fix: close agent authorization boundaries

[thiago-ss]

Summary

• enforce operator-only gate pre-authorization and remove agent self-authorization
• refresh managed OpenCode policies fail-closed, inject policy into worktree sessions, and keep API keys out of config metadata
• validate agent roles/write scopes, pass role-specific providers, and reject out-of-scope worktree changes
• surface permission tool/input in blocked events and TUI
• add regression coverage and include the pending workflow diagram assets

Verification

• make test
• make race
• make vet
• make build

Summary by CodeRabbit

• New Features

  • Added live run monitoring with event streaming, polling fallback, transcript tails, and reconnection support.
  • Added permission approval and denial controls, gate authorization safeguards, and attention notifications.
  • Added worktree listing and safe pruning for merged or stale worktrees.
  • Added reviewer-based evidence verification and standalone Claude Code integration.
  • Added configurable run budgets, circuit breakers, model selection, and improved progress displays.

• Bug Fixes

  • Improved permission recovery, event delivery, completion handling, secret redaction, and worktree cleanup.
  • Tightened agent permissions, role fallback behavior, graph validation, and write-scope enforcement.

• Documentation

  • Expanded documentation for monitoring, verification, adapters, worktrees, permissions, safeguards, and the terminal interface.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ab41f399-9517-4ec6-8986-648b47a46bf4

📥 Commits

Reviewing files that changed from the base of the PR and between 7d4acb5 and a1d8baf.

⛔ Files ignored due to path filters (2)

• expense-report-workflow.png is excluded by !**/*.png
• go.sum is excluded by !**/*.sum

📒 Files selected for processing (64)

• .gitignore
• .opencode/tools/corral.ts
• README.md
• cmd/corral/main.go
• cmd/corral/main_test.go
• docs/task2-scheduler.md
• docs/task3-adapter.md
• docs/task4-verification.md
• docs/task5-worktrees.md
• docs/task6-plugin.md
• docs/task7-tui.md
• docs/task8-hardening.md
• example/opencode.json
• expense-report-workflow.excalidraw
• go.mod
• internal/adapter/adapter.go
• internal/assets/assets_test.go
• internal/assets/corral.ts
• internal/assets/opencode.json
• internal/claudeadapter/adapter.go
• internal/claudeadapter/adapter_test.go
• internal/claudeadapter/permission.go
• internal/daemon/broker.go
• internal/daemon/broker_test.go
• internal/daemon/daemon.go
• internal/daemon/daemon_test.go
• internal/daemon/e2e_test.go
• internal/daemon/events.go
• internal/daemon/events_reconcile_test.go
• internal/daemon/events_test.go
• internal/daemon/hardening_test.go
• internal/daemon/openapi.go
• internal/daemon/planner.go
• internal/daemon/planner_test.go
• internal/graph/graph_test.go
• internal/graph/validate.go
• internal/ocx/client.go
• internal/ocx/client_test.go
• internal/ocx/events.go
• internal/ocx/types.go
• internal/ocxadapter/adapter.go
• internal/ocxadapter/adapter_test.go
• internal/ocxadapter/terminal_test.go
• internal/ocxreviewer/reviewer.go
• internal/ocxreviewer/reviewer_test.go
• internal/sched/gates_test.go
• internal/sched/hardening_test.go
• internal/sched/sched.go
• internal/sched/sched_test.go
• internal/sched/tail_test.go
• internal/sched/worktree_test.go
• internal/spike/server.go
• internal/store/redact_test.go
• internal/store/store.go
• internal/store/store_test.go
• internal/tui/api.go
• internal/tui/client_test.go
• internal/tui/model.go
• internal/tui/notify.go
• internal/tui/notify_test.go
• internal/tui/tui_test.go
• internal/tui/view.go
• internal/worktree/worktree.go
• internal/worktree/worktree_test.go

---

📝 Walkthrough

Walkthrough

The change adds OpenCode and Claude adapter support, reviewer verification, durable run watching and SSE events, TUI live updates, permission controls, scheduler safeguards, worktree management, stricter agent policies, and updated documentation.

Changes

Corral platform changes

Layer / File(s)	Summary
Policy, configuration, and CLI wiring .opencode/*, internal/assets/*, cmd/corral/main.go, internal/graph/*, README.md, docs/*	Unknown agents now use the unknown role. Agent permissions default to deny. Planner output can use wrapped graphs. The CLI configures reviewers, safeguards, and worktree commands.
Provider adapters and reviewer internal/adapter/*, internal/ocx/*, internal/ocxadapter/*, internal/claudeadapter/*, internal/ocxreviewer/*	OpenCode gains model overrides, permission reconciliation, stream fallback, buffered completions, and terminal classification. A standalone Claude adapter and Unix-socket permission broker are added. Evidence review requires exact verdicts and notes.
Run persistence, scheduling, and event delivery internal/store/*, internal/sched/*, internal/daemon/*	Runs persist gate authorization. Store events support replay and subscribers. The scheduler centralizes completion routing, restores budgets and retry state, records steering, and validates write scopes. The daemon adds watch, tail, and SSE event endpoints.
TUI streaming, permissions, and rendering internal/tui/*	The TUI consumes durable SSE events with polling fallback, displays transcript tails and budgets, handles permission responses, tracks event cursors, sanitizes output, and emits optional attention notifications.
Worktree safety and lifecycle internal/worktree/*, cmd/corral/main.go	Worktrees can be listed and safely pruned. Dirty, locked, detached, ignored, and protected worktrees are retained. Merge cleanup and changed-file detection are added.
Workflow diagram and supporting changes expense-report-workflow.excalidraw, go.mod, .gitignore, internal/spike/server.go	The expense-report workflow diagram is added. Direct Go requirements are declared. Local OpenCode configuration is ignored, and embedded server configuration is supported.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant TUI
  participant Daemon
  participant Store
  participant Broker
  participant Scheduler

  TUI->>Daemon: Open run events stream with cursor
  Daemon->>Store: Replay durable events after cursor
  Daemon->>Broker: Subscribe to run events
  Store->>Broker: Publish committed event notification
  Broker-->>Daemon: Deliver run event
  Daemon-->>TUI: Send ordered SSE event
  TUI->>Daemon: Request permission response
  Daemon->>Scheduler: Resolve pending permission
  Scheduler->>Store: Persist state transition
  Store->>Broker: Publish transition event
  Daemon-->>TUI: Send updated run state

Loading

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/security-role-boundaries

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}