Skip to content
Cockpit0.29.0
A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live

I1206

What an anonymous reader may do is derived from the effect classification, not from a list

Where it stands

devtask.issue
Readiness
blocked 1 of its dependencies is not DONE
Status
BLOCKED
Can start
not now
Milestone
web-sign-in
Milestone status
PLANNED
Wave
5
Waiting on
I1205
Holds back
I1208
Behind it in all
1
Evidence
0 of 3
In the waySubjectDetail
issueI1205I1205 is not DONE

Moves

plan.transition
A move writes the repository: it stamps one field of this issue's record and appends one event to the ledger, and a commit will carry both.
The same moves from a terminal

majordomus plan start I1206

majordomus plan verify I1206

majordomus plan done I1206

What it is

Objective
Derive the exposure decision from the capability registry: a read-only capability stays open to an anonymous reader, anything that mutates requires an identified one, and the decision is stated once in policy over effect classes rather than per route. Project the decision into the OpenAPI security scheme, the Cockpit's disabled controls with their reason, and the generated documentation.
Why
A route list is a second inventory of what this repository can do, and it is the inventory that will be out of date. The registry already knows what each capability is; the policy only has to say what each class of capability requires.
Now
Every route is served to everyone; the fly-deployment milestone therefore forbids exposing any mutating operation to the browser.
Wanted
Adding a capability inherits its exposure from its effect class, and a capability that mutates cannot be reached anonymously without a policy change that is visible as one.
Done when
unknown: the record declares no `completion`
Risk
This issue depends on the effect classification being trustworthy. Where a capability's class is wrong, the fix is the classification, never an exception in the router.

Acceptance

  • The policy states the requirement per effect class, and no route names its own requirement
  • A capability added with a mutating effect is refused to an anonymous caller with no edit to the HTTP layer, proved by a test capability
  • The OpenAPI document carries the security scheme and marks the operations that require it, generated rather than written
  • The Cockpit disables what the caller may not invoke and states the reason it is disabled
Validation
cargo test --workspace --all-featuresmajordomus generate --checkbash test/run.sh
Evidence required
policy_by_effect_classnew_capability_inheritsopenapi_security_generated
Evidence present
unknown: the record carries no `evidence` entries

Scope

Touches
.ai/repo/policy.yamlapps/majordomus-cli/src/capabilityapps/majordomus-cli/src/httpapps/majordomus-cli/src/cockpitdocsapps/majordomus-cli/tests
Not
A per-route authorisation table in any formatGranting a signed-in reader anything the effect policy has not classified
Depends on
I1205
Priority
p1
Profile
implementation
Parallel safe
false
Owner
unknown: the record declares no `owner`

The work so far

Branches
none
Merged
none
Commits
0
Trunk
master
Sessions
none
Created
2026-09-08
Updated
2026-09-08
Started
unknown: the record declares no `started_at`
Verified
unknown: the record declares no `verified_at`
Completed
unknown: the record declares no `completed_at`

Synchronisation

Adapter
scripts/github-sync
Repository
unknown: the derived plan's header carries no repository
External issue
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
State there
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.