Add scoped authentication tokens (inline role on create_authentication_tokens) - #2176

Merged

kriszyp merged 15 commits into

mainfrom

kris/create-token-scoped-role

Aug 21, 2026

Commits on Aug 21, 2026

Support minting scoped authentication tokens from an inline role object

kriszyp
and
claude
committed
e43cc26
Document scoped tokens and the synthetic-role identity invariant in DESIGN.md

kriszyp
and
claude
committed
eeda69c
Address cross-model review: SQL allowlist gate, expired-token rethrow, bounded synthetic memo

kriszyp
and
claude
committed
b911af5
Address round-2 review: attribution collision, allowlist scope docs, stub-free tests

kriszyp
and
claude
committed
79b3e15
Address round-3 review: persist scoped identity on last wills, plain-require test module

kriszyp
and
claude
committed
1ce4493
Address round-4 review: scoped tokens in live-subscription rechecks

kriszyp
and
claude
committed
3600464
DESIGN.md: record both handled by-name rehydration sites

kriszyp
and
claude
committed
4b93111
Address round-5 review: block scoped-token self-mint, add recheck regression coverage

kriszyp
and
claude
committed
17ffce7
Address round-6 (cursor-grok): guard third by-name site + will-expiry symmetry

kriszyp
and
claude
committed
45c0c73
Address round-7 (cursor-grok): key will expiry off the persisted principal

kriszyp
and
claude
committed
20fba85
Address final-pass review: scoped will publishes under its embedded role

kriszyp
and
claude
committed
cbabf77
Polish (final-pass minors): loop-abort, fail-closed expiry, storage-safe will

kriszyp
and
claude
committed
5f7f9d9
Trim will-context comment to the invariant (review nit)

kriszyp
and
claude
committed
bc2da04
Canonicalize permission keys before hashing the synthetic role name

kriszyp
and
claude
committed
29ce44c
Trim canonicalJSON docstring to the load-bearing invariant (review nit)

kriszyp
and
claude
committed
9cf83f4

Navigation Menu

Uh oh!

Add scoped authentication tokens (inline role on create_authentication_tokens) - #2176

Add scoped authentication tokens (inline role on create_authentication_tokens)#2176
kriszyp merged 15 commits into
mainfrom
kris/create-token-scoped-role

Commits on Aug 21, 2026

Support minting scoped authentication tokens from an inline role object

Document scoped tokens and the synthetic-role identity invariant in DESIGN.md

Address cross-model review: SQL allowlist gate, expired-token rethrow, bounded synthetic memo

Address round-2 review: attribution collision, allowlist scope docs, stub-free tests

Address round-3 review: persist scoped identity on last wills, plain-require test module

Address round-4 review: scoped tokens in live-subscription rechecks

DESIGN.md: record both handled by-name rehydration sites

Address round-5 review: block scoped-token self-mint, add recheck regression coverage

Address round-6 (cursor-grok): guard third by-name site + will-expiry symmetry

Address round-7 (cursor-grok): key will expiry off the persisted principal

Address final-pass review: scoped will publishes under its embedded role

Polish (final-pass minors): loop-abort, fail-closed expiry, storage-safe will

Trim will-context comment to the invariant (review nit)

Canonicalize permission keys before hashing the synthetic role name

Trim canonicalJSON docstring to the load-bearing invariant (review nit)