Fullsend

Appearance

77. Mint repos scope hardening with PER_ORG_FOREIGN_COMPAT ​

Date: 2026-08-02

Status ​

Accepted

Context ​

ADR 0060 authorized cross-org minting via FOREIGN org variables and treated empty repos as installation-wide on both same-org and foreign paths. Same-org callers could also request arbitrary repo lists. That blast radius conflicts with least privilege in the security threat model: a compromised enrolled workflow could mint tokens for repos other than the one that authenticated.

Org-mode dispatch still needs limited exceptions — .fullsend callers minting across enrolled repos, and enrolled callers minting {self,.fullsend} — without restoring unrestricted same-org scope.

Options ​

  1. Keep ADR 0060 defaults. No code change; rely on WIF enrollment alone. Rejected: enrollment does not bound repos to the authenticating repository.
  2. Strict requesting-repo only, no exceptions. Simplest rule. Rejected: breaks established .fullsend / org-mode dispatch shapes.
  3. Default-deny with an explicit compat flag. Deny installation-wide and broad same-org lists by default; gate the known org-mode shapes behind PER_ORG_FOREIGN_COMPAT.

Decision ​

After OIDC verification, the mint enforces repos scope as follows:

  1. Normalize a sole ["*"] entry to empty (alias for empty repos only). Mixed * lists remain invalid pattern input.
  2. Foreign (cross-org) requests require empty repos. Non-empty lists are denied. FOREIGN gating from ADR 0060 still applies.
  3. Same-org requests must list exactly the requesting repository's bare name. Empty repos (installation-wide) is always denied on the same-org path.
  4. PER_ORG_FOREIGN_COMPAT (env / worker config; truthy = 1/true/yes) unlocks only these same-org exceptions:
    • Caller repository .fullsend: any non-empty validated repo list
    • Other enrolled callers: exactly [.fullsend] or {requestingBare, .fullsend}
  5. The effective flag is visible on GET /v1/status as per_org_foreign_compat and in fullsend mint status (from traffic env; absent = off).

This revises the installation-wide and unrestricted same-org repos consequences of ADR 0060; FOREIGN allowlists and target_org remain as decided there.

Consequences ​

  • Same-org workflows that omitted repos or listed unrelated repos break until they request only the calling repo, or operators enable PER_ORG_FOREIGN_COMPAT for the documented org-mode shapes.
  • Foreign mints cannot carry a non-empty repos list; installation-wide foreign tokens remain possible only with empty repos plus FOREIGN authorization.
  • Hosted and standalone mints must set PER_ORG_FOREIGN_COMPAT explicitly where org-mode dispatch is required; the default is off.
  • ADR 0060's earlier allowance of same-org installation-wide tokens is superseded for repos policy by this decision (FOREIGN mechanism unchanged).

Later note: ADR 0083 relaxes the foreign empty-repos constraint. Cross-org requests with non-empty repos are now permitted when each target repo has a repo-level FULLSEND_FOREIGN_<ROLE>_REPOS variable authorizing the caller.