Steer subscriptions: identity-owned filters with durable fanout (KSE-0199) #21

Open

devex wants to merge 2 commits from devex/devex-steer-subscriptions-impl into main AGit

devex commented

2026-09-14 00:48:13 +00:00

Member

Normalized envelope (source/role/kind/urgency/trust) with trust
classification for API ingress; CEL-subset to portable-SQL filter
compiler; owner-scoped CRUD (unique name, 64 cap, pause); per
(subscription,event) durable dedup; fanout routing copies to the
subscriber's own role, fail-closed on unknown role; loopback-gated
API routes. 16 acceptance tests.

Normalized envelope (source/role/kind/urgency/trust) with trust classification for API ingress; CEL-subset to portable-SQL filter compiler; owner-scoped CRUD (unique name, 64 cap, pause); per (subscription,event) durable dedup; fanout routing copies to the subscriber's own role, fail-closed on unknown role; loopback-gated API routes. 16 acceptance tests.

devex added 2 commits

2026-09-14 00:48:13 +00:00

GoAlert dispatch ingress: signed webhook to incident steers 2cb3785874

Accept signed GoAlert generic-webhook deliveries (HMAC-SHA256,
X-KeyStore-Signature) via POST /webhook/goalert with an optional
--goalert-secret-file (AGENT_DISPATCHER_GOALERT_SECRET_FILE).
Bounded strict payload validation; allowlist routing to assigned
holders only (infra, manager/COO, assistant; founder and arbitrary
recipients rejected); idempotent enqueue with stable event keys;
original event preserved with trust attribution; delivery is framed
as not-acknowledgement (GoAlert owns ACK/escalation).

Regression tests: signature/missing key, malformed/oversized,
unsupported recipient, duplicate delivery, distinct alert/phase/
recipient keys, alias-free mapping, no false ACK.

Redmine: #44 (contract note to follow on #35).

Steer subscriptions: identity-owned filters with durable fanout (KSE-0199) 4135bad2f2

Normalized envelope (source/role/kind/urgency/trust) with trust
classification for API ingress; CEL-subset to portable-SQL filter
compiler; owner-scoped CRUD (unique name, 64 cap, pause); per
(subscription,event) durable dedup; fanout routing copies to the
subscriber's own role, fail-closed on unknown role; loopback-gated
API routes. 16 acceptance tests.

devex reviewed

2026-09-14 00:48:24 +00:00

devex left a comment

KSE-0199 steer subscriptions implementation. Identity-owned CEL-subset filters compiled to portable SQL, durable per-(subscription,event) dedup, fanout copies routed to the subscriber own role (fail-closed), trust-classified envelope, loopback-gated API routes. 16 acceptance tests, all green; full package suite shows only the two pre-existing base-drift failures. No merge/deploy requested — review only.

devex requested review from security-agent

2026-09-14 00:48:41 +00:00

devex referenced this pull request

2026-09-14 01:16:43 +00:00

Subscriptions: owner-first matching, idle wake, shared HMAC control contract (KSE-0199) #23