Server-side requestContext source, consulted on EVERY start and resume.
This is the trusted-computing-base seam (security-threat-model.md, trust
boundary 6): the DO HTTP boundary never maps requestContext from request
bodies, so capability keys — e.g. breakwater's approval grants
('breakwater.approvedConnectors') — can only enter a run through this
provider. Wire it to derive values from trusted server-side state (the
flowsafe approval store), never from client input, model output, or tool
results.
Merge semantics (pinned by test against core 1.49.0): the context provided
at resume merges OVER the run's persisted context — provided keys win,
persisted start-time keys survive. Omitting a key therefore does not
revoke it; a provider that scopes a capability per leg must return the key
on EVERY leg (an empty value when nothing applies) so the overwrite
retires stale grants.
Server-side requestContext source, consulted on EVERY start and resume. This is the trusted-computing-base seam (security-threat-model.md, trust boundary 6): the DO HTTP boundary never maps requestContext from request bodies, so capability keys — e.g. breakwater's approval grants ('breakwater.approvedConnectors') — can only enter a run through this provider. Wire it to derive values from trusted server-side state (the flowsafe approval store), never from client input, model output, or tool results.
Merge semantics (pinned by test against core 1.49.0): the context provided at resume merges OVER the run's persisted context — provided keys win, persisted start-time keys survive. Omitting a key therefore does not revoke it; a provider that scopes a capability per leg must return the key on EVERY leg (an empty value when nothing applies) so the overwrite retires stale grants.