feat(auth): bind workflow authority to runtime principals

[TheodoreSpeaks]

Summary

• bind canonical workflow execution metadata directly to runtime principals across workflow entry points, child workflows, snapshots, resumptions, and executor JWT transport
• preserve the original actor while making internal route transport explicit and failing closed on malformed or mismatched execution authority
• keep resource-policy evaluation disabled and update focused authorization truth-table coverage

Type of Change

• Feature

Testing

• 78 affected test files / 1,300 tests
• 393 executor/internal test files / 5,040 tests
• app and auth package type checks
• lint, block registry validation, and all 40 repository audits

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 7, 2026 8:10pm UTC

[TheodoreSpeaks]

@greptile-apps

[greptile-apps]

Greptile Summary

The PR binds canonical workflow execution metadata to runtime principals and carries that authority through internal executor transport, child execution, snapshots, and resumptions.

• Preserves original workflow actors while supporting actorless system executions.
• Uses the execution workspace as the canonical workspace boundary for internal operations.
• Makes session and executor-JWT transport explicit for authorization, attribution, and secret provenance.
• Updates authorization and execution-path regression coverage.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains within the eligible follow-up scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/api/server/routes/internal-json-route.ts	Refactors internal route authentication to preserve the signed runtime principal while exposing executor transport and canonical execution workspace metadata.
apps/sim/lib/auth/internal-delegation.ts	Replaces receiver-derived delegated-principal binding with validation and admission of canonical workflow execution principals.
apps/sim/executor/handlers/credential-group/credential-group-handler.ts	Uses execution-bound runtime principals and asserted execution workspace context for credential-group operations.
apps/sim/executor/execution/snapshot.ts	Carries runtime-principal authority through execution snapshot and restoration flows.
packages/auth/src/principal.ts	Defines and validates the canonical principal and workflow execution metadata used across runtime boundaries.

Sequence Diagram

sequenceDiagram
    participant Entry as Workflow Entry Point
    participant Exec as Executor
    participant JWT as Executor JWT
    participant Route as Internal Route
    participant Auth as Authorization
    participant UseCase as Application Use Case

    Entry->>Exec: Create runtime principal with execution metadata
    Exec->>JWT: Sign canonical runtime principal
    JWT->>Route: Bearer token
    Route->>Route: Verify token and identify executor transport
    Route->>Auth: Authorize runtime principal and operation
    Auth->>UseCase: Principal plus canonical execution workspace
    UseCase-->>Route: Authorized result

Loading

_{Reviews (5): Last reviewed commit: "fix(auth): preserve runtime authority ac..." | Re-trigger Greptile}

[cubic-dev-ai]

All reported issues were addressed across 183 files

<sub>Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.

Re-trigger cubic</sub>

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@TheodoreSpeaks I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 226 files

<sub>Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Re-trigger cubic</sub>

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@TheodoreSpeaks I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 226 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.

Re-trigger cubic</sub>