[Iamsdt]

Part of the 1.0.0 auth revision. Replaces the authorization key and AuthorizationBackend with
one auth key that carries the role config, builds a core Identity per request, and lets storage
enforce ownership by the caller's reach. Depends on core 10xgraph branch feat/auth-identity
(Identity, Reach, ThreadNotFoundError); merge core first.

What changes

• One auth key. method (none | jwt | custom + path) plus RBAC keys next to it:
  roles (each with permissions, inherits, required reach), roles_claim,
  permissions_claim, tenant_claims, default_role, system_identities. "auth": "jwt" still
  works: default permission set, reach own.
• One validator, check_auth_config, for boot, 10xgraph config, audit and build. It refuses
  a leftover authorization or graph_introspection key, unknown roles, permissions or reach,
  inheritance cycles, reach tenant without tenant_claims, and both roles_claim and
  permissions_claim. tenant_claims must match the tenant columns on the checkpointer and store
  (refused in production, a warning otherwise).
• Permission registry (core/auth/permissions_registry.py): graph (read, invoke, stream, stop,
  fix), threads (read, write, delete), store, files (read, upload, delete), config:read,
  tasks (trigger, read, cancel), admin (read, write); wildcards resource:* and *. Default set:
  everything except admin:*. Token scope / scopes only narrow.
• BaseAuth.authorize(identity, permission, resource=None), async, defaults to the RBAC check.
  It takes no request, so the jobs worker calls it too. Every transport passes the thread or file id
  as resource. authenticate now takes an HTTPConnection (HTTP and WebSocket) and may get
  response / credential as None.
• Dependencies: RequireIdentity (401, or close 1008 on WebSocket) and
  RequirePermission("resource", "action") (403), exported from tenxgraph_api with Identity.
  The route guard refuses to boot if a non-public route has neither.
• Ownership in storage. core/threads.py::require_thread makes one scoped read before the run
  lock and any response header on every thread route and run entry point (REST, stream, WS, AG-UI,
  live, stop, observability). A foreign thread, message, memory, file or run answers 404. Reach
  widens reads, lists, deletes and stop; runs and writes always stay own.
• GET /v1/me: user_id, tenant, roles, permissions, reach; {"auth": "off"} with
  auth off.
• Jobs: the worker rebuilds config["user"] with the current role config before every run and
  checks tasks:trigger; refused or invalid identities fail the run without executing it. A task
  label identity="<name>" runs as a system identity from auth.system_identities and never
  replaces a caller's identity. /v1/tasks GET and cancel follow reach; trigger and PATCH stay own.
• Keys with tenant: run caps, idempotency, rate limit by user and the WebSocket cap are keyed by
  user id plus tenant (run_limits.identity_key).
• Removed: authorization.py, auth_backend.py, identity_cache.py, ownership_resolver.py,
  the ownership cache, tombstones, POST /v1/threads/{id}/messages (history import) and the
  authz reserved config key. request_config.py and client_filters.py moved to
  core/validation/.

Breaking changes and migration

Before	Now
"authorization": "ownership"	Delete it. Every resource is private to its owner (reach own).
"authorization": {"backend": "rbac", "roles": {...}}	auth.roles, each role with permissions and reach
"authorization": "module:MyBackend"	"auth": {"method": "custom", "path": "module:MyAuth"}; override authorize on the BaseAuth class (call super().authorize to keep roles)
authorize(user, resource, action, resource_id)	authorize(identity, "resource:action", resource)
graph_introspection	Delete it; reading the graph is graph:read
checkpointer:read/write/delete	threads:read/write/delete
tasks:invoke	tasks:trigger (tasks:pause removed)
checkpointer:import, graph:setup	Removed
403 for a foreign resource	404; 403 now means only a missing permission
config["user"] as a dict	The core Identity (identity.get(key) / identity[key] still work)

Testing

• New tests: RBAC resolution (with hypothesis), auth config validation, transport parity (REST,
  stream, WS, AG-UI, live, files pass the resource id), thread ownership and 404s, media lifecycle,
  run guard recheck, rate-limit keying, jobs worker identity rebuild, system identities and task
  reach (tests/unit_tests/jobs/test_auth.py).
• pre-commit run --all passes (ruff, mypy, bandit).
• Full suite: <fill in: N passed, coverage>

Notes for reviewers

• Risky areas: core/auth/permissions.py (authorize_resource, identity reuse with the rate
  limiter), core/threads.py::require_thread, routers/graph/run_guard.py (recheck after the
  lock), jobs/middleware.py::_run_identity (fails closed), checkpointer_service.py
  (file release on delete).
• Release: the 10xgraph floor in pyproject.toml must point to the core release that ships
  Identity.
• Docs (10xgraph-docs, docs/auth-rbac), client me() and the playground (feat/auth-me in each)
  follow in their own PRs.
• CHANGELOG: older unreleased authorization.isolation / isolation_scope / rbac backend entries
  are superseded and will be trimmed before release.

[codecov]

Codecov Report

❌ Patch coverage is 94.91194% with 52 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
tenxgraph_api/src/app/routers/graph/router.py	86.74%	8 Missing and 3 partials ⚠️
...ters/checkpointer/services/checkpointer_service.py	90.80%	4 Missing and 4 partials ⚠️
tenxgraph_api/src/app/core/auth/permissions.py	95.34%	3 Missing and 3 partials ⚠️
...enxgraph_api/cli/templates/prod/auth/agent_auth.py	50.00%	3 Missing ⚠️
tenxgraph_api/jobs/middleware.py	95.38%	3 Missing ⚠️
tenxgraph_api/src/app/main.py	40.00%	2 Missing and 1 partial ⚠️
...pi/src/app/routers/graph/services/graph_service.py	91.42%	2 Missing and 1 partial ⚠️
tenxgraph_api/cli/commands/audit.py	88.88%	1 Missing and 1 partial ⚠️
tenxgraph_api/src/app/core/threads.py	91.30%	2 Missing ⚠️
tenxgraph_api/src/app/loader.py	93.54%	0 Missing and 2 partials ⚠️
... and 7 more

📢 Thoughts on this report? Let us know!