Infrastructure: Authorize and settle every controlled Storybook mutation entrance #4443

Current status - 2026-11-07

Blocked for landing by F4 #4437; both tracks are implemented together in #4463 and can co-land. This is an integration gate, not a request for another independent ingress implementation.

Windows/Win32 descriptor evidence now covers controlled HTTP/foreign-WS refusal, owned select/reset, channel lifetime, manifest-backed driver selection and explicit legacy separation; see the ledger. Finish macOS protected-ingress/manifest-lifetime coverage and preserve historical failed bypass attempts under #4441. F4's remaining context/secondary-window evidence is still tracked in #4437.

Protected args are intentionally unsupported (story-args-unsupported), including for the session-owning grant. This explicit refusal is the chosen args policy, not permission to log values or fall back to legacy HTTP. Non-agent channel/smoke remains explicitly legacy/unprotected and does not prove exclusive agent control. Transparent channel reconnect is not promised.

Goal

A protected driver listener does not make Storybook control exclusive. Story selection and prepare still reach the app through the unauthenticated HTTP and WebSocket ingress created by upstream createChannelServer, and #4434 refuses story args on protected services (story-args-unsupported). Make every controlled mutation entrance participate in authority, settlement, and context invalidation.

Part of #4435 (plan item F5).

Scope

• Owner: Storybook control ingress and the driver args policy.
• Paths (under packages/agentic/): the story and args routes in desktop-driver/src/server/createDesktopDriverServer.ts, storybook-desktop/src/driver/StorybookChannelOrchestrator.ts, smoke traversal, and storybook-desktop/config/server.cjs.
• Define an explicit args policy: keep refusing, or implement authorization, invalidation, settlement, and a privacy-preserving journal that records no values. The session-owning grant matters.
• Protect or disable alternate HTTP and WebSocket mutations while a target is controlled. Decide on a supported upstream interception approach before changing the channel.
• Make smoke traversal use the authoritative path.
• Keep the deliberately unprotected legacy mode separate. Do not block this on moving the channel into the parent process.

Dependencies

• Blocked by: F4 Infrastructure: Settle Storybook story-provider cancellation and reconnect epochs #4437 (context settlement and fencing).
• Unblocks: the Storybook facet of F13 Infrastructure: Add the generalized desktop-mcp management facet #4450.
• Parallel with: F2 Infrastructure: Implement settled desktop lifecycle supervision and fenced ownership records #4442, F6 Infrastructure: Tighten Storybook manifest provenance and native helper trust handoff #4445, F10-M Infrastructure: Implement neutral macOS desktop application ownership and identity recovery #4446, and F10-W Infrastructure: Implement neutral Windows desktop application ownership and containment #4447.
• Coordination: server.cjs integration commits are ordered F1 Infrastructure: Unify desktop driver-service composition and wire durable recovery #4436, F3 Infrastructure: Add owned-process lifelines and typed desktop service readiness #4444, F5, F6, then F9 Infrastructure: Convert Storybook lifecycle takeover into desktop-test resource contributions #4449. Apply ingress changes to StorybookChannelOrchestrator.ts after F4's epoch changes.

Acceptance

• Unauthenticated or foreign-authority selection and args cannot alter controlled context.
• Allowed mutations share settlement and invalidation.
• No argument values enter logs or journals.
• Legacy unprotected mode remains explicitly separate.
• "Exclusive Storybook control" leaves work in progress in the status references only with endpoint evidence.

Validation

• Iterate with focused yarn test <name> in each changed package, then run its yarn format, yarn lint, yarn build, and yarn test. Finish with yarn clean-lage-cache then yarn lage buildci; run yarn lage test-links --verbose --grouped after markdown changes.
• Add a patch changeset for each changed published package. Update the owning references/current-status.md rows (done, work in progress, unsupported) and affected README/AGENTS guidance in the same change.
• Native, provider, or process-topology changes need matching-OS native contracts and the affected consumer lane. JavaScript tests and bundles do not qualify native behavior; hosted capability skips are not passes. Report each check as passed, failed, skipped, not run, or unsupported.

Evidence

• Current state: "Story args on protected driver" and "Exclusive Storybook control" in packages/agentic/desktop-driver/references/current-status.md; partial protection boundaries in packages/agentic/storybook-desktop/references/integration.md.
• Retired plan: driver-next.md at 0569e1b86, section 8 (F5).