From f8ea71f6b19f93434e8f0e45b554ea22e838fb4a Mon Sep 17 00:00:00 2001 From: weichen Date: Thu, 15 Oct 2026 06:38:18 +0000 Subject: [PATCH] Bind auth-off observations to the local project epoch Why: The real local-mode product has authoritative project access without an enabled account-model row. Evidence: The app suite passes; non-local missing or disabled accounts still fail closed. Impact: Auth-off local acceptance can record a nonempty authorization epoch while authenticated deployments retain account-version binding. Refs: TT-N03 --- internal/app/project_work_observation.go | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/internal/app/project_work_observation.go b/internal/app/project_work_observation.go index 9c76b20..9175715 100644 --- a/internal/app/project_work_observation.go +++ b/internal/app/project_work_observation.go @@ -136,10 +136,16 @@ func deliverProjectWorkRows(ctx context.Context, st *store.Store, provider *exte return completed, fmt.Errorf("project work source %s: current project authorization denied", row.EventID) } account, err := st.GetAccountByOwner(row.Owner) - if err != nil || !account.Enabled { + authorizationEpoch := "" + if err == nil && account.Enabled { + authorizationEpoch = fmt.Sprintf("account:%d:project:%s", account.AuthVersion, row.ProjectID) + } else if row.Owner == store.OwnerDefault { + // Auth-off local mode has no enabled account model. The project-work + // callback above is still authoritative for this process. + authorizationEpoch = "auth-off-local:project:" + row.ProjectID + } else { return completed, fmt.Errorf("project work source %s: current account authorization unavailable", row.EventID) } - authorizationEpoch := fmt.Sprintf("account:%d:project:%s", account.AuthVersion, row.ProjectID) observation := extension.WorkObservation{ EventID: row.EventID, Phase: "source-committed", Actor: row.Owner, Owner: row.Owner, ProjectID: core.ID(row.ProjectID), ConversationID: core.ID(row.ConversationID), RunID: core.ID(row.RunID),