feat(authz): kernel token verification, human principals & sign-out-everywhere (ARN-255 steps 1 + 3-kernel)

[rita-aga]

What

The kernel can now verify ES256 JWTs from a per-tenant allowlisted issuer and resolve them to a verified principal — the keystone of RFC-0002 (First-Class Authorization), rollout step 1. Additive: the existing header and AgentCredential paths are unchanged.

Pieces

• ES256 verifier (crates/temper-server/src/identity/jwt.rs): RustCrypto p256 (pure Rust, no ring). Pinned to ES256 — none/HS256/RS256 are rejected before any key is consulted, so alg-confusion can't select a different primitive. exp/nbf are validated against a caller-supplied now_unix from sim_now(), never a wall clock, so verification is DST-deterministic. 17 adversarial unit tests.
• TrustedIssuer governed entity (IOA spec + CSDL + bootstrap): per-tenant allowlist, entity id = the issuer URL, inline JWKS so verification makes no outbound call and stays deterministic; RegisterIssuer/RotateIssuerKeys/SuspendIssuer/ResumeIssuer/RevokeIssuer actions.
• Resolver (identity/resolver.rs): JWS-shaped bearers → issuer verification (cache TTL capped at the token's own exp); opaque bearers → the AgentCredential registry as before.
• SecurityContext::from_verified_jwt: maps verified claims to a principal carrying acting_for (the owning human) and role; odata bindings pick this constructor for JWT-resolved identities.

Verification

• cargo test -p temper-server --lib identity:: — 19 pass; temper-authz 66 pass; temper-platform bootstrap 33 pass. Full four-gate pre-push pipeline (fmt, clippy, readability, complete test suite) passed.
• scripts/e2e-trusted-issuer.sh boots a local server, registers a TrustedIssuer, mints real ES256 tokens, and asserts valid-accepted / rogue-key-rejected / expired-rejected / unregistered-issuer-rejected / operator-key-still-works. (Live run attached on this PR once I've run it against the built binary.)

Follow-ups (not in this PR)

• Step 2 (katagami adapter forwards the caller's token) ships in parallel; the header-trust removal is gated on that + zero header-authenticated traffic (see RFC rollout + ARN-170).
• Sign-out-everywhere: the token's auth_generation claim is carried through ResolvedIdentity, but the check needs a store the kernel can read (Member is an app entity). Decision — kernel-side generation entity vs. app liveness hook — lands with step 3.

Part of ARN-255.

🤖 Generated with Claude Code

https://claude.ai/code/session_0125RD5byAmmMuvhLaK2jsZR

Greptile Summary

Adds tenant-scoped ES256 JWT identity resolution and authorization principals.

• Introduces inline-JWKS TrustedIssuer and PrincipalGeneration governed entities.
• Maps verified human and agent JWT claims into Cedar SecurityContext values.
• Adds issuer lifecycle, generation-based sign-out and grant-revocation checks.
• Adds startup issuer registration plus unit, integration, and live E2E coverage.

Confidence Score: 2/5

The PR is not safe to merge until JWT revocation is made fail-closed, cache invalidation is coordinated with revocation actions, and issuer bootstrap covers enabled non-default tenants.

Cached JWT principals can outlive issuer suspension and generation bumps, generation lookup failures accept revoked tokens, and deployment-configured issuers are unavailable to non-default tenants.

Files Needing Attention: crates/temper-server/src/identity/resolver.rs, crates/temper-platform/src/identity_cache.rs, crates/temper-cli/src/serve/bootstrap.rs

Security Review

Two authentication revocation paths remain bypassable: cached identities are not invalidated when issuer or generation state changes, and generation-read failures are treated as an unrevoked generation.

Important Files Changed

Filename	Overview
crates/temper-server/src/identity/jwt.rs	Adds a narrowly scoped ES256 verifier with explicit algorithm, signature, issuer, audience, and time validation.
crates/temper-server/src/identity/resolver.rs	Adds tenant issuer lookup and JWT claim resolution, but cached identities and generation-read errors can bypass revocation.
crates/temper-authz/src/context.rs	Adds trusted JWT construction for human and agent principals, including role and acting-for data.
crates/temper-authz/src/engine/mod.rs	Adds built-in forbids protecting issuer and principal-generation actions from non-admin principals.
crates/temper-platform/src/bootstrap.rs	Registers the new governed specs and provides environment-driven issuer seeding.
crates/temper-cli/src/serve/bootstrap.rs	Activates environment issuer bootstrap, but only for the default tenant.
crates/temper-platform/tests/trusted_issuer_resolve.rs	Covers cryptographic and revocation behavior with fresh resolvers, leaving the shared-cache revocation path untested.

Sequence Diagram

sequenceDiagram
  participant Client
  participant Middleware as Bearer middleware
  participant Resolver as IdentityResolver
  participant Issuer as TrustedIssuer
  participant Generation as PrincipalGeneration
  participant Authz as Cedar/OData
  Client->>Middleware: Bearer JWT + tenant
  Middleware->>Resolver: resolve(tenant, token)
  alt Cached identity
    Resolver-->>Middleware: ResolvedIdentity
  else Cache miss
    Resolver->>Issuer: Read tenant issuer and JWKS
    Issuer-->>Resolver: Status, audience, keys
    Resolver->>Resolver: Verify ES256, iss, aud, exp, nbf
    Resolver->>Generation: Read human and grant generations
    Generation-->>Resolver: Current counters
    Resolver-->>Middleware: Verified ResolvedIdentity
  end
  Middleware->>Authz: Trusted SecurityContext
  Authz-->>Client: Authorized OData response

Loading

Comments Outside Diff (1)

1. crates/temper-server/src/identity/resolver.rs, line 106-108 (link)

   Cached identities bypass revocation

   When an issuer is suspended, its keys are rotated, or a principal or grant generation is bumped, this cache hit returns the previously resolved identity before any liveness checks run. Because JWT-related mutations do not invalidate the shared resolver cache, the revoked token continues authorizing OData operations for up to 60 seconds.

   How this was verified: The cache-hit branch returns before resolve_jwt, and the mutation invalidation middleware covers only AgentCredential actions.

   Knowledge Base Used: temper-server

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: crates/temper-server/src/identity/resolver.rs
   Line: 106-108
   
   Comment:
   **Cached identities bypass revocation**
   
   When an issuer is suspended, its keys are rotated, or a principal or grant generation is bumped, this cache hit returns the previously resolved identity before any liveness checks run. Because JWT-related mutations do not invalidate the shared resolver cache, the revoked token continues authorizing OData operations for up to 60 seconds.
   
   **How this was verified:** The cache-hit branch returns before `resolve_jwt`, and the mutation invalidation middleware covers only `AgentCredential` actions.
   
   **Knowledge Base Used:** [temper-server](https://app.greptile.com/arni-labs/-/custom-context/knowledge-base/nerdsane/temper/-/docs/temper-server.md)
   
   How can I resolve this? If you propose a fix, please make it concise.

   

Prompt To Fix All With AI

Fix the following 3 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 3
crates/temper-server/src/identity/resolver.rs:106-108
**Cached identities bypass revocation**

When an issuer is suspended, its keys are rotated, or a principal or grant generation is bumped, this cache hit returns the previously resolved identity before any liveness checks run. Because JWT-related mutations do not invalidate the shared resolver cache, the revoked token continues authorizing OData operations for up to 60 seconds.

**How this was verified:** The cache-hit branch returns before `resolve_jwt`, and the mutation invalidation middleware covers only `AgentCredential` actions.

### Issue 2 of 3
crates/temper-server/src/identity/resolver.rs:305
**Generation reads fail open**

When the generation lookup encounters an actor timeout, full mailbox, missing transition table, or other query error, this arm substitutes generation zero. A token invalidated by a human sign-out or grant revocation is therefore accepted during the failure and becomes an authenticated OData principal.

**How this was verified:** `get_tenant_entity_state` returns these operational failures as `Err`, and both revocation checks trust the zero returned here.

### Issue 3 of 3
crates/temper-cli/src/serve/bootstrap.rs:493
**Issuer bootstrap skips other tenants**

When the server hosts an app tenant or runs in tenant-routed mode, this hardcoded `default` registration leaves that tenant without the configured issuer. Bearer resolution performs the `TrustedIssuer` lookup in the request tenant, causing otherwise valid issuer-signed JWTs for every non-default tenant to receive 401 responses.

_{Reviews (1): Last reviewed commit: "test(authz): live end-to-end against a r..." | Re-trigger Greptile}

Greptile also left 2 inline comments on this PR.

Context used (5)

• Context used - CLAUDE.md (source)
• Context used - AGENTS.md (source)
• Knowledge Base — temper-server
• Knowledge Base — temper-authz: Cedar-Based Authorization for Agents
• Knowledge Base — temper-cli

[rita-aga]

@greptile review

[rita-aga]

@greptile review