Repository navigation
Conversation
… bypass; document per-spend default
…atch); opt-in require_agent_id strict mode
…ools, durable store and ledger fold - server.py: /check and /spend accept agent_id (400 if not a non-empty string); POST /api/permits accepts approval_mode, require_agent_id, principal_id (400 on invalid); GET /api/permits/<id> exposes them. - agent/tools.py: SpendTools binds the caller agent_id at construction (defaults to the permit's agent) and passes it on every spend. - durability: grant/check/spend forward the least-privilege fields and agent_id; snapshot records them. - sqlite_ledger fold: GRANTED restores principal_id/approval_mode/ require_agent_id; DELEGATED children inherit require_agent_id.
… their caller agent_id Mechanical: every in-process spend()/check()/eligible() and HTTP /check|/spend body now passes the permit's own agent_id, as an honest caller would. No assertion changed. Unknown-permit cases stay anonymous.
… default - Permit/grant defaults: approval_mode='cumulative' (lifetime reserved + captured + amount vs threshold), require_agent_id=True (carves inherit). approval_mode='per_spend' and require_agent_id=False stay as explicit opt-outs. _evaluate (four-clause gate) unchanged. - Tests that assert per-spend or anonymous-caller behaviour now set the explicit opt-out; new tests pin the defaults (in-process, HTTP, carve inheritance, ledger fold). - README: document the new defaults and that agent_id is a caller- supplied string, not an authenticated credential.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes three least-privilege holes found by a runtime harness on
794eaa1. The four-clause gate (_evaluate) is unchanged; the new checks run outside it. Amounts remain positive integer cents.Holes and fixes
self_approval). An optionalprincipal_idat grant binds the approver (principal_mismatch).approval_mode="per_spend"remains as an explicit opt-out.require_agent_id=Trueis now the default and is inherited by child permits. Missing →agent_id_required, wrong →agent_mismatch.agent_idis carried through/check,/spend,agent/tools.py, the durable store and the ledger rebuild.Breaking HTTP API changes
/checkand/spendnow requireagent_id. Without it the response is allowed=false with reasonagent_id_required; on/spendone BLOCKED receipt is written, nothing is reserved and PayPal is not called.pending_principal_approvalonce the running total passes the threshold.POST /api/permitsaccepts optionalapproval_mode,require_agent_idandprincipal_id, with new 400s for invalid values.GET /api/permits/<id>returns them.Evidence (mock rail, local)
794eaa1).demo.py: ledger VERIFIED, 16 receipts.--fastreplay against the existing fixture: VERIFIED, 26 receipts. The fixture was not regenerated (sha256 unchanged).Known limits
agent_idand the approver are caller-supplied strings, not authenticated credentials.dashboard, so it is refused on permits that name aprincipal_id.demo_approval.py,demo_delegation.py(live LLM) and the 3 live-sandbox tests were not run.Draft. Not for merge without the maintainer's explicit approval.