Define verification of MI utilization against authorization-filtered decisions #246

New issue

Closed

opened 2026-11-01 19:22:21 +00:00 by kilo · 2 comments

kilo commented

2026-11-01 19:22:21 +00:00

Member

Observed installed behavior

At canonical SR f96d58e6d7d0fffdbe70476850d824efa5de2fb5, MI d65891668b7e79f7b666c021f02a1b4bf8c4ca9c, Foundry PR #8 was run with verified local TLS, protected bootstrap, two registered synthetic resources, and distinct client grants. Both authenticated /v1/select responses returned no_solution because the registered catalog had reasoning_effort: null and no viable provider state. The filtered response redacted the restricted resource ID, while the retained internal routed decision contained it. This confirms only that no-solution projection, not privacy or correctness for a viable filtered choice.

For each request, the retained MI utilization decoded successfully against the retained internal routed decision, context, timestamp and exact cut. The public HTTP decision equaled route.selection but differed from the retained internal selection (in this run, expired_happy_hour_rules). Passing the raw HTTP response to the MI decoder failed decision-binding-envelope; wrapping the public decision in the schema-1 envelope failed decision-binding-result-mismatch.

Source inspection indicates SR binds decision.to_dict() before applying the authorization-filtered public route projection. We do not claim this proves an authorization leak or that public and internal bytes should always match. The missing contract is how an authorized client or auditor can verify that a retained internal receipt corresponds to the particular filtered public result, without exposing restricted identities or misrepresenting an internal pre-filter decision as the client-visible result.

Requested acceptance

Define the public projection/receipt binding and supported verification interface, then exercise both a viable permitted choice and a grant removing the otherwise preferred resource, including privacy of the response and any accessible receipt. Cover synthetic matching MI evidence, stale/withdrawn/mismatched cases and retained-cut consistency. SR #227 tracks broader installed acceptance. Foundry tracking: Creatidy/foundry#1.

## Observed installed behavior At canonical SR `f96d58e6d7d0fffdbe70476850d824efa5de2fb5`, MI `d65891668b7e79f7b666c021f02a1b4bf8c4ca9c`, Foundry PR #8 was run with verified local TLS, protected bootstrap, two registered synthetic resources, and distinct client grants. Both authenticated `/v1/select` responses returned `no_solution` because the registered catalog had `reasoning_effort: null` and no viable provider state. The filtered response redacted the restricted resource ID, while the retained internal routed decision contained it. This confirms only that no-solution projection, not privacy or correctness for a viable filtered choice. For each request, the retained MI utilization decoded successfully against the retained internal routed decision, context, timestamp and exact cut. The public HTTP `decision` equaled `route.selection` but differed from the retained internal selection (in this run, `expired_happy_hour_rules`). Passing the raw HTTP response to the MI decoder failed `decision-binding-envelope`; wrapping the public decision in the schema-1 envelope failed `decision-binding-result-mismatch`. Source inspection indicates SR binds `decision.to_dict()` before applying the authorization-filtered public route projection. We do not claim this proves an authorization leak or that public and internal bytes should always match. The missing contract is how an authorized client or auditor can verify that a retained internal receipt corresponds to the particular filtered public result, without exposing restricted identities or misrepresenting an internal pre-filter decision as the client-visible result. ## Requested acceptance Define the public projection/receipt binding and supported verification interface, then exercise both a viable permitted choice and a grant removing the otherwise preferred resource, including privacy of the response and any accessible receipt. Cover synthetic matching MI evidence, stale/withdrawn/mismatched cases and retained-cut consistency. SR #227 tracks broader installed acceptance. Foundry tracking: https://forgejo.creatidy.com/Creatidy/foundry/issues/1.

kilo referenced this issue from Creatidy/foundry

2026-11-01 19:22:29 +00:00

Establish first secure SR–MI installed integration #1

kilo added the

label

2026-11-02 21:09:25 +00:00

adrian.tkacz referenced this issue from a commit

2026-11-03 00:22:55 +00:00

Bind MI receipts to authorized projections (#246)

kilo referenced this issue

2026-11-03 00:22:59 +00:00

Verify MI receipts against authorized projections (#246) #252

kilo commented

2026-11-03 00:23:04 +00:00

Author

Member

Implementation PR #252 is open at af828fc620 against develop 7985cbadd3. Focused MI tests, full make check (3269 tests, 18 skipped), basedpyright, package-check and whitespace checks completed. Independent review and Forgejo CI remain required.

Implementation PR #252 is open at af828fc620d71ead4fce96a7f75f0a09ac973567 against develop 7985cbadd31e6b594cb3a7b5fc27a06f6e03f33e. Focused MI tests, full `make check` (3269 tests, 18 skipped), basedpyright, package-check and whitespace checks completed. Independent review and Forgejo CI remain required.

kilo referenced this issue

2026-11-03 00:23:11 +00:00

Verify MI receipts against authorized projections (#246) #252

kilo referenced this issue from a commit

2026-11-03 00:39:15 +00:00

Merge pull request 'Verify MI receipts against authorized projections (#246)' (#252) from issue-246-authorized-receipt into develop

kilo commented

2026-11-03 00:39:27 +00:00

Author

Member

Completed via PR #252. Reviewed HEAD af828fc620 received independent review #1 APPROVE with no findings; Forgejo run #3501 succeeded on that HEAD. Merge c16cc1db29 has approved base 7985cbadd3 and approved HEAD as parents; its tree ad950af530 equals the approved HEAD tree. The client-scoped versioned verification checks the public decision and route against private retained MI evidence and the exact retained cut without returning private contents. Local validation: make check (3269 tests, 18 skipped), basedpyright, package-check and whitespace checks. Historical correspondence is not current authorization or an independent signature; installed cross-product acceptance remains separately tracked by #227.

Completed via PR #252. Reviewed HEAD af828fc620d71ead4fce96a7f75f0a09ac973567 received independent review #1 APPROVE with no findings; Forgejo run #3501 succeeded on that HEAD. Merge c16cc1db29f3828b3f9e8d05b19e645cfb0c32b8 has approved base 7985cbadd31e6b594cb3a7b5fc27a06f6e03f33e and approved HEAD as parents; its tree ad950af5305b7789ecfb52bb1476535b30c938c8 equals the approved HEAD tree. The client-scoped versioned verification checks the public decision and route against private retained MI evidence and the exact retained cut without returning private contents. Local validation: make check (3269 tests, 18 skipped), basedpyright, package-check and whitespace checks. Historical correspondence is not current authorization or an independent signature; installed cross-product acceptance remains separately tracked by #227.

kilo closed this issue

2026-11-03 00:39:31 +00:00