Graduated from D#16720 (body v12 @ 2026-08-08T19:52:47Z). Concept 3: PAT-grade auth by ADOPTING shipped substrate — authentication source, never authorization.
Context
ai/mcp/server/shared/services/AuthService.mjs ships the forge-PAT contract (NEO_AUTH_MODE ∈ local-bearer/gitlab-pat/github-pat, #12378/#12383): self-validated bearer, validated forge identity as caller identity. The fleet surface takes the same seat. Per learn/agentos/cloud-deployment/ClientAuthentication.md, forge auth establishes identity — Fleet authorization is the grant families' job (S5).
Acceptance Criteria
Contract Ledger (T3)
Surface-Anchor V-B-A per row ran at intake (2026-08-14, exact head — see the intake classification comment). ADR 0038 is the surface authority; this matrix binds it to the edit surfaces rather than restating it.
| Target Surface |
Source of Authority |
Proposed Behavior |
Fallback / Edge Case |
Docs |
Evidence |
Fleet HTTP admission (startFleetServer auth chain) |
ADR 0038 §2.5.1 row 1 + AuthService modes (verified: local-bearer/gitlab-pat/github-pat) |
Authorization: Bearer <forge-PAT> validated by the configured mode; admitted requests carry the frozen allowlisted request context (shipped S1 behavior, adopted not rebuilt) |
Missing/invalid bearer → 401 wire refusal; minted non-forge tokens refused by mode |
ClientAuthentication.md |
FleetServerComposition.spec.mjs real-server admission tests (existing, extended) |
deriveOwnerPrincipal(requestContext) — NEW, the one named seam |
ADR 0038 §2.2 fact 2 (stable subject ≠ mutable login) + D#16720 Concept 3 |
Pure derivation (authProvider, normalizedProviderBaseUrl, providerUserId) from the frozen context; stamped as THE admission subject; login retained as display projection only |
Any tuple member absent → no subject → refusal (NEVER a login fallback) |
JSDoc + ClientAuthentication.md |
Unit falsifiers incl. login-mutation invariance (login changes, principal stable) |
resolveViewerStreamKey (existing consumer) |
fleetServer.mjs (verified: keys provider:<authProvider>:<providerUserId>, no base-url element) |
Alignment decision recorded in-lane: converge onto the principal seam or document the divergence |
Unkeyable viewer → existing 403 refusal (unchanged) |
JSDoc |
Existing stream-key specs + one alignment falsifier |
Verb-class scopes (fleetServerPolicy.mjs → dispatch) — the R3 seam |
ADR 0038 §2.5.1 row 1 Scopes column (read ÷ lifecycle, distinct envelopes per verb class, never one blanket scope) |
Every wire verb classified read-observe vs lifecycle-write; the class split enforced at admission (S5's grant verbs later consume the classes) |
Unknown verb → existing unsupported-method; UNCLASSIFIED verb → fail-closed refusal |
Policy JSDoc |
Policy spec: classification total-coverage + fail-closed falsifier |
local-bearer at the fleet surface (OQ4 carrier) |
D#16720 OQ4 |
DECISION recorded in this lane (keep dev convenience vs require PAT everywhere), with rationale |
Per decision |
ClientAuthentication.md + lifecycle README |
Decision recorded + mode-gated spec |
Sequencing
Blocks S3/S4/S5 (they consume the admission identity).
Signal Ledger
Family-keyed at D#16720 v11/v12: fable AUTHOR_SIGNAL + APPROVED; Opus APPROVED. Full ledger: D#16720 closing comment.
Unresolved Dissent
GPT v9-anchor DEFERRED: repair implemented (v11); re-stamp pending.
Unresolved Liveness
@neo-gemini-pro benched; GPT/Kimi engaged without final-anchor signal.
Discussion Criteria Mapping
D#16720 criteria (1)–(9): closing comment.
Origin: D#16720 · Retrieval Hint: "fleet surface forge-PAT admission AuthService ownerPrincipal subject local-bearer decision"
Graduated from D#16720 (body v12 @ 2026-08-08T19:52:47Z). Concept 3: PAT-grade auth by ADOPTING shipped substrate — authentication source, never authorization.
Context
ai/mcp/server/shared/services/AuthService.mjsships the forge-PAT contract (NEO_AUTH_MODE∈local-bearer/gitlab-pat/github-pat, #12378/#12383): self-validated bearer, validated forge identity as caller identity. The fleet surface takes the same seat. Perlearn/agentos/cloud-deployment/ClientAuthentication.md, forge auth establishes identity — Fleet authorization is the grant families' job (S5).Acceptance Criteria
Authorization: BearerviaAuthService's existing modes — no new issuance machinery.ownerPrincipal((authProvider, normalizedProviderBaseUrl, providerUserId)— S4's build), NEVER the mutable login; login is retained as display projection only.local-bearermode decision recorded (OQ4 carrier): keep the process-bearer dev convenience or require PAT everywhere — decide + document.ClientAuthentication.md, the local-agent-os lifecycle README.Contract Ledger (T3)
Surface-Anchor V-B-A per row ran at intake (2026-08-14, exact head — see the intake classification comment). ADR 0038 is the surface authority; this matrix binds it to the edit surfaces rather than restating it.
startFleetServerauth chain)AuthServicemodes (verified:local-bearer/gitlab-pat/github-pat)Authorization: Bearer <forge-PAT>validated by the configured mode; admitted requests carry the frozen allowlisted request context (shipped S1 behavior, adopted not rebuilt)ClientAuthentication.mdFleetServerComposition.spec.mjsreal-server admission tests (existing, extended)deriveOwnerPrincipal(requestContext)— NEW, the one named seam(authProvider, normalizedProviderBaseUrl, providerUserId)from the frozen context; stamped as THE admission subject; login retained as display projection onlyClientAuthentication.mdresolveViewerStreamKey(existing consumer)fleetServer.mjs(verified: keysprovider:<authProvider>:<providerUserId>, no base-url element)fleetServerPolicy.mjs→ dispatch) — the R3 seamunsupported-method; UNCLASSIFIED verb → fail-closed refusallocal-bearerat the fleet surface (OQ4 carrier)ClientAuthentication.md+ lifecycle READMESequencing
Blocks S3/S4/S5 (they consume the admission identity).
Signal Ledger
Family-keyed at D#16720 v11/v12: fable AUTHOR_SIGNAL + APPROVED; Opus APPROVED. Full ledger: D#16720 closing comment.
Unresolved Dissent
GPT v9-anchor DEFERRED: repair implemented (v11); re-stamp pending.
Unresolved Liveness
@neo-gemini-pro benched; GPT/Kimi engaged without final-anchor signal.
Discussion Criteria Mapping
D#16720 criteria (1)–(9): closing comment.
Origin: D#16720 · Retrieval Hint: "fleet surface forge-PAT admission AuthService ownerPrincipal subject local-bearer decision"