fix(kernel): preserve device attenuation across authority views

[joshuajbouw]

Linked Issue

Closes #1237

Refs #1228 and astrid-runtime/rfcs#36.

Summary

Preserves the authenticating device's attenuation across every kernel authority view touched by capsule inventory, agent/group listing, and pair-device delegation. No product-specific trust path or public wire change is introduced.

Changes

• centralize canonical device-key resolution with malformed, unknown, and revoked IDs denied
• pin the authorized principal profile, group config, and resolved device scope at one policy-decision point per request
• use that exact authorization snapshot for capsule inventory, agent/group visibility, and pair delegation
• derive the dispatch principal from the snapshot so authority and identity cannot diverge internally
• preserve existing no-device and Full device behavior
• require effective self:auth:pair:admin before a scoped child may contain bare *
• retain issuer denies in every scoped child
• make profile-cache invalidation generation-aware per principal so an older concurrent disk load cannot republish pre-revocation authority and unrelated principals do not retry
• keep unknown-device assertions at the router authorization boundary rather than private handlers that cannot receive them in production
• preserve one outward scope-denial reason for malformed, unknown, revoked, and valid scoped denials so authorization responses do not become a device-key existence oracle; structured security logs retain the operator cause
• add regressions across capsule inventory, agent/group views, pair delegation, broad-scope minting, stale-load publication, cross-principal cache isolation, and outward denial opacity

Verification

• cargo fmt --all -- --check
• git diff --check
• deterministic snapshot regressions authorize, revoke and invalidate, prove a later request fails, then prove the in-flight request keeps the authority already audited as allowed
• focused regressions cover no-device, Full, scoped allow/deny, malformed, unknown, revoked, concurrent stale-profile, cross-principal invalidation, and denial-reason opacity
• compilation, tests, Clippy, and platform coverage run in repository CI

Checklist

• Linked to an issue
• CHANGELOG.md updated under [Unreleased]

[Copilot]

Pull request overview

This PR closes #1237 by ensuring the authenticating device’s DeviceScope attenuation is consistently applied across kernel “secondary” authority views (capsule inventory surfaces, admin agent/group listing, and pair-device delegation), and by hardening profile-cache invalidation against concurrent stale-load republish.

Changes:

• Centralizes device-scope resolution into a shared helper and applies it to capsule inventory visibility plus agent/group list “global view” gates.
• Tightens pair-device issuing rules so scoped requests containing a bare * require effective self:auth:pair:admin, and unknown/malformed/revoked device IDs fail closed.
• Makes astrid-capsule’s PrincipalProfileCache invalidation generation-aware to prevent stale concurrent disk loads from republishing pre-invalidation authority.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/astrid-kernel/src/kernel_router/tests.rs	Adds regression coverage asserting device attenuation is preserved across capsule inventory endpoints and unknown/malformed device IDs fail closed.
crates/astrid-kernel/src/kernel_router/mod.rs	Wires device_key_id into capsule inventory visibility and centralizes device scope resolution for request authorization and visibility.
crates/astrid-kernel/src/kernel_router/device_scope.rs	Introduces shared, fail-closed device-scope resolver for kernel authority checks.
crates/astrid-kernel/src/kernel_router/admin/state_tests.rs	Adds regression ensuring agent list global visibility is attenuated by device scope.
crates/astrid-kernel/src/kernel_router/admin/state_tests_group.rs	Adds regression ensuring group list global visibility is attenuated by device scope.
crates/astrid-kernel/src/kernel_router/admin/pair_device_tests.rs	Expands coverage for unknown/revoked issuer devices, universal * scoped mint gate, and deny inheritance behavior.
crates/astrid-kernel/src/kernel_router/admin/pair_device_handlers.rs	Applies authenticated device scope to the issuer effective-capability checks and adds universal * scoped mint gate.
crates/astrid-kernel/src/kernel_router/admin/mod.rs	Ensures admin dispatch passes authenticated device id through for secondary views and delegation.
crates/astrid-kernel/src/kernel_router/admin/handlers.rs	Applies authenticated device scope when deciding whether AgentList can return the global roster.
crates/astrid-kernel/src/kernel_router/admin/group.rs	Applies authenticated device scope when deciding whether GroupList can return the global group view.
crates/astrid-capsule/src/profile_cache.rs	Adds generation tracking so invalidation prevents stale concurrent loads from republishing prior profiles.
CHANGELOG.md	Documents the security fix under [Unreleased].

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated no new comments.