Test
5e7cb7a4f7
feat: add AssumeRoleActivity for temporary LLM API token grants
...
Implements AWS AssumeRole-like pattern for Poimen:
- User/service requests temporary access with identity + scope
- AssumeRoleActivity exchanges credentials with OAuth2 auth server
- Returns JWT token valid for limited time (default: 1hr, max: 24hrs)
- Token used in all subsequent LLM API calls to api.riotpiao.com
Key features:
- Credentials from vault/K8s secrets (never hardcoded)
- Scope-based access control (llm:read, llm:read llm:write, llm:admin)
- Automatic token expiration tracking
- Retry support for transient auth failures (2x, 1.5s backoff)
- Configurable auth server endpoint
Usage pattern:
1. AssumeRoleActivity(identity, scope) → JWT token
2. LLMRouter uses token in LLMAuth config
3. All activity calls validated against token + scopes
4. Workflow optionally refreshes token before expiry
Security:
- No credentials in code/logs (env or vault only)
- Short-lived tokens (1hr default, 24hr max)
- Server-enforced scope validation
- Token revocation support
Activity registered: #10 (authentication category)
Knowledge base updated with full activity spec
New file: action/assume_role.go (5.2 KB)
2026-09-04 14:11:58 -07:00
Test
8caa7d1c0c
refactor: simplify auth - remove undefined TenantID concept
...
- Remove TenantID field from LLMAuth (JWT claims handle tenant info)
- Remove Scopes field (not part of Poimen's design)
- Simplify to 3 core auth types: Bearer, API Key, Custom
- Update LLMRouterConfig to only include Auth field
- Simplify README examples to per-deployment pattern
- Focus on secure token management vs multi-tenant isolation
- Clarify token rotation pattern for long-running workflows
- Update security section with practical vault integration examples
TenantID was introduced without proper context. In Poimen:
- JWT token itself contains tenant/customer info in claims
- Each deployment gets its own LLM_AUTH_TOKEN from vault
- LLM API provider (riotpiao.com) validates token at their end
- No need for separate tenant header in Poimen layer
Simpler, clearer, more maintainable.
2026-09-04 10:56:47 -07:00
Test
813dc23f80
feat: add JWT/OAuth2 authentication & multi-tenant federation
...
- Add LLMAuth struct with support for Bearer, API Key, and Custom auth types
- Implement applyAuth() to inject auth headers into LLM requests
- Add X-Tenant-ID header for multi-tenant isolation
- Add X-OAuth-Scopes header for OAuth2 scope enforcement
- Add UpdateAuth() for runtime token refresh (long-running workflows)
- Update LLMRouterConfig with Auth and TenantID fields
- Document 4 authentication patterns (Bearer, API Key, Custom, Router config)
- Add security best practices: token vault integration, tenant isolation, scopes
- Add audit headers for compliance & logging
- Create multi-tenant router factory pattern
Auth types supported:
- Bearer: JWT/OAuth2 tokens (most secure for federated access)
- API Key: Static keys (X-API-Key header)
- Custom: Any custom header-based scheme
- None: No authentication
Customers can now pass per-tenant JWT tokens with customized scopes
and isolated LLM API access per tenant/customer.
2026-09-04 10:54:22 -07:00
Test
78b5fce74a
docs: comprehensive README with skills & knowledge guide
...
- Explain Poimen philosophy (shepherd metaphor for orchestration)
- Document architecture and data flow with visual diagrams
- List all 9 registered activities with knowledge specs
- Provide getting started guide and usage patterns
- Include CI/CD pipeline, troubleshooting, and roadmap
- Integrate skills registration guide for contributors
- Explain registerable knowledge types (activity, domain, patterns)
- Document CRAP score improvements (97% reduction)
- Create virtuous cycle explanation (self-improving system)
- Add .gitignore exception for README.md
Refs: Shepherd metaphor emphasizes learning, adaptation, and composition
over rigid task scheduling. Each registered skill teaches the system.
2026-09-03 13:58:33 -07:00
Test