feat(integration): land reviewed source and authorization stack on main - #143
Merged
Conversation
Define source declaration discovery and trust boundaries on the merged Source contract. Signed-off-by: Tim Nunamaker <tnunamak@gmail.com> Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com> Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com> Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com> Assisted-by: AI
Integrate the reviewed source declaration, discovery/trust, immutable consent review, and durable authorization stack from ri/source-declaration-v01 onto current main. Preserve main's current connector-admission and quality-ledger baselines while resolving the small cross-stack conflicts. #125 remains an independent UAT-health line and is not a prerequisite. Signed-off-by: Tim Nunamaker <tnunamak@gmail.com> Assisted-by: AI
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Describe unsupported persisted authorization state without treating pre-release development data as a public migration case. Keep fresh consent conditional on whether a deployment supports or explicitly migrates the state. Signed-off-by: Tim Nunamaker <tnunamak@gmail.com> Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com> Assisted-by: AI
Signed-off-by: Tim Nunamaker <tnunamak@gmail.com> Assisted-by: AI
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this brings together
This merged PR is the final source and authorization stack on
main. It combines:Spec review guide
The short version: a client receives only the source declaration and grant facts that were explicitly discovered, reviewed, and frozen at consent. The resource server authorizes from that frozen grant, not from live configuration. OAuth, introspection, replay, and migration paths preserve the same authority boundary and fail closed when required facts are missing.
For the normative documents, skim Core, Source discovery and trust, Architecture, and Deferred boundaries. The corresponding OpenSpec changes are in the PRs above.
This PR is already merged. It is the single integration reference; the stacked PRs should not be merged again. #125 and #140 are separate UAT/connector-verification work.
Assisted-by: AI