aaronrene / knowtation public
feat BREAKING auth feat/durable-agent-auth-phase-c #3 / 4
aaronrene · 41 days ago · Jul 27, 2026 · Diff

feat(auth): Phase C scoped REST agent credentials (kt_agent_)

Implement DURABLE-AGENT-AUTH-C-b against cleared freeze: opaque kt_agent_ credentials, agent_access JWT exchange, Netlify-mounted mint/list/revoke/rotate, propose-scope REST authz, Hub UI, docs/OpenAPI, seven-tier tests 22/22. Awaiting build-verification before DONE. Trend-agent wiring follow-on.

sha256:4e0e0dd680824306e9be1023b06d40bb907b459ef1779d3991ed4c83610a253e sha
sha256:e81978a957c8e61ce6916b2848fbe96b4f6428d358c57314e51768feb1af146b parent
+47 ~48 −8 symbols
sha256:4ef7b777b9a7ccd5c68c34f7bb4e31982abaffbc8f5d5ac25a332dcda3c722cd snapshot
+47
symbols added
~48
symbols modified
−8
symbols removed
0
dead code introduced
Semantic Changes 103 symbols
~ hub/gateway/agent-credential-routes.mjs .mjs 3 symbols added
+ allowExchange function function allowExchange L34–43
+ createAgentCredentialRouter function function createAgentCredentialRouter L55–251
+ requireHumanSession function function requireHumanSession L80–95
~ hub/gateway/agent-credential-store.mjs .mjs 6 symbols added
+ createAgentCredentialStore function function createAgentCredentialStore L92–139
+ credentialFilePath function function credentialFilePath L29–32
+ getBlobStore function function getBlobStore L34–36
+ load function async_function load L52–65
+ normalizeRecords function function normalizeRecords L38–50
+ save function async_function save L67–81
~ hub/lib/agent-credential-core.mjs .mjs 16 symbols added
+ agentScopesPermitMethod method function agentScopesPermitMethod L378–389
+ applyScopeCeiling function function applyScopeCeiling L106–124
+ assertAgentVaultAllowed function function assertAgentVaultAllowed L396–402
+ cloneRecords function function cloneRecords L159–173
+ countActiveForSub function function countActiveForSub L181–187
+ hashSecret function function hashSecret L39–41
+ listCredentialsForSub function function listCredentialsForSub L334–351
+ mintCredential function function mintCredential L200–243
+ normalizeAgentRequestPath function function normalizeAgentRequestPath L358–364
+ normalizeScopes function function normalizeScopes L75–99
+ normalizeVaultIds function function normalizeVaultIds L130–153
+ parseAgentCredential function function parseAgentCredential L60–69
+ revokeCredential function function revokeCredential L290–300
+ rotateCredential function function rotateCredential L308–328
+ safeEqualHashes function function safeEqualHashes L48–54
+ verifyCredential function function verifyCredential L250–282
+ test/agent-credentials-data-integrity.test.mjs .mjs
+ test/agent-credentials-e2e.test.mjs .mjs
~ test/agent-credentials-integration.test.mjs .mjs 2 symbols added
+ sessionJwt function function sessionJwt L34–36
+ withTempStore function async_function withTempStore L21–32
+ test/agent-credentials-performance.test.mjs .mjs
+ test/agent-credentials-security.test.mjs .mjs
+ test/agent-credentials-stress.test.mjs .mjs
+ test/agent-credentials-unit.test.mjs .mjs
~ docs/AGENT-INTEGRATION.md .md 4 symbols modified
~ Agent integration — one page
~ )
~ Always-on cloud agents (Hermes / VPS) — do not paste Hub JWT as durable auth
~ table
~ docs/HUB-API.md .md 3 symbols modified
~ Knowtation Hub API
~ Authentication
~ 1 Model
~ docs/KNOWTATION-OVERSEER-HANDOVER.md .md 5 symbols added, 5 symbols removed, 2 symbols modified
~ Parallel / parked — FINISH-COMPLETE-APPLY-KN-b BV
− NEXT SESSION — DURABLE-AGENT-AUTH-C-b Auto (PRIMARY) section NEXT SESSION — DURABLE-AGENT-AUTH-C-b Auto (PRIMARY) L21–70
− Paste-ready prompt — DURABLE-AGENT-AUTH-C-b section Paste-ready prompt — DURABLE-AGENT-AUTH-C-b L44–63
− code[text] variable variable code[text] L46–62
− THE ONE NEXT STEP — Model: Auto section THE ONE NEXT STEP — Model: Auto L35–44
− table section table L37–43
+ NEXT SESSION — build-verification DURABLE-AGENT-AUTH-C-b (PRIMARY) section NEXT SESSION — build-verification DURABLE-AGENT-AUTH-C-b (PRIMARY) L21–68
+ Paste-ready prompt — DURABLE-AGENT-AUTH-C-b BV section Paste-ready prompt — DURABLE-AGENT-AUTH-C-b BV L43–61
+ code[text] variable variable code[text] L45–60
+ THE ONE NEXT STEP — Model: Thinking section THE ONE NEXT STEP — Model: Thinking L34–43
+ table section table L36–42
~ Knowtation Overseer Handover — knowtation
~ docs/KNOWTATION-ROADMAP.md .md 3 symbols modified
~ Knowtation Roadmap — knowtation
~ Build queue
~ table
~ docs/openapi.yaml .yaml
~ hub/gateway/access-token-authz.mjs .mjs 2 symbols added, 4 symbols modified
+ assertAgentVaultAllowed function function assertAgentVaultAllowed L189–194
+ isAgentAccessPayload function function isAgentAccessPayload L42–44
~ mayApplyAdminAllowlistOverride
~ resolveActorTokenClass
~ roleFromVerifiedAccessPayload
~ subFromVerifiedPayload
~ hub/gateway/server.mjs .mjs 1 symbol added, 3 symbols modified
+ getBearerPayload function function getBearerPayload L1542–1547
~ assertHostedProposalApproveDiscard
~ getUserId
~ resolveHostedActorRole
~ lib/hub-proposal-personal-self-apply.mjs .mjs 1 symbol modified
~ roleEligibleForPersonalSelfApply
~ netlify/functions/gateway.mjs .mjs 1 symbol modified
~ handler
~ web/hub/hub.js .js 3 symbols added
+ agentCredAuthHeaders function function agentCredAuthHeaders L5369–5376
+ refreshAgentCredList function async_function refreshAgentCredList L5378–5470
+ setAgentCredMsg function function setAgentCredMsg L5362–5367
~ web/hub/index.html .html 9 symbols added, 3 symbols removed, 27 symbols modified
~ details@1378
~ details@1404
~ details@1837
~ details@1844
~ details@1972
~ details@1978
~ details@2003
~ details@2163
~ details@2235
~ details@2239
~ details@2245
~ details@2251
~ details@2259
~ details@2287
~ details@2317
~ details@2331
~ details@2359
~ details@2446
~ details@2500
~ fieldset@1708
~ fieldset@1748
− details@1966 section details@1966 L1966–1971
− details@1991 section details@1991 L1991–1996
− details@1997 section details@1997 L1997–2002
+ button#btn-agent-cred-mint section button#btn-agent-cred-mint L1390–1390
+ button#btn-agent-cred-refresh section button#btn-agent-cred-refresh L1391–1391
+ details@2002 section details@2002 L2002–2007
+ details@2027 section details@2027 L2027–2032
+ details@2033 section details@2033 L2033–2040
+ h3#agent-credentials-heading section h3#agent-credentials-heading L1379–1382
+ p#agent-cred-msg section p#agent-cred-msg L1393–1393
+ pre#agent-cred-once section pre#agent-cred-once L1394–1394
+ ul#agent-cred-list section ul#agent-cred-list L1395–1395
~ details@1984
~ details@2009
~ details@2015
~ div#app
~ div#modal-settings
~ div#settings-panel-integrations
Older docs(auth): clear Phase C freeze for scoped REST agent credentials sha256:e81978a957c8e61ce6916b2848fbe96b4f6428d358c57314e51768feb1af146b All commits Newer feat(auth): Phase C BV pass — fix §8 UI + §7.4 vault choke sha256:8b4123ffa2dfc73f6457b62a855efeec1508e4f44a41cec397ae051be11cd139

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:4e0e0dd680824306e9be1023b06d40bb907b459ef1779d3991ed4c83610a253e --body "your comment"