cgalo5758
5829091881
The contained runner that drove the 2026-09 security audit, the README review and four rounds of design ideation lived only inside the ignored notebook. It moves to scripts/agent-runner/: the prepare, tools, audit, ideation and teardown scripts, the compose and container files, the allowlist proxy and the prompt templates, with the paths that assumed the notebook fixed and findings written to a caller-named directory. Run outputs, transcripts and the round-specific sheet scripts stay behind. docs/agent-runner.md states the method: the disposable git archive copy and the fail-closed proxy, how a task is shaped, union rather than intersection of findings across models, separate adjudication of every finding against the source, and the evidence a finding must carry.
24 lines
1.2 KiB
Markdown
24 lines
1.2 KiB
Markdown
# T02 — The operator role boundary
|
|
|
|
**Threat model.** A signed-in member who does not hold `operator-member`
|
|
tries to reach operator functionality by requesting its URLs directly.
|
|
|
|
**Slice.** `internal/server/operator.go` (especially the gate around line 165),
|
|
`internal/server/operator_partials.go`, the partials router in
|
|
`internal/server/server.go` near line 706, and `server.go:723` / `:754`.
|
|
Then survey the `internal/server/operator_*.go` handlers to see which ones
|
|
sit behind the gate and which register their own routes.
|
|
|
|
**Questions.**
|
|
1. Every operator route: does the role check run before the handler body?
|
|
Name any route or partial that reaches data or a mutation without one.
|
|
2. Are HTMX partial endpoints gated the same way as the pages that embed them,
|
|
or does the gate live only on the page handler?
|
|
3. Is the check applied on the write path, or only on the read that renders
|
|
the form?
|
|
4. `HasRole` reads roles from the session. Between a person losing the operator
|
|
role in Keycloak and their session expiring, what can they still do?
|
|
5. Do any operator handlers registered by integrations bypass the core gate?
|
|
|
|
**Not in scope.** Cross-tenant member access (T05). Session mechanics (T01).
|