feat(auth): bind workflow authority to runtime principals

[TheodoreSpeaks]

Summary

• bind canonical workflow execution metadata directly to runtime principals across workflow entry points, child workflows, snapshots, resumptions, and executor JWT transport
• preserve the original actor while making internal route transport explicit and failing closed on malformed or mismatched execution authority
• keep resource-policy evaluation disabled and update focused authorization truth-table coverage

Type of Change

• Feature

Testing

• 78 affected test files / 1,300 tests
• 393 executor/internal test files / 5,040 tests
• app and auth package type checks
• lint, block registry validation, and all 40 repository audits

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 1, 2026 11:06am UTC

[TheodoreSpeaks]

@greptile-apps

[greptile-apps]

Greptile Summary

The PR binds canonical workflow execution metadata to runtime principals and carries that authority through executor JWT transport, nested execution, snapshots, and resumptions.

• Adds canonical workspace and workflow checks across internal application boundaries.
• Preserves original actor identity while making executor transport metadata explicit.
• Updates authorization, delegation, credential, knowledge, table, file, workflow, and executor tests for the new principal model.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/api/server/routes/internal-json-route.ts	Separates executor authentication transport from the runtime principal and propagates canonical execution workspace metadata through route composition.
apps/sim/lib/auth/internal-delegation.ts	Revalidates active execution context and binds canonical workflow authority to runtime principals.
packages/auth/src/principal.ts	Extends the principal contract with validated workflow execution metadata and related resolution helpers.
apps/sim/executor/utils/credential-token.ts	Resolves managed credential delegation through the bound runtime principal and fails before token issuance when execution metadata is absent.
apps/sim/executor/handlers/credential-group/credential-group-handler.ts	Passes the executor workspace assertion into credential-group application operations.
apps/sim/executor/execution/snapshot.ts	Preserves runtime principal execution authority across execution snapshots and restoration.

Sequence Diagram

sequenceDiagram
  participant E as Workflow entry point
  participant P as Runtime principal binding
  participant X as Executor
  participant R as Internal route
  participant A as Application authorization
  E->>P: Actor and execution metadata
  P->>P: Bind canonical workflow and workspace
  P->>X: Runtime principal
  X->>R: Executor JWT and execution authority
  R->>R: Validate transport and canonical workspace
  R->>A: Principal and asserted workspace
  A-->>R: Authorized result or fail closed

Loading

_{Reviews (3): Last reviewed commit: "fix(auth): enforce canonical execution s..." | Re-trigger Greptile}

[cubic-dev-ai]

All reported issues were addressed across 183 files

<sub>Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.

Re-trigger cubic</sub>

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile