VerseVDI-Protocol/openspec/changes/phase-3d-client-safe-session-authority/specs/gateway-transport-and-admission/spec.md

ADDED Requirements

Requirement: Client-facing authority is provider-free

The gateway-to-client acknowledgement SHALL use ClientSessionAuthority version "1" containing exactly version, session_id, gateway_id, audience, reconnect_sequence, expires_at, and capabilities. The contract SHALL reject missing required fields, unknown fields including provider identities and routes, invalid or noncanonical expiry timestamps, and trailing JSON values.

Scenario: Gateway acknowledges an admitted client

• WHEN provider work succeeds and gateway and client capabilities intersect
• THEN the gateway returns a valid ClientSessionAuthority containing the selected capabilities and no provider-bearing field

Scenario: Client receives provider-bearing authority

• WHEN a client authority payload contains provider_profile, provider_identity, a provider route, or any unknown key
• THEN the strict client authority decoder rejects the payload

Scenario: Client receives incomplete or malformed authority

• WHEN a client authority omits any required binding, has an invalid expiry, or is followed by another JSON value
• THEN the strict client authority decoder rejects the payload

Requirement: Server-to-gateway authority remains provider-bound

The authenticated Server-to-gateway control plane SHALL continue to use the existing provider-bearing SessionAuthority for admission, provider work, release, and cleanup. SessionAuthority and ProviderSessionWork fields and semantics MUST remain unchanged by this change.

Scenario: Gateway performs provider work

• WHEN the Server admits a gateway session and the gateway requests provider work
• THEN the original provider-bearing SessionAuthority continues to bind provider work and subsequent release or cleanup

Requirement: RC4 is a coordinated hard cut

The RC4 gateway and client SHALL use ClientSessionAuthority; mixed RC3/RC4 gateway-client compatibility SHALL NOT be claimed. RC4 SHALL NOT add optional provider fields, a dual decoder, or response negotiation for RC3.

Scenario: RC4 candidate is qualified

• WHEN the Protocol RC4 tag is pinned by Server, gateway, and client
• THEN qualification uses only that exact coordinated set