amadan
CLI-API × scoped-keys intersection follow-ups (from merge-resolution review of #25) Issue open
Migrated from github.com/carlosframework/platform issue #26, opened 2026-08-03. GitHub issues are closed for this repo; see AGENTS.md, "Work is tracked on amadan, not GitHub".
Still outstanding: Follow-up hardening from the #25 merge review: an inert-scoped-key warning, a test for the console's root-key-only guard, and intersection tests.
---
From the fa41fc9 merge-resolution review (verdict CLEAN, nothing exploitable). Follow-ups, none deploy-blocking:
- Warn when a scoped key is inert — API mode silently ignores CARLOSRELEASEKEY; print one line ("ignoring CARLOSRELEASEKEY — API mode promotes with your console membership") so operator belief matches behavior. Docs already state it (a1bd7c6).
- Test the console's root-key-only guard — cmd/console/main.go:207 is the single untested check protecting five signing doors (grew from three in #25); serve() needs a test seam for it.
- Intersection test coverage — console API doors against grant-signed pointers: channels rendering a grant-bearing pointer, promote climbing a ladder whose lower rung was scoped-signed, rollback over a scoped-signed pointer. All verified-by-inspection correct today.
- Grant-label exposure in channel error rows — a member's CLI token can read grant labels/timestamps via verifyPointer error text in per-row errors; consider trimming to a generic message.
- Also noted: RootSigner anchors on key.Public() not cfg.ReleasePub — matters only during a root-key rotation drill; both directions fail closed.
🤖 Generated with Claude Code