Repository navigation
Per-connection project, provider and model access — simple v1 #1
Description
Connection access — approved simple v1
Approved by user on 2026-10-11. Supersedes broader scoped-tool plan. Canonical tracking: alimek/t3code #1. Implement sequential small testable sessions and stacked fork PRs. Existing source-accepted stack PR16–28 is retained, not undone or restacked now. Restricted issuance stays CLOSED until final activation and integrated validation.
Product
Trusted friends pair separate devices to one server. Owner chooses projects and configured providers, then all or selected canonical models within each provider. Friends see selected projects and their active/archived threads, create threads and reply under existing action permissions. Web, desktop and native mobile share history/output through existing sync and message queue.
Access belongs to a connection/device, not a person. Existing connection names and environment permission switches remain. Project/provider/model grants intersect existing scopes. All includes future additions; explicit IDs include only selected resources; empty explicit lists deny. Deleted/unavailable IDs never authorize replacements. Legacy unrestricted connections retain current behavior. Invitation/exchange/reconnect cannot widen authority.
Project grants control T3 visibility/access. Provider/model grants control new execution, not reading history in a visible project. Native agent filesystem/shell tools, independent logins and native provider subagents stay trusted; no OS sandbox or activity policing.
Simple v1 tool policy
A resource-restricted connection has any explicit project or provider selection, even if that selection currently includes every resource. Empty explicit lists are restricted. Legacy/null grants and projects=all/providers=all remain resource-unrestricted; existing action scopes still apply.
Resource-restricted connections can use the basic project/thread/chat/history/queue/reply/model and permitted-file/attachment flows. Additional T3 tools are unavailable: general Git/VCS/PR operations and subscriptions, T3 MCP/toolkit/delegation, scheduled tasks/webhook management, terminal UI, browser/device control, host settings/admin/import/discovery, unregistered clone/lookup and external MCP OAuth approval. Use explicit server-side denial, not a new policy framework. Safe version/environment identity and allowed catalog descriptors remain available. UI hides/disables denied features with a concise explanation.
Already accepted scoped Git/PR read/cache guards remain as defense and owner-compatible behavior; no new final eleven-write preflight implementation is required for restricted callers. Static historical links/checkpoint diffs inside an admitted thread remain ordinary history; they must not trigger a general Git/PR API or expose another project. Internal checkpointing/Git work required for an admitted coding run remains supported. Automatic helpers must respect actual model selection or use local fallback.
Restricted-origin runs must not acquire/reuse unrestricted T3 MCP authority. v1 denies T3 MCP instead of implementing nested delegation inheritance. Public device/OAuth/tool routes deny through policy stage; durable run/provider credential reuse is checked in stage08. Native provider tools remain outside T3 grants. Owner/unrestricted T3 tools and scheduled jobs keep existing behavior.
Required server guarantees
Hidden projects, threads, titles, paths, snippets and references stay absent from snapshots, archives, searches, streams, direct reads and replay. Cross-project source/target operations and receipts enforce current participating owners before hydration/materialization and SQL commits. Existing accepted PRs preserve these guards.
Permitted direct files and attachments remain usable. Guessed hidden IDs, stolen pending uploads, arbitrary host paths, traversal/symlink escapes and stale restricted signed URLs fail. Outside-root outputs are shared via ordinary admitted attachments, not arbitrary host-file access. Grant changes remove hidden state and reject stale access.
Before accepting launch/create/reply/model change/retry/continuation, resolve actual configured provider instance and canonical model including defaults/custom aliases, then intersect grant and action scope. View-only cannot operate. Friends queue their own allowed turn while another device runs; they cannot steer or answer another device's execution requests. Pure stop/cancel remains permitted under existing project/operate permission. Forbidden-provider history stays readable.
Accepted queued/preparing/running work stores its device anchor/admission ceiling in existing durable flow. Deferred start, queue promotion, retry/recovery/restart, runtime continuation and helpers intersect current live authority. Narrow/revoke cancels affected pending work and interrupts affected device-origin active runs, leaving other devices' authorized work alone. Grant expansion does not broaden previously accepted work. No generic provenance ledger. Work already executed by native tools is not undone.
Clients and activation
Shared client state refreshes self-authority and prunes hidden projects/details/assets and stale cache writes after cuts/reconnect. Cache identity distinguishes connections; old cached state cannot resurrect hidden data. Preserve permitted-project drafts where safe. Server remains authoritative for modified/older clients.
Connections settings expose existing name/scopes plus projects and nested provider/model selection, all/explicit/empty, pairing and inspect/edit/revoke. Allowed provider/model pickers and all launch/reply paths work on web/desktop/mobile. Extra tool UI is unavailable to restricted friends; no new role matrix, attribution, quotas or accounts.
Owner + friend integrated test on isolated server: A/B projects, active/archived history, multiple configured instances/models; A-only visibility/guessed-ID denial, allowed creation/reply/queue, forbidden actual/default model, scope-denied writes, cuts/revoke, stale cache/reconnect, assets, denied extra tools, ordinary owner behavior. Primary coordinator runs authorized real web/desktop/mobile pass once after integration; slice sessions do not launch servers/devices/providers.
Delivery and tracking
Remaining sequential stages:05 tool denial/catalog,06 files/assets,07 actual execution admission,08 durable authority/MCP denial,11 shared client state,12 web/desktop controls,13 mobile parity,14 activation/integrated verification. Old04c4 granular PR write scope is superseded by05 denial. Old09 restricted MCP inheritance and10 separate automation implementation are removed from v1; their minimum denial is explicitly owned by05/08. #5 remains open until its accepted direct-access stack plus05 final tool disposition integrate.
One fork PR per bounded stage from previous exact source-accepted head; configured Git identity, no attribution/trailers. Review each substantive stage once along Standards/Spec, return concrete fixes together. Routine convention fixes stay in the same stage; no new ticket for a method count or two-line repair. Focused meaningful tests, touched lint/format/named typechecks only. No repo-wide checks, live userdata, paid/live providers or competing dev servers. Plans/artifacts stay outside repo; canonical progress lives in GitHub issues. Source acceptance is not merge/fullCI; close implementation issues after integration/verification. Superseded planning issues may close not-planned, explicitly not counted as implemented.
Final fork integration precedes separate coherent upstream branch/PR, subject to maintainer scope approval and user direction. No upstream submission now. No activation until every enabled path is protected or explicitly denied.
Deferred v2: scoped Git/PR/terminal tools, restricted T3 MCP/delegation/automation support, person accounts/OIDC, isolated provider credentials, OS sandbox, message attribution and new roles/quotas.
Current execution
Source-accepted PR16–28 (13 stages), currenthead2c2b81e1236e8c1c5e0cdeaf982e86295745e241; unmerged. #2/#3/#4 source ready; #5 accepted direct-access parts await05 final tool denial and integration.
- [05] Connection access: Deny extra tools in v1; filter provider metadata #6 — V1 tool denial and allowed catalog
- [06] Connection access: Authorize files, uploads and signed assets #7 — Files, uploads and signed assets
- [07] Connection access: Admit actual provider and model #8 — Actual provider/model admission
- [08] Connection access: Durable run authority and restricted MCP denial #9 — Durable origin, cuts and restricted MCP denial
- [11] Connection access: Shared client authority and cache pruning #12 — Shared client authority/caches
- [12] Connection access: Web/desktop sharing controls #13 — Web/desktop connection controls
- [13] Connection access: Mobile sharing parity #14 — Mobile parity
- [14] Connection access: Activate simple v1 and integrated verification #15 — Activation and integrated proof
#10 (scoped MCP inheritance) deferred; #11 separate automation implementation superseded by#6 denial. Both closed not-planned/superseded, not completed feature counts. Remaining active stages above. Latest measured budget23%,two credits,no reset.
Activity
[-]Draft spec: per-connection project, provider and model access[/-][+]Per-connection project, provider and model access[/+]6 remaining items
alimek commentedon Oct 11, 2026
Coordinator approved minimum TWO04c3 boundaries after source audit:04c3a all34 service/owner/routing/cache/transport/common-write entry in existing prepared session;04c3b delayed per-entry batches/credentials/cache-lock effects and typed fallback in a separate successor after exact04c3a review. Entire04c3 still required. Final11writes04c4 base becomesaccess/04c3-pr-read-effects;05baseunchanged. No implementation at checkpoint; exact6074a729 clean. #5OPEN/gateCLOSED, no merge/restack or full enforcement claim. Budget33%, no reset. Concrete approved plan in issue body; external ticket-04c3-coordinator-split.md.
alimek commentedon Oct 11, 2026
Coordinator exact-source review ofPR26 at
b4d2dda1efbfac67617c6ac7852a7a06297d9d70: Standards1P3, Spec0. Only repair: newlistStats schema-predicatecatchIf atPullRequestService.ts3862 violates documented whole-channel catching convention; useEffect.catch with explicit authorization passthrough/ordinaryNone. Full29paths independently reviewed on both axes. Coordinator202/202 service+linked testsPASS. Same ordinary session repairs narrow site then exactre-review; no04c3b yet. Entire04c3 incomplete untilB. #5OPEN/gateCLOSED, CIsubstantivequeued, OPEN/unmerged/no restack. Quota32%, noreset. External ticket-04c3a-review.md records exact evidence.alimek commentedon Oct 11, 2026
04c3a source accepted at
0668bc7a3890c6caaa6292696e026bd39c224c33/ PR26, unchanged accepted base6074a7298885cf7b65c8476010c59611a0dac5cb. Standards0/Spec0 repair re-review. Whole-channel listStats recovery preserves typed denial and ordinary fallback; coordinator selected6/6 controls PASS. Prior202/373 full runs retained as historical; named server typecheck/touched lint/format/diff pass. Entire04c3 remains incomplete until distinct04c3b delayed batch/context/credential/identity/cache-wait guards. Coordinator starts that ordinary session from exact accepted0668bc7a; final11 writes remain04c4. #5 OPEN through integration, gate CLOSED. Current fingerprint CI queued; no full CI claim, merge or restack. Budget31%, no reset redeemed.alimek commentedon Oct 11, 2026
Coordinator approved minimum TWO04c3b review boundaries after concrete persistence source audit:04c3b1 request/context/credential/provider-owned caches and typed fallback in current ordinary session;04c3b2 persisted PR cache backing effects/serialization/error recovery in a distinct successor after exact review. Entire04c3 remains required.04c4 base becomesaccess/04c3-persisted-read-effects;05base unchanged. No implementation at checkpoint, exact0668bc7a clean. Prefer smallest safe seam; external persisted-read bypass may avoid retrofitting library callbacks if cache/freshness/action semantics remain correct. No new engine or vendored edits. #5OPEN/gateCLOSED, no merge/restack. Budget31%, no reset. Approved concrete scope/branches/proof in issue body and external ticket-04c3b-coordinator-split.md.
alimek commentedon Oct 11, 2026
04c3b1 PR27 source review: 249 independent focused tests pass; Standards0, Spec1 P2 (workflow REST denial wrapped and recovered as unavailable). Actual PR API probe reproduces channel loss; narrow same-PR repair requested before exact re-review. 11 small stages source accepted so far; 3/14 main tickets implemented, ticket04 remains in progress. #5 stays OPEN, no integration merge or next part; ResourceGrantGuard CLOSED. Last measured quota26%,no reset.
alimek commentedon Oct 11, 2026
04c3b1 PR27 source accepted at c14c83d after workflow denial and namespace repairs. Independent Standards0/Spec0; coordinator final6 workflow controls PASS (prior25/249 historical). Starting distinct approved04c3b2 persisted cache slice; then04c4 final writes. 12 small stages accepted;3/14 main tickets implemented,ticket04 ongoing. PRs remain OPEN/unmerged;#5/#1 OPEN through integration;gateCLOSED. Budget25%,no reset.
alimek commentedon Oct 11, 2026
04c3b2 PR28 source accepted at2c2b81e1236e8c1c5e0cdeaf982e86295745e241: independent Standards0/Spec0, coordinator77 selected testsPASS. Cache bypass/invalidation/held publication scope complete; no merge/fullCI/gateactivation. 13 small stages source accepted,main01–03 implemented;04 still needs final write disposition under original plan. User scope question for simpler v1 pending; no04c4/later launch or silent plan replacement. #5/#1 remain OPEN throughintegration. Budget24%,no reset.
[-]Per-connection project, provider and model access[/-][+]Per-connection project, provider and model access — simple v1[/+]alimek commentedon Oct 11, 2026
Coordinator SOURCE ACCEPTED PR29 exact03458d586f27aee4c9888a83ed43c837a5efc621 on accepted base2c2b81e1236e8c1c5e0cdeaf982e86295745e241. Independent Standards0 / Spec0; all three bounded review findings resolved. Root17/17 OAuth/catalog tests PASS; prior candidate66 tests remain historical. Implementer named server typecheck/touched lint/format PASS inspected.
Current browser approval rechecks grant/scopes/CSRF after crypto before code publication. Restricted cached config/refresh/subscription belongs to ProviderCatalog service; invalid credential cause retained. Simplev1 direct access04 disposition completes through05 denial instead of full scoped PR writes04c4. Native origin/credential/request-time MCP denial stays REQUIRED08; actual provider/model execution07 not claimed.
PR29 remains OPEN/unmerged, gate CLOSED unchanged. #5/#6/#1 remain OPEN until integration/verification; no activation/client/fullCI claim. Next sequential ordinary app-bound stage06 files/assets on exact accepted03458d5, issue7. Seven main stages remain06/07/08/11/12/13/14. Root quota18%,2credits,no reset redeemed.
External review: ticket05-v1/coordinator-repair-review.md. This acceptance does not merge/restack the PR stack.
alimek commentedon Oct 11, 2026
Coordinator exact source review PR30 af71bd0 on accepted03458d586f27aee4c9888a83ed43c837a5efc621 completed. Source acceptance withheld; one bounded repair in same ordinary stage06 thread/PR. No07.
SpecP1: retained asset response check re-admits root/thread but omits actual requested/canonical file owner after resolution waits and before HEAD/chunks. RealSQL proof: issue/resolve friendA media under A/child, move hidden projectB registered root to A/child with friend grant/revision unchanged. Retained HEAD remains200; retained range actually returns206/body234 from seeded file. Repair must re-admit concrete file owners before delivery, with meaningful before/after proof. No OS sandbox/framework or durable08 expansion.
Standards3/P2: new FileAccess and persisted chat intake capabilities need domain service shape; new asset owner admission/grant routing belongs behind service boundary rather than WS. Preserve inherited owner/legacy behavior and existing upload helpers; no blanket rewrite.
Root existing40 focused tests PASS; two new intended-denial probes RED reproduce gap. Production source unchanged; temporary probes removed, external evidence retained. Gate CLOSED byte-identical, PR30 OPEN/unmerged, #7/#1 OPEN. No merge/restack/activation/client/fullCI claim. Budget17%,2credits,no reset redeemed.
alimek commentedon Oct 11, 2026
Stage06 exact repair review at15a28aafa48a5be366a69c1fd3b059548e70c9c2: original retained file-owner P1 and three service Standards P2 findings resolved. Standards0; Spec2 remain: bound GitHub media drops live checks through credential/fetch/body waits (P1), image issuance misses actual file-owner changes during canonical/open/header waits (P2). Two real SQL+Deferred coordinator controls reproduce HTTP effect1/200 after authority cut and URL+PNG dimensions390x844 after hidden owner root cut. Existing affected43/43 pass but miss these branches.
One bounded repair requested in same stage06 thread/worktree/PR30 using existing checks; no new framework or scope. No07, source acceptance, merge or activation. Issue remains OPEN. Root budget15%,2credits,no reset. Full review/proofs retained outside repository in ticket06-files-assets/coordinator-repair-review.md and coordinator-continuation-probe.*.
alimek commentedon Oct 11, 2026
Refs #7: same PR30 stage06 bounded continuation repair
b66e06efeb8caaf9c0137ed31940bd06e0121f18on unchanged accepted05 base03458d586f27aee4c9888a83ed43c837a5efc621. Current GitHub credential/fetch/body and file-owner issuance/header/publication gaps repaired;55 focused tests, named server typecheck and touched style/diff pass. GateCLOSED. #7/#1 stay OPEN; exact-source acceptance and integration/client validation belong coordinator. No07/merge/activation.alimek commentedon Oct 11, 2026
Stage06 source accepted at b66e06e (PR30), exact base03458d586f27aee4c9888a83ed43c837a5efc621. Independent Standards0 / Spec0. Both media continuation findings fixed: current GitHub credential/request/body checks and requested/canonical image issuance owner checks. Root independently55/55 affected testsPASS; exact refs/clean/diff/gate verified; named server typecheck/touched style evidence inspected. ResourceGrantGuard remains CLOSED byte-identical.
Source acceptance is not merge/integration/activation. #7 remains OPEN until stack integration and verification. Next approved sequential stage07 actual provider/model admission (#8); no native08/client implementation claim. Root budget15%,2credits,no reset. Review/proof: external ticket06-files-assets/coordinator-continuation-review.md and coordinator-continuation-tests-final.log.
alimek commentedon Oct 11, 2026
Work paused at user request. Stages01–06 source accepted:6 main stages,15 stacked PRs, all unmerged. Stage07 interrupted with existing uncommitted changes preserved in access/07-execution-admission; not complete or reviewed. PR monitoring stopped. Remaining approved simple-v1 stages07,08,11,12,13,14 (6). No resume without explicit user request; gateCLOSED.
alimek commentedon Oct 11, 2026
Stages01–06 consolidated into one PR#30 against feature/connection-resource-access at accepted b66e06e. PR16–29 closed as superseded, with all branches/29 commits/review records preserved. All15 accepted heads/ancestry verified; final source tree816baee70af573af152118a84505f5292b280aa1 unchanged. No rebase/squash/code change or main/upstream merge.
The six stages retain source acceptance and focused test evidence. Full fork CI is queued, not verified green; client integration remains later. ResourceGrantGuard CLOSED. Tracking sub-issues remain OPEN until integration verification. Stage07 remains paused with its uncommitted changes preserved; no further implementation or monitoring resumed. External record: consolidation-01-06/.