hanzoai/cloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

request gate: name the reason two new apps reach for the request

Browse Source 
apps/engine and apps/registry landed calling cloud.Request without an entry on
the pin, so `go test .` has been red on main since. The pin is not a formality:
it exists so the next reader learns WHY an op holds its raw request instead of
its tenant, and an unexplained call site is exactly what it is built to stop.

Both are legitimate and neither is the same reason.

engine reads deployment-global platform facts — the host's accelerators, the
build's capabilities — so there is no org to scope by and principal.OrgFrom
cannot express what the gate needs: it answers with an org or refuses, and what
this wants is the one bit beside it, principal.Validated.

registry does resolve an org, and still separates two refusals OrgFrom folds
into one. "Not signed in" and "signed in with no org" have different remedies,
and on a plane where the org is a path SEGMENT of every repository name that is
the difference between "log in" and "you are in no org". The org still comes
from principal.Org, which is what makes a foreign repository inexpressible.

Co-authored-by: Hanzo Dev <dev@hanzo.ai>
This commit is contained in:
hanzo-dev
2026-07-30 23:11:51 -07:00
parent 34663c4974
commit 741215952d
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
typed_request_gate_test.go
+14
View File
@@ -187,6 +187,20 @@ var allowedRequestUses = map[string]string{
"moves off the effective org — so principal.OrgFrom would charge the org being INSPECTED for a " +
"platform admin's reading of its books. Empty off the HTTP path, where the meter no-ops rather " +
"than billing the wrong ledger.",
"apps/engine/engine.go": "caller — AUTHENTICATION with no tenant, which principal.OrgFrom " +
"cannot express at all: every op here reads a deployment-global platform fact (the host's " +
"accelerators, the build's capabilities), so there are no org-scoped rows and no org to scope " +
"by, and OrgFrom answers with an org or refuses. What the gate needs is the one bit beside " +
"it — principal.Validated — so an org-less but signed-in operator is admitted and an " +
"anonymous caller is not. ONE function, which every op asks; fails closed off the HTTP path.",
"apps/registry/registry.go": "caller — the tenancy input for every op, and it separates two " +
"refusals principal.OrgFrom folds into one. Not signed in (\"sign in to use Registry\") and " +
"signed in with no org (\"no validated org\") have different remedies, and OrgFrom's single " +
"ok bit cannot tell an operator which one they hit — on a plane where the org is a path " +
"SEGMENT of every repository name, that is the difference between \"log in\" and \"you are in " +
"no org\". The org itself still comes from principal.Org, never from an In field, which is " +
"what makes a foreign repository inexpressible. ONE function, asked by every op through " +
"owned(); fails closed off the HTTP path.",
"apps/x402/x402.go": "payerOf — the receipt lookup is scoped to the org whose LEDGER was " +
"DEBITED, which is what every settlement row is keyed on and what the Enforce middleware " +
"beside it charges. principal.Ledger folds in the SuperAdmin masquerade rule (X-User-IsAdmin " +