From a4c70c5a71a4a73f24f04060a301703ba5ac7530 Mon Sep 17 00:00:00 2001
From: Jarvis <jarvis@mosaicstack.dev>
Date: Mon, 13 Jul 2026 01:17:24 -0500
Subject: [PATCH] fix(#709): make runtime approvals transport neutral

---
 .../commands/command-authorization.service.ts | 20 +++++--------------
 1 file changed, 5 insertions(+), 15 deletions(-)

diff --git a/apps/gateway/src/commands/command-authorization.service.ts b/apps/gateway/src/commands/command-authorization.service.ts
index a9f829e..819813f 100644
--- a/apps/gateway/src/commands/command-authorization.service.ts
+++ b/apps/gateway/src/commands/command-authorization.service.ts
@@ -134,8 +134,6 @@ export class CommandAuthorizationService {
     if (
       !this.isRuntimeTerminationApproval(approval) ||
       approval.actionDigest !== this.runtimeActionDigest(action) ||
-      approval.actorId !== action.actorId ||
-      approval.tenantId !== action.tenantId ||
       !this.isUnexpired(approval.expiresAt)
     ) {
       return false;
@@ -196,27 +194,19 @@ export class CommandAuthorizationService {
   }
 
   private hasRuntimeTerminationAction(action: RuntimeTerminationApprovalAction): boolean {
-    return [
-      action.providerId,
-      action.sessionId,
-      action.actorId,
-      action.tenantId,
-      action.channelId,
-      action.correlationId,
-      action.agentName,
-    ].every((value: string): boolean => value.trim().length > 0);
+    return [action.providerId, action.sessionId, action.agentName].every(
+      (value: string): boolean => value.trim().length > 0,
+    );
   }
 
   private runtimeActionDigest(action: RuntimeTerminationApprovalAction): string {
     return createHash('sha256')
       .update(
         JSON.stringify({
+          // Exact action identity is transport-neutral. Discord actor/correlation
+          // remain immutable audit metadata on the record, not its consume key.
           providerId: action.providerId,
           sessionId: action.sessionId,
-          actorId: action.actorId,
-          tenantId: action.tenantId,
-          channelId: action.channelId,
-          correlationId: action.correlationId,
           agentName: action.agentName,
         }),
       )