broker: per-user balance privacy fix + io.pilot.orthogonal v0.1.1#72
Merged
Conversation
…balance
A shared-master-key (credit) app whose partner exposes an account-wide balance/
credits endpoint would leak the WHOLE pooled account balance (every user's spend)
to any single caller. Add CreditSpec.balance_path: the broker answers that path
from its OWN per-caller ledger and never forwards it, returning only the caller's
remaining micro-$ budget ("$X.XX" + credits_remaining). Seeds on first sight so
the per-IP cap applies. Operators keep the partner's real account-balance/usage/
transactions paths OUT of the allow-list so they can't be proxied.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…de methods The broker now answers orthogonal.balance from its own per-user ledger and blocks the partner's account-wide credit endpoints. Update the app surface to match: - orthogonal.balance description → YOUR per-user budget (not the shared account). - remove orthogonal.check / .transactions / .usage (account-wide; broker 403s them). - long description: clarify you only ever see your own budget, never the pooled total. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This was referenced Jul 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A user flagged that
orthogonal.balancereturned the entire shared account's credit balance — every pilot user's pooled spend on the masterorth_live_key. A shared-master-key app must never expose the account-wide balance.Fix (broker, server-side — protects every already-installed adapter)
CreditSpec.balance_path: the broker answers that path from its own per-caller ledger and never forwards it upstream, returning only the caller's remaining micro-$ budget ("$X.XX"+credits_remaining+credits_seed,scope: per-pilot-user). Seeds on first sight so the per-IP cap applies.io.pilot.orthogonalbroker entry now allows onlysearch/details/integrate/list-endpoints/run, withbalance_path: /v1/credits/balance.broker.pilotprotocol.network) and live-verified.App v0.1.1 (surface matches reality)
orthogonal.balancedescription → your per-user budget (not the account).orthogonal.check/.transactions/.usage(account-wide; the broker now 403s them).Verified live (real master key)
orthogonal.balance→ $5.00 per-user (was $54 account); account balance never exposed.usage/transactions/check→ 403.rundebits the per-user budget; depleted user → 402 (upstream not charged); free discovery still works.TestCreditBalance_PerUserNotAccount(+ existing respcost/IP-cap tests) green;verify-submissionbuilds 4 platforms for v0.1.1.🤖 Generated with Claude Code