mosaicstack/stack
1
0
Fork 0
Code Issues 19 Pull Requests Actions Packages Projects Releases 12 Wiki Activity

FED-M7: multi-user RBAC hardening + acceptance suite #466

New Issue
Open
opened 2026-04-19 22:02:17 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-04-19 22:02:17 +00:00
Owner
Copy Link

Epic: Federation v1 — see docs/federation/PRD.md and docs/federation/MILESTONES.md.

Goal

Full multi-tenant scenario from PRD §4 works end-to-end with no cross-user leakage under any circumstance.

Scope

  • Three-user scenario on Server B (E1, E2, E3), each with their own Server A
  • Team-scoped grants: each employee's team-data visible on their own A; E1's personal data never visible on E2's A
  • User-facing UI on both gateways: peer list, grant list, audit log viewer, scope editor
  • Negative-path test matrix (every denial path from PRD §8)
  • All PRD §15 acceptance criteria mapped to automated tests
  • Security review: cert-spoofing, scope-bypass, audit-bypass paths explicitly tested
  • Cold-storage rollover for audit log >90 days
  • Docs: runbook, onboarding guide, troubleshooting guide

Deliverables

  • Full acceptance suite in tools/federation-harness/acceptance/
  • apps/web surfaces for peer/grant/audit management
  • docs/federation/RUNBOOK.md, ONBOARDING.md, TROUBLESHOOTING.md
  • Audit cold-tier job (daily cron)

Acceptance Tests

All PRD §15 criteria automated and green. Plus:

  • 3-employee scenario: each A sees only its user's data from B
  • Team-scoped grant returns team data; same grant denied access to another employee's personal data
  • Concurrent sessions from E1's and E2's Server A to B interleave without leakage
  • Audit log across 3-user test shows per-grant trails with no mis-attributed rows
  • Scope editor UI round-trip: edit → save → next request uses new scope
  • Attempt to use revoked grant's cert against different grant's endpoint: rejected
  • 90-day-old audit rows moved to cold tier; queryable via explicit historical query
  • Runbook steps validated: operator (not author) can onboard, rotate, revoke

Dependencies

Blocked by FED-M4, FED-M5, FED-M6.

Estimated budget

~25K tokens

Risk notes

Security-critical milestone. Budget review time is non-negotiable — plan for two independent code reviews (internal + security-focused) before merge.

**Epic:** Federation v1 — see `docs/federation/PRD.md` and `docs/federation/MILESTONES.md`. ## Goal Full multi-tenant scenario from PRD §4 works end-to-end with no cross-user leakage under any circumstance. ## Scope - Three-user scenario on Server B (E1, E2, E3), each with their own Server A - Team-scoped grants: each employee's team-data visible on their own A; E1's personal data never visible on E2's A - User-facing UI on both gateways: peer list, grant list, audit log viewer, scope editor - Negative-path test matrix (every denial path from PRD §8) - All PRD §15 acceptance criteria mapped to automated tests - Security review: cert-spoofing, scope-bypass, audit-bypass paths explicitly tested - Cold-storage rollover for audit log >90 days - Docs: runbook, onboarding guide, troubleshooting guide ## Deliverables - Full acceptance suite in `tools/federation-harness/acceptance/` - `apps/web` surfaces for peer/grant/audit management - `docs/federation/RUNBOOK.md`, `ONBOARDING.md`, `TROUBLESHOOTING.md` - Audit cold-tier job (daily cron) ## Acceptance Tests All PRD §15 criteria automated and green. Plus: - [ ] 3-employee scenario: each A sees only its user's data from B - [ ] Team-scoped grant returns team data; same grant denied access to another employee's personal data - [ ] Concurrent sessions from E1's and E2's Server A to B interleave without leakage - [ ] Audit log across 3-user test shows per-grant trails with no mis-attributed rows - [ ] Scope editor UI round-trip: edit → save → next request uses new scope - [ ] Attempt to use revoked grant's cert against different grant's endpoint: rejected - [ ] 90-day-old audit rows moved to cold tier; queryable via explicit historical query - [ ] Runbook steps validated: operator (not author) can onboard, rotate, revoke ## Dependencies Blocked by **FED-M4**, **FED-M5**, **FED-M6**. ## Estimated budget ~25K tokens ## Risk notes Security-critical milestone. Budget review time is non-negotiable — plan for two independent code reviews (internal + security-focused) before merge.
jason.woltje added this to the Federation v1 milestone 2026-04-19 22:02:17 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone Federation v1
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#466
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?