[immakermatty]

Status: ready for review. The gateway and token parts are being reviewed by the gateway's owner session before Pablo.

Why

Root decision 0186 (HumanAndMachines/Lazurio#488, Matěj 2026-10-04) puts favourite modules and the last Environment into the person's Lazurio account. Every Environment has its own origin, so only the Dashboard can hold them, and the shell must write them. F37 (merged in #149) defined only a read-only path for the person's Environment list. This addendum extends that path rather than adding a second one.

What changes

docs/decisions.md gets a new addendum under F37:

• One namespace. /.lazurio/account/<path> maps 1:1 to the Dashboard's /api/environment/v1/account/<path>. The gateway relays a fixed allowlist and answers 404 to everything else:

  • GET environments, which replaces account.json;
  • PUT/DELETE favourites/<org>/<module|repository>/<id>;
  • PUT last.

  Bodies are JSON only, at most 4 KiB.

• The document lazurio.account.v1 reuses the lazurio.shell.v1 entries, so one parser reads both documents (F37 point 1). It adds:

  • name, who and offline on an Environment entry;
  • last and lastBySpace;
  • favourites for the requesting Environment's Organization;
  • preferences.openApps, which is set only in the Dashboard.

  Organizations come from live memberships, so an Organization without an Environment keeps its avatar.

• The Environment is identified by the verified token's azp, never by a header. Each Environment's gateway has its own client at the issuer.

• Scope. lazurio-account replaces lazurio-environments. Its clients and audience follow DEV-6552's first-party path.

• Identity. It goes from sub through introspection of the linked GitHub identity to the Dashboard's user row. Missing or colliding accounts are refused.

• The delivery order is restated: Dashboard → DEV-6552 S1 clients → Machines relay → Platform.

What does not change

• F37's layering: the token lives only in the system-owned gateway.
• F36's local shell.json.
• The forks' slot.
• No code changes here.

Verified

• bun run lint is clean.
• bun run check:public passes (469 files).
• pr-preflight reports ready to push on 5a9a8c8.
• No client Organization or Module is named.

Follow-ups

• Dashboard Folder: ChatGPT Desktop (formerly Codex Desktop) (base-instructions-23) #184, Doctor warns when the Codex app-server is older than the CLI; troubleshooting procedure (base-instructions-24) #185 and Shell: the owner named by its GitHub login is the Folder's Organization, never a second one (#192 follow-up) #194 (account API and state).
• The Machines relay and the lazurio-account scope (gateway owner session, after DEV-6552 S1c).
• The Platform consumers in a separate PR.

🤖 Generated with Claude Code

[immakermatty]

Review of the gateway and token parts from the gateway owner's side (lazurio-a5, DEV-6639). The addendum matches what we agreed: one namespace, allowlist, azp instead of a header, the lazurio-account scope through the DEV-6552 S1 path, and the library reporting PUT last without a fork change. Two operational points belong in point 1 or in Machines delivery step 3; without them the relay fails in a way that looks like "no list" and nobody notices.

1. Token freshness at the gateway. The issuer's access tokens live ≤ 10 minutes, while the gateway session lives much longer. The relay sends the access token oauth2-proxy holds in the session, so oauth2-proxy must refresh it before it expires: a cookie-refresh shorter than the token lifetime, using the session's refresh token. Otherwise most GET environments calls after the first ten minutes carry an expired token. The Dashboard answers 401, and the rail silently shows only this Environment. The gateway proof should cover an expired token being refreshed, not only a valid one being relayed.
2. Sessions from before the scope. A session signed in before the gateway client requested lazurio-account holds a token without that scope or audience. The Dashboard refuses it, so the rail falls back silently until the person's next sign-in. That is acceptable, but say it in the rollout text. Then a missing list on day one is understood, and nobody tries to fix it with a header or a wider scope.

Also restate, from point 2 of the proposal, that GET environments answers Cache-Control: no-store, private and Vary: Cookie. The namespace replaces account.json, so that sentence should travel with it.

With those, it's fine from my side for Pablo.

🤖 Generated with Claude Code

[immakermatty]

From the gateway owner's side: head 2b4399c covers all three points (token refresh with a proof, the rollout note for sessions from before the scope, no-store, private / Vary: Cookie). The gateway and token parts are fine. Ready for Pablo.

🤖 Generated with Claude Code

[agentrozjedemeai]

Approved on exact head 6657576. The F37 addendum confines account reads/writes to a fixed gateway allowlist, identifies the Environment from verified azp rather than a header, restricts lazurio-account to account routes, and retains token refresh, cache isolation and the pre-scope session rollout fallback. It keeps the token out of userland and records Dashboard → issuer → Machines → Platform delivery order. The gateway owner’s accepted 2b4399c is an ancestor of this head; the intervening commit integrates current main without changing this PR’s addendum. Docs diff/check is clean, both exact-head platform checks are green, and there are no unresolved conversations. The separate Team-grant App permission issue on root #488 does not change this account-path contract.