refactor(plugins): Push protocol classification down to parsers

[huang195]

Summary

Move protocol-classification logic out of guardrail plugins (IBAC today) and into the parsers that own each protocol. Adds a single IsAction bool field on each protocol extension and a pctx.Classification() helper that aggregates the verdict across all populated extensions. IBAC's three protocol-specific bypass steps collapse to a single classification gate.

Why

Before: IBAC encoded MCP-protocol vocabulary inline (isMCPHousekeeping listing every housekeeping method, isTransportRetrieval for body-less GET/HEAD/OPTIONS detection, the body-less DELETE+Mcp-Session-Id check from PR #451). Every new guardrail (rate limiter, audit logger, secret scanner, …) and every new protocol (A2A subroutes, OTEL, gRPC) would multiply this work.

After: each parser owns its protocol's "is this an action vs protocol mechanics" answer; guardrails read one verdict and decide. Adding a guardrail is now zero protocol-specific work; adding a protocol's classification rules touches only that parser.

What changes

Five logical commits, each independently reviewable:

1. feat(pipeline): Add IsAction classification on protocol extensions — the wire. Adds IsAction bool to MCPExtension, A2AExtension, InferenceExtension. Adds pctx.Classification() (anyAction, anyBypass bool) aggregating across populated extensions. No behavior change yet — every parser still leaves IsAction at the zero value.

2. feat(mcp-parser): Classify methods + recognize transport via path config — the largest change. mcp-parser now:

   • Sets IsAction = true for tools/call, prompts/get, resources/read; everything else stays at default false.
   • Gains a paths config field (default ["/mcp"]) for body-less transport detection.
   • On body-less DELETE + Mcp-Session-Id on a configured path, populates a synthetic MCPExtension{Method: "$transport/terminate"} (replaces the logic from PR fix(ibac): Bypass MCP session-terminate DELETE as transport_stream #451).
   • On body-less GET on a configured path, populates a synthetic MCPExtension{Method: "$transport/stream"} (replaces the body-less GET case from PR fix(ibac): Bypass transport-layer calls and let agents take self-actions #450).
   • The $ prefix on synthetic methods is reserved (real MCP methods follow category/action with no $), so operators can tell at a glance these aren't methods that appeared on the wire.

3. feat(a2a-parser): Classify outbound A2A methods — sets IsAction = true for message/send and message/stream; protocol/discovery methods inherit default false.

4. feat(inference-parser): Mark all populated requests as actions — every populated InferenceExtension is an outbound LLM call; sets IsAction = true unconditionally. The "don't judge inference by default" decision lives separately in IBAC's judge_inference operator-config flag — classification (parser concern) and operator policy (guardrail concern) stay cleanly separated.

5. refactor(ibac): Replace inline protocol logic with classification gate — the simplification. Removes:

   • isMCPHousekeeping (now an mcp-parser concern; PR fix(ibac): Bypass MCP session-terminate DELETE as transport_stream #451's resources/subscribe/resources/unsubscribe additions follow).
   • isTransportRetrieval and the body-less DELETE+header check (now mcp-parser's synthetic transport extensions).
   • Steps 5 (mcp_housekeeping) and 5b (transport_stream) from OnRequest.

   Adds the new step 4: classification gate driven by pctx.Classification(). Updates Capabilities() to declare RequiresAny: ["mcp-parser", "a2a-parser", "inference-parser"] (pipeline boot-fails if no parser is in the chain — without one, IBAC has no classification to read and would silently no-op on every request).

End-state guardrail logic

isAction, isBypass := pctx.Classification()
if isBypass {
    pctx.Skip("protocol_mechanics")
    return Continue
}
if !isAction {
    return Continue  // defense in depth: not our traffic, pass through
}
// classified action — proceed to operator-config bypasses + intent + judge

That's it. No protocol-specific code in IBAC. Same five lines work for any future guardrail.

Test plan

• go test ./... in authbridge/authlib — all 29 packages pass.
• Per-parser classification coverage:
  • mcp-parser: per-method table covering 14 methods (3 actions + 11 housekeeping); body-less DELETE+header → $transport/terminate; body-less GET → $transport/stream; non-configured-path / no-header / body-less-POST cases all decline to claim; paths config defaults + custom + bad-glob rejection.
  • a2a-parser: classification table for message/send, message/stream, plus a representative non-action.
  • inference-parser: assert IsAction = true unconditionally.
  • pipeline: Classification() on empty pctx, single-extension action, single-extension bypass, multi-extension agreement, multi-extension mixed.
• IBAC: TestOnRequest_ClassificationBypass_ProtocolMechanics, TestOnRequest_NoClassification_PassesThrough, TestOnRequest_MCPActionReachesJudge, TestOnRequest_DescribeActionHasNoLeadingWhitespace (regression-locks the listener pctx.Method plumbing from PR fix(ibac): Bypass transport-layer calls and let agents take self-actions #450). Existing tests updated to populate IsAction explicitly where they expect to reach the judge.
• Live verification on the exgentic-a2a-tool-calling-gsm8k agent (procedure same as PR fix(ibac): Bypass transport-layer calls and let agents take self-actions #450/fix(ibac): Bypass MCP session-terminate DELETE as transport_stream #451):
  • Rebuild + push; load into Kind; restart pod; rerun ./deploy-and-evaluate.sh --benchmark gsm8k --agent tool_calling --plugin-preset ibac-only.
  • Confirm in :9094/v1/sessions/<id> that MCP setup methods record skip/protocol_mechanics, tools/call is judged, body-less GET on /mcp records skip/protocol_mechanics (synthetic $transport/stream), DELETE on /mcp with Mcp-Session-Id records skip/protocol_mechanics (synthetic $transport/terminate).
  • Compare gsm8k accuracy against pre-PR baseline — should be identical.
• Negative test: deploy a pipeline with IBAC but no parsers; expect boot failure with a RequiresAny error.

Compatibility / breaking changes

• RequiresAny on IBAC. Any existing IBAC-only pipeline (no parsers in the same outbound chain) will fail to boot after this change. Such pipelines were silently no-op anyway — IBAC had nothing to read — so the breakage catches misconfig rather than introducing it.
• No config changes for typical deployments. mcp-parser's paths config defaults to ["/mcp"], which matches the standard MCP Streamable HTTP setup used by all in-tree demos (weather-agent, github-issue, ibac). Operators with non-default endpoint paths add explicit entries.
• Wire format additive. Each protocol extension gains one JSON field (isAction); abctl renders unknown JSON opaquely so existing UI keeps working.
• #451 (still open) becomes redundant if this PR lands first. The MCP session-terminate logic moves from IBAC into mcp-parser as the synthetic $transport/terminate extension.

Out of scope (deferred)

• Lifting transport-shape detection into a shared helper or pseudo-plugin. Not needed: parsers own all classification.
• Spec-evolution lint or audit tooling for the action-method lists in each parser. Worth doing as a follow-up given default-false on IsAction means a missing entry produces silent under-judging.
• abctl visual treatment of the $-prefixed synthetic methods (a "synthetic transport" badge or different color). Functional today as opaque literal string.
• Adding classification to SecurityExtension / DelegationExtension / Custom. Those aren't protocol parsers; classification doesn't apply.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

Summary by CodeRabbit

• New Features

  • Protocol parsers now classify extensions as user "action" vs "protocol mechanics"; classifications are aggregated for guardrail gating
  • MCP parser: configurable endpoint paths, body-less transport detection, and action classification; A2A and Inference parsers surface action verdicts
  • IBAC: classification gate, configurable unclassified/no-intent policies, and boot-time requirement for at least one parser

• Tests

  • Added unit tests for classification aggregation and parser classification paths

• Documentation

  • New plugin-author classification contract and updated architecture/IBAC docs

• Chores

  • Demo config and build tweaks; demo agent now mints missing context IDs automatically

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Parsers add an IsAction boolean to MCP/A2A/Inference extensions. Context.Classification() aggregates those flags into anyAction and anyBypass. MCP/A2A/Inference set IsAction per method heuristics; IBAC uses the aggregation to skip protocol mechanics, pass through unclassified traffic, or judge actions.

Changes

Request classification contract and integration

Layer / File(s)	Summary
Extension classification contract and documentation authbridge/authlib/pipeline/extensions.go, authbridge/docs/framework-architecture.md, authbridge/docs/plugin-reference.md, authbridge/CLAUDE.md	Adds IsAction to MCPExtension, A2AExtension, InferenceExtension with contract docs; plugin-reference and framework docs describe guardrail consumption via pctx.Classification().
Classification aggregation method and tests authbridge/authlib/pipeline/context.go, authbridge/authlib/pipeline/extensions_test.go	Adds Context.Classification() returning anyAction, anyBypass by inspecting populated extensions; tests cover no-extension, action, bypass, and mixed cases.
A2A and Inference parser classification authbridge/authlib/plugins/a2aparser/plugin.go, authbridge/authlib/plugins/a2aparser/plugin_test.go, authbridge/authlib/plugins/inferenceparser/plugin.go, authbridge/authlib/plugins/inferenceparser/plugin_test.go	A2A parser tags message/send and message/stream as actions via isA2AAction(); Inference parser marks populated inference extensions as actions; tests validate both.
MCP parser configuration and method classification authbridge/authlib/plugins/mcpparser/plugin.go	Adds Configure() with path globbing and defaults, body-less transport detection (synthetic $transport/stream/$transport/terminate) scoped to configured paths, and isMCPAction() to classify JSON-RPC methods (tools/call, prompts/get, resources/read) with request logging of isAction.
MCP parser test coverage: configuration, classification, and transport detection authbridge/authlib/plugins/mcpparser/plugin_test.go	Extensive tests for default/custom paths, invalid config rejection, action-method classification table, body-less transport detection cases, and helper for applying JSON config in tests.
IBAC integration: classification-driven gating and pipeline enforcement authbridge/authlib/plugins/ibac/plugin.go, authbridge/authlib/plugins/ibac/plugin_test.go, authbridge/docs/ibac-plugin.md	IBAC Capabilities() now RequiresAny of MCP/Inference parsers; OnRequest calls pctx.Classification() to record protocol_mechanics skips for bypasses, apply unclassified_policy, pass through unclassified traffic by default, and send action-classified traffic to the judge. Tests and docs updated to reflect the new flow and no_intent_policy/unclassified_policy knobs.

Demos and tooling

Layer / File(s)	Summary
IBAC demo config patch authbridge/demos/ibac/k8s/ibac-patch.yaml	Sets unclassified_policy: "judge" in the demo outbound ibac config.
Demo Makefile freshness build authbridge/demos/ibac/Makefile	build-abctl target now rebuilds when source files are newer and runs the build from the abctl source directory.
A2A demo: session context-id minting authbridge/demos/ibac/agent/main.go	Handler now mints a UUID when params.message.contextId is omitted.

Sequence Diagram(s)

sequenceDiagram
  participant Request
  participant IBAC
  participant Classification
  participant Judge
  participant Skip
  Request->>IBAC: OnRequest
  IBAC->>Classification: pctx.Classification()
  alt anyBypass == true
    Classification->>Skip: protocol_mechanics skip
  else anyAction == false
    Classification->>IBAC: pass through (no skip)
  else anyAction == true
    IBAC->>Judge: proceed to judge/evaluate
  end

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

• kagenti/kagenti-extensions#443: Earlier work on MCP housekeeping bypass that this PR replaces with classification-driven gating.
• kagenti/kagenti-extensions#450: Related changes around transport_stream skip logic replaced by the unified classification approach.

Suggested reviewers

• pdettori
• cwiklik

Poem

🐰 I hopped through logs and parsed the play,
Flagging true actions along the way.
IsAction raised, the judge can see,
Skips the noise, lets real acts be.
Hooray — a rabbit watched the policy!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 69.05% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'refactor(plugins): Push protocol classification down to parsers' is clear and directly summarizes the main architectural change—moving classification logic from guardrails into protocol parsers.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

authbridge/docs/ibac-plugin.md (1)

29-36: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Threat-model walkthrough now contradicts the new classification gate.

This section (and the Limitations note at Lines 330-333) states that the plain-HTTP POST evil-server/collect — explicitly "plain HTTP, not MCP, not inference traffic" — is judged and denied with 403 ibac.blocked when IBAC is enabled. But the new step-4 classification gate you added above passes unclassified traffic through silently: a request with no parser-populated extension yields !anyAction and Continue without judging. As written, the headline example can no longer be caught by IBAC, so the doc is internally inconsistent.

Update the Threat Model and Limitations to reflect that IBAC now only fires on parser-classified traffic, or clarify how plain-HTTP exfiltration is expected to be classified.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@authbridge/docs/ibac-plugin.md` around lines 29 - 36, The threat-model doc is
inconsistent with the new classification gate (!anyAction => Continue) so update
the Threat Model and Limitations to state that IBAC (checked in OnRequest) only
evaluates requests that parsers populate as actions; explicitly mention that
plain-HTTP requests without parser enrichment will pass through (not be judged)
unless a parser or MCP enrichment classifies them, and adjust the example that
previously showed DenyStatus(403, "ibac.blocked") for a plain POST to either
show it being classified first (e.g., via parser/MCP enrichment) or change the
outcome to Continue; ensure references to pctx.Session.LastIntent() and the
judge LLM pathway remain accurate when describing the classified path.

authbridge/authlib/plugins/ibac/plugin_test.go (1)

290-304: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

This test no longer exercises the inference_bypass path it names.

makePCtx injects a default MCP{IsAction:true}, and this test leaves the new Inference extension at IsAction:false. In Classification() that yields anyAction=true (MCP) and anyBypass=true (Inference), so the request short-circuits at the step-4 protocol_mechanics gate and never reaches the step-5 inference-bypass branch. The assertions (Continue, calls==0) pass either way, masking the gap.

Mirror what inference-parser actually does (IsAction:true) so the request passes the classification gate, and assert the skip reason.

💚 Proposed fix

 	pctx := makePCtx(t)
-	pctx.Extensions.Inference = &pipeline.InferenceExtension{Model: "gpt-4o-mini"}
+	// inference-parser sets IsAction=true on populated extensions; keep
+	// anyBypass=false so we reach the step-5 inference operator-policy gate.
+	pctx.Extensions.MCP = nil
+	pctx.Extensions.Inference = &pipeline.InferenceExtension{Model: "gpt-4o-mini", IsAction: true}
 	action := invokeOnRequest(p, pctx)

 	if action.Type != pipeline.Continue {
 		t.Errorf("got %v, want Continue (inference bypassed by default)", action.Type)
 	}
 	if fj.calls != 0 {
 		t.Errorf("judge invoked on inference; want 0")
 	}
+	inv := lastInvocation(t, pctx)
+	if inv.Reason != "inference_bypass" {
+		t.Errorf("Invocation reason = %q, want 'inference_bypass'", inv.Reason)
+	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@authbridge/authlib/plugins/ibac/plugin_test.go` around lines 290 - 304, The
test TestOnRequest_InferenceBypassByDefault currently leaves the Inference
extension IsAction=false so Classification() treats MCP.IsAction=true and
Inference.IsAction=false as anyBypass=true and short-circuits before the
inference-bypass branch; update the test to mirror the inference-parser by
setting pctx.Extensions.Inference.IsAction = true (or construct the PCtx so the
Inference extension has IsAction:true) so the request passes the classification
gate and reaches the inference-bypass logic in OnRequest; then add an assertion
that the returned action includes the expected skip reason (verifying the
inference-bypass path was exercised) and keep the existing checks for
action.Type and fj.calls.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@authbridge/authlib/plugins/ibac/plugin_test.go`:
- Around line 290-304: The test TestOnRequest_InferenceBypassByDefault currently
leaves the Inference extension IsAction=false so Classification() treats
MCP.IsAction=true and Inference.IsAction=false as anyBypass=true and
short-circuits before the inference-bypass branch; update the test to mirror the
inference-parser by setting pctx.Extensions.Inference.IsAction = true (or
construct the PCtx so the Inference extension has IsAction:true) so the request
passes the classification gate and reaches the inference-bypass logic in
OnRequest; then add an assertion that the returned action includes the expected
skip reason (verifying the inference-bypass path was exercised) and keep the
existing checks for action.Type and fj.calls.

In `@authbridge/docs/ibac-plugin.md`:
- Around line 29-36: The threat-model doc is inconsistent with the new
classification gate (!anyAction => Continue) so update the Threat Model and
Limitations to state that IBAC (checked in OnRequest) only evaluates requests
that parsers populate as actions; explicitly mention that plain-HTTP requests
without parser enrichment will pass through (not be judged) unless a parser or
MCP enrichment classifies them, and adjust the example that previously showed
DenyStatus(403, "ibac.blocked") for a plain POST to either show it being
classified first (e.g., via parser/MCP enrichment) or change the outcome to
Continue; ensure references to pctx.Session.LastIntent() and the judge LLM
pathway remain accurate when describing the classified path.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b3aa6b65-30cc-4d8c-b86c-b3161f695d78

📥 Commits

Reviewing files that changed from the base of the PR and between b9ee2ed and 5a3c012.

📒 Files selected for processing (15)

• authbridge/CLAUDE.md
• authbridge/authlib/pipeline/context.go
• authbridge/authlib/pipeline/extensions.go
• authbridge/authlib/pipeline/extensions_test.go
• authbridge/authlib/plugins/a2aparser/plugin.go
• authbridge/authlib/plugins/a2aparser/plugin_test.go
• authbridge/authlib/plugins/ibac/plugin.go
• authbridge/authlib/plugins/ibac/plugin_test.go
• authbridge/authlib/plugins/inferenceparser/plugin.go
• authbridge/authlib/plugins/inferenceparser/plugin_test.go
• authbridge/authlib/plugins/mcpparser/plugin.go
• authbridge/authlib/plugins/mcpparser/plugin_test.go
• authbridge/docs/framework-architecture.md
• authbridge/docs/ibac-plugin.md
• authbridge/docs/plugin-reference.md

[mrsabath]

Strong refactor — pushing classification into parsers and collapsing IBAC's three protocol-specific gates into one verdict is the right shape, and the pctx.Classification() contract is clean. CI green, DCO clean across 6 commits, and the synthetic $transport/* extension idiom for body-less MCP retrievals reads well.

Must-fix (both unaddressed CodeRabbit findings)

1. authbridge/docs/ibac-plugin.md — threat model contradicts the new gate (out-of-diff, lines ~23-39 and ~320-340).

The headline IBAC scenario describes a plain-HTTP POST evil-server/collect ("plain HTTP, not MCP, not inference traffic") being denied with 403 ibac.blocked. With the new step-4 classification gate, that exact request has no parser-populated extension, so pctx.Classification() returns (false, false), the !anyAction branch fires, and IBAC Continues silently with no Skip recorded.

The operational-flow update at lines 107-145 is correct, but it didn't propagate up to the threat model walkthrough or the Limitations note. Security-relevant doc accuracy issue — readers will assume IBAC catches plain-HTTP exfiltration when the gate now lets it through.

Fix: either rewrite the headline example to use MCP-shaped exfil (mcp-parser populates an MCPExtension{IsAction:true}, IBAC actually fires) or explicitly call out plain-HTTP exfil as out-of-scope under the new gate, with a pointer to the runtime classification semantics.

2. authbridge/authlib/plugins/ibac/plugin_test.go — TestOnRequest_InferenceBypassByDefault (out-of-diff, line ~299).

makePCtx (modified in this PR) sets Extensions.MCP = {Method: "tools/call", IsAction: true} by default. The test adds Inference{Model: "gpt-4o-mini"} which leaves IsAction: false. Under the new Classification():

• MCP populated with IsAction:true → anyAction=true
• Inference populated with IsAction:false → anyBypass=true

Result: step-4 short-circuits with skip/protocol_mechanics. The step-5 inference-bypass branch is never reached. Assertions Continue + calls==0 still pass for the wrong reason. A regression in the inference-bypass logic would not be caught.

The 944838d commit fixed TestOnRequest_InferenceJudgedWhenEnabled (line ~322) but missed this sibling. Fix:

pctx.Extensions.Inference = &pipeline.InferenceExtension{Model: "gpt-4o-mini", IsAction: true}
// existing assertions ...
inv := lastInvocation(t, pctx)
if inv.Reason != "inference_bypass" {
    t.Errorf("Invocation reason = %q, want %q", inv.Reason, "inference_bypass")
}

Suggestion

Default fail-open on missing intent is a security-posture change not in the breaking-changes list.

The PR body's "Compatibility / breaking changes" section calls out RequiresAny and the additive wire-format fields, but no_intent_policy: "allow" as the new default flips the prior hardcoded 403 ibac.no_intent (fail closed) to skip/no_user_context + Continue (fail open). Operators upgrading without setting no_intent_policy: "deny" will see previously-blocked traffic now passing through. Worth a row in the breaking-changes list and a callout in ibac-plugin.md Limitations.

Inline comment below covers a smaller RequiresAny modeling concern.

Areas reviewed: Go pipeline framework (Classification, RequiresAny), plugin classification contract, IBAC refactor, mcp-parser synthetic transport extensions, threat-model doc, plugin reference doc, demo pipeline composition (demos/ibac/k8s/ibac-patch.yaml), prior CodeRabbit feedback follow-through.
Commits: 6, all signed off ✓
CI status: All 19 checks passing.

[mrsabath]

suggestion: RequiresAny validation is same-chain (per pipeline/plugin.go:65-76). IBAC runs in the outbound chain, but a2a-parser runs in the inbound chain in every in-tree config — see demos/ibac/k8s/ibac-patch.yaml:

inbound_prepend:
  - name: a2a-parser   # <-- inbound
outbound_append:
  - name: inference-parser
  - name: mcp-parser
  - name: ibac          # <-- outbound

Including a2a-parser in IBAC's RequiresAny means an outbound chain [a2a-parser, ibac] would pass the validator, but a2a-parser running outbound populates nothing IBAC reads (no Session.Intents to feed step 6). The realistic outbound parsers are mcp-parser and inference-parser.

Two options: (a) drop a2a-parser from RequiresAny (more accurate — only the parsers that actually populate extensions in the outbound chain count), or (b) keep it but document in the doc-comment block above that this entry exists only to satisfy the boot-time validator — the functional a2a-parser dependency comes from the inbound chain and remains a runtime check governed by no_intent_policy.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@authbridge/docs/ibac-plugin.md`:
- Around line 188-190: The Request Flow step 4 description is out of sync with
the new `unclassified_policy` option: update the flow text so that when
`!anyAction` you conditionally branch on `unclassified_policy` (e.g., if
`unclassified_policy == "passthrough"` then Continue silently, if `"judge"` then
fall through to the judge) instead of always continuing; reference the
`unclassified_policy` setting and the `!anyAction` check in the step text and
briefly describe both branching outcomes so operators see the runtime behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5365839d-8eae-4236-bc67-597e23cfc956

📥 Commits

Reviewing files that changed from the base of the PR and between 944838d and 2c35546.

📒 Files selected for processing (4)

• authbridge/authlib/plugins/ibac/plugin.go
• authbridge/authlib/plugins/ibac/plugin_test.go
• authbridge/demos/ibac/k8s/ibac-patch.yaml
• authbridge/docs/ibac-plugin.md

🚧 Files skipped from review as they are similar to previous changes (1)

• authbridge/authlib/plugins/ibac/plugin_test.go

[coderabbitai]

🧹 Nitpick comments (1)

authbridge/demos/ibac/Makefile (1)

119-121: ⚡ Quick win

Include module files in staleness detection for abctl rebuilds.

On Line 119, rebuild freshness only checks *.go under ../../cmd/abctl. If go.mod/go.sum changes, the binary can be stale but still be treated as up-to-date.

Suggested patch

 build-abctl:  ## Build abctl into /tmp (rebuilds when source is newer; used by show-result)
 	`@ABCTL_SRC_DIR`=../../cmd/abctl; \
+	ABCTL_MOD_DIR=../..; \
 	if [ -x /tmp/abctl-ibac-demo ]; then \
 	  NEWER=$$(find $$ABCTL_SRC_DIR -name '*.go' -newer /tmp/abctl-ibac-demo -print -quit 2>/dev/null); \
-	  if [ -z "$$NEWER" ]; then \
+	  if [ -z "$$NEWER" ] && [ ! "$$ABCTL_MOD_DIR/go.mod" -nt /tmp/abctl-ibac-demo ] && [ ! "$$ABCTL_MOD_DIR/go.sum" -nt /tmp/abctl-ibac-demo ]; then \
 	    echo "[*] /tmp/abctl-ibac-demo is up to date with the abctl source; skipping. \`rm /tmp/abctl-ibac-demo\` to force rebuild."; \
 	    exit 0; \
 	  fi; \

Also applies to: 128-128

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@authbridge/demos/ibac/Makefile` around lines 119 - 121, The staleness check
for rebuilding abctl only finds '*.go' files (variable NEWER using
$$ABCTL_SRC_DIR) so changes to go.mod or go.sum are ignored; update the find
invocation that computes NEWER (and the similar block later) to also consider
go.mod and go.sum (e.g., include -name 'go.mod' -o -name 'go.sum' or use -type f
with specific patterns) so the /tmp/abctl-ibac-demo freshness test correctly
detects module file changes and forces rebuilds when go.mod/go.sum change.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@authbridge/demos/ibac/Makefile`:
- Around line 119-121: The staleness check for rebuilding abctl only finds
'*.go' files (variable NEWER using $$ABCTL_SRC_DIR) so changes to go.mod or
go.sum are ignored; update the find invocation that computes NEWER (and the
similar block later) to also consider go.mod and go.sum (e.g., include -name
'go.mod' -o -name 'go.sum' or use -type f with specific patterns) so the
/tmp/abctl-ibac-demo freshness test correctly detects module file changes and
forces rebuilds when go.mod/go.sum change.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c48cccca-1895-4577-a74d-aea227b5e6b4

📥 Commits

Reviewing files that changed from the base of the PR and between 2c35546 and c053423.

📒 Files selected for processing (1)

• authbridge/demos/ibac/Makefile

[mrsabath]

Follow-up commits comprehensively address all prior review feedback.

Prior finding	Status
Must-fix #1: TestOnRequest_InferenceBypassByDefault passing for wrong reason	Fixed in f001507 — IsAction:true on inference + assertion on inv.Reason == "inference_bypass"
Must-fix #2: ibac-plugin.md threat model contradicts new gate	Fixed in f001507 — new unclassified_policy config knob + demo manifest opts in to "judge" + Default Security Posture doc section
Suggestion: RequiresAny cross-chain modeling	Fixed in f001507 — a2a-parser dropped from RequiresAny; doc-comment explains the cross-chain runtime dependency governed by no_intent_policy
Suggestion: no_intent_policy posture flip undocumented	Fixed in f001507 — Default Security Posture section in ibac-plugin.md covers both fail-open knobs

The new unclassified_policy config knob is the cleanest resolution to the "plain-HTTP exfil under defense-in-depth" tension — defaults to "passthrough" (clean defense in depth for production), opts into "judge" for the demo's threat-model walkthrough. New tests cover both branches plus default-validation (TestOnRequest_UnclassifiedPolicy_Judge, TestConfigure_UnclassifiedPolicy_*). Doc updates to ibac-plugin.md (Default Security Posture, Threat-coverage notes) and plugin-reference.md (Classifying requests contract) are thorough.

Unrelated demo improvements (f1e28b0 abctl rebuild-on-source-change; eec27ad mint contextId per A2A spec §6.6) are sensible and well-scoped.

Areas reviewed: Go pipeline framework (Classification, RequiresAny scope), IBAC classification gate, mcp-parser synthetic transport extensions + path config, threat-model docs, demo manifest, prior-review delta.
Commits: 9, all signed off.
CI status: All 19 checks passing.