Remove Team Token PR2.1: Host-route admission security prerequisite

control-api/src/config.ts

@@ -240,6 +240,7 @@ type Config = {
   // It is deliberately separate from the capacity-impacting wake budget.
   hostArtifactReadRlPerMin: number
   hostMessageRlPerMin: number
+  hostRpcAdmissionRlPerMin: number
   hostWakeCoalesceWindowMs: number
   approvalMediumChallengeTtlSec: number
   telegramProviderEventChallengeTtlSec: number
@@ -1183,6 +1184,10 @@ export const config: Config = {
   // list and download reads across rpc-proxy replicas.
   hostArtifactReadRlPerMin: 30,
   hostMessageRlPerMin: positiveIntegerFromEnv('CONTROL_API_HOST_MESSAGE_RL_PER_MIN', 60),
+  hostRpcAdmissionRlPerMin: positiveIntegerFromEnv(
+    'CONTROL_API_HOST_RPC_ADMISSION_RL_PER_MIN',
+    300
+  ),
   hostWakeCoalesceWindowMs: Number(process.env.CONTROL_API_HOST_WAKE_COALESCE_WINDOW_MS || 2000),
   approvalMediumChallengeTtlSec: Number(
     process.env.WORKFLOW_APPROVAL_MEDIUM_CHALLENGE_TTL_SEC || 60 * 60

control-api/src/routes/internal/actionAuthorityCheckpoint.ts

@@ -11,6 +11,11 @@ import {
   admitHostMessage,
   respondHostMessageAdmissionFailure,
 } from '../../services/hostMessageAdmission.js'
+import {
+  admitHostRpc,
+  requiresHostRpcAdmission,
+  respondHostRpcAdmissionFailure,
+} from '../../services/hostRpcAdmission.js'
 import {
   issueHostMessageAdmissionReceipt,
   verifyHostMessageAdmissionReceipt,
@@ -81,6 +86,13 @@ export function createInternalActionAuthorityCheckpointRouter(gateway: K8sGatewa
           }
         }
       }
+      if (requiresHostRpcAdmission(parsed.operationId)) {
+        const admission = await admitHostRpc(parsed.principal.sub)
+        if (admission.status !== 'allowed') {
+          respondHostRpcAdmissionFailure(res, admission)
+          return
+        }
+      }
       const budget = AccessExecutionBudget.create('action')
       try {
         const result = await checkpointActionAuthority({

control-api/src/routes/rpc-access/users.ts

@@ -26,6 +26,7 @@ import {
   admitHostMessage,
   respondHostMessageAdmissionFailure,
 } from '../../services/hostMessageAdmission.js'
+import { admitHostRpc, respondHostRpcAdmissionFailure } from '../../services/hostRpcAdmission.js'
 import {
   type DirectRunAttributionBindingService,
   DirectRunBindingConflictError,
@@ -270,6 +271,48 @@ export function createRpcAccessUsersRouter(
   // host claim, a live user/team directory grant, and an enabled Host CR.
   const hostAccessPath = '/rpc/access/users/:userId/mcp-hosts/:hostRef'
 
+  // Internal, operation-agnostic adapter for legacy non-message Host routes.
+  // The signed token supplies the stable subject; user/Host selectors are
+  // checked against its claims but never enter the shared bucket key.
+  router.post(
+    `${hostAccessPath}/host-rpc-admission`,
+    requireValidRpcAccessTokenAny([
+      'host:message:invoke',
+      'host:wake:write',
+      'host:status:read',
+      'host:health:read',
+      'host:activity:read',
+      'host:approval:write',
+      'host:model:write',
+      'host:task:read',
+      'host:session:read',
+      'host:session:write',
+    ]),
+    requireRpcTokenUserMatch(),
+    requireRpcTokenHostMatch(),
+    async (req: RpcAuthedRequest, res, next) => {
+      try {
+        if (Number(req.headers['content-length'] || 0) > 0 || req.headers['transfer-encoding']) {
+          res.status(400).json({ error: 'request body is not allowed' })
+          return
+        }
+        const claims = req.rpcAuth
+        if (!claims) {
+          res.status(403).json({ error: 'Forbidden' })
+          return
+        }
+        const admission = await admitHostRpc(claims.sub)
+        if (admission.status !== 'allowed') {
+          respondHostRpcAdmissionFailure(res, admission)
+          return
+        }
+        res.status(204).end()
+      } catch (error) {
+        next(error)
+      }
+    }
+  )
+
   router.get(
     hostAccessPath,
     requireValidRpcAccessTokenAny([...HOST_ACCESS_SCOPES]),

control-api/src/services/hostMessageAdmission.ts

@@ -1,55 +1,39 @@
-import type { Response } from 'express'
 import { config } from '../config.js'
 import { type RateLimitCheck, checkAndIncrement } from './rateLimiterService.js'
+import {
+  type StrictFixedWindowAdmission,
+  admitStrictFixedWindow,
+  respondStrictFixedWindowFailure,
+} from './strictFixedWindowAdmission.js'
 
 export function hostMessageAdmissionBucketKey(verifiedSubject: string): string {
   return `host-message-admission:${verifiedSubject}`
 }
 
-export type HostMessageAdmission =
-  | { status: 'allowed'; check: RateLimitCheck }
-  | { status: 'limited'; check: RateLimitCheck }
-  | { status: 'unavailable' }
+export type HostMessageAdmission = StrictFixedWindowAdmission
 
 /** Shared authority for legacy messages and the later v2 chat.message.invoke checkpoint. */
 export async function admitHostMessage(
   verifiedSubject: string,
   check: typeof checkAndIncrement = checkAndIncrement
 ): Promise<HostMessageAdmission> {
   if (!verifiedSubject) return { status: 'unavailable' }
-  let result: RateLimitCheck
-  try {
-    result = await check(hostMessageAdmissionBucketKey(verifiedSubject), config.hostMessageRlPerMin)
-  } catch {
-    return { status: 'unavailable' }
-  }
-  if (
-    !result ||
-    result.backendAvailable !== true ||
-    typeof result.allowed !== 'boolean' ||
-    !Number.isSafeInteger(result.count) ||
-    result.count < 1 ||
-    !Number.isSafeInteger(result.resetMs) ||
-    result.allowed !== result.count <= config.hostMessageRlPerMin
-  ) {
-    return { status: 'unavailable' }
-  }
-  return { status: result.allowed ? 'allowed' : 'limited', check: result }
+  return admitStrictFixedWindow(
+    hostMessageAdmissionBucketKey(verifiedSubject),
+    config.hostMessageRlPerMin,
+    check
+  )
 }
 
 /** The same response contract can be used by the PR2 checkpoint after cascade. */
 export function respondHostMessageAdmissionFailure(
-  res: Response,
+  res: import('express').Response,
   admission: Exclude<HostMessageAdmission, { status: 'allowed' }>
 ): void {
-  if (admission.status === 'unavailable') {
-    res.status(503).json({ error: 'host_message_admission_unavailable' })
-    return
-  }
-  const retryAfterSeconds = Math.max(1, Math.ceil((admission.check.resetMs - Date.now()) / 1000))
-  res.setHeader('Retry-After', String(retryAfterSeconds))
-  res.setHeader('X-RateLimit-Limit', String(config.hostMessageRlPerMin))
-  res.setHeader('X-RateLimit-Remaining', '0')
-  res.setHeader('X-RateLimit-Reset', String(Math.floor(admission.check.resetMs / 1000)))
-  res.status(429).json({ error: 'Too Many Requests', retryAfterSeconds })
+  respondStrictFixedWindowFailure(
+    res,
+    admission,
+    'host_message_admission_unavailable',
+    config.hostMessageRlPerMin
+  )
 }

control-api/src/services/hostRpcAdmission.ts

@@ -0,0 +1,57 @@
+import { config } from '../config.js'
+import { checkAndIncrementStrict } from './rateLimiterService.js'
+import {
+  type StrictFixedWindowAdmission,
+  admitStrictFixedWindow,
+  respondStrictFixedWindowFailure,
+} from './strictFixedWindowAdmission.js'
+
+export const HOST_RPC_ADMISSION_BUCKET_PREFIX = 'host-rpc-admission:'
+
+/** Closed checkpoint operation set approved by Task 106 Spec 65. */
+const HOST_RPC_ADMISSION_OPERATIONS = new Set([
+  'host.wake',
+  'task.manage',
+  'task.read',
+  'session.read',
+  'session.manage',
+  'model.read',
+  'model.select',
+  'host.activity.read',
+  'host.activity.read_all',
+  'host.status.read',
+  'host.health.read',
+])
+
+export function requiresHostRpcAdmission(operationId: string): boolean {
+  return HOST_RPC_ADMISSION_OPERATIONS.has(operationId)
+}
+
+export function hostRpcAdmissionBucketKey(verifiedSubject: string): string {
+  return `${HOST_RPC_ADMISSION_BUCKET_PREFIX}${verifiedSubject}`
+}
+
+/** One durable, subject-wide budget shared by legacy Host routes and v2 checkpoints. */
+export async function admitHostRpc(
+  verifiedSubject: string,
+  check: typeof checkAndIncrementStrict = checkAndIncrementStrict
+): Promise<StrictFixedWindowAdmission> {
+  if (!verifiedSubject) return { status: 'unavailable' }
+  return admitStrictFixedWindow(
+    hostRpcAdmissionBucketKey(verifiedSubject),
+    config.hostRpcAdmissionRlPerMin,
+    check
+  )
+}
+
+export function respondHostRpcAdmissionFailure(
+  res: import('express').Response,
+  admission: Exclude<StrictFixedWindowAdmission, { status: 'allowed' }>
+): void {
+  respondStrictFixedWindowFailure(
+    res,
+    admission,
+    'host_rpc_admission_unavailable',
+    config.hostRpcAdmissionRlPerMin
+  )
+}