fix(auth): tell the truth about supplied command records by cursor[bot] · Pull Request #135 · ContextualWisdomLab/psychometrics-commons

cursor · 2026-08-16T15:48:28Z

Superseded

This supplied-record honesty slice is fully contained in the verified successor chain #144 → #159. Do not merge this predecessor.

Fresh ancestry evidence:

fix(auth): tell the truth about supplied command records #135 head: 80ceb23f54e93a4620a803c983d6c17669d9725c
fix(auth): stop claiming command records were store-loaded #144 is ahead by 2 commits, behind by 0.
current fix(auth): name persist landing #158 and drop leftover load claims #159 head 5ee49d86b858079cb83fcd5fe6a88932cb56395d is ahead of fix(auth): stop claiming command records were store-loaded #144 by 3 commits, behind by 0.

#159 retains the supplied-record command gate and removes remaining false store-load claims while updating the active persistence pointer. #159 remains Draft and subject to exact-head CI/security/review gates. Closing this PR does not promote successor behavior to protected-main truth.

Keep the session-authorization adapter beside the landed account-link module.

Derive the assessment-session resource from the stored participant tenant and the loaded session so a transport cannot invent a matching scope and then command a different session. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Keep the loaded session unchanged when the proof is expired or names a different session, and still fail closed on illegal lifecycle transitions. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Compare the verified actor to the loaded participant tenant and session instead of rebuilding a ResourceScope. Tenant mismatch is reported before ownership so a foreign-tenant inconsistent pair cannot hide as OwnerMismatch. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Store tenant, participant reference, anonymous status, and creation time so command authorization can load the participant instead of rebuilding it from the proof. Exact replay is idempotent; tenant or time rebinding fails closed; linked participants stay out of this slice. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Record the opened successor so architecture views do not leave the assessment-participant slice unlabeled. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

#114 already owns assessment_participant plus append-only identity-link history on migration 0021. This successor keeps the #104 command-auth contract fix and does not open a colliding anonymous-only persist slice. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Command authorization compares the verified actor to supplied participant and session values. It does not accept a ResourceScope and does not claim those aggregates were store-loaded. Align rustdoc, ADR-0003, SECURITY_AND_DATA, UML Activate, TRACEABILITY, and CHANGELOG. Use a session created after publication and before exclusive proof expiry. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Backtick the publication and exclusive-expiry instants in the command authorization fixtures, and name honesty successor #135 in TRACEABILITY. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

cursor

Review

#135 does not finish its own honesty slice.

apply_anonymous_session_command still tells callers to invoke it only after the participant and session have been loaded from the product store. authorize_anonymous_session_command still labels those arguments as store-loaded. docs/architecture/SECURITY_AND_DATA.md still says tenant comes from a ParticipantRecord supplied after a store load. The type system accepts caller-built aggregates; the gate does not prove a store read.

The same files still name superseded #114 as the persist landing. Identity persist/reload is Active PR #133. Prefer that head over #114 or #124.

The command-path tests, exclusive expiry (valid_until and valid_until + 1), and NIST SP 800-63-4 scope look correct. Keep those. Do not merge this head.

Successor: the current honesty repair on cursor/bc-fe73db53-d0af-4771-92e6-436f18f3c258-1af4. Prefer that head over #135, #118, and #104. Persist stays on #133. Session command history stays on #129. Do not start HTTP here.

_{Sent by Cursor Automation: Fix Issues}

Point command-authorization honesty at the opened successor so reviewers do not treat #135 as the landing head. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Backtick the publication and exclusive-expiry instants in the command authorization fixtures, and name honesty successor #135 in TRACEABILITY. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

#135 still said apply_anonymous_session_command ran after a store load and named superseded #114 as the persist landing. The gate compares supplied records only; persist/reload remains Active PR #133. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Point command-authorization honesty at the opened successor so reviewers do not treat #135 as the landing head. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Backtick the publication and exclusive-expiry instants in the command authorization fixtures, and name honesty successor #135 in TRACEABILITY. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Point command-authorization honesty at the opened successor so reviewers do not treat #135 as the landing head. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Backtick the publication and exclusive-expiry instants in the command authorization fixtures, and name honesty successor #135 in TRACEABILITY. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Point command-authorization honesty at the opened successor so reviewers do not treat #135 as the landing head. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

* test(auth): bind anonymous proof to exact session resource * feat(auth): bind anonymous proof to exact session resource * feat(auth): expose anonymous session authorization * style(auth): apply rustfmt to anonymous authorization tests * test(auth): pin anonymous denial precedence * docs(auth): explain anonymous session authorization * feat(auth): authorize anonymous commands from loaded session Derive the assessment-session resource from the stored participant tenant and the loaded session so a transport cannot invent a matching scope and then command a different session. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * feat(auth): apply session commands only after anonymous authorization Keep the loaded session unchanged when the proof is expired or names a different session, and still fail closed on illegal lifecycle transitions. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * fix(auth): classify anonymous commands from loaded records Compare the verified actor to the loaded participant tenant and session instead of rebuilding a ResourceScope. Tenant mismatch is reported before ownership so a foreign-tenant inconsistent pair cannot hide as OwnerMismatch. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * feat(participant): persist anonymous assessment identity Store tenant, participant reference, anonymous status, and creation time so command authorization can load the participant instead of rebuilding it from the proof. Exact replay is idempotent; tenant or time rebinding fails closed; linked participants stay out of this slice. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * docs(traceability): name Active PR #118 for participant persist Record the opened successor so architecture views do not leave the assessment-participant slice unlabeled. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * revert(participant): leave persist/reload on Active PR #114 history on migration 0021. This successor keeps the #104 command-auth contract fix and does not open a colliding anonymous-only persist slice. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * fix(auth): tell the truth about supplied command records Command authorization compares the verified actor to supplied participant and session values. It does not accept a ResourceScope and does not claim those aggregates were store-loaded. Align rustdoc, ADR-0003, SECURITY_AND_DATA, UML Activate, TRACEABILITY, and CHANGELOG. Use a session created after publication and before exclusive proof expiry. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * fix(auth): satisfy clippy doc-markdown on command timeline Backtick the publication and exclusive-expiry instants in the command authorization fixtures, and name honesty successor #135 in TRACEABILITY. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * fix(auth): stop claiming command records were store-loaded and named superseded #114 as the persist landing. The gate compares supplied records only; persist/reload remains Active PR #133. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * docs(traceability): name honesty successor Active PR #144 Point command-authorization honesty at the opened successor so reviewers do not treat #135 as the landing head. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * fix(auth): name persist landing #147 and drop leftover load claims The command gate still compares supplied records. Docs and the architecture contract now name Active PR #147 for persist/reload, forbid the leftover #133 pointer, and stop saying the gate authorized from loaded records. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * docs(traceability): name honesty successor Active PR #159 Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * fix(auth): name persist landing #158 instead of superseded #147 Identity persist/reload landing moved to #158. Keep the command gate honest about supplied records and stop pinning the leftover #147 pointer. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * fix(auth): drop closed #158 persist landing and loaded names Name persist/reload as Target, forbid the closed pointer, and call command-test records supplied. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * docs(traceability): name honesty successor Active PR #225 Record the opened successor so architecture views do not leave the command-auth honesty slice labeled as closed #159. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * fix(auth): keep anonymous authorization after rebase onto main Preserve account-link and anonymous-credential modules beside the session-command authorization entry point so this honesty head stays mergeable without claiming participant persist on this branch. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> * docs(traceability): drop merged Active PR leftovers after rebase After rebasing onto 0c695b9, exclusive outbox leases, observation clocks/membership, and claim-next scoring-job poll are protected-main truth. Keep #225 as the Active PR for supplied-record anonymous command authorization. Persist/reload of assessment_participant remains Target. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com> --------- Co-authored-by: Seongho Bae <me@seonghobae.me> Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

seonghobae and others added 15 commits August 16, 2026 10:41

test(auth): bind anonymous proof to exact session resource

c728de7

feat(auth): bind anonymous proof to exact session resource

0bf3f3d

feat(auth): expose anonymous session authorization

cddef86

style(auth): apply rustfmt to anonymous authorization tests

ed6978b

test(auth): pin anonymous denial precedence

d2beee7

docs(auth): explain anonymous session authorization

16e7283

merge(main): reconcile anonymous session authorization after #85

00d7000

Keep the session-authorization adapter beside the landed account-link module.

docs(traceability): name Active PR #118 for participant persist

53ae118

Record the opened successor so architecture views do not leave the assessment-participant slice unlabeled. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

cursor Bot requested a review from seonghobae August 16, 2026 15:49

This was referenced Aug 16, 2026

fix(session): reject stale shorter command history on persist #129

Closed

feat(narrative): assign Personality Style from scored Big Five #141

Closed

cursor Bot commented Aug 16, 2026

View reviewed changes

cursor Bot mentioned this pull request Aug 16, 2026

fix(auth): stop claiming command records were store-loaded #144

Closed

This was referenced Aug 16, 2026

fix(identity): recover participant from unterminated history #133

Closed

fix(auth): name persist landing #158 and drop leftover load claims #159

Closed

seonghobae mentioned this pull request Aug 16, 2026

fix(auth): classify anonymous commands from loaded records #118

Closed

seonghobae closed this Aug 16, 2026

cursor Bot mentioned this pull request Aug 16, 2026

fix(auth): drop closed #158 persist landing and loaded names #225

Merged

Navigation Menu

fix(auth): tell the truth about supplied command records - #135

fix(auth): tell the truth about supplied command records#135
cursor[bot] wants to merge 15 commits into
mainfrom
cursor/bc-a06c72bc-693c-4244-b4bd-997b164f1ed7-75da

cursor Bot commented Aug 16, 2026 •

edited by seonghobae

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

cursor Bot commented Aug 16, 2026 • edited by seonghobae Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Superseded

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cursor Bot commented Aug 16, 2026 •

edited by seonghobae

Loading