add per-chat and per-gadget observation tracking

.agents/skills/write-gatekeeper/SKELETON.md

@@ -410,6 +410,10 @@ export class MyGatekeeperImpl extends DurableObject<Env, MyGatekeeperImplProps>
   //   - Strategy D (low-stakes):   make both methods no-ops.
   //   - Strategy C (data-set tracking): record observed sets + store verifiers, and route every read
   //     through an authorizeSetObservation helper that sets `excludeObservers` (see SKILL.md).
+  //   - Workshop-tracked (`supportsObserverTracking` in describe()): always throw (a redeploy can
+  //     land between the Workshop's describe() and this call); authorize every read with
+  //     authorizeTrackedObservation(), reporting its `subresources`, and implement
+  //     verifyObserverAccess(observers, ids) instead, checking each observer's verifier the same way.
   async addObserver(_id: string, user: Fetcher<GatekeeperUserVerifier>): Promise<void> {
     let verifier = user as unknown as Fetcher<MyVerifierApi>;
     if (!(await verifier.hasResourceAccess(/* this.ctx.props.resourceId */ "TODO"))) {

packages/gatekeeper-google/__tests__/worker.ts

@@ -71,6 +71,10 @@ class TestApprovalQueue extends RpcTarget implements ApprovalQueue {
     this.observations.push(description.description);
   }
 
+  async authorizeTrackedObservation(): Promise<void> {
+    throw new Error("Unexpected tracked observation");
+  }
+
   async getGitCache(): Promise<GitCache> {
     throw new Error("Unexpected git cache access");
   }

packages/gatekeeper-google/__tests__/workerd/native-sessions.test.ts

@@ -108,6 +108,10 @@ class TestApprovalQueue extends RpcTarget implements ApprovalQueue {
     this.observations.push(description);
   }
 
+  async authorizeTrackedObservation(): Promise<void> {
+    throw new Error("Unexpected tracked observation");
+  }
+
   async getGitCache(): Promise<GitCache> {
     throw new Error("Unexpected git cache access");
   }

packages/gatekeeper-google/__tests__/workerd/sheets-session.test.ts

@@ -26,6 +26,10 @@ class TestApprovalQueue extends RpcTarget implements ApprovalQueue {
     this.observations.push(description);
   }
 
+  async authorizeTrackedObservation(): Promise<void> {
+    throw new Error("Unexpected tracked observation");
+  }
+
   async getGitCache(): Promise<GitCache> {
     throw new Error("Unexpected git cache access");
   }

packages/gatekeeper-google/__tests__/workerd/slides-session.test.ts

@@ -19,6 +19,10 @@ class TestApprovalQueue extends RpcTarget implements ApprovalQueue {
     this.observations.push(description);
   }
 
+  async authorizeTrackedObservation(): Promise<void> {
+    throw new Error("Unexpected tracked observation");
+  }
+
   async getGitCache(): Promise<GitCache> {
     throw new Error("Unexpected git cache access");
   }

packages/gatekeeper-google/__tests__/workerd/worker.ts

@@ -156,6 +156,10 @@ class TestApprovalQueue extends RpcTarget {
     }
   }
 
+  async authorizeTrackedObservation(): Promise<void> {
+    throw new Error("Tracked observations are not used by these tests.");
+  }
+
   async submitAction(actionId: number, description: unknown): Promise<void> {
     this.#submissions.push({actionId, description});
     if (this.#pausedSubmission) {

packages/gatekeeper-kit/__tests__/workerd/conformance/gatekeeper.ts

@@ -103,6 +103,10 @@ export class FixtureQueue extends RpcTarget {
     observations.push(description);
   }
 
+  async authorizeTrackedObservation(): Promise<void> {
+    throw new Error("The conformance gatekeeper does not use observer tracking.");
+  }
+
   async submitAction(action: number, description: ActionDescription): Promise<void> {
     submissions.push([action, description]);
   }

packages/gatekeeper-kit/__tests__/workerd/cursors.test.ts

@@ -41,6 +41,10 @@ class TestAuthorizer extends RpcTarget implements ObservationAuthorizer {
     this.#seen.push(description.description);
   }
 
+  async authorizeTrackedObservation(): Promise<void> {
+    throw new Error("Tracked observations are not used in this test.");
+  }
+
   async getGitCache(): Promise<GitCache> {
     throw new Error("Git cache is not used in this test.");
   }