feat(auth): add SPIFFE supervisor authentication#1414

Draft

TaylorMutch wants to merge 12 commits into

tmutch/per-supervisor-authnfrom

tmutch/supervisor-authn-spiffe

Commits on May 15, 2026

refactor(server): introduce Authenticator trait and Principal enum
TaylorMutch
committed
feat(server): gateway-minted sandbox JWTs and IssueSandboxToken RPC
TaylorMutch
committed
feat(server)!: per-sandbox JWT identity over Bearer (wire break)
TaylorMutch
committed
fix(sandbox): strip supervisor-only credentials from entrypoint env
TaylorMutch
committed
fix(server): per-handler sandbox_id equality check (closes #1354)
TaylorMutch
committed
feat(server): RefreshSandboxToken RPC + sandbox refresh loop
TaylorMutch
committed
feat(server): make K8s ServiceAccount bootstrap token TTL configurable
TaylorMutch
committed
feat(server): JWKS-based K8s ServiceAccount token validation
TaylorMutch
committed
fix(server): three sandbox-identity issues found during helm exercise
TaylorMutch
committed
feat(sandbox): openshell-sandbox debug-rpc subcommand for end-to-end testing
TaylorMutch
committed
fix(helm): mount sandbox JWT keys without TLS
TaylorMutch
committed
feat(auth): add SPIFFE supervisor authentication
TaylorMutch
committed