ZeroClaw binds tools and channels to authenticated principals

zeroclaw-labs/zeroclaw PR #10263 is the inspected primary source: “feat(security): compose principal tool selectors into agent sessions (#8289, supersedes #8672 in part).” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- zeroclaw-labs/zeroclaw PR #10263 was created 2026-08-22T22:36:03Z and was open at inspection; its title is “feat(security): compose principal tool selectors into agent sessions (#8289, supersedes #8672 in part).” - zeroclaw-labs/zeroclaw PR #10259 was created 2026-08-22T14:52:17Z and was open at inspection; its title is “feat(security): enforce authenticated principals on RPC with native+peercred (#8289 stage 3, supersedes #8672 in part).” - zeroclaw-labs/zeroclaw PR #10246 was created 2026-08-22T04:09:27Z and was open at inspection; its title is “fix(rpc): expose configured channels to sessions.” - The repository reported 32636 stars, 789 open issues, default branch master, and last push 2026-08-23T00:35:13Z. - The latest tagged-release baseline checked was v0.8.4 published 2026-08-02T21:00:00Z.

What changed

zeroclaw-labs/zeroclaw PR #10263 reports: **Stacked on #10259** (→ #10255 → #10248) — review scope is the single commit feat(runtime): compose the principal tool selector into agent sessions; everything before it belongs to the parent PRs. Depends on #10259. Summary **Base branch:** master **What changed and why:** The resolved grants' allowed_tools selector now composes into agent sessions: at session/new (and session rehydrate), the dispatcher derives a per-run narrowing from the bound principal — None for admin or an explicit "*", otherwise the named list — and threads it through the agent builder's existing per-run allowed_tools channel (the same mechanism cron job narrowing uses). The result is composition by intersection with the agent's own risk-profile policy; an empty selector yields a tool-less session. This lifts the deliberate fail-closed posture #10259 shipped with: a principal with a constrained tool selector was refused session/new rather than silently under-enforced. Now the constraint is enforced, so scoped principals become actually usable. Narrowing binds at session creation: selector changes reach new sessions, and revoking a principal's session grants cuts existing sessions off at the per-operation gate (documented in the book page). **Scope boundary:** No change to the coarse gate, providers, or handshake. No session/memory ownership (#8290 slice), no gateway consumption (#6250), no enrollment. The Resource::Tools classification (direct tool-surface reads like tools/param-options) is unchanged; this composes the selector into agent-run assembly. **Blast

zeroclaw-labs/zeroclaw PR #10259 reports: **Stacked on #10255** (which stacks on #10248) — review scope is the nine commits from feat(log): add principal attribution fields onward; earlier commits belong to the parent PRs and fall out of the diff as they merge. Depends on #10255. Depends on #10248. Summary **Base branch:** master **What changed and why:** This is the #8289 Stage 3 boundary — the first behavior-changing slice, landing RPC enforcement together with the native and peercred compatibility providers so no enforced-but-unusable interval exists. initialize now authenticates: an explicit auth_token selects its named provider (default native), a kernel peer credential routes to peercred, and only a local connection with no [users] roster keeps the legacy trusted shared-operator path. Remote connections without a credential are refused. tui_id/tui_sig grants no authority anymore — reconnect re-presents a credential by construction. Every one of the 87 RPC methods is classified to a required resource-verb grant (Method::authz(), arm-complete match: an unclassified new method is a compile error) and gated per call, after checks for credential expiry, revalidation deadlines, live pairing revocation, and authorization-generation staleness (grants re-resolve when policy changed — profile/roster/mapping edits reach established connections without reconnect). **One live pairing authority:** the daemon owns the PairingGuard and shares the instance with the gateway, so /pair and revocation act on RPC authentication immediately (no boot-time token snapshot). Established native connections retain

zeroclaw-labs/zeroclaw PR #10246 reports: Summary **Base branch:** master (all contributions) **What changed and why:** Seeds configured channel handles into new and rehydrated RPC agents before adding the synthetic rpc back-channel, so channel-backed tools can reach the channels already authorized for the selected agent. Applies the same selected-agent channel filtering to the existing CLI and process-message paths while preserving the no-bindings compatibility fallback. Reuses the daemon's supervised Arc clients instead of reconstructing authenticated channel clients inside each RPC session. Resets and republishes the live channel registry per daemon generation, gates fresh local/WSS RPC listeners until that generation is ready, and drains accepted connections during reload so an old RPC context cannot use stale channel clients. **Scope boundary:** No Git-specific path, config/schema change, new channel authorization rule, or asynchronous plugin-channel activation. rpc remains the conversational default, and existing per-agent channel bindings remain the capability boundary. **Blast radius:** Runtime channel-handle construction, RPC new-session and rehydration paths, daemon channel-registry publication, and local/WSS RPC connection lifetime during reload. **Linked issue(s):** Closes #10225. Related #10146. **Labels:** bug, core, cli, agent, channel, channel:core, runtime, domain:architecture, risk:high, size:XL. What this does, simply ZeroClaw could already connect to a configured service such as GitHub, but a Code session did not receive access to that existing connection. A Git tool therefore reported that only the session's internal reply channel was available even when the

Why it matters

An RPC connection is not an authorization principal by itself. Tool reach and channel reach need the same authenticated identity when sessions are created and rehydrated. The operator test is whether the system remains bounded and its receipts still describe the action after failure, retry or restart.

Current

The primary record was open when captured on 2026-08-23. The tagged-release baseline was v0.8.4 published 2026-08-02T21:00:00Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/zeroclaw-labs/zeroclaw/pull/10263. Supporting records are https://github.com/zeroclaw-labs/zeroclaw/pull/10259 and https://github.com/zeroclaw-labs/zeroclaw/pull/10246. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Authenticate before session construction, compose principal selectors with agent policy, and expose only configured channels authorized for that principal. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.