Broker tenancy + per-IP grant cap + fail-closed guards

[Alexgodoroja]

Summary

Makes the managed-key broker enforce per-caller resource isolation for apps whose partner account cannot be split per user (e.g. io.pilot.agentphone, an account bound to a provider campaign), and closes several defaults that resolved to "allow" when a field was unset.

Upstream, every pilot user of a shared-account app is the same customer, so the partner cannot tell them apart and nothing enforced isolation. Any caller could reference any resource id on the shared account. The broker is now the tenancy layer.

What changed

Tenancy (internal/broker/tenancy.go, owner.go, store*.go)

• Every resource is claimed by its creator; a reference in the path, query, or body is checked against an ownership ledger before the request is forwarded; list responses are filtered to the caller's own rows; account summaries are recomputed from the caller's ledger.
• Deny-by-default: a resource with no ledger row belongs to nobody and is refused to everybody (this is what retires shared/legacy resources).
• Parser-differential hardening: bodies with duplicate keys or trailing content are refused (the broker validates with one parser but forwards raw bytes to another).
• 404 (never 403) on a denied reference, so the broker isn't an oracle for enumerating other tenants' ids.

Per-IP grant cap (broker.go)

• The (N+1)th distinct identity on a source IP is recorded with a zero grant rather than refused: it can still read, but every priced call hits 402. Bounds free budget minted per network without hard-locking a shared-NAT newcomer out.

Fail-closed defaults

• allow entries are method-scoped (a registry can express reads-yes/writes-no).
• creditEnabled keys off the credit block's presence, not a non-zero seed (so seed_credits: 0 means a zero budget, not "no metering").
• max_identities_per_ip defaults to a cap; only an explicit negative disables it.
• A classic managed app that forwards with header auth but no header name is rejected at load, not on first traffic.
• Store/upstream errors return a correlation id instead of internal hostnames/addresses.
• Access-key gate (accesskey.go) available for apps that grant something of value; broker refuses to boot if an app requires a key that isn't configured.

Deploy (deploy/setup-broker-tls.sh, deploy/agentphone-tenancy.py)

• Generated nginx location / now sets X-Real-IP (the only source-IP signal the broker trusts; without it the per-IP cap collapses to one bucket).
• Registry script for agentphone: enables spend routes (bound by tenancy + grant cap), withholds account-level webhooks and unownable reactions.

Tests

Tests are written as attacks: cross-tenant use via a body reference, reads of another tenant's resources, ownership takeover, type confusion, parser-differential duplicate keys, count fields that leak the unfiltered set, and the grant-cap contract (capped identity reads but cannot spend).

Live verification (pilot-publish)

Deployed and exercised via a real pilot node against all four managed apps:

• agentphone: full funded flow (create agent → buy number → attach → real SMS from the owned number); cross-tenant send/read/delete all 404; lists and usage counts scoped to the caller; per-IP cap boundary (3 funded, 4th zero-grant reads but 402 on spend); balance debited exactly.
• sixtyfour / bowmark / orthogonal: forward correctly (no tenancy — they return data, no per-user resources).

🤖 Generated with Claude Code

[Alexgodoroja]

Added two operational fixes surfaced during live deployment (both prod-verified on pilot-publish):

1. X-Real-IP durability — deploy/setup-broker-tls.sh now emits proxy_set_header X-Real-IP in the catch-all location /. This was the root cause of orthogonal 429-ing every new user: the generated nginx vhost only set X-Real-IP on the signup sub-locations, so all managed-app callers collapsed to 127.0.0.1 and the per-IP identity cap saw one bucket. The live box was hotfixed; this makes it survive a regenerate. (smol-broker's template already sets it.)

2. ACCESS log restore — re-added the WithAccessLog middleware so the broker emits structured ACCESS {json} per request to journald (monitoring crawler → Postgres). It had been lost on a prior rebuild; shipping it here keeps security + monitoring on the same binary so neither redeploy clobbers the other.

Ledger note: pruned unused-full (credits==seed) 127.0.0.1 provision rows so the cap math is clean; spent rows and active identities kept. Verified real IPs now recorded and orthogonal seeds fresh users at $5.