Plan 08 steps 1–2: owner-mode signing via the tenant's AA wallet - #83
Merged
Merged
Conversation
An operator tenant configures a Kernel v3.1 AA wallet + root key as a tenant credential; when that wallet owns a vehicle, this service signs operations itself through the sudo validator instead of requiring a passkey or the owner-registered-our-signer arrangement. Decisions locked 2026-08-31; first slice is fleet-lite sharing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015pBnm1rp9MV5SDWj8hkbGk
Two columns on tenant_credentials (aa_wallet_address, aa_wallet_key_enc, both-or-neither enforced by a CHECK), a strict config endpoint that refuses a wallet the chain cannot verify — deployed code, sudo ECDSA validator owner matching the supplied key, RPC answering the configured chain — and an AAWalletSigner decrypt path with the same one-operation-lifetime rule as every other key here. Reads resolve effectively, so a managed customer sees (and will later share with) its operator's wallet; writes land only where the license lives. The validator storage getter (0x20709efc) was verified against the deployed Polygon contract before being coded. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015pBnm1rp9MV5SDWj8hkbGk
AuthorizeShare now answers WHICH WAY to sign: when the live owner is the tenant's own AA wallet, the share or revoke goes through the kernel's sudo validator, signed with the wallet's root key — no passkey, no owner-registered-our-signer arrangement. Everything else falls through to the signer path unchanged. One switch, three surfaces: AA_BUNDLER_URL (its own ZeroDev project — sponsorship is per-project, and the sponsoring project was confirmed 2026-08-31) gates the authorizer, the display gate and the workers through OwnerModeConfigured, so half-configured means off everywhere, never a wrong-validator attempt. The chart wires it from ASM behind a values flag rather than into values itself — this repo is public and the URL embeds the project id. One long-lived owner client serves every tenant's wallet: the op is built for the job's wallet, signed by a per-job signer, submitted pre-signed. Typed shared operations refuse owner-mode vehicles (409 at the endpoint, a named error in the worker) until step 7. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015pBnm1rp9MV5SDWj8hkbGk
JamesReate
changed the title
The sponsoring ZeroDev project is the one BUNDLER_URL already carries, so AA_BUNDLER_URL held the same value twice and is folded away, along with the chart's gated remoteRef and values flags. OwnerModeConfigured now equals SharingConfigured — kept as its own method because three surfaces consult it by name. The feature's switch is the per-tenant aa_wallet credential row: clear it to turn one tenant off, empty a sharing setting to turn everything off. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015pBnm1rp9MV5SDWj8hkbGk
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015pBnm1rp9MV5SDWj8hkbGk
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015pBnm1rp9MV5SDWj8hkbGk
FilterSignable's refactor left tenantSigner unused (lint), and the new FilterSignableOwnerMode test called testStore with the parent test's t from inside subtests — on a runner with no database that turns the skip into a panic. The fixture now takes the subtest's t. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015pBnm1rp9MV5SDWj8hkbGk
JamesReate
marked this pull request as ready for review
September 1, 2026 14:53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Plan 08 (
docs/plans/08-aa-owner-signing.md, in this PR): an operator tenant configures a Kernel v3.1 AA wallet + root key as an encrypted tenant credential; when that wallet owns a vehicle, this service signs shares and revokes itself through the sudo validator — no passkey, no owner-registered-our-signer arrangement. Managed customers inherit through effective-credential resolution.Step 1 — credential + config surface. Migration
20260831120000(two columns ontenant_credentials, both-or-neither CHECK);PUT/GET/DELETE /v1/tenants/{id}/credentials/aa-walletbehind the standard scope check. Strict validation before anything persists: address/key parse, license-holder check, and on chain — RPC answers the configured chain, the kernel is deployed, and the sudo ECDSA validator's owner record (ecdsaValidatorStorage(address), verified against the deployed Polygon contract) matches the supplied key. The key goes in and never comes out;CredentialService.AAWalletSignerdecrypts it for one operation at a time.Step 2 — owner mode in the sharing engine.
AuthorizeSharereturns the mode; share/revoke workers dispatch by it (sendByMode) — owner mode routes through a newOwnerClient(one long-livedzerodev.Client, per-job wallet + signer, raw-hash sudo signature), signer mode is byte-for-byte the existing path.shareable-ownersreports the AA wallet as a configuration-backed positive with anownerModeWalletfield. Owner mode rides the sharing config — one ZeroDev project carries both signing paths (the sponsoring project isBUNDLER_URL's, confirmed), soOwnerModeConfigured()equalsSharingConfigured()and the feature's switch is the per-tenant wallet row: clear it to turn one tenant off, empty a sharing setting to turn everything off. Typed shared operations refuse owner-mode vehicles (409 + worker guard) until step 7.Ships dark: no tenant has an AA wallet until the console lands (step 3).
Note:
TestRenewMembershipNeverBackdatesfails on origin/main as well (date-sensitive, unrelated); everything else is green.🤖 Generated with Claude Code
https://claude.ai/code/session_015pBnm1rp9MV5SDWj8hkbGk