Use mTLS, a private socket, or another non-forwardable carrier credential. Eliminate direct backend access.
REMOTE SETTINGS · IDENTITY · CAPABILITY
HTTPS is not a Settings grant.
Authenticate the gateway and browser principal separately, then enforce every narrow operation at the Host.
HTTPS gatewayencrypted + login
not yet a grantDSH principalidentity + tenant
authorizeHost capabilitynarrow operation
Current rc.2 proof
Look for the request that never happened.
The non-loopback mirror starts unavailable. External HTTPS or login state is never negotiated.
The request reached DSH but Host, Origin, or privileged-method policy rejected it.
The RPC passed; inspect schema, revision, Settings store, and credential ownership.
Additive upstream design
Two identities. One narrow grant.
Preserve principal, tenant, session, audience, expiry, authentication strength, and revocation.
Authorize namespace-scoped read, write, credential, and model-discovery capabilities independently.
Server-side checks, CSRF, revisions, step-up auth, audit, secret redaction, and default deny.
Capability split
Do not turn the local control plane into one Boolean.
Allowlisted namespaces; every mutation audited and conflict checked.
Values cross toward the Host once and never return in responses, logs, or exports.
Picker, open-path, arbitrary Host paths, Sessions, and Agent tools need separate authority.
Migration invariant
Preserve the safe default.
Existing local clients keep the current carrier.
No authenticated handshake means no Settings RPC.
All-interface binding exists only when the authenticated carrier owns it.
Gateway identity or browser session loss removes grants immediately.
Primary evidence