All runbooks
runbookuapiredacted view

UAPI GLM 5.2 Auth Role Gate Test Matrix 2026-06-22

GLM 5.2 test matrix for unified login, role assertions, wrong-role denial, expired sessions, and lane mismatch.

Updated 2026-06-22·Freshness: Reference·Sensitive tokens or credentials were hidden before display.

UAPI GLM 5.2 Auth Role Gate Test Matrix 2026-06-22

GLM 5.2 test matrix for unified login, role assertions, wrong-role denial, expired sessions, and lane mismatch.

Promotion Metadata

  • Source feedback id: 123
  • Source feedback ids: 123
  • Promotion request id: 54
  • Feedback category: beneficial
  • Feedback source: [REDACTED:high-entropy]
  • Feedback created at: 2026-06-22T18:27:40.706980+00:00
  • Target slug: [REDACTED:high-entropy]
  • Review state: review
  • Reviewer note: AI lane auto-promoted redacted feedback into internal catalog context.

Source Feedback Body

Feedback 123

  • Product: uapi
  • Category: beneficial
  • Related slug: [REDACTED:high-entropy]
  • Source: [REDACTED:high-entropy]
  • Created at: 2026-06-22T18:27:40.706980+00:00

GLM 5.2 — Auth Role Gate Test Matrix

Date: 2026-06-22 Lane: Unified login / role gates (first wedge) Sources: contract-fit-review, adapter-boundary-and-demo-plan (same date), agent-work-queue-v1-scaleout. Assumptions: Codex confirms role_assertions on UnifiedIdentityPrincipal and lane on LoginSession. Mock principals used; no Explorer auth.

Principal Types Under Test

Type Mock Principal Role Set Allowed Lanes
Human human-operator-01 operator embedding, light-inference
Human human-viewer-01 viewer (read-only, no dispatch)
Service svc-embed-bot service-provider embedding only
AI-agent ai-dispatch-agent-01 agent-dispatcher embedding, light-inference
Device nuc-edge-07 device-endpoint device-local only

Test Cases

T1: Valid login — human operator → embedding lane

  • Input: human-operator-01 with role_assertions = ["operator"], requests lane embedding.
  • Expected: LoginSession created with principal_ref, lane = "embedding", issued_at, expires_at.
  • Gate: Identity Gate → allow. GateRecord: decision = allow.
  • EventEnvelope: emitted with correlation_id from session.

T2: Valid login — service principal → embedding lane

  • Input: svc-embed-bot with role = "service-provider", requests lane embedding.
  • Expected: Session created, lane locked to embedding only.

T3: Valid login — AI-agent principal → light-inference lane

  • Input: ai-dispatch-agent-01 with role = "agent-dispatcher", requests lane light-inference.
  • Expected: Session created, Identity Gate allow, Placement Gate may fire.

T4: Valid login — device principal → device-local lane

  • Input: nuc-edge-07 with role = "device-endpoint", requests lane device-local.
  • Expected: Session created, restricted to device-local dispatch.

T5: Wrong-role denial — viewer requests embedding dispatch

  • Input: human-viewer-01 with role = "viewer", requests lane embedding.
  • Expected: Identity Gate denies. GateRecord: decision = deny, reason = "role viewer not authorized for lane embedding".
  • EventEnvelope: emitted with deny decision.

T6: Wrong-role denial — service principal requests wrong lane

  • Input: svc-embed-bot (service-provider) requests lane light-inference.
  • Expected: Denied. Service-provider role only unlocks embedding.

T7: Wrong-role denial — hardware-researcher (Grok lane role)

  • Input: Principal with role = "hardware-researcher" requests Conductor dispatch.
  • Expected: Denied; that role does not unlock Conductor lanes.

T8: Expired session — replay attempt

  • Input: LoginSession where expires_at < now. Principal attempts job submit.
  • Expected: Identity Gate denies before Placement. GateRecord: decision = deny, reason = "session expired".

T9: Lane mismatch — valid session, wrong lane job

  • Input: human-operator-01 has session with lane = "embedding", submits job targeting light-inference.
  • Expected: Placement Gate or Identity Gate denies. Session lane must match job lane.

T10: Missing role_assertions — malformed principal

  • Input: Principal with no role_assertions field.
  • Expected: Identity Gate denies. GateRecord: reason = "missing role_assertions".

Assertion Summary

Every test must produce: 1. A GateRecord with gate_name, decision, reason. 2. An EventEnvelope with correlation_id threaded from LoginSession. 3. No session creation on denial paths.

Blockers

  • Codex must confirm role_assertions field name and allowed role enumeration.
  • Lane-to-role mapping table needs Codex sign-off.

Next Handoff

→ Codex: confirm role set and lane mapping. → GLM Worker B: incorporate session state into job lifecycle state machine.