Week of September 7 -- 13, 2026

The week’s defining event was the landing of the full authorization audit — 131 commits classifying every registered route — followed by an intensive stabilization effort that resolved a cascade of P0 regressions across progeny secrets, broker reads, template resolution, and agent scoping. In parallel, GCP identity support for sandbox runtimes was unblocked end-to-end with passthrough-to-assign credential translation, and broker lifecycle management matured with heartbeat timeouts, hub-level default selection, and clean unregistration. The week closed with credential-leak prevention hardening, a new Meta Muse Code harness, and a tighter agent messaging permission model.

Highlights

1. Authorization Audit Landing & Stabilization

Scion’s authorization kernel reached full coverage: all 177 registered routes and 194 permission classifications are now enforced, backed by role-binding CRUD, a project membership service, access constraints, and structured denial responses. The audit’s merge on September 7 triggered a week-long tail of P0 fixes — progeny agents losing inherited secrets due to missing scopes and wrong permission derivation, brokers denied template and harness-config reads by the new security gate, agents unable to assign GCP service accounts or resolve templates, and the WebServer login path failing to create super-admin RoleBindings. Each regression was resolved promptly, and two missing mutation-classification entries were added to restore CI on main. By week’s end the authorization catalog was complete and stable.

2. GCP Identity for Sandbox Runtimes

gVisor-sandboxed agents on Cloud Run could not reach the GCE metadata server, leaving GCP passthrough mode non-functional. The hub now translates passthrough to assign using the broker’s host service account at create and PATCH time, with downstream JWT scoping, resolved environment, and the gcp-token endpoint working automatically. Companion fixes propagated GOOGLE_CLOUD_LOCATION into sandbox containers, taught the auth autodetect path to recognize translated agents, and corrected Vertex AI hostname generation when the region was set to global. The result is reliable GCP credential delivery on every supported runtime.

3. Broker Lifecycle & Multi-Broker Infrastructure

Multi-broker deployments gained a hub-level DefaultRuntimeBroker setting — step 2.5 in the broker resolution cascade — with an admin UI dropdown, agent-create fallback, and seven new cascade tests. Operators can now cleanly decommission brokers via an admin-gated Unregister button that tears down HMAC secrets and join tokens. A new 5-minute heartbeat timeout scheduler marks stale brokers offline when WebSocket disconnects fail to fire, and the agent delete path was hardened to skip broker dispatch for never-provisioned agents, with a force-delete fallback dialog on 502/503 and a reduced timeout.

🔐 Authorization & Access Control

Route-level authorization enforcement (#1487): 131-commit authorization audit covering all 177 routes and 194 classifications, with role-binding CRUD, project membership service, access constraints, structured denial responses, D-002 migration coexistence, and cold-start super-admin binding.
Progeny secret inheritance fix (#1489): Three stacked defects — missing scopes on synthetic identity, wrong CheckAccess permission derivation, and walkDelegationChain ignoring the Permission field — prevented progeny agents from receiving inherited secrets.
Broker template and harness-config reads (#1494): Broker and agent-scoped reads denied after the audit merge. Added broker-identity bypass and AgentScopes to the permission registry.
Agent template resolution (#1504): Three compounding defects — missing AgentScopes on template.read/list, error mislabelled as authentication failure, and scope-fallback path abort.
Global template and harness-config listing (#1535): Parentless global-scoped resources could not match project-scoped agent bindings. Grants hasAdminView to agents with ScopeProjectRead.
Full-role template management (#1506): Added project:template:write scope for template create/update, granted to agent-role-full.
WebServer super-admin RoleBinding (#1508): Both login paths now call ensureSuperAdminBinding, fixing IsSystemAdmin returning false for admin-role users.
Agent messaging permission tightening (#1543): Removed agent.message from the project-member role. Messaging now requires owner/admin role or creator ancestry, matching the terminal attach gate.
Metrics dashboard admin gate (#1581): Moved metrics nav to ADMIN_SCOPEABLE_ITEMS and registered hub.metrics.read in the permission maps.
AllowProgeny propagation on secret promotion (#1580): The setEnvVar promotion path now propagates the AllowProgeny flag, restoring progeny inheritance for promoted secrets.

☁️ GCP Identity & Credentials

Passthrough-to-assign translation (#1509): Hub translates GCP passthrough to assign using the broker’s host SA for sandbox runtimes at create and PATCH time, unblocking credential delivery on cloudrun-sandbox.
GOOGLE_CLOUD_LOCATION propagation (#1517): Three compounding bugs — ResolveAuth collapsing the variable, cloudrun_sandbox_runtime.go skipping applyResolvedAuth(), and Gemini CLI missing GCP vars in allowedEnvironmentVariables.
Auth autodetect for translated agents (#1514): hasRequiredAuthCredentials() now recognizes passthrough-to-assign translated agents via a new agentHasGCPIdentityAssigned() helper.
Secret Manager user-managed replication (#1533): Optional ReplicationLocations config field for GCP orgs enforcing constraints/gcp.resourceLocations, exposed via settings YAML, admin UI, and Postgres config store.
Credential leak on clone failure (#1577): Deferred .git/ cleanup after workspace init prevents credential-bearing URLs from persisting on disk.
PullImage credential safety (#1582): Switched to runSimpleCommand with per-site error enrichment, eliminating credential exposure in diagnostic output.

🔧 Broker & Agent Lifecycle

Hub-level default runtime broker (#1521): DefaultRuntimeBroker added to AgentDefaultsSettings with admin UI, agent-create fallback, and cascade tests.
Broker unregister button (#1515): Admin-gated button with confirmation dialog; backend cleans up HMAC secrets and join tokens.
Heartbeat timeout scheduler (#1518): 5-minute-cycle scheduler marks stale brokers offline when WebSocket disconnect events fail to fire.
Agent delete on stale broker (#1520): Phase-aware delete skips broker dispatch for never-provisioned agents. Force-delete fallback dialog on 502/503, timeout reduced from 90s to 15s.
Embedded broker passthrough gate (#1507): Co-located brokers registered without CreatedBy; admin-role users now treated as owners for the passthrough identity gate.

🤖 Harness Ecosystem

Muse Code harness (#1541): Complete harness bundle for Meta’s Muse Code terminal coding agent — config.yaml with API key auth and MCP mapping, provision.py, dialect.yaml mapping all 13 hook events, Dockerfile, seed files, and 14 unit tests.
grok-build hook events and quality (#1536): Wired 4 missing hook events, increased stop hook timeout to 60s, updated model aliases to grok-4.5/grok-4.6, added --no-ask-user for headless reliability.
grok-build Vertex AI publisher prefix (#1530): Pre-resolved models without a / now fall back to the default vertex model, fixing Vertex AI 400 errors.
grok-build global region normalization (#1529): Normalizes GOOGLE_CLOUD_REGION=global to empty string, yielding the correct aiplatform.googleapis.com hostname.
Claude harness startup fix (#1513): Wildcard * in permissions.allow and an invalid hook event caused an interactive Settings Warning prompt, blocking headless startup.
Harness-config bootstrap in hosted mode (#1525): Removed the bulk SkipIfAnyExist guard that short-circuited after the first existing config; per-resource OverwritePolicy handles dedup.

🖥️ UI & Platform Stability

Chat markdown HTML truncation (#1565): Angle-bracket text interpreted as real HTML caused message truncation. Custom marked renderer hook entity-escapes raw HTML tokens.
Template pagination overflow (#1528): Lowered page size from 200 to 100, added apiFetchAllPages() with cursor pagination and MAX_PAGES=50 safety bound. Hubs with 100+ templates no longer silently drop entries.
Agent Start/Stop UI capability (#1490): Buttons now gate on attach capability, matching server-side authorizeAgentLifecycle semantics across 12 call sites.
Chat terminal window (#1505): Terminal link opens a named window per agent instead of replacing the chat tab, with popup-blocker fallback.
Restart button 502 fix (#1519): Fire-and-poll with exponential backoff on /healthz replaces fire-and-check, showing a spinner and success toast.
Duplicate access-denied toasts (#1503): Added suppressAccessDeniedToast to 7 apiFetch calls for admin-only requests that degrade gracefully on 403.
Web chat store initialization (#1524): Store initialization moved outside the MessageBroker.Enabled gate so single-node Cloud Run instances render correctly.
Stale project marker on recreation (#1573): buildStartContext detects and overwrites stale on-disk markers using external config dir existence as the staleness heuristic.
isGit preservation for skill injection (#1570): Original isGit value preserved before the container override so inject_when: git_workspace matches in clone-per-agent workspaces.
ADO clone URL .git suffix (#1584): Strips trailing .git suffix from Azure DevOps repository URLs.
Default --registry from env var (#1576): build-images.sh now defaults REGISTRY from SCION_IMAGE_REGISTRY with a warning when neither is set.

🏗️ Build & Infrastructure

BuildKit enabled in cloudbuild-omni (#1484): Added DOCKER_BUILDKIT=1 to all 8 build steps to support RUN --mount=type=secret in upstream Dockerfiles.
Internal Python package index (#1488): PIP_INDEX_URL build-arg and BuildKit secret mount for pip.conf enable image builds behind corporate proxies blocking PyPI.
Telemetry cloud export gating (#1578): Gates GCP export on ProjectID, bounds re-buffer loop with consecutive failure counter, adds gRPC error classification and startup warnings.

📖 Documentation

Python package index proxy (#1512): Added proxy section to custom-images.md mirroring the npm pattern; project:template:write scope added to the Full role list in security.md.
Multi-broker resolution cascade (#1527): DefaultRuntimeBroker in admin-settings, 5-step cascade table in multi-broker guide, health monitoring and unregistration in runtime-broker guide, and sandbox passthrough-to-assign callout in auth docs.
BYO-TLS for internal GCE deployments (#1572): Section added to hub-setup-gce.md covering SCION_SERVER_BASE_URL, skippable scripts, and Caddy config with custom certs.