T-DBAL-sdf-safe-controls-token
Status: closed/done · Impact: medium · Complexity: medium
Add the first bounded operator actions to SDF — closing the observe→decide→act loop — while answering the auth question D-0013-dashboard-app deferred: mutating routes require a token; the human merge gate stays untouched.
| Location | Role today |
|---|---|
apps/sdf/ | read-only control plane after T-0DLC |
packages/rust/platform-core/ | precedent: x-platform-token auth on mutating Axum routes |
apps/sdlc/lib/services/dashboard/server.ts | POST /api/refresh — unauthenticated mutation precedent D-0013 flagged |
Proposed
Section titled “Proposed”Four controls, each a generated op with an audit trail: refresh lease
refs (fetch from lease_authority), open worktree in Finder/terminal
(zoo’s quick-actions pattern), probe sdlc orchestrate watch and surface
the verdict, and copy-affordances (branch, PR URL). HTTP mutations
require x-platform-token (generated per install, stored in app data);
desktop IPC is in-process and exempt; every action appends to an SDF
action log. Blocked/denied actions render inline, one click from the row
that surfaced them.
Approach
Section titled “Approach”- Token: platform-core pattern — mint on first run, store under app data dir, require header on mutating HTTP routes; 401 otherwise.
- Ops:
refresh_leases,open_worktree {finder|terminal},orchestrate_watch_probe; shell out togit fetch/sdlcCLI (S-0008 seams), never import substrate lib. - Audit: append JSONL action log under SDF’s runtime dir; surface last-N in UI.
- Negative tests: browser mutation without token 401s; IPC path works; read routes stay tokenless.
Files to touch
Section titled “Files to touch”| Location | Kind | Change |
|---|---|---|
apps/sdf/src-tauri/src/ | modify | token middleware, action ops, audit log |
apps/sdf/src-nuxt/app/ | modify | action buttons, action-log pane |
Acceptance criteria
Section titled “Acceptance criteria”- AC-1: mutating HTTP routes 401 without the token and succeed with it; read routes need none; desktop IPC actions work untokened.
- AC-2: refresh/open-worktree/watch-probe function end-to-end and each appends an audit record rendered in the UI.
- AC-3: no route merges PRs or mutates task/lease ownership — the bounded-controls list is enforced by test.
Out of scope
Section titled “Out of scope”- Dispatching implementation work (task-work/orchestrate ticks) — needs the human-gate decision first, since settled by D-VSLI-distributed-work-runner-architecture: gates are declared per process registration, not per autonomy level.
- Remote/network exposure (127.0.0.1 binding stands).
Dependencies
Section titled “Dependencies”T-0DLC(hard): panels the actions attach to.
Discovery context
Section titled “Discovery context”- Phase 6 of D-0018-sdf-control-plane-app; token pattern from platform-core; quick-actions and one-click-amend patterns from zoo.
Depends on
Section titled “Depends on”T-0DLC