Problem
Several existing bootstrap and local-control compatibility paths can silently acquire or lose the authority of the default bootstrap principal:
- Kernel and admin management routers resolve a missing or malformed IPC principal as
PrincipalId::default(). A caller that reaches either router without a valid host-stamped identity can therefore be evaluated as the bootstrap administrator.
- Connection tracking independently applies the same fallback, so malformed lifecycle traffic can be attributed to
default.
- Default-admin profile seeding warns and continues when profile/key creation fails, and legacy profile migration errors are also swallowed. The daemon can finish booting without the policy or key material required for its bootstrap anchor.
admin.agent.modify can remove the built-in admin group from default, despite delete, disable, and capability-revoke paths already protecting that principal.
These are fail-open authority transitions. They must be corrected before the first product release without changing the intentional local CLI behavior that selects an active principal before publishing a request.
Required behavior
- Require a valid principal on parsed kernel and admin management requests. Missing and malformed identities return one deterministic denial and never fall back to
default.
- Keep active-principal defaulting in the local CLI unchanged.
- Attribute a lifecycle event with no identity to the explicit no-capability
anonymous principal, and ignore malformed lifecycle identities. Neither path may move default's counter.
- Propagate default profile seeding, bootstrap key creation, stale-profile cleanup, and legacy-profile migration failures through
Kernel::with_resources / Kernel::new so boot aborts.
- After applying an
AgentModify group delta to default, require the resulting profile to retain the built-in admin group. Removing and re-adding it in one idempotent request remains valid, as do other non-destructive modifications.
- Add live-router, connection-tracker, injected-resource boot, and handler regressions for every behavior above.
- Preserve the existing public Rust and wire APIs.
Dependencies and exclusions
The implementation should build on #1238 because both changes touch the kernel-router authority snapshot path. The PR should still target main and merge only after #1238.
This issue does not implement persisted authority-profile migration, wildcard removal, recovery redesign, authenticated control RFCs, or any AOS-specific identity or privilege.
Problem
Several existing bootstrap and local-control compatibility paths can silently acquire or lose the authority of the
defaultbootstrap principal:PrincipalId::default(). A caller that reaches either router without a valid host-stamped identity can therefore be evaluated as the bootstrap administrator.default.admin.agent.modifycan remove the built-inadmingroup fromdefault, despite delete, disable, and capability-revoke paths already protecting that principal.These are fail-open authority transitions. They must be corrected before the first product release without changing the intentional local CLI behavior that selects an active principal before publishing a request.
Required behavior
default.anonymousprincipal, and ignore malformed lifecycle identities. Neither path may movedefault's counter.Kernel::with_resources/Kernel::newso boot aborts.AgentModifygroup delta todefault, require the resulting profile to retain the built-inadmingroup. Removing and re-adding it in one idempotent request remains valid, as do other non-destructive modifications.Dependencies and exclusions
The implementation should build on #1238 because both changes touch the kernel-router authority snapshot path. The PR should still target
mainand merge only after #1238.This issue does not implement persisted authority-profile migration, wildcard removal, recovery redesign, authenticated control RFCs, or any AOS-specific identity or privilege.