[josjeon]

Summary

• Binding lists sent to Orbit authorization without both target parameters currently become upstream 400 responses and public 502 errors. Validate these requests locally and return 422 VALIDATION_ERROR with guidance to supply target_type and target_id.
• Enable this requirement only for the known Orbit management authorization route. An independent identity URL alone does not enable it.

Scope

• User-facing/API changes: incomplete binding-read targets receive a clear 422 before an upstream call. control_id remains an additional filter within an authorized target.
• Internal changes: add an opt-in provider setting and derive its Orbit default alongside the existing identity URL.
• Out of scope: stopping or changing callers, broader binding-list permissions, and changes to agent registration or runtime authorization. Unexpected upstream rejections retain their 502 response.

Risk and Rollout

• Risk level: low. Local auth and generic HTTP upstreams preserve namespace-wide list behavior. Complete targets still pass through upstream authorization.
• Release order: merge and publish Agent Control, update Orbit dependency pins, then validate in an approved non-production environment before the normal production rollout.
• Rollback plan: restore the previous Agent Control dependency release through the normal deployment process.
• No production access or deployment is part of this PR. The local reproduction uses mocked authorization and storage; release and deployment verification remain separate.

Testing

• Added or updated automated tests: incomplete targets, scoped filtering, generic-upstream compatibility, unaffected operations, and unexpected upstream failures. Review follow-up covers preserved 401/403/404 denials, mismatched target grants, and by-ID reads with target validation enabled.
• Ran all make check stages across tests, lint, and typechecking. Resumed contrib-test lint typecheck with public PyPI after the configured registry returned 401; all remaining stages passed. Server: 1,040 passed. SDK: 754 passed, 2 skipped.
• Manually verified behavior through the real FastAPI route with mocked authorization/storage: baseline incomplete target 400 -> 502; patched request 422 without an upstream call; complete targets return 200 with an empty list in both versions.
• Focused authorization and binding suites: 271 passed. The full repository check also passed.

Checklist

• Linked issue/spec (no separate issue linked).
• Updated docs/examples for user-facing changes in server/README.md.
• Included follow-up release/dependency/validation steps above.

Incident regression coverage

The HTTP regression matrix uses environment-driven startup configuration for both deployment URL shapes (HTTP and HTTPS), rather than manually enabling the provider flag.

Request shape	Expected result
No target/query parameters; control_id only (33, 37, 80)	422, no authorization request or binding storage access
Only target_type or only target_id, with or without control_id	422, no authorization request or binding storage access
Empty/whitespace target values or both fields empty	422, no authorization request or binding storage access
Cursor/limit, with or without control_id, but no target	422, no authorization request or binding storage access
Unsupported camel-case target parameter names	422; required snake-case parameters are absent
Complete authorized target, optional control_id filter	200; target and control filters exclude unrelated bindings
Complete authorized target across cursor pages	200 on each page; target forwarded for each authorization
Complete authorized target with zero matching bindings	200 with an empty page

The matrix covers 16 incomplete query shapes in both URL configurations plus valid filtering, pagination, and empty-list cases. Existing tests also cover upstream 401/403/404 denials, mismatched grants, by-ID binding reads, generic upstreams, registration/runtime operations, and unexpected upstream failures.

The incident's missing-target-context rejection is covered. Original query parameters for the later incident were not recovered, so its exact external request is not claimed as a replay. Non-empty malformed target syntax remains outside this presence-validation fix.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!