sechmachine/VerseVDI-Protocol
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4693102b3ccbb81aeb1144c1a3b0884ee682bfa3
VerseVDI-Protocol/openspec/changes/phase-3d-client-safe-session-authority/proposal.md
T
sechmachine afbcea62f9
Verify Protocol / verify (push) Successful in 1m2s
Details
Verify Protocol / module (push) Successful in 1m45s
Details
Protocol: split client session authority
2026-08-12 11:50:41 +07:00

1.2 KiB
Raw Blame History

Why

The gateway currently serializes the provider-bearing Server-to-gateway SessionAuthority to clients, crossing provider identity into a client trust boundary that forbids it. RC4 must make that boundary structural before the pre-release client set is qualified.

What Changes

  • Add a strict provider-free ClientSessionAuthority with the seven session, gateway, audience, reconnect, expiry, and capability fields shared with SessionAuthority.
  • Keep SessionAuthority and ProviderSessionWork unchanged for the authenticated Server-to-gateway control plane.
  • BREAKING Replace the gateway-to-client RC3 response shape with ClientSessionAuthority as a coordinated RC4 hard cut; no mixed RC3/RC4 compatibility is claimed.

Capabilities

New Capabilities

  • gateway-transport-and-admission: Defines the distinct client-facing authority and its provider-free gateway admission boundary.

Modified Capabilities

None.

Impact

Protocol JSON Schema, tunnel Protobuf, generated Go/Rust/Swift bindings, and consumer Protocol pins advance together to v1.0.0-phase3d-macos-rc.4. VERSION, global compatibility history, and the Server-to-gateway provider authority remain unchanged.

Reference in New Issue View Git Blame Copy Permalink