main · last commit
23 hours ago ·
7bghjra2
sr-ht-ecore-g3r Unify the GraphQL bearer plane: meta PAT beside the working token
epic
Lined Up
bd update sr-ht-ecore-g3r --claim
bd close sr-ht-ecore-g3r
| Created by | Eugene Blikh |
| Owner | bigbes@gmail.com |
| Created | 2026-08-16T18:27:30Z |
| Updated | 2026-08-16T18:27:30Z |
Four services (cov, bench, spec, artifacts) accept only a tokens.sr.ht working token on /query, and publish an empty scope list in api-meta.json, so meta.sr.ht cannot mint a PAT for them at all. dolt already accepts both and publishes a scope. api.sr.ht forwards ONE client Authorization header to every service a federated query touches, so a GraphQL plane that refuses meta PATs cannot federate. Bring the four to dolt's shape: /query accepts meta PAT + working token; MCP and REST stay on tokens.sr.ht alone.
Shared half lands in a new sr-ht-ecore package, metapat, beside bearer: ClientID routing, the meta PAT resolve path (decode, username check, LookupUser, LookupTokenRevocation, positive cache) and the OAuth scope check. Each service keeps its own Principal, MetaBackend and error classification. dolt is not migrated in this epic: its PAT plane is entangled with the Basic clone path. Scopes are spelled upstream-style, upper case: cov.sr.ht/REPORTS, bench.sr.ht/RESULTS, spec.sr.ht/SPECS, artifacts.sr.ht/REPOS.
sr-ht-ecore-g3r.6
— api.sr.ht is not deployed on the instance, so nothing is federated yet
P2
open
sr-ht-ecore-g3r.1
— ecore/metapat: the shared meta.sr.ht PAT plane
P1
closed
sr-ht-ecore-g3r.2
— cov.sr.ht accepts a meta PAT on /query (scope REPORTS)
P1
closed
@Eugene Blikh
sr-ht-ecore-g3r.3
— bench.sr.ht accepts a meta PAT on /query (scope RESULTS)
P1
closed
@Eugene Blikh
sr-ht-ecore-g3r.4
— spec.sr.ht accepts a meta PAT on /query (scope SPECS)
P1
closed
sr-ht-ecore-g3r.5
— artifacts.sr.ht accepts a meta PAT on /query (scope REPOS)
P1
closed
No outgoing dependencies.
sr-ht-ecore-g3r.5
— artifacts.sr.ht accepts a meta PAT on /query (scope REPOS)
parent-child
sr-ht-ecore-g3r.2
— cov.sr.ht accepts a meta PAT on /query (scope REPORTS)
parent-child
sr-ht-ecore-g3r.6
— api.sr.ht is not deployed on the instance, so nothing is federated yet
parent-child
sr-ht-ecore-g3r.4
— spec.sr.ht accepts a meta PAT on /query (scope SPECS)
parent-child
sr-ht-ecore-g3r.3
— bench.sr.ht accepts a meta PAT on /query (scope RESULTS)
parent-child
sr-ht-ecore-g3r.1
— ecore/metapat: the shared meta.sr.ht PAT plane
parent-child
| id | sr-ht-ecore-g3r |
| content_hash | 7bc634f8ff5276c0d7ed0606d98065dcab336835eeeb84293e5d62817317aa68 |
| title | Unify the GraphQL bearer plane: meta PAT beside the working token |
| description | Four services (cov, bench, spec, artifacts) accept only a tokens.sr.ht working token on /query, and publish an empty scope list in api-meta.json, so meta.sr.ht cannot mint a PAT for them at all. dolt already accepts both and publishes a scope. api.sr.ht forwards ONE client Authorization header to every service a federated query touches, so a GraphQL plane that refuses meta PATs cannot federate. Bring the four to dolt's shape: /query accepts meta PAT + working token; MCP and REST stay on tokens.sr.ht alone. |
| design | Shared half lands in a new sr-ht-ecore package, metapat, beside bearer: ClientID routing, the meta PAT resolve path (decode, username check, LookupUser, LookupTokenRevocation, positive cache) and the OAuth scope check. Each service keeps its own Principal, MetaBackend and error classification. dolt is not migrated in this epic: its PAT plane is entangled with the Basic clone path. Scopes are spelled upstream-style, upper case: cov.sr.ht/REPORTS, bench.sr.ht/RESULTS, spec.sr.ht/SPECS, artifacts.sr.ht/REPOS. |
| acceptance_criteria | |
| notes | |
| status | open |
| priority | 1 |
| issue_type | epic |
| assignee | NULL |
| estimated_minutes | NULL |
| created_at | 2026-08-16T18:27:30Z |
| created_by | Eugene Blikh |
| owner | bigbes@gmail.com |
| updated_at | 2026-08-16T18:27:30Z |
| closed_at | NULL |
| closed_by_session | |
| external_ref | NULL |
| spec_id | |
| compaction_level | 0 |
| compacted_at | NULL |
| compacted_at_commit | NULL |
| original_size | NULL |
| sender | |
| ephemeral | 0 |
| wisp_type | |
| pinned | 0 |
| is_template | 0 |
| mol_type | |
| work_type | |
| source_system | |
| metadata | �{} |
| source_repo | |
| close_reason | |
| event_kind | |
| actor | |
| target | |
| payload | |
| await_type | |
| await_id | |
| timeout_ns | 0 |
| waiters | |
| hook_bead | |
| role_bead | |
| agent_state | |
| last_activity | NULL |
| role_type | |
| rig | |
| due_at | NULL |
| defer_until | NULL |
| no_history | 0 |
| started_at | NULL |
| is_blocked | 0 |
| id | 4a2009d1-fc1d-58c8-835f-c5b066d045d7 |
| issue_id | sr-ht-ecore-g3r.5 |
| type | parent-child |
| created_at | 2026-08-16T21:37:50Z |
| created_by | Eugene Blikh |
| metadata | �{} |
| thread_id | |
| depends_on_issue_id | sr-ht-ecore-g3r |
| depends_on_wisp_id | NULL |
| depends_on_external | NULL |
| id | 50d909f3-e703-5206-8c86-605257d183b2 |
| issue_id | sr-ht-ecore-g3r.2 |
| type | parent-child |
| created_at | 2026-08-16T21:37:48Z |
| created_by | Eugene Blikh |
| metadata | �{} |
| thread_id | |
| depends_on_issue_id | sr-ht-ecore-g3r |
| depends_on_wisp_id | NULL |
| depends_on_external | NULL |
| id | 64b204ca-7ac0-5425-b8eb-f47e06c0724a |
| issue_id | sr-ht-ecore-g3r.6 |
| type | parent-child |
| created_at | 2026-08-16T22:35:26Z |
| created_by | Eugene Blikh |
| metadata | �{} |
| thread_id | |
| depends_on_issue_id | sr-ht-ecore-g3r |
| depends_on_wisp_id | NULL |
| depends_on_external | NULL |
| id | bae5162f-7729-5b93-a537-9df43e6a9680 |
| issue_id | sr-ht-ecore-g3r.4 |
| type | parent-child |
| created_at | 2026-08-16T21:37:50Z |
| created_by | Eugene Blikh |
| metadata | �{} |
| thread_id | |
| depends_on_issue_id | sr-ht-ecore-g3r |
| depends_on_wisp_id | NULL |
| depends_on_external | NULL |
| id | ebc848cd-b26e-5f0b-bec4-442ad9c69067 |
| issue_id | sr-ht-ecore-g3r.3 |
| type | parent-child |
| created_at | 2026-08-16T21:37:49Z |
| created_by | Eugene Blikh |
| metadata | �{} |
| thread_id | |
| depends_on_issue_id | sr-ht-ecore-g3r |
| depends_on_wisp_id | NULL |
| depends_on_external | NULL |
| id | ff2cf065-8a99-5350-8c91-ba482dc1acb0 |
| issue_id | sr-ht-ecore-g3r.1 |
| type | parent-child |
| created_at | 2026-08-16T21:37:37Z |
| created_by | Eugene Blikh |
| metadata | �{} |
| thread_id | |
| depends_on_issue_id | sr-ht-ecore-g3r |
| depends_on_wisp_id | NULL |
| depends_on_external | NULL |
| id | 01a00bd4-3006-75b1-bf8f-d187dcf3f1f6 |
| issue_id | sr-ht-ecore-g3r |
| event_type | created |
| actor | Eugene Blikh |
| old_value | |
| new_value | |
| comment | NULL |
| created_at | 2026-08-16T21:27:30Z |
No comments.