Repository navigation
Conversation
Gateways now bind human-gated clears on the claim that identifies the same person in both tokens, detected from the issuer host: Entra ID and Okta are recognised, and SESSION_SUBJECT_PROVIDER in `gateway.advanced` covers an Okta custom domain or a sovereign-cloud Entra ID issuer. The gateway-config skill now tells users how to set up the clearing app on Okta (Native app, Okta-generated client ID, in the authorization server's access policy), which redirect URI to register, that intent clears need intent capture, and when to set the provider. The vendored schema reference picks up the matching `session_control.client_id` guidance; the digest is regenerated and its pinned hash bumped. Only that rationale string changed, so no safe-default seed moved. Bumps the plugin to 1.3.5.
Contributor
Author
|
Ready for review, but shouldn't merge yet. This needs to wait until after the production deploy that includes the updated gateway version, since the guidance describes behaviour that ships in that release. |
The schema reference was re-copied for the session_control.client_id guidance; the validator bundle is built from the same schema, so it is re-vendored from the same source revision and its pinned hash bumped. Only that rationale string differs.
The identity-claim note and the vendored client_id guidance now lead with the default: Entra ID and Okta are detected and every other issuer, Auth0 included, is standard OIDC. The setting is only for an Okta custom domain or a sovereign-cloud Entra ID issuer. Schema and validator bundle are re-vendored from the same source revision and their pins bumped.
pareilly
marked this pull request as ready for review
November 5, 2026 20:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The
dtwo-gateway-configskill gets guidance for arming human-gated clearing on a gateway that authenticates against the customer's own IdP:<gateway origin>/session-control/clear/callback, or thesession_control.redirect_urivalue, and when that override is required.gateway.intent.enabled: true; without itset_intentstores nothing.SESSION_SUBJECT_PROVIDERingateway.advanced.The vendored
schema-reference.jsonis re-copied from the product's schema generator, picking up the updatedsession_control.client_idguidance. The digest is regenerated and the pinned artifact hash bumped. Only that one rationale string changed, so no safe-default seed moved.The plugin version goes to 1.3.5 in all three manifests.
Merge timing
This describes gateway behaviour in the next gateway release. Keep it as a draft until that release is out.
Checks
node scripts/generate-schema-digest.mjs --checkpasses.skill-harness:pnpm test(183 pass),biome:checkandtypecheckare clean.node scripts/build-openai-plugin.mjs --checkpasses.