FORGE — ACT Federation Ingress
Canonical: /root/AAA/governance/federation_act.py
Authority registry: /root/AAA/registries/tool_authority.py (tools.yaml)
A-FORGE: src/infrastructure/governance/actIngress.ts
Rename lineage (2026-09-04)
SCT → ACT completed. Wire format: act_v1.* canonical (minted since 2026-08-07);
legacy sct_v1.* verify-only during the dual-accept migration window. Kernel
birth path mint_act/verify_act (SCT-era aliases mint_sct/verify_sct kept
until window close). Input keys session_token and sct remain accepted for
compat; act is primary. Error code ACT_AMBIGUOUS (was SCT_AMBIGUOUS).
SEALED foundation (do not re-implement)
| PR |
Law |
Commit |
| PR1 |
Collect-all sources; identical→normalize; distinct→ACT_AMBIGUOUS (was SCT_AMBIGUOUS) |
AAA 056a8c9 |
| PR2 |
action_class from tools.yaml only; no caller self-declare |
AAA 57217da |
| A-FORGE |
Same AMBIGUOUS + production FORGE_SCT_REQUIRE_MUTATE=0 → exit(1) (env name is a historical deployment contract — retained) |
1f1779b |
Law
ACT present → verify fail-closed (claims required)
No ACT + OBSERVE → allow (registry-owned OBSERVE)
No ACT + MUTATE → ACT_REQUIRED
Conflicting tokens → ACT_AMBIGUOUS, execute nothing
Log fingerprint only (sha256) — never raw ACT
Production mutate bypass → startup FATAL
Mint + gate
import sys; sys.path.insert(0, "/root/AAA")
from governance.federation_act import gate_tool_ingress
# gate_tool_ingress(tool, args, organ="geox") # registry sets require_act
PARKED — next block (after T3a + R4)
| PR |
Scope |
| 3 |
Decision-event schema formal seal (scaffold may exist) |
| 4 |
trace_id across 5 organs |
| 5 |
Cockpit filter by trace_id |
| 6 |
13×5 = 65 adversarial matrix, one shared trace_id |
| 7 |
VAULT999 rollup receipt |
ChatGPT App OAuth 2.1 resource-server alignment
Blueprint contract: /root/forge_work/2026-07-20/GEOX-CHATGPT-MCP-GUI-BLUEPRINT.md §8 (auth), PR pr/geox-auth-resource-alignment. Exit criteria: auth matrix passes; wrong-audience fails closed.
ChatGPT is an EXTERNAL host. Its OAuth path is parallel to — never a replacement for — the ACT Law above.
1. RFC 9728 protected-resource metadata (PRM)
2. ONE canonical resource identity
Exactly one identity string is the resource. For GEOX v1 it is the HTTPS MCP endpoint:
https://geox.arif-fazil.com/mcp
All four positions MUST agree byte-for-byte:
| Position |
Value |
| MCP endpoint URL |
https://geox.arif-fazil.com/mcp |
PRM resource field |
same |
OAuth resource parameter (auth + token requests) |
same |
| Access-token audience validation on the server |
same |
Never mix geox.arif-fazil.com/mcp with any other identity (no pathless origin, no forge.* alias, no localhost) across these positions. Any mismatch = wrong-audience = fail closed.
3. Per-tool securitySchemes + scope map
Every public tool declares noauth or oauth2 + scopes explicitly (silence is not a policy). Blueprint scope table:
| Scope |
Covers |
v1 exposure |
geox.read |
read-only evidence tools (profile, status, view) |
ChatGPT-allowed |
geox.compute |
compute-lane tools (petrophysics, seismic compute, basin math) |
ChatGPT-allowed |
geox.ingest |
ingest tools (well/seismic ingest) |
ChatGPT-allowed |
geox.export |
export / publish tools |
ChatGPT-allowed |
geox.claim.write |
claim lifecycle writes |
ChatGPT-allowed |
geox.seal |
claim sealing (irreversible) |
WITHHELD from ChatGPT v1 — sovereign-gated per F13 |
geox.seal never appears in any ChatGPT-facing scope set, metadata document, or consent screen. Requesting it from the external path is rejected, not deferred.
4. Token validation duties (resource server side)
Every bearer token presented to /mcp is validated fail-closed on all five:
- Signature — valid against the AS key set.
- Issuer — matches a declared
authorization_servers entry.
- Audience / resource — equals the canonical identity of §2 exactly.
- Expiry — not expired (no grace window).
- Scopes — token scopes ⊇ the called tool's declared scopes; absent scope = deny.
5. Two ingress paths, no weakening
| Path |
Principal |
Mechanism |
Status |
| INTERNAL federation |
organ → organ (A-FORGE, AAA, WEALTH, WELL) |
ACT mint/validate per the Law above |
unchanged, authoritative |
| EXTERNAL host |
ChatGPT App |
OAuth 2.1 + RFC 9728 + scopes |
new, this section |
Threading rules:
- An external ChatGPT call authenticated by OAuth does NOT mint, imply, or bypass an ACT. If the requested action class would require ACT internally (
MUTATE+), the OAuth scope set must independently authorize it — and geox.seal-class actions remain F13-gated regardless of token.
- An ACT does NOT satisfy OAuth audience checks; internal tokens are never accepted on the external ingress path.
- One request, one ingress path. Mixed credentials (ACT header + bearer token) are treated like conflicting tokens → reject, execute nothing (same posture as
ACT_AMBIGUOUS).
- Both paths log fingerprint only (sha256) — never raw tokens.
Do not
- First-token-wins
- Trust caller
action_class
- Mock arifOS in production gates
- Advance SE stage from this skill — T3a matrix first (
FORGE-t3a-binding-matrix)
- Mix canonical resource identities across endpoint / PRM / OAuth param / audience check
- Expose
geox.seal to ChatGPT v1 under any alias or wildcard scope
- Accept ACT on the external path, or OAuth bearer on the internal path
1---2name: forge-act-federation-ingress3description: Wire, verify, and operate federation Arif's Capability Tokens (ACT) across arifOS mint/validate and organ ingress gates (A-FORGE, GEOX, WEALTH, WELL, AAA). Use when: ACT gate (legacy SCT), session_token, federation_act, ACT_AMBIGUOUS (legacy SCT_AMBIGUOUS), tool_authority, FORGE_SCT_REQUIRE_MUTATE (historical env name, retained), 65-case matrix, decision event. Also covers ChatGPT App OAuth 2.1 resource-server alignment (RFC 9728 PRM, canonical resource identity, per-tool securitySchemes) as the EXTERNAL host ingress path alongside the INTERNAL ACT path.4---56# FORGE — ACT Federation Ingress78> **Canonical:** `/root/AAA/governance/federation_act.py`9> **Authority registry:** `/root/AAA/registries/tool_authority.py` (tools.yaml)10> **A-FORGE:** `src/infrastructure/governance/actIngress.ts`1112## Rename lineage (2026-09-04)1314SCT → ACT completed. Wire format: **act_v1.\*** canonical (minted since 2026-08-07);15legacy **sct_v1.\*** verify-only during the dual-accept migration window. Kernel16birth path `mint_act`/`verify_act` (SCT-era aliases `mint_sct`/`verify_sct` kept17until window close). Input keys `session_token` and `sct` remain accepted for18compat; `act` is primary. Error code `ACT_AMBIGUOUS` (was `SCT_AMBIGUOUS`).1920## SEALED foundation (do not re-implement)2122| PR | Law | Commit |23|----|-----|--------|24| **PR1** | Collect-all sources; identical→normalize; distinct→**ACT_AMBIGUOUS** (was SCT_AMBIGUOUS) | AAA `056a8c9` |25| **PR2** | action_class from **tools.yaml** only; no caller self-declare | AAA `57217da` |26| **A-FORGE** | Same AMBIGUOUS + production `FORGE_SCT_REQUIRE_MUTATE=0` → **exit(1)** (env name is a historical deployment contract — retained) | `1f1779b` |2728## Law2930```31ACT present → verify fail-closed (claims required)32No ACT + OBSERVE → allow (registry-owned OBSERVE)33No ACT + MUTATE → ACT_REQUIRED34Conflicting tokens → ACT_AMBIGUOUS, execute nothing35Log fingerprint only (sha256) — never raw ACT36Production mutate bypass → startup FATAL37```3839## Mint + gate4041```python42import sys; sys.path.insert(0, "/root/AAA")43from governance.federation_act import gate_tool_ingress44# gate_tool_ingress(tool, args, organ="geox") # registry sets require_act45```4647## PARKED — next block (after T3a + R4)4849| PR | Scope |50|----|--------|51| 3 | Decision-event schema formal seal (scaffold may exist) |52| 4 | `trace_id` across 5 organs |53| 5 | Cockpit filter by trace_id |54| 6 | **13×5 = 65** adversarial matrix, one shared trace_id |55| 7 | VAULT999 rollup receipt |5657## ChatGPT App OAuth 2.1 resource-server alignment5859> Blueprint contract: `/root/forge_work/2026-07-20/GEOX-CHATGPT-MCP-GUI-BLUEPRINT.md` §8 (auth), PR `pr/geox-auth-resource-alignment`. Exit criteria: auth matrix passes; wrong-audience fails closed.6061ChatGPT is an EXTERNAL host. Its OAuth path is parallel to — never a replacement for — the ACT Law above.6263### 1. RFC 9728 protected-resource metadata (PRM)6465- Serve `/.well-known/oauth-protected-resource` on the GEOX public origin. The document MUST carry:66 - `resource` — the canonical resource URI (§2).67 - `authorization_servers` — at least one entry naming the AS that issues ChatGPT-bound tokens.68- On any `401`, respond with a `WWW-Authenticate` challenge pointing at the PRM URL:69 ```70 WWW-Authenticate: Bearer resource_metadata="https://geox.arif-fazil.com/.well-known/oauth-protected-resource"71 ```72- Without the challenge, ChatGPT cannot discover the AS; without `authorization_servers`, discovery dead-ends. Both are boot-blocking.7374### 2. ONE canonical resource identity7576Exactly one identity string is the resource. For GEOX v1 it is the HTTPS MCP endpoint:7778```79https://geox.arif-fazil.com/mcp80```8182All four positions MUST agree byte-for-byte:8384| Position | Value |85|---|---|86| MCP endpoint URL | `https://geox.arif-fazil.com/mcp` |87| PRM `resource` field | same |88| OAuth `resource` parameter (auth + token requests) | same |89| Access-token audience validation on the server | same |9091Never mix `geox.arif-fazil.com/mcp` with any other identity (no pathless origin, no `forge.*` alias, no localhost) across these positions. Any mismatch = wrong-audience = **fail closed**.9293### 3. Per-tool `securitySchemes` + scope map9495Every public tool declares `noauth` or `oauth2` + scopes explicitly (silence is not a policy). Blueprint scope table:9697| Scope | Covers | v1 exposure |98|---|---|---|99| `geox.read` | read-only evidence tools (profile, status, view) | ChatGPT-allowed |100| `geox.compute` | compute-lane tools (petrophysics, seismic compute, basin math) | ChatGPT-allowed |101| `geox.ingest` | ingest tools (well/seismic ingest) | ChatGPT-allowed |102| `geox.export` | export / publish tools | ChatGPT-allowed |103| `geox.claim.write` | claim lifecycle writes | ChatGPT-allowed |104| `geox.seal` | claim sealing (irreversible) | **WITHHELD from ChatGPT v1 — sovereign-gated per F13** |105106`geox.seal` never appears in any ChatGPT-facing scope set, metadata document, or consent screen. Requesting it from the external path is rejected, not deferred.107108### 4. Token validation duties (resource server side)109110Every bearer token presented to `/mcp` is validated fail-closed on all five:1111121. **Signature** — valid against the AS key set.1132. **Issuer** — matches a declared `authorization_servers` entry.1143. **Audience / resource** — equals the canonical identity of §2 exactly.1154. **Expiry** — not expired (no grace window).1165. **Scopes** — token scopes ⊇ the called tool's declared scopes; absent scope = deny.117118### 5. Two ingress paths, no weakening119120| Path | Principal | Mechanism | Status |121|---|---|---|---|122| **INTERNAL federation** | organ → organ (A-FORGE, AAA, WEALTH, WELL) | ACT mint/validate per the Law above | unchanged, authoritative |123| **EXTERNAL host** | ChatGPT App | OAuth 2.1 + RFC 9728 + scopes | new, this section |124125Threading rules:126127- An external ChatGPT call authenticated by OAuth does NOT mint, imply, or bypass an ACT. If the requested action class would require ACT internally (`MUTATE`+), the OAuth scope set must independently authorize it — and `geox.seal`-class actions remain F13-gated regardless of token.128- An ACT does NOT satisfy OAuth audience checks; internal tokens are never accepted on the external ingress path.129- One request, one ingress path. Mixed credentials (ACT header + bearer token) are treated like conflicting tokens → reject, execute nothing (same posture as `ACT_AMBIGUOUS`).130- Both paths log fingerprint only (sha256) — never raw tokens.131132## Do not133134- First-token-wins 135- Trust caller `action_class` 136- Mock arifOS in production gates 137- Advance SE stage from this skill — T3a matrix first (`FORGE-t3a-binding-matrix`) 138- Mix canonical resource identities across endpoint / PRM / OAuth param / audience check 139- Expose `geox.seal` to ChatGPT v1 under any alias or wildcard scope 140- Accept ACT on the external path, or OAuth bearer on the internal path
ariffazil