Stop publishing repository-wide prompt ledgers and enforce per-user prompt isolation through authenticated Gitea IDs.

Hop-State: A_06FN8NFDRFAFN5VCJTHJAAG
Hop-Proposal: R_06FN8NEGJ054CPMJF9ZAN70
Hop-Task: T_06FN8HT6XG332C3XY6PYCCG
Hop-Attempt: AT_06FN8HT6XGRXW0B4WPFFBJG

services/control-plane/internal/gitea/client.go

@@ -27,6 +27,19 @@ type Owner struct {
 	Username string `json:"username"`
 }
 
+type User struct {
+	ID       int64  `json:"id"`
+	Login    string `json:"login"`
+	Username string `json:"username"`
+}
+
+func (u User) LoginName() string {
+	if u.Login != "" {
+		return u.Login
+	}
+	return u.Username
+}
+
 func (r Repository) OwnerName() string {
 	if r.Owner.Login != "" {
 		return r.Owner.Login
@@ -79,6 +92,69 @@ func (c *Client) Repository(ctx context.Context, owner, name string) (Repository
 	return repo, nil
 }
 
+func (c *Client) User(ctx context.Context, login string) (User, error) {
+	if c.token == "" {
+		return User{}, ErrTokenNotConfigured
+	}
+	u := c.baseURL.JoinPath("api", "v1", "users", login)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	if err != nil {
+		return User{}, err
+	}
+	req.Header.Set("Authorization", "token "+c.token)
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return User{}, fmt.Errorf("request user: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return User{}, fmt.Errorf("gitea user lookup returned %s", resp.Status)
+	}
+	var user User
+	if err := json.NewDecoder(resp.Body).Decode(&user); err != nil {
+		return User{}, fmt.Errorf("decode user: %w", err)
+	}
+	if user.ID <= 0 || user.LoginName() == "" {
+		return User{}, errors.New("gitea returned an incomplete user")
+	}
+	return user, nil
+}
+
+func (c *Client) AuthenticatedUser(ctx context.Context, cookie string) (User, bool, error) {
+	if strings.TrimSpace(cookie) == "" {
+		return User{}, false, nil
+	}
+	u := c.baseURL.JoinPath("api", "v1", "user")
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	if err != nil {
+		return User{}, false, err
+	}
+	req.Header.Set("Cookie", cookie)
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return User{}, false, fmt.Errorf("load authenticated user: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden {
+		return User{}, false, nil
+	}
+	if resp.StatusCode != http.StatusOK {
+		return User{}, false, fmt.Errorf("gitea authenticated user lookup returned %s", resp.Status)
+	}
+	var user User
+	if err := json.NewDecoder(resp.Body).Decode(&user); err != nil {
+		return User{}, false, fmt.Errorf("decode authenticated user: %w", err)
+	}
+	if user.ID <= 0 || user.LoginName() == "" {
+		return User{}, false, errors.New("gitea returned an incomplete authenticated user")
+	}
+	return user, true, nil
+}
+
 // ViewerCanReadRepository checks a browser's existing Gitea session before
 // returning prompt data. Prompts may contain sensitive intent, so the Hop API
 // must never turn a private repository into a public metadata feed.

services/control-plane/internal/gitea/client_test.go

@@ -43,6 +43,59 @@ func TestRepositoryRequiresToken(t *testing.T) {
 	}
 }
 
+func TestUserUsesTokenAndDecodesStableID(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/users/alice" {
+			t.Fatalf("path = %q", r.URL.Path)
+		}
+		if got := r.Header.Get("Authorization"); got != "token gitea-token" {
+			t.Fatalf("authorization = %q", got)
+		}
+		_, _ = w.Write([]byte(`{"id":42,"login":"alice"}`))
+	}))
+	defer server.Close()
+	client, err := NewClient(server.URL, "gitea-token")
+	if err != nil {
+		t.Fatal(err)
+	}
+	user, err := client.User(context.Background(), "alice")
+	if err != nil || user.ID != 42 || user.LoginName() != "alice" {
+		t.Fatalf("user = %#v, err = %v", user, err)
+	}
+}
+
+func TestAuthenticatedUserForwardsSessionCookie(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/v1/user" {
+			t.Fatalf("path = %q", r.URL.Path)
+		}
+		if got := r.Header.Get("Cookie"); got != "i_like_gitea=session" {
+			t.Fatalf("cookie = %q", got)
+		}
+		_, _ = w.Write([]byte(`{"id":42,"login":"alice"}`))
+	}))
+	defer server.Close()
+	client, err := NewClient(server.URL, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	user, authenticated, err := client.AuthenticatedUser(context.Background(), "i_like_gitea=session")
+	if err != nil || !authenticated || user.ID != 42 {
+		t.Fatalf("user = %#v, authenticated = %t, err = %v", user, authenticated, err)
+	}
+}
+
+func TestAuthenticatedUserRejectsMissingSession(t *testing.T) {
+	client, err := NewClient("http://gitea.test", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	user, authenticated, err := client.AuthenticatedUser(context.Background(), "")
+	if err != nil || authenticated || user.ID != 0 {
+		t.Fatalf("user = %#v, authenticated = %t, err = %v", user, authenticated, err)
+	}
+}
+
 func TestViewerCanReadRepositoryForwardsSessionCookie(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/api/v1/repos/hop/private" {

services/control-plane/internal/httpapi/server.go

@@ -21,6 +21,8 @@ const maxWebhookBody = 2 << 20
 
 type giteaClient interface {
 	Repository(context.Context, string, string) (gitea.Repository, error)
+	User(context.Context, string) (gitea.User, error)
+	AuthenticatedUser(context.Context, string) (gitea.User, bool, error)
 	ViewerCanReadRepository(context.Context, string, string, string) (bool, error)
 }
 
@@ -51,7 +53,18 @@ func (s *server) listPrompts(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "owner and repo are required")
 		return
 	}
-	allowed, err := s.gitea.ViewerCanReadRepository(r.Context(), r.Header.Get("Cookie"), owner, name)
+	cookie := r.Header.Get("Cookie")
+	viewer, authenticated, err := s.gitea.AuthenticatedUser(r.Context(), cookie)
+	if err != nil {
+		s.logger.Error("load prompt viewer", "owner", owner, "name", name, "error", err)
+		writeError(w, http.StatusBadGateway, "could not verify signed-in user")
+		return
+	}
+	if !authenticated {
+		writeError(w, http.StatusUnauthorized, "sign in to view your prompts")
+		return
+	}
+	allowed, err := s.gitea.ViewerCanReadRepository(r.Context(), cookie, owner, name)
 	if err != nil {
 		s.logger.Error("check prompt viewer access", "owner", owner, "name", name, "error", err)
 		writeError(w, http.StatusBadGateway, "could not verify repository access")
@@ -61,7 +74,7 @@ func (s *server) listPrompts(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusUnauthorized, "sign in to view this repository's prompts")
 		return
 	}
-	prompts, err := s.store.ListPrompts(r.Context(), owner, name, 100)
+	prompts, err := s.store.ListPrompts(r.Context(), owner, name, viewer.ID, 100)
 	if err != nil {
 		s.logger.Error("list prompts", "owner", owner, "name", name, "error", err)
 		writeError(w, http.StatusInternalServerError, "could not list prompts")
@@ -77,6 +90,7 @@ func (s *server) createPrompt(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	var input struct {
+		UserLogin       string          `json:"user_login"`
 		TaskID          string          `json:"task_id"`
 		AttemptID       string          `json:"attempt_id"`
 		StateID         string          `json:"state_id"`
@@ -92,6 +106,11 @@ func (s *server) createPrompt(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
+	input.UserLogin = strings.TrimSpace(input.UserLogin)
+	if !validSlug(input.UserLogin) {
+		writeError(w, http.StatusBadRequest, "user_login is required")
+		return
+	}
 	input.Prompt = strings.TrimSpace(input.Prompt)
 	if input.Prompt == "" || len(input.Prompt) > 32<<10 {
 		writeError(w, http.StatusBadRequest, "prompt is required and must be at most 32 KiB")
@@ -110,9 +129,20 @@ func (s *server) createPrompt(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "metadata must be valid JSON and at most 16 KiB")
 		return
 	}
+	promptOwner, err := s.gitea.User(r.Context(), input.UserLogin)
+	if err != nil {
+		if errors.Is(err, gitea.ErrTokenNotConfigured) {
+			writeError(w, http.StatusServiceUnavailable, err.Error())
+			return
+		}
+		s.logger.Error("resolve prompt owner", "user_login", input.UserLogin, "error", err)
+		writeError(w, http.StatusBadGateway, "could not resolve prompt owner")
+		return
+	}
 	saved, err := s.store.CreatePrompt(r.Context(), store.CreatePromptInput{
 		Owner: owner, Repository: name, TaskID: input.TaskID, AttemptID: input.AttemptID, StateID: input.StateID,
-		Prompt: input.Prompt, AgentName: input.AgentName, AgentModel: input.AgentModel, Status: input.Status,
+		GiteaUserID: promptOwner.ID,
+		Prompt:      input.Prompt, AgentName: input.AgentName, AgentModel: input.AgentModel, Status: input.Status,
 		ResponseSummary: input.ResponseSummary, Metadata: input.Metadata, CompletedAt: input.CompletedAt,
 	})
 	if err != nil {

services/control-plane/internal/httpapi/server_test.go

@@ -20,6 +20,7 @@ import (
 type fakeStore struct {
 	repositories []store.Repository
 	prompts      []store.Prompt
+	listUserID   int64
 	delivery     store.WebhookDelivery
 	duplicate    bool
 }
@@ -33,11 +34,12 @@ func (f *fakeStore) UpsertRepository(_ context.Context, repository gitea.Reposit
 	f.repositories = append(f.repositories, saved)
 	return saved, nil
 }
-func (f *fakeStore) ListPrompts(context.Context, string, string, int) ([]store.Prompt, error) {
+func (f *fakeStore) ListPrompts(_ context.Context, _, _ string, giteaUserID int64, _ int) ([]store.Prompt, error) {
+	f.listUserID = giteaUserID
 	return f.prompts, nil
 }
 func (f *fakeStore) CreatePrompt(_ context.Context, input store.CreatePromptInput) (store.Prompt, error) {
-	prompt := store.Prompt{ID: "PM_TEST", Prompt: input.Prompt, Status: input.Status, AgentName: input.AgentName, AgentModel: input.AgentModel, Metadata: input.Metadata}
+	prompt := store.Prompt{ID: "PM_TEST", GiteaUserID: input.GiteaUserID, Prompt: input.Prompt, Status: input.Status, AgentName: input.AgentName, AgentModel: input.AgentModel, Metadata: input.Metadata}
 	f.prompts = append(f.prompts, prompt)
 	return prompt, nil
 }
@@ -48,13 +50,21 @@ func (f *fakeStore) RecordWebhook(_ context.Context, delivery store.WebhookDeliv
 
 type fakeGitea struct {
 	repository    gitea.Repository
+	user          gitea.User
 	err           error
 	viewerAllowed bool
+	authenticated bool
 }
 
 func (f fakeGitea) Repository(context.Context, string, string) (gitea.Repository, error) {
 	return f.repository, f.err
 }
+func (f fakeGitea) User(context.Context, string) (gitea.User, error) {
+	return f.user, f.err
+}
+func (f fakeGitea) AuthenticatedUser(context.Context, string) (gitea.User, bool, error) {
+	return f.user, f.authenticated, f.err
+}
 func (f fakeGitea) ViewerCanReadRepository(context.Context, string, string, string) (bool, error) {
 	return f.viewerAllowed, f.err
 }
@@ -130,7 +140,7 @@ func TestWebhookRejectsInvalidSignature(t *testing.T) {
 
 func TestListPromptsRequiresGiteaSession(t *testing.T) {
 	data := &fakeStore{prompts: []store.Prompt{{ID: "PM_TEST", Prompt: "Ship the prompt view", Status: "completed"}}}
-	handler := testServer(data, fakeGitea{viewerAllowed: true})
+	handler := testServer(data, fakeGitea{user: gitea.User{ID: 42, Login: "alice"}, viewerAllowed: true, authenticated: true})
 	req := httptest.NewRequest(http.MethodGet, "/api/v1/prompts?owner=hop&repo=demo", nil)
 	req.Header.Set("Cookie", "i_like_gitea=session")
 	response := httptest.NewRecorder()
@@ -141,6 +151,9 @@ func TestListPromptsRequiresGiteaSession(t *testing.T) {
 	if !bytes.Contains(response.Body.Bytes(), []byte("Ship the prompt view")) {
 		t.Fatalf("prompt missing from response: %s", response.Body.String())
 	}
+	if data.listUserID != 42 {
+		t.Fatalf("prompts listed for Gitea user %d, want 42", data.listUserID)
+	}
 }
 
 func TestListPromptsRejectsUnauthenticatedViewer(t *testing.T) {
@@ -155,8 +168,8 @@ func TestListPromptsRejectsUnauthenticatedViewer(t *testing.T) {
 
 func TestCreatePrompt(t *testing.T) {
 	data := &fakeStore{}
-	handler := testServer(data, fakeGitea{})
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/repositories/hop/demo/prompts", bytes.NewBufferString(`{"prompt":"Ship the prompt view","agent_name":"codex","status":"completed","metadata":{"duration_ms":1200}}`))
+	handler := testServer(data, fakeGitea{user: gitea.User{ID: 42, Login: "alice"}})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/repositories/hop/demo/prompts", bytes.NewBufferString(`{"user_login":"alice","prompt":"Ship the prompt view","agent_name":"codex","status":"completed","metadata":{"duration_ms":1200}}`))
 	req.Header.Set("Authorization", "Bearer admin-secret")
 	response := httptest.NewRecorder()
 	handler.ServeHTTP(response, req)
@@ -166,4 +179,18 @@ func TestCreatePrompt(t *testing.T) {
 	if len(data.prompts) != 1 || data.prompts[0].Prompt != "Ship the prompt view" {
 		t.Fatalf("prompt not created: %#v", data.prompts)
 	}
+	if data.prompts[0].GiteaUserID != 42 {
+		t.Fatalf("prompt owner = %d, want 42", data.prompts[0].GiteaUserID)
+	}
+}
+
+func TestCreatePromptRequiresOwner(t *testing.T) {
+	handler := testServer(&fakeStore{}, fakeGitea{})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/repositories/hop/demo/prompts", bytes.NewBufferString(`{"prompt":"private work","status":"completed"}`))
+	req.Header.Set("Authorization", "Bearer admin-secret")
+	response := httptest.NewRecorder()
+	handler.ServeHTTP(response, req)
+	if response.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want %d; body=%s", response.Code, http.StatusBadRequest, response.Body.String())
+	}
 }

services/control-plane/internal/store/migrations/003_prompt_owners.sql

@@ -0,0 +1,5 @@
+ALTER TABLE prompts ADD COLUMN gitea_user_id bigint CHECK (gitea_user_id > 0);
+
+CREATE INDEX prompts_repository_user_created_at_idx
+    ON prompts (repository_id, gitea_user_id, created_at DESC)
+    WHERE gitea_user_id IS NOT NULL;

services/control-plane/internal/store/store.go

@@ -40,6 +40,7 @@ type WebhookDelivery struct {
 
 type Prompt struct {
 	ID              string          `json:"id"`
+	GiteaUserID     int64           `json:"-"`
 	TaskID          string          `json:"task_id,omitempty"`
 	AttemptID       string          `json:"attempt_id,omitempty"`
 	StateID         string          `json:"state_id,omitempty"`
@@ -56,6 +57,7 @@ type Prompt struct {
 type CreatePromptInput struct {
 	Owner           string
 	Repository      string
+	GiteaUserID     int64
 	TaskID          string
 	AttemptID       string
 	StateID         string
@@ -72,7 +74,7 @@ type Store interface {
 	Ping(context.Context) error
 	ListRepositories(context.Context) ([]Repository, error)
 	UpsertRepository(context.Context, gitea.Repository) (Repository, error)
-	ListPrompts(context.Context, string, string, int) ([]Prompt, error)
+	ListPrompts(context.Context, string, string, int64, int) ([]Prompt, error)
 	CreatePrompt(context.Context, CreatePromptInput) (Prompt, error)
 	RecordWebhook(context.Context, WebhookDelivery) (bool, error)
 }
@@ -162,15 +164,15 @@ func (p *Postgres) UpsertRepository(ctx context.Context, repository gitea.Reposi
 	return upsertRepository(ctx, p.pool, id, repository)
 }
 
-func (p *Postgres) ListPrompts(ctx context.Context, owner, name string, limit int) ([]Prompt, error) {
+func (p *Postgres) ListPrompts(ctx context.Context, owner, name string, giteaUserID int64, limit int) ([]Prompt, error) {
 	rows, err := p.pool.Query(ctx, `
-		SELECT p.id, p.task_id, p.attempt_id, p.state_id, p.prompt, p.agent_name, p.agent_model,
+		SELECT p.id, p.gitea_user_id, p.task_id, p.attempt_id, p.state_id, p.prompt, p.agent_name, p.agent_model,
 			p.status, p.response_summary, p.metadata, p.created_at, p.completed_at
 		FROM prompts p
 		JOIN repositories r ON r.id = p.repository_id
-		WHERE r.owner=$1 AND r.name=$2
+		WHERE r.owner=$1 AND r.name=$2 AND p.gitea_user_id=$3
 		ORDER BY p.created_at DESC
-		LIMIT $3`, owner, name, limit)
+		LIMIT $4`, owner, name, giteaUserID, limit)
 	if err != nil {
 		return nil, err
 	}
@@ -178,7 +180,7 @@ func (p *Postgres) ListPrompts(ctx context.Context, owner, name string, limit in
 	prompts := make([]Prompt, 0)
 	for rows.Next() {
 		var prompt Prompt
-		if err := rows.Scan(&prompt.ID, &prompt.TaskID, &prompt.AttemptID, &prompt.StateID, &prompt.Prompt, &prompt.AgentName, &prompt.AgentModel, &prompt.Status, &prompt.ResponseSummary, &prompt.Metadata, &prompt.CreatedAt, &prompt.CompletedAt); err != nil {
+		if err := rows.Scan(&prompt.ID, &prompt.GiteaUserID, &prompt.TaskID, &prompt.AttemptID, &prompt.StateID, &prompt.Prompt, &prompt.AgentName, &prompt.AgentModel, &prompt.Status, &prompt.ResponseSummary, &prompt.Metadata, &prompt.CreatedAt, &prompt.CompletedAt); err != nil {
 			return nil, err
 		}
 		prompts = append(prompts, prompt)
@@ -197,12 +199,12 @@ func (p *Postgres) CreatePrompt(ctx context.Context, input CreatePromptInput) (P
 	}
 	var prompt Prompt
 	err = p.pool.QueryRow(ctx, `
-		INSERT INTO prompts (id, repository_id, task_id, attempt_id, state_id, prompt, agent_name, agent_model, status, response_summary, metadata, completed_at)
-		SELECT $1, r.id, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13
+		INSERT INTO prompts (id, repository_id, gitea_user_id, task_id, attempt_id, state_id, prompt, agent_name, agent_model, status, response_summary, metadata, completed_at)
+		SELECT $1, r.id, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14
 		FROM repositories r WHERE r.owner=$2 AND r.name=$3
-		RETURNING id, task_id, attempt_id, state_id, prompt, agent_name, agent_model, status, response_summary, metadata, created_at, completed_at`,
-		id, input.Owner, input.Repository, input.TaskID, input.AttemptID, input.StateID, input.Prompt, input.AgentName, input.AgentModel, input.Status, input.ResponseSummary, metadata, input.CompletedAt,
-	).Scan(&prompt.ID, &prompt.TaskID, &prompt.AttemptID, &prompt.StateID, &prompt.Prompt, &prompt.AgentName, &prompt.AgentModel, &prompt.Status, &prompt.ResponseSummary, &prompt.Metadata, &prompt.CreatedAt, &prompt.CompletedAt)
+		RETURNING id, gitea_user_id, task_id, attempt_id, state_id, prompt, agent_name, agent_model, status, response_summary, metadata, created_at, completed_at`,
+		id, input.Owner, input.Repository, input.GiteaUserID, input.TaskID, input.AttemptID, input.StateID, input.Prompt, input.AgentName, input.AgentModel, input.Status, input.ResponseSummary, metadata, input.CompletedAt,
+	).Scan(&prompt.ID, &prompt.GiteaUserID, &prompt.TaskID, &prompt.AttemptID, &prompt.StateID, &prompt.Prompt, &prompt.AgentName, &prompt.AgentModel, &prompt.Status, &prompt.ResponseSummary, &prompt.Metadata, &prompt.CreatedAt, &prompt.CompletedAt)
 	if err != nil {
 		return Prompt{}, err
 	}