Skip to content

docs(iam): WS event org filtering — intent, spec, plan (#3679) - #3683

Draft
olafkfreund wants to merge 24 commits into
mainfrom
docs/3679-ws-event-org-filtering
Draft

docs(iam): WS event org filtering — intent, spec, plan (#3679)#3683
olafkfreund wants to merge 24 commits into
mainfrom
docs/3679-ws-event-org-filtering

Conversation

@olafkfreund

@olafkfreund olafkfreund commented Nov 7, 2026

Copy link
Copy Markdown
Owner

Intent, spec and plan for #3679: org filtering on the /ws/events feeds in AIFactory, PFactory and TFactory.

What I measured: none of the three factories has a caller of send_to_org, so every /ws/events event was broadcast to every org.

The user decided (2026-11-07):

  • ship broadcast filtering first, and defer the multi-org cockpit key;
  • send org-less events only to the user who started them;
  • re-check acw_ keys every 5 minutes;
  • option A: acw_ key sockets are always confined to their org, and JWT sockets follow each factory's REST mode.

Reviews:

  • codex: confirmed findings fixed at each stage (intent 6 of 7, spec 6 of 7, plan 5 of 7).
  • agy: on the intent it restated the intent with no findings. On the spec it failed twice: "jetski: no output produced — a tool required the "command" permission that headless mode cannot prompt for, so it was auto-denied." On the plan, all its findings were refuted against the code.

Status: draft. Implementation was stopped by the user at the 16:01 deadline; see "Stopping point" in the plan. It builds on Factory#3680 (this branch is cut from it), so merge after it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1

olafkfreund and others added 24 commits November 7, 2026 14:48
@olafkfreund @claude
docs(intent): draft 2026-11-07-312-cockpit-scoped-keys (#312)
6944e6f 
Refs #312

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(intent): address codex review on 2026-11-07-312-cockpit-scoped-k…
3cc9c54 
…eys (#312)

Refs #312

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(intent): approve 2026-11-07-312-cockpit-scoped-keys (#312)
bfb07ce 
Approved unseen by user 2026-11-07, bulk run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(spec): draft 2026-11-07-312-cockpit-scoped-keys (#312)
e46a700 
Refs #312

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(spec): TFactory has no org routing (#312)
2355e8d 
Refs #312

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(intent): amend 2026-11-07-312-cockpit-scoped-keys WS constraint (#…
78716d6 
…312)

Codex spec review: /ws/events broadcast/user scopes and TFactory's feed do
not filter by org for any principal, so 'never more than REST' was not
enforceable without a routing rewrite. State the enforceable boundary and
name the pre-existing gap. Re-approved unseen by user 2026-11-07, bulk run.

Refs #312

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(spec): address codex review on 2026-11-07-312-cockpit-scoped-keys (
bbd835a 
#312)

Reuse the REST principal builders, cover the rmux caller, independent WS
exception policy, delivery-level org test, name the unfiltered paths.

Refs #312

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(spec): approve 2026-11-07-312-cockpit-scoped-keys (#312)
67dbe4a 
Approved unseen by user 2026-11-07, bulk run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(plan): draft 2026-11-07-312-cockpit-scoped-keys (#312)
90f0e08 
Refs #312

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(plan): address codex/agy review on 2026-11-07-312-cockpit-scoped…
39cadef 
…-keys (#312)

Refs #312

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(plan): approve 2026-11-07-312-cockpit-scoped-keys (#312)
d55a4f1 
Approved unseen by user 2026-11-07, bulk run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(plan): operator checklist — a scoped key covers one org (#312)
4186361 
Deviation found by the final Opus review: keys are org-bound at mint, so
membership in many orgs does not widen the cockpit's view.

Refs #312

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(intent): draft 2026-11-07-3679-ws-event-org-filtering (#3679)
c6096e3 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(intent): address codex review on 2026-11-07-3679-ws-event-org-fi…
691880b 
…ltering (#3679)

TFactory lacks the #312 narrowing too; relay is Redis/Postgres/local per factory;
initiating-user option for auth events; revocation question; softer compat wording.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(intent): record owner decisions for 2026-11-07-3679-ws-event-org…
de29074 
…-filtering (#3679)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(intent): approve 2026-11-07-3679-ws-event-org-filtering (#3679)
5bef8bd 
Approved unseen by user 2026-11-07, bulk run wave 2. Owner decisions recorded in the previous commit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(spec): draft 2026-11-07-3679-ws-event-org-filtering (#3679)
de5b47c 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(spec): address codex review on 2026-11-07-3679-ws-event-org-filt…
89e5443 
…ering (#3679)

Single delivery predicate (key org wins over org_ids), legacy broadcast relays
filtered, service-initiated logins, key sockets fail closed on user events,
notify_org org override, emitter-level tests. Shadow-mode question pending owner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(spec): record user decision (option A) for 2026-11-07-3679-ws-ev…
9f0f2f7 
…ent-org-filtering (#3679)

JWT sockets follow REST mode (AIF strict; PF/TF strict only with
RBAC_ENFORCE_TASK_ROUTES); key sockets always strict; flag test added.
Residual: PF/TF shadow mode JWT users still receive unresolved events.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(spec): approve 2026-11-07-3679-ws-event-org-filtering (#3679)
a889d47 
Approved unseen by user 2026-11-07, bulk run wave 2. Shadow-mode design choice (option A) made by the user 2026-11-07.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(plan): draft 2026-11-07-3679-ws-event-org-filtering (#3679)
c42bd23 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(plan): address codex review on 2026-11-07-3679-ws-event-org-filt…
f2bfe71 
…ering (#3679)

Endpoint-level and same-socket flag tests, cache/notify_org/raising-validator
cases, absolute venv paths for worktrees, honest TF scope and rollback.
agy findings checked against code: all refuted (see PR).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(plan): approve 2026-11-07-3679-ws-event-org-filtering (#3679)
09ee467 
Approved unseen by user 2026-11-07, bulk run wave 2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1
@olafkfreund @claude
docs(plan): record stopping point for 2026-11-07-3679-ws-event-org-fi…
cc121f0 
…ltering (#3679)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@olafkfreund