kami/correx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(retro): record cross-session grants (PROJECT/GLOBAL) + revoke

Browse Source 
c36d41b + 8df0ec7, with the cross-session live-QA gate noted.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
kami
2026-06-21 22:36:06 +00:00
parent 8df0ec750c
commit 67855d8593
1 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
RETRO.md
+21
View File
@@ -7,6 +7,27 @@ could not be run here.
---
## 2026-06-21 — wider grants + revoke (branch `feat/backlog-burndown`)
Operator-requested (not a prior BACKLOG item): grants that outlive a single session, plus a
revoke path. Two commits, each compiled + unit-tested green.
| Commit | What |
|--------|------|
| `c36d41b` | **Cross-session grant scopes (PROJECT/GLOBAL) + revoke.** `GrantScope.GLOBAL(toolName)` added; `PROJECT` made tool-bound. Engine `scopeMatches`: GLOBAL matches the bound tool anywhere, PROJECT when the session's `projectId` (derived from the bound workspace root via `ProjectIdentity.of`) AND tool match. New reserved `GRANT_LEDGER_SESSION_ID` stream holds PROJECT/GLOBAL grants; the approval gate unions the ledger's grants with the session's. `RevokeGrant` → `ApprovalGrantExpiredEvent` on the ledger (reducer already drops it); `ListGrants`/`GrantList` expose the active standing grants. **Server-side T2 grant ceiling removed** per operator request — a grant may now authorize any tier (incl. T3/T4); tool-binding is the remaining guard. New `GrantScopeMatchingTest` (5). |
| `8df0ec7` | **TUI: scope picker (A) + standing-grants viewer.** `A` (approve-always) opens a session/project/global picker (SESSION default = old behaviour); `p`/`g` create wider grants. `grants` palette command + `G` shortcut open `OverlayGrants` listing scope/tool/tiers/path with `x`/enter to revoke. `protocol.go`: `TypeGrantList`+`GrantDto`, `RevokeGrant`/`ListGrants` encoders. Both overlays rendered via `cmd/preview` (kinds `grants`, `grant-scope`). |
**Why the design:** session grants are event-sourced per-session and die with the session;
project/global grants must outlive any one session, so they live in a dedicated ledger stream
the gate folds in — keeps grants in the audit log (invariant #9) rather than config.
**⚠️ Live-QA gate (move out of RETRO once passed):** unit tests cover the engine matching,
reducer, and ledger fold, but the *cross-session* behaviour — create a GLOBAL/PROJECT grant in
session A, confirm a **different** session B auto-clears that tool, then revoke and confirm it
prompts again — needs a running server + model. Not runnable in this sandbox.
---
## 2026-06-20 — backlog burndown (branch `feat/backlog-burndown`)
Nine tracks, each compiled + unit-tested green before commit.