before senders (cut line: Runtime calls).", "Retarget callers: the Dispatcher's `ProxyRunner`, the app bridge, the Notification Service's `ProxyRunner` and the central sampler's Executor client. The controller's quiesce calls the Runtime directly, as its `WatchState` observer already does.", "Update RBAC, certificate identities, cdk8s and settings (code before manifests) and the README system diagram; remove the old serving path after traffic has left (cut line: rollout)." ], @@ -11491,10 +11491,10 @@ }, { "id": "privileged-auth", - "title": "Choose privileged peer authentication", - "status": "DEFERRED DESIGN", + "title": "Replace backend bearers with service SVIDs without moving the auth owners", + "status": "PLANNED", "components": ["net", "identity", "sandboxes", "env"], - "kind": "contract design; no filesystem move selected", + "kind": "decided migration across services; no filesystem move selected", "source_paths": [ "agentplane/net/peertls", "agentplane/identity/operator", @@ -11502,12 +11502,12 @@ ], "source_owner": "agentplane/net/peertls + identity + per-target clients", "candidate_target": null, - "summary": "Keep the current shared peer TLS owner at net/peertls. Later compare Kubernetes-independent service SPIFFE, audience-scoped ServiceAccount/TokenReview over pinned TLS, and explicit per-target configuration. No mechanism is selected. Operator, 2026-11-14 direction discussion: service authentication will be made consistent; the scheme is not picked (`PRIVILEGED_BACKEND_AUTH_DESIGN`).", + "summary": "Operator, 2026-11-14, `PRIVILEGED_BACKEND_AUTH_DESIGN` option 2: \"One auth mode can fire off\". Every first-party service-to-service call authenticates its caller by a service SVID over mTLS with verified server TLS; the `kubernetes_bearer` listener mode, Agentplane's TokenReview code, projected token audiences and the `tokenreviews` RBAC go, and Kubernetes authentication stays only toward the Kubernetes API. A service acting for an Identity proves itself with its certificate plus the typed delegation envelope. The app's `agentplane-agent` TokenReview bearer goes separately (operator, 05:05–05:06 UTC). The decision record is in #16342. The migration removes code paths inside files and moves none: `net/peertls` and `identity/auth` stay the owners.", "how": [ - "Inventory callers, peer identity and delegated authority separately.", - "Design the mechanism and migration/configuration surface; then choose any additional owner boundaries from that contract." + "Runs as its own staged migration, owned by the DAG node `PRIVILEGED_BACKEND_AUTH_DESIGN`: inventory, issue and mount service SVIDs, receivers admit exact service SPIFFE IDs beside bearers (#16350), callers present SVIDs after the receivers' images are pinned, then bearer admission, TokenReview and its RBAC go.", + "This plan moves no file in `net/peertls`, `identity/auth` or the listener configuration while the migration runs. The two-binary split grants the Runtime proxy's methods to the Sessions binary's service SVID (target binaries cut line: Runtime calls)." ], - "gate": "Deferred by the operator. Do not move peer TLS under identity/transport or infer an authentication decision from a path change.", + "gate": "Decided 2026-11-14. Each stage rolls on its own with its rollback stated; certificates exist before code relies on them, receivers before callers, RBAC removals last. No reorg move waits on it.", "preserve": "Role and delegation boundaries; peer URI/EKU checks, rotation and expiry closure.", "validation": [], "evidence_paths": [ @@ -11717,9 +11717,9 @@ }, { "stage": 6, - "title": "Deferred authentication and protobuf contracts", + "title": "Service authentication migration and deferred protobuf contracts", "work": ["privileged-auth", "protobuf-alignment"], - "result": "Keep existing peer TLS and wire contracts until the operator selects mechanisms and compatibility rules. Inventory callers and stored payloads as preflight, not as a naming move." + "result": "Service authentication is decided (service SVIDs over mTLS, operator 2026-11-14) and migrates in its own stages without moving files. Keep wire contracts until the operator selects protobuf namespaces and compatibility rules; inventory callers and stored payloads as preflight, not as a naming move." } ], "scope_coverage": {