Skip to content

I1205 — Identity is resolved once, in the router, and every surface reads it from there

Resolve the caller once, where the request enters, and carry the result to every surface: the HTTP API, the Cockpit's rendering, the OpenAPI document's security scheme and the MCP surface. No handler parses a cookie, and no surface decides for itself what an absent identity means.

BLOCKED wave 4 · p1 · implementation profile · runs alone

Part of web-sign-in — The deployed surfaces know who is asking, and the identity providers are data.

Blocked. This issue cannot start until I1204 is done. The status is derived from that, not declared.

Objective

Resolve the caller once, where the request enters, and carry the result to every surface: the HTTP API, the Cockpit's rendering, the OpenAPI document's security scheme and the MCP surface. No handler parses a cookie, and no surface decides for itself what an absent identity means.

Why

Authentication that is applied per handler is authentication that is forgotten on the handler added next week. One resolution point is also the only way the four surfaces can agree about who the caller is.

Current state

I1204 issues sessions; nothing reads them outside the flow.

Desired state

A request carries a resolved caller — anonymous or identified — from the router onward, and a handler cannot be written that skips the resolution.

Scope

  • apps/majordomus-cli/src/http
  • apps/majordomus-cli/src/identity
  • apps/majordomus-cli/src/cockpit
  • apps/majordomus-cli/src/mcp
  • apps/majordomus-cli/tests

Out of scope

  • Roles, groups or permissions beyond identified and anonymous
  • A second resolution in any surface

Dependencies

What waits on this

Acceptance criteria

  • Exactly one place reads the session cookie, proved by a test that fails when a second appears
  • The Cockpit shows who is signed in and offers sign-out, from the resolved caller rather than from its own read
  • The MCP surface receives the same caller as the HTTP API for the same connection
  • An anonymous caller is a value, not an absence, so no surface can forget to handle it

Validation

  • cargo test --workspace --all-features
  • bash test/run.sh

Evidence required

  • single_resolution_point
  • surfaces_agree

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

The Cockpit is the surface most likely to re-read the cookie for convenience. The test that forbids a second read is what keeps it honest.

Timeline

started
—
verified
—
completed
—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I1205.yaml. Read it back with majordomus plan show I1205.