OCTOBER-REVIEW-REVISIONS 3b: the front server assigns one principal, forwarded as one header #44

The front server works out a request's principal once, in its access check, and forwards it as a single header, x-lichen-principal (JSON {principal, user, role}, with the host role inside). The site believes it only on connections passed on its control channel and refuses a header naming a principal no request can be (only Owner, ShareGuest, FullToken, SafeToken and Visitor are taken). The site's second mapping (forwarded_principal), the Forwarded marker and the token scope as a request extension are removed; after entry every check is permissions_of(principal).

The full-token push reads the principal, a dashboard publish's "who" is set only for a token principal, and the safe-token refusal text comes from one function. The signed-in name stays in the header for publish records and /cms/api/info, but no check reads it. A request that nothing resolved is now forwarded as Visitor (it was Owner), so it fails closed, and the health check is sent as Visitor.

---

OCTOBER-REVIEW-REVISIONS, subunit 3b. Plan: https://tangled.org/notplants-bot.bsky.social/lichen-orchestrator/blob/main/machine-docs/plans/OCTOBER-REVIEW-REVISIONS-2026-10-28.md

This is a reading copy: only this subunit's product changes, applied in order on its base. Nothing here is to be merged.

Source PRs on lichen.page.review (product), in order, with their original descriptions #

• #3402 s/770-orr-u3b-one-principal — ORR 3b: one principal, assigned once by the front server

  OCTOBER-REVIEW-REVISIONS unit 3b, product: one principal, assigned once, by the front server (A4).

  • The header: the front server works out the request's principal once, in its access check, and forwards it as one header: x-lichen-principal, JSON {principal, user, role}, with the host role inside it.
    • The site believes it only on connections passed on its control channel.
    • The site refuses a header that names a principal no request can be; only Owner, ShareGuest, FullToken, SafeToken and Visitor are taken.
  • Removed: the site's second mapping (forwarded_principal), the Forwarded marker and the token scope as a request extension. After entry, every check is permissions_of(principal).
  • Other readers:
    • the full-token push (hub_http) reads the principal;
    • a dashboard publish's "who" is set only for a token principal;
    • the safe-token refusal text comes from one function.
  • Departures from the plan's text, with reasons:
    • The signed-in name stays in the header for publish records and /cms/api/info. No check reads it.
    • A request nothing resolved is forwarded as Visitor, where it was Owner: it now fails closed.
    • The health check is sent as Visitor, since its route is public.

Commits #

• 1319903d2 ORR 3b: orr-u3b-one-principal (#3402)

Count and shas #

count-product-code-lines 6b998ef5d61e..1319903d2793: NET -11 · counted +72 -83 · moved out of the counted set +0 · comment-only deletions flagged 16 · macros flagged 0 · tests-folder code flagged 0

Base 6b998ef5d61e02e63fc5b51e9697bd5d2b192f62 (tip of s/769-orr-u3a-ipc-socket-tests). Head 1319903d2793d338e32ad393bc1dd32dc215de43. 15 files changed.

Check #

Every changed file is a file one of the product PRs changed, and each is identical at the head to the same file at the last product branch s/770-orr-u3b-one-principal.