mathias/hyperguild
1
0
Fork 0
Code Issues 30 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Provenance: first-party writers (claudewatcher, pipeline) stamp origin: unknown — add an internal origin #148

New Issue
Open
opened 2026-10-01 20:19:45 +00:00 by mathias · 0 comments
mathias commented 2026-10-01 20:19:45 +00:00
Owner
Copy Link
Copy Source

Follow-up to #145 / PR #147.

Provenance is stamped from the authenticated MCP/capture principal. Writers that bypass both, such as claudewatcher, the ingestion pipeline and REST POST /write, carry no principal and stamp origin: unknown. That's correct as a fail-closed default. But a trusted first-party source then looks the same as an anonymous one, which makes the signal noisier for a reader who wants to discount connector-written entries.

Wanted

These in-process writers pass an explicit Origin: "internal" through api.WriteNoteOptions, with WrittenBy set to the component name. REST /write stays unknown, because its body is caller-controlled and must never set provenance.

Done when

A claudewatcher-written fact shows origin: internal, written_by: claudewatcher, and a test proves REST /write still stamps unknown.

Blocked on #147 merging.

Created via git-mcp on behalf of @mathias

Follow-up to #145 / PR #147. Provenance is stamped from the authenticated MCP/capture principal. Writers that bypass both, such as claudewatcher, the ingestion pipeline and REST `POST /write`, carry no principal and stamp `origin: unknown`. That's correct as a fail-closed default. But a trusted first-party source then looks the same as an anonymous one, which makes the signal noisier for a reader who wants to discount connector-written entries. ## Wanted These in-process writers pass an explicit `Origin: "internal"` through `api.WriteNoteOptions`, with `WrittenBy` set to the component name. REST `/write` stays `unknown`, because its body is caller-controlled and must never set provenance. ## Done when A claudewatcher-written fact shows `origin: internal`, `written_by: claudewatcher`, and a test proves REST `/write` still stamps `unknown`. Blocked on #147 merging. --- _Created via git-mcp on behalf of @mathias_
mathias added the risk/lowsize/stype/feat labels 2026-10-01 20:19:45 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agent/ready
Meets the agent-ready contract; authorizes unattended execution
 blocked/client
Waiting on the client
 blocked/supplier
Waiting on a supplier
 blocked/upstream
Waiting on an upstream project or vendor
 risk/high
Irreversible, security-relevant, or control plane
 risk/low
Reversible, local, test-covered
 risk/medium
Touches shared state, deploys or data
 size/l
Too big - split it
 size/m
Under two days
 size/s
Under half a day
 size/xs
Under an hour
 status:dispatch
status:dispatched
status:review
status:reviewing
type/chore
Maintenance, no behaviour change
 type/decision
Human decision required; never agent/ready
 type/docs
Documentation only
 type/feat
New capability
 type/fix
Corrects broken behaviour
 type/ops
Infrastructure, deploy, runtime
 type/research
Investigate; output is a finding, not code
 type/test
Test coverage only
No labels risk/low size/s type/feat
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate-bot mathias
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mathias/hyperguild#148