Follow-up to #9 (closed) — the identity-scoped dispatch subject contract has landed, so the client's publish subject is now identity-bearing.
Context
pgCK v0.4.24 closed the server-derived dispatch identity work (styk-tv/pgCK#10). The NATS auth-callout admits a connection and the broker enforces an identity-scoped subject segment: a verified connection may publish only on its own
input.kernel.pgCK.id.<sub>.action.>
The legacy input.kernel.pgCK.action.<verb> still routes, but as an anonymous dispatch (back-compat). The acting identity is read from the broker-enforced subject segment — never a payload field or header — and set as ckp.requester before dispatch, so the seal records the real created_by and delivered events carry by: urn:ckp:participant:<sub>.
Requirement (WHAT, not how)
When the client is connected under a verified identity, dispatch actions must be published on the identity-scoped subject:
input.kernel.pgCK.id.<sub>.action.<verb>
so that the dispatch seals with the real created_by and the delivered event's by carries the true subject. Publishing on the legacy subject yields anonymous attribution (subscribe-only clients and unverified connections are unaffected).
Never-assert is preserved
The client still never asserts identity in the payload. <sub> is the broker-enforced identity of the verified connection surfaced to the client (from its own connect context), used solely to form the subject the broker already permits — not a client claim. A forged <sub> on the wire is denied by the broker and never seals.
Links
Scope: WHAT-only — the client-side "how" is this repo's.
Follow-up to #9 (closed) — the identity-scoped dispatch subject contract has landed, so the client's publish subject is now identity-bearing.
Context
pgCK v0.4.24 closed the server-derived dispatch identity work (styk-tv/pgCK#10). The NATS auth-callout admits a connection and the broker enforces an identity-scoped subject segment: a verified connection may publish only on its own
The legacy
input.kernel.pgCK.action.<verb>still routes, but as an anonymous dispatch (back-compat). The acting identity is read from the broker-enforced subject segment — never a payload field or header — and set asckp.requesterbefore dispatch, so the seal records the realcreated_byand delivered events carryby: urn:ckp:participant:<sub>.Requirement (WHAT, not how)
When the client is connected under a verified identity, dispatch actions must be published on the identity-scoped subject:
so that the dispatch seals with the real
created_byand the delivered event'sbycarries the true subject. Publishing on the legacy subject yields anonymous attribution (subscribe-only clients and unverified connections are unaffected).Never-assert is preserved
The client still never asserts identity in the payload.
<sub>is the broker-enforced identity of the verified connection surfaced to the client (from its own connect context), used solely to form the subject the broker already permits — not a client claim. A forged<sub>on the wire is denied by the broker and never seals.Links
msg.byread surface) — closed, delivered in v1.5.5./wss): Attach server-verified identity to the connection (edge/transport) sporaxis-com/oci-germination#19.Scope: WHAT-only — the client-side "how" is this repo's.