@lssm-tech/integration.osint-managed-runtime
Managed infrastructure adapters shared by the OSINT API, worker, and MCP composition packages. It verifies OIDC grants against HTTPS JWKS, obtains a fresh scoped authority decision for every request or effect, and adapts the
postgres driver to the FORCE-RLS OSINT store ports.
assertManagedOsintDatabaseRoleV0 verifies the exact PostgreSQL
current_user and rejects superuser or BYPASSRLS connections. Runtime compositions use this readiness gate before dedicated rights workers can claim deletion work; application filtering never substitutes for database isolation.
Authority responses must bind the exact actor, requested scope, grants, purpose, request digest, decision evidence, and expiry. The runtime rejects widening, stale decisions, malformed bearer tokens, and credential-bearing endpoints.
createManagedOsintOperationHandlerV0 is the single managed REST/MCP handler: authorized reads use canonical scoped SQL and mutations enter the same durable queue with a canonical digest.
ManagedOsintOutboxStreamBrokerV0 turns the append-only Postgres outbox into scope-isolated SSE/WebSocket delivery. Each subscriber replays strictly after its numeric cursor under transaction-local FORCE-RLS context; malformed rows retain the cursor and surface only a redacted failure code. The API closes the poller before releasing its database pool.
Managed compositions can bind the same fail-closed runtime controls to every surface. Global, per-program, export, and research switches reject requests before SQL reads or durable queue writes. Environment-backed compositions use strict true/false values and default the global kill switch to active.
Fresh worker authority decisions retain their evidence references so downstream provider policy checks bind the exact server-side membership decision rather than treating a decision identifier as an implicit grant.
createManagedOsintTelemetryV0 emits structured lifecycle and bounded HTTP route-class logs without raw paths, entity IDs, tenants, query strings, or credentials. Metrics and traces use OpenTelemetry only when an explicit OTLP endpoint is configured; otherwise the adapter remains structured-log-only and does not activate the console exporter.
The managed self-improvement adapters reuse the same Postgres pool without transferring ownership, construct tenant/workspace-bound durable stores, and resolve a fresh, exact self-improvement authority decision for every HTTP request. Phase execution and review/evidence reads go to a credential-free HTTPS control plane with a bounded workload token and bounded response bodies. The control plane must return immutable decision/evidence receipts; malformed or denied responses fail closed. A readiness probe verifies all four durable tables and deliberately does not run migrations from a runtime role.
Proposed reviewed development resource authority
PROPOSED_NOT_ADMITTED private development resource authority: optional canonical AuthOS resource JWT/workload profiles; exact <=300-second TTL and registered resource/claim validation; durable scoped OSINT receipts preserve SAME active decisionRef and terminal expiry/revocation. Existing defaults and production RP catalog remain unchanged. Real adoption, security review, TLS/registration, canonical lifecycle/obligation/evidence adapters, migration admission and runtime qualification are required before enablement. Product entitlement is not an OSINT effect grant. No issuer, key, token, grant or database has been created or verified by this source preparation.
The proposed reviewed authority composition verifies exact single-resource access JWTs through the existing jose dependency and reads canonical AuthOS client, pairwise identity and coarse entitlement rows under the receipt SQL transaction. OSINT membership, scoped workload delegation, effect policy, controls and evidence remain in their canonical owners. Separate AuthDB reads cannot satisfy the required receipt/revocation fence. Required claim emission, real issuer/resource registration, role privileges and lifecycle races require actual qualification before admission. Original OIDC verifier defaults remain unchanged.
Proposed createSqlReviewedOsintCompositionV1 completes the canonical development wiring: real PolicyRegistry/PolicyEngine, native resource token signature verification, verified canonical-user to RP-pairwise principal projection, and same-transaction current review/resource/client/session/product-access/scope/delegation/obligation reads. Workload authorization requires a completed native registration and an exact current canonical service-principal digest. The existing durable receipt coordinator remains the sole issuer. Unsupported PII, field rules, rate limits, OPA and external policy-source enforcement deny. Review/token revokers and actor lifecycle revokers take conflicting transaction locks; workers revalidate before later effects. Existing committed effects are not reversed. This is PROPOSED_NOT_ADMITTED for an explicitly reviewed same-database development topology; no production AuthDB topology is silently changed.
Proposed local disposable custody
Local disposable custody successor: an additive V2 whole-review arm admits only the genuine Windows DPAPI CurrentUser provider, exact owner SID/owner-only ACL, local namespace/root and immutable pairwise/issuer ciphertext digests. V1 review syntax and generic SecretProvider interface remain unchanged. Only explicit local-disposable host composition admits the factory-branded provider; native signing, reserved claims, canonical SQL locks/policies and revocation remain. This source proposal is unapproved and unqualified. Source/runtime/security admission, actual DB/TLS/native key installation and mandatory real issuance, revocation/custody/cleanup acceptance remain required. No cloud backend is impersonated, production admission introduced, keys generated or review installed.
