feat(ai): authenticate proposal audit through signed gateway context

.env.example

@@ -25,6 +25,8 @@ CORS_ALLOWED_ORIGINS=http://localhost:3000
 IDENTITY_SERVICE_ORIGIN=http://127.0.0.1:4101
 PLANNING_SERVICE_ORIGIN=http://127.0.0.1:4102
 PLANNING_GATEWAY_CONTEXT_SECRET=replace-with-at-least-32-random-bytes
+AI_SERVICE_ORIGIN=http://127.0.0.1:4105
+AI_GATEWAY_CONTEXT_SECRET=replace-with-at-least-32-random-bytes
 SESSION_SECRET=replace-with-at-least-32-random-bytes
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=

CHANGELOG.md

@@ -16,6 +16,7 @@ All notable changes to LifeOS are documented in this file.
 - A bounded notification runtime that composes one PostgreSQL pool, the reminder repository, the in-app gateway, and the scheduler with exactly-once pool shutdown.
 - A production AI runtime that persists every inert proposal before returning it and exposes tenant-scoped proposal evidence and append-only accept/reject decision history.
 - Replay-safe AI proposal decisions bound to the exact workspace, actor, proposal revision digest, UUIDv4 idempotency key, and decision timestamp.
+- An authenticated same-origin AI proposal boundary that derives workspace and actor identity from the active session, signs the exact upstream method and path, and never forwards browser credentials to AI service.
 
 ### Fixed
 
@@ -29,4 +30,5 @@ All notable changes to LifeOS are documented in this file.
 
 - Planning-search upstream responses are stopped at a fixed byte limit before they can be fully buffered by the web boundary.
 - Notification persistence stores SHA-256 idempotency digests instead of raw delivery keys, validates every untrusted row, and keeps all SQL tenant-scoped and parameterized.
-- The AI production boundary accepts workspace and actor scope only through trusted headers, rejects ownership injection in decision bodies, returns credential-free problem details, and exposes no proposal apply or execution route.
+- The AI production boundary rejects direct client-selected ownership headers, verifies a short-lived HMAC-SHA-256 context bound to workspace, actor, HTTP method, and exact path, returns credential-free problem details, and exposes no proposal apply or execution route.
+- The AI web boundary consumes and bounds identity-session response streams exactly once, avoiding unbounded buffering from cloning an untrusted streamed response.

apps/ai-service/migrations/README.md

@@ -24,12 +24,16 @@ The production module exposes the inert proposal-generation route together with
 - `GET /v1/proposals/:proposalId/decisions`
 - `POST /v1/proposals/:proposalId/decisions`
 
-Every route derives workspace scope only from `x-workspace-id`. Decision append additionally requires `x-actor-id` and a closed JSON body containing `expectedContentDigest`, `idempotencyKey`, `decision`, optional `reason`, and `decidedAt`. Workspace and actor identifiers are trusted only when supplied by an authenticated gateway; direct public exposure of the AI service is not supported.
+Every route requires a short-lived signed service context produced only after a trusted proxy authenticates a session and authorizes workspace membership. The headers are `x-life-os-workspace-id`, `x-life-os-actor-id`, `x-life-os-context-issued-at`, and `x-life-os-context-signature`. The HMAC-SHA-256 payload binds canonical workspace and actor UUIDv4 values to issuance time, uppercase HTTP method, and the exact `/v1/...` path. The shared `AI_GATEWAY_CONTEXT_SECRET` must contain 32–4096 UTF-8 bytes, remain server-only, and be identical in the trusted proxy and AI service.
 
-There is deliberately no apply, execute, command, or user-data mutation route. Proposal generation persists the complete verified audit record before returning the proposal. Validation, not-found, stale-digest, conflicting replay, persistence, and unknown failures are mapped to bounded credential-free problem details.
+Direct `x-workspace-id` and `x-actor-id` headers never authorize a route. Browser cookies, bearer material, client-selected ownership fields, and the HMAC secret must never be forwarded to or exposed by AI service. Missing, malformed, stale, future-dated, method-replayed, path-replayed, or forged context fails closed before the proposal or audit application receives tenant scope.
+
+Decision append accepts a closed JSON body containing `expectedContentDigest`, `idempotencyKey`, `decision`, optional `reason`, and `decidedAt`; actor identity comes only from the verified service context. There is deliberately no apply, execute, command, or user-data mutation route. Proposal generation persists the complete verified audit record before returning the proposal. Validation, not-found, stale-digest, conflicting replay, persistence, and unknown failures are mapped to bounded credential-free problem details.
 
 ## Trust boundary
 
+The default LifeOS composition exposes same-origin `/api/ai/...` web routes. That BFF sends the opaque browser cookie only to identity-service `GET /v1/session`, derives `workspaceId` and `userId` from the validated session response, signs the exact AI request, and calls AI service without forwarding the cookie. AI service remains independently deployable behind another compatible private proxy that implements the same versioned contract.
+
 The audit schema stores only validated proposal requests, model identity, inert proposed operations, explanatory rationale, canonical SHA-256 digests, timestamps, and explicit user decisions. It has no foreign key, repository dependency, database privilege, or command surface for planning, calendar, habit, identity, notification, or other user-owned state mutation.
 
 Every proposal, workspace, decision, actor, and idempotency identifier is constrained to UUIDv4. Decision ownership carries `(proposal_id, workspace_id, proposal_content_digest)` through a composite foreign key so an accept/reject event cannot silently target another tenant or a stale proposal revision.
@@ -52,12 +56,14 @@ Destructive schema setup is permitted only through `AI_TEST_DATABASE_URL`. The U
 
 ## Validation evidence
 
-CI supplies separate application and disposable-test variables, applies the migration to an ephemeral PostgreSQL service, and verifies restart durability, deterministic reads, tenant isolation, exact decision replay, stale-digest rejection, conflicting replay rejection, append-only enforcement, bounded runtime configuration, retryable exactly-once successful shutdown, idle-client error handling, and the absence of proposal execution routes. All SQL values are parameterized and stored JSON is treated as untrusted evidence on read.
+CI supplies separate application and disposable-test variables, applies the migration to an ephemeral PostgreSQL service, and verifies restart durability, deterministic reads, tenant isolation, exact decision replay, stale-digest rejection, conflicting replay rejection, append-only enforcement, bounded runtime configuration, retryable exactly-once successful shutdown, idle-client error handling, unsigned ownership rejection, method/path replay rejection, and the absence of proposal execution routes. All SQL values are parameterized and stored JSON is treated as untrusted evidence on read.
 
-## Deferred work
+## Secret rotation and rollback
 
-Authenticated workspace and actor derivation belongs at the gateway. External model transport, prompt and context redaction, policy evaluation, model-quality evaluation, and separately authorized action execution remain independent reviewed capabilities. The audit service must not gain planning, calendar, habit, identity, notification, or generic command dependencies when those slices are added.
+This contract currently supports one active secret. Rotation requires a coordinated trusted-proxy and AI-service deployment; zero-downtime overlapping verification keys are deferred. If signer and verifier become incompatible, disable external AI proposal traffic rather than falling back to unsigned ownership headers. Secret compromise requires coordinated replacement, waiting at least the 60-second context lifetime before treating old tags as expired, and reviewing proposal/decision audit evidence for forged activity.
 
-## Rollback
+The database migration is forward-only in automated environments. An operator-approved rollback must export and verify proposal and decision evidence before dropping `ai.proposal_decision_events`, `ai.proposal_audit_records`, `ai.reject_proposal_audit_mutation()`, and the `ai` schema. Do not roll back after recording production decisions unless legal, retention, and audit requirements have been reviewed and documented.
+
+## Deferred work
 
-This migration is forward-only in automated environments. An operator-approved rollback must export and verify proposal and decision evidence before dropping `ai.proposal_decision_events`, `ai.proposal_audit_records`, `ai.reject_proposal_audit_mutation()`, and the `ai` schema. Do not roll back after recording production decisions unless legal, retention, and audit requirements have been reviewed and documented.
+External model transport, prompt and context redaction, policy evaluation, model-quality evaluation, multi-secret rotation windows, asymmetric workload identity, and separately authorized action execution remain independent reviewed capabilities. The audit service must not gain planning, calendar, habit, identity, notification, or generic command dependencies when those slices are added.

apps/ai-service/src/ai-http-boundary.test.ts

@@ -0,0 +1,297 @@
+import { createHmac } from 'node:crypto';
+import { HttpException } from '@nestjs/common';
+import { describe, expect, it } from 'vitest';
+import {
+  requireTrustedAiContext,
+  type TrustedAiContextHeaders,
+} from './ai-http-boundary';
+
+const WORKSPACE_ID = '11111111-1111-4111-8111-111111111111';
+const ACTOR_ID = '22222222-2222-4222-8222-222222222222';
+const PROPOSAL_ID = '33333333-3333-4333-8333-333333333333';
+const GATEWAY_SECRET = 'trusted-ai-gateway-context-secret-32-bytes';
+const NOW_SECONDS = 1_785_806_400;
+
+/** Creates the exact versioned HMAC expected by the AI service boundary. */
+function signContext(
+  input: {
+    workspaceId?: string;
+    actorId?: string;
+    issuedAt?: string;
+    method?: string;
+    path?: string;
+    secret?: string;
+  } = {},
+): string {
+  const workspaceId = (input.workspaceId ?? WORKSPACE_ID).toLowerCase();
+  const actorId = (input.actorId ?? ACTOR_ID).toLowerCase();
+  const issuedAt = input.issuedAt ?? String(NOW_SECONDS);
+  const method = input.method ?? 'POST';
+  const path = input.path ?? '/v1/proposals';
+  const secret = input.secret ?? GATEWAY_SECRET;
+  return createHmac('sha256', secret)
+    .update(
+      `life-os.ai-context.v1\n${workspaceId}\n${actorId}\n${issuedAt}\n${method}\n${path}`,
+      'utf8',
+    )
+    .digest('base64url');
+}
+
+/** Returns one complete context header object with optional field overrides. */
+function contextHeaders(
+  overrides: Partial<TrustedAiContextHeaders> = {},
+): TrustedAiContextHeaders {
+  return {
+    workspaceId: WORKSPACE_ID,
+    actorId: ACTOR_ID,
+    issuedAt: String(NOW_SECONDS),
+    signature: signContext(),
+    ...overrides,
+  };
+}
+
+/** Asserts one stable credential-free problem response. */
+function expectProblem(
+  operation: () => unknown,
+  expected: { status: number; title: string; code: string },
+): void {
+  try {
+    operation();
+    throw new Error('Expected trusted AI context validation to fail');
+  } catch (error) {
+    expect(error).toBeInstanceOf(HttpException);
+    const exception = error as HttpException;
+    expect(exception.getStatus()).toBe(expected.status);
+    expect(exception.getResponse()).toEqual({
+      type: 'about:blank',
+      ...expected,
+    });
+  }
+}
+
+describe('trusted AI service context', () => {
+  it('accepts an exact fresh method-and-path-bound context', () => {
+    expect(
+      requireTrustedAiContext(
+        contextHeaders({
+          workspaceId: WORKSPACE_ID.toUpperCase(),
+          actorId: ACTOR_ID.toUpperCase(),
+        }),
+        GATEWAY_SECRET,
+        'POST',
+        '/v1/proposals',
+        NOW_SECONDS,
+      ),
+    ).toEqual({ workspaceId: WORKSPACE_ID, actorId: ACTOR_ID });
+  });
+
+  it('accepts proposal and decision paths at the documented time boundaries', () => {
+    for (const input of [
+      {
+        issuedAt: NOW_SECONDS - 60,
+        method: 'GET',
+        path: `/v1/proposals/${PROPOSAL_ID}`,
+      },
+      {
+        issuedAt: NOW_SECONDS + 5,
+        method: 'POST',
+        path: `/v1/proposals/${PROPOSAL_ID}/decisions`,
+      },
+    ] as const) {
+      const issuedAt = String(input.issuedAt);
+      expect(
+        requireTrustedAiContext(
+          contextHeaders({
+            issuedAt,
+            signature: signContext({
+              issuedAt,
+              method: input.method,
+              path: input.path,
+            }),
+          }),
+          GATEWAY_SECRET,
+          input.method,
+          input.path,
+          NOW_SECONDS,
+        ),
+      ).toEqual({ workspaceId: WORKSPACE_ID, actorId: ACTOR_ID });
+    }
+  });
+
+  it.each([
+    undefined,
+    null,
+    '',
+    'too-short',
+    'x'.repeat(4097),
+    `x${String.fromCharCode(0)}y`,
+  ])('fails closed when the gateway secret is unavailable: %#', (secret) => {
+    expectProblem(
+      () =>
+        requireTrustedAiContext(
+          contextHeaders(),
+          secret,
+          'POST',
+          '/v1/proposals',
+          NOW_SECONDS,
+        ),
+      {
+        title: 'Trusted gateway context is unavailable',
+        status: 503,
+        code: 'gateway_context_unavailable',
+      },
+    );
+  });
+
+  it.each([
+    { field: 'workspaceId', value: undefined },
+    { field: 'workspaceId', value: 'workspace-a' },
+    { field: 'actorId', value: null },
+    { field: 'actorId', value: 'actor-a' },
+    { field: 'issuedAt', value: `0${NOW_SECONDS}` },
+    { field: 'issuedAt', value: 'not-a-time' },
+    { field: 'issuedAt', value: '12345678901234' },
+    { field: 'signature', value: undefined },
+    { field: 'signature', value: 'invalid' },
+    { field: 'signature', value: `${'a'.repeat(42)}!` },
+  ])('rejects malformed context field $field: %#', ({ field, value }) => {
+    expectProblem(
+      () =>
+        requireTrustedAiContext(
+          contextHeaders({ [field]: value }),
+          GATEWAY_SECRET,
+          'POST',
+          '/v1/proposals',
+          NOW_SECONDS,
+        ),
+      {
+        title: 'Trusted gateway context is invalid',
+        status: 401,
+        code: 'invalid_gateway_context',
+      },
+    );
+  });
+
+  it.each([
+    { issuedAt: NOW_SECONDS - 61, nowSeconds: NOW_SECONDS },
+    { issuedAt: NOW_SECONDS + 6, nowSeconds: NOW_SECONDS },
+    { issuedAt: NOW_SECONDS, nowSeconds: -1 },
+    { issuedAt: NOW_SECONDS, nowSeconds: Number.MAX_SAFE_INTEGER + 1 },
+  ])(
+    'rejects stale, future, or invalid clock input %#',
+    ({ issuedAt, nowSeconds }) => {
+      const issuedAtText = String(issuedAt);
+      expectProblem(
+        () =>
+          requireTrustedAiContext(
+            contextHeaders({
+              issuedAt: issuedAtText,
+              signature: signContext({ issuedAt: issuedAtText }),
+            }),
+            GATEWAY_SECRET,
+            'POST',
+            '/v1/proposals',
+            nowSeconds,
+          ),
+        {
+          title: 'Trusted gateway context is invalid',
+          status: 401,
+          code: 'invalid_gateway_context',
+        },
+      );
+    },
+  );
+
+  it.each([
+    { method: 'post', path: '/v1/proposals' },
+    { method: 'PUT', path: '/v1/proposals' },
+    { method: 42, path: '/v1/proposals' },
+    { method: 'GET', path: '/v1/proposals/' },
+    { method: 'GET', path: '/v1/proposals?workspace=other' },
+    { method: 'GET', path: `/v1/proposals/${PROPOSAL_ID.toUpperCase()}` },
+    { method: 'GET', path: '/v1/proposals/not-a-uuid' },
+    { method: 'GET', path: '/v1/proposals/decisions' },
+    { method: 'GET', path: '/v1/proposals\n' },
+    { method: 'GET', path: 42 },
+  ])('rejects noncanonical method or path %#', ({ method, path }) => {
+    expectProblem(
+      () =>
+        requireTrustedAiContext(
+          contextHeaders(),
+          GATEWAY_SECRET,
+          method,
+          path,
+          NOW_SECONDS,
+        ),
+      {
+        title: 'Trusted gateway context is invalid',
+        status: 401,
+        code: 'invalid_gateway_context',
+      },
+    );
+  });
+
+  it('rejects a noncanonical base64url spelling of a 32-byte signature', () => {
+    const alphabet =
+      'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+    const canonical = signContext();
+    const finalIndex = alphabet.indexOf(canonical[canonical.length - 1]!);
+    expect(finalIndex).toBeGreaterThanOrEqual(0);
+    expect(finalIndex % 4).toBe(0);
+    const alternateFinalCharacter = alphabet[finalIndex + 1]!;
+    expect(alternateFinalCharacter).toBeDefined();
+    const noncanonical = `${canonical.slice(0, -1)}${alternateFinalCharacter}`;
+
+    expectProblem(
+      () =>
+        requireTrustedAiContext(
+          contextHeaders({ signature: noncanonical }),
+          GATEWAY_SECRET,
+          'POST',
+          '/v1/proposals',
+          NOW_SECONDS,
+        ),
+      {
+        title: 'Trusted gateway context is invalid',
+        status: 401,
+        code: 'invalid_gateway_context',
+      },
+    );
+  });
+
+  it.each([
+    {
+      method: 'GET',
+      path: '/v1/proposals',
+      signature: signContext({ method: 'POST' }),
+    },
+    {
+      method: 'POST',
+      path: `/v1/proposals/${PROPOSAL_ID}`,
+      signature: signContext({ method: 'POST', path: '/v1/proposals' }),
+    },
+    {
+      method: 'POST',
+      path: '/v1/proposals',
+      signature: signContext({
+        secret: 'another-gateway-secret-with-32-bytes',
+      }),
+    },
+  ])('rejects method replay, path replay, or forged signature %#', (input) => {
+    expectProblem(
+      () =>
+        requireTrustedAiContext(
+          contextHeaders({ signature: input.signature }),
+          GATEWAY_SECRET,
+          input.method,
+          input.path,
+          NOW_SECONDS,
+        ),
+      {
+        title: 'Trusted gateway context is invalid',
+        status: 401,
+        code: 'invalid_gateway_context',
+      },
+    );
+  });
+});