chore(restack): adopt protected auth baseline into runtime configuration by seonghobae · Pull Request #310 · ContextualWisdomLab/wardnet

seonghobae · 2026-09-11T06:22:36Z

Foundation-first, non-force synthesis only. Runtime Configuration owner #140 remains exact 7d98725cc51b259b0be940385b2245758d098081; protected/default main remains f8260f1e03836039ff9463dd99fa982e4e270c4b after #155. This reverse-direction lane exists only to adopt protected authentication/security truth into the moving #140 foundation before any trusted-proxy or PostgreSQL dependent moves.

Current conflict / serialized synthesis — 2026-09-17 KST

GitHub still reports this Draft PR mechanically non-mergeable because its head is protected main and its base is the pre-#155 #140 lineage. Its recorded base SHA is historical because #140 moved after #310 opened; that movement is an intervening delta to adopt normally, not a reason to force/rebase or discard either side.

src/credentials.rs on #140 is already causally reconciled with #155: strict credential-file JSON typing, blank/null rejection, visible-ASCII/header-safe secret admission, constant-time comparison, loopback/public-bind helpers and hostile tests are preserved while CredentialRegistry::bootstrap_from_env remains the process-edge secret adapter. Blank/whitespace WAF_IDS_CREDENTIALS_PATH remains unset. Blank/whitespace WAF_IDS_STATE_PATH also remains in-memory/unset through the hostile regression.

The former semantic source conflict was src/lib.rs. The architecture text on #140 states the actual CredentialRegistry + write-capable, header-presentable administrator contract and rejects TLS/identity controls or read-only credentials as substitutes for the public-bind write-auth prerequisite.

The #140 architecture-fitness hardening remains current. 6b314dd3b0541328726ffacb097fec1c6054efdb replaced substring matching with token-structured Rust syntax analysis so function-item aliases and import aliases cannot hide direct process-environment authority while comments and normal/raw strings do not cause false positives. c039776bb15a3af936cd93720c60c27f777dd4aa fixed the hostile lifetime-apostrophe edge. Current exact parent 7d98725... additionally contains the format-only repair exposed by child CI before any semantic authentication test ran.

Serialized Draft child #430 is the active synthesis/admission lane on exact #140 and has advanced to exact 65b887e347d47e3cd29071342c353408c3f14e4a. The hostile RED remains causal history: test-only exact 062ea6ab787d0a1d864e429a95f7ed1642fbf37e produced Fuzz 35029440921 SUCCESS and CI 35029440905 / rust job 104584220679, which proved stale run_from_env could bind public 0.0.0.0:44429 without a write-capable administrator and left protected-auth helpers unused.

The invalid attempted repair 408e8b8de90d061e6ef01414f298f2156d2466df replaced nearly all of src/lib.rs (221 additions / 6777 deletions) and violated the bounded synthesis requirement; 61790e2a46e8c45467f57558673e5a1b8a2e0490 immediately reverted it. No result from that source is promotable.

The deterministic one-shot synthesis subsequently executed successfully on exact helper input cc8f721775e808ff00961dc8e29540e34720b1c2. Run 35160876925, job 105011075007, pinned checkout by immutable SHA, guarded the expected predecessor and protected main@f826..., reconstructed from the complete protected src/lib.rs, applied only the reviewed Runtime Configuration/authentication composition, passed cargo fmt, git diff --check, cargo test --locked --test runtime_configuration_auth_synthesis, and cargo test --locked --lib, then committed only src/lib.rs as 0e0f01efbd6e21874c94eed987192534e234f211. The temporary helper workflow was removed by ordinary fast-forward follow-up at current exact 65b887e... and is no longer part of the child diff.

The synthesized child now preserves protected #155 source/tests and #140's bounded Runtime Configuration delta in one complete source tree. run_from_env consumes one immutable RuntimeConfiguration; secrets remain under CredentialRegistry::bootstrap_from_env; strict ADMIN_TOKEN / ADMIN_TOKENS, header-presentable write-capable-principal derivation, constant-time request authentication, listener loopback state, require_write_auth_for_bind before public listener bind, readiness auth_mode, with_listen_loopback, management 401/403, request-body/rate-limit, state/credential/flush/shutdown invariants and single-sourced parse helpers are retained. No source truncation, second configuration/credential authority, foreign-owner implementation, mutable dependency, source copy or cross-service SQL was introduced.

Exact-current admission state

Construction GREEN does not substitute for unchanged-current-head admission. Current #430 exact CI 35180770661 / rust job 105072217366 and Fuzz 35180770659 / fuzz job 105072216969 remain QUEUED at the latest fresh read. Do not blind-rerun, add no-op source churn, merge the child, move #140, or restack #193 and later dependents while that exact head is still non-terminal.

Once #430 has repository-native hostile/authentication GREEN plus then-current security/review/thread/base evidence on the unchanged exact head, merge it normally into #140. Then reconcile #140 non-force against protected main, preserving the complete current #140 architecture/configuration delta and protected authentication truth. Only after that settled root exists should PostgreSQL/trusted-proxy dependents move in dependency order.

Remaining repair acceptance

The eventual #140 integration must simultaneously:

retain exact current refactor(config): centralize runtime bootstrap snapshot #140 7d98725cc51b259b0be940385b2245758d098081, including the token-structured environment scanner, lifetime hostile regression, current formatter truth and corrected architecture authority text;
retain every protected fix(auth): fail closed without write-capable admin on public bind #155 fail-closed authentication/security semantic and hostile test;
retain one immutable non-secret RuntimeConfiguration delivery snapshot and forbid direct non-secret environment authority outside designated bootstrap adapters;
keep secrets under the reconciled CredentialRegistry::bootstrap_from_env boundary;
preserve strict administrator parsing, constant-time authentication, pre-bind public-listener authorization, readiness/health auth evidence, management 401/403, body/rate/state/credential/flush/shutdown behavior;
preserve blank/unset WAF_IDS_STATE_PATH and WAF_IDS_CREDENTIALS_PATH semantics;
keep parse helpers single-sourced in runtime_config.rs rather than duplicating them in lib.rs;
preserve the code-current docs/architecture.md authority contract already repaired on refactor(config): centralize runtime bootstrap snapshot #140;
preserve all non-overlapping protected/refactor(config): centralize runtime bootstrap snapshot #140 files and the complete application/UI/adapter/test surface;
reacquire exact-current 100% owned-production statement/branch/edge/public-rustdoc, security/SAST/CodeQL, review/thread, package/SBOM/provenance and fresh protected-base evidence on one unchanged integration head.

No force update, destructive rebase, source truncation, wholesale ours/theirs selection, gate weakening, predecessor-result promotion, routine bypass, mutable foreign dependency, source copy, cross-service SQL or dependent feature delta.

* fix(auth): fail closed without write-capable admin on public bind * fix(auth): reject unusable bootstrap credentials * fix(auth): reject header-ambiguous admin secrets * docs(security): record research redistribution assessment * test(auth): strengthen strict admin-token properties * test(auth): mirror strict admin-token rejection in fuzz target * test(auth): keep fuzz role semantics in sync * test(auth): property-check credential and RBAC boundary * test(auth): exercise fuzz invariants for arbitrary bytes * fix(auth): align health and write denial auth semantics * test(auth): reject fixed smoke administrator credential * fix(auth): mint ephemeral smoke administrator credential * docs(security): preserve fail-closed auth traceability * test(auth): bind smoke token generation to forwarding * docs(auth): retain redistributable NIST SSDF evidence * docs(auth): preserve external-secret deployment lifecycle after restack * docs(security): reconcile NIST artifact provenance --------- Co-authored-by: OpenAI Codex <codex@openai.com>

github-advanced-security · 2026-09-11T06:22:37Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

coderabbitai · 2026-09-11T06:22:44Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 207d0135-6924-4025-9344-1501941111cf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-09-11T06:43:10Z

Fresh exact-head repair finding: the ordinary expected-head merge of main@f8260f1e03836039ff9463dd99fa982e4e270c4b into feat/runtime-config-bootstrap-snapshot@93a51f9706cf8a9704f69aed4a69df5be16c84e4 was rejected as non-mergeable. Keep this restack open; this is a semantic conflict to repair, not a reason to close or replace the lineage.

The conflict sits on the bootstrap/auth edge. Protected #155 changed both src/credentials.rs and src/lib.rs, while #140 validly moved non-secret process configuration into the Runtime Configuration supporting subdomain. The repaired merge must preserve both authorities:

retain every protected fix(auth): fail closed without write-capable admin on public bind #155 auth/security invariant: strict malformed/blank credential rejection, header-safe administrator secrets, constant-time token matching, 401 for missing/unknown write credentials versus 403 for known read-only principals, require_write_auth_for_bind before listener bind, and loopback/public auth_mode evidence;
add refactor(config): centralize runtime bootstrap snapshot #140 CredentialRegistry::bootstrap_from_env without weakening fix(auth): fail closed without write-capable admin on public bind #155 credential parsing or validation;
keep refactor(config): centralize runtime bootstrap snapshot #140 RuntimeConfiguration as the sole non-secret process-environment bootstrap owner and do not whitelist lib.rs as an architecture-fitness escape hatch;
adapt run_from_env to the immutable runtime snapshot while still executing the protected fail-closed write-auth/public-bind checks before bind;
preserve the complete refactor(config): centralize runtime bootstrap snapshot #140 six-file Runtime Configuration delta and its architecture fitness tests.

No ours/theirs shortcut, force update, destructive rebase, gate weakening, or closure by replacement. GREEN requires a non-force two-parent adoption of the exact protected and feature heads, followed by fresh exact-head CI/Fuzz/Security/SAST/CodeQL/review/thread evidence; predecessor receipts are historical after the merge.

seonghobae · 2026-09-11T14:19:06Z

Fresh semantic conflict inventory against unchanged protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b and #140 exact a7eeb2620b1dd743b163516571d185d726838559 narrows the repair to two overlapping files; the other #140 paths (CHANGELOG.md, docs/architecture.md, src/runtime_config.rs, tests/runtime_configuration_bounds.rs) can be inherited as-is.

Conflict resolution must synthesize, not choose ours/theirs:

src/credentials.rs: start from protected fix(auth): fail closed without write-capable admin on public bind #155 semantics (strict JSON type/null/blank rejection, trim-aware env filtering, header-presentability validation, constant_time_eq, loopback detection, require_write_auth_for_bind, existing hostile tests) and add refactor(config): centralize runtime bootstrap snapshot #140's CredentialRegistry::bootstrap_from_env delivery adapter. The adapter may import PathBuf, but WAF_IDS_CREDENTIALS_PATH remains CredentialRegistry-owned; blank/whitespace path must remain unset rather than a filesystem target.
src/lib.rs: preserve protected fix(auth): fail closed without write-capable admin on public bind #155 AppState/listener/auth semantics and apply only refactor(config): centralize runtime bootstrap snapshot #140's runtime-snapshot refactor. run_from_env must load RuntimeConfiguration::from_env(), bootstrap credentials independently, derive AppConfig from the snapshot, parse ADMIN_TOKENS with the protected strict parser, compute has_write_capable_admin, call require_write_auth_for_bind(&runtime.bind_addr, ...) before bind/readiness, bind runtime.bind_addr, retain listen_loopback + /healthz.auth_mode, and pass snapshot rate/body bounds into AppState. Keep parse_event_limit/parse_u32_env/parse_u64_env single-sourced in src/runtime_config.rs and re-export them from lib.rs.
Preserve protected fix(auth): fail closed without write-capable admin on public bind #155 401/403 behavior, write-capable-principal semantics, secret comparison, readiness logging, smoke/security tests, and every non-overlapping protected path. Preserve refactor(config): centralize runtime bootstrap snapshot #140 RED→GREEN blank-state-path invariant from 87635bbee035e34c2a66c4fe63b66e3c35d99b3b → d72a67ab0ca9d1d43c26873840a2b7d5db46d250.

Acceptance on the resulting non-force two-parent/current-base head: the #140 runtime architecture-fitness suite plus all #155 credential/RBAC/public-bind hostile tests must pass together; no direct operational env reads outside the designated runtime/credential bootstrap adapters; exact-current CI/security/coverage/CodeQL/review/thread evidence must be reacquired. Do not move dependents until this root is semantically GREEN.

seonghobae · 2026-09-11T16:08:01Z

Fresh repair evidence on current Runtime Configuration head 0c678a924e3bf6ecdd248167e4289c1cbff60688: src/credentials.rs has now been causally reconciled against protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b without force/rebase. The branch keeps #155 strict credential JSON typing, blank/null rejection, header-safe secret validation, constant-time comparison, blank credentials-path filtering, and public-bind helpers, while restoring #140's CredentialRegistry::bootstrap_from_env as the designated process-edge secret adapter. bootstrap_from_env itself now filters blank/whitespace WAF_IDS_CREDENTIALS_PATH before returning the locator, so the returned bootstrap provenance cannot claim a blank path.

Current combined commit statuses on 0c678a9... are Devin Review=success and CodeRabbit=success; no repository Actions workflow has materialized on this exact head yet, so this is not GREEN evidence. The remaining semantic source conflict is src/lib.rs: the resolution must make run_from_env consume RuntimeConfiguration while retaining protected #155 listen_is_loopback_only, strict ADMIN_TOKENS parsing, write-capable principal derivation, require_write_auth_for_bind, readiness auth_mode, with_listen_loopback, and max-body/rate-limit behavior. Parse helpers remain single-sourced in runtime_config.rs. Keep this lane Draft until that final overlap is resolved and the combined hostile suites execute on one unchanged exact head.

seonghobae · 2026-09-11T22:13:45Z

Fresh exact-source synthesis for the remaining src/lib.rs semantic conflict, against #140@0c678a924e3bf6ecdd248167e4289c1cbff60688 and protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b. The feature ref is unchanged; do not close/replace this lane.

The minimum causal merge is not an ours/theirs file choice. Keep protected #155's AppState.listen_loopback, with_listen_loopback, health auth_mode, strict RBAC helpers/tests, management 401/403 behavior, header-safe secret admission and constant-time matching. Keep #140's mod runtime_config; plus pub use runtime_config::{RuntimeConfiguration, parse_event_limit, parse_u32_env, parse_u64_env};; remove the duplicate parse-helper definitions from lib.rs so the architecture-fitness gate continues to reject process-env authority outside runtime_config.rs/credentials.rs.

run_from_env should resolve to this authority composition (illustrative exact logic; formatting/rustdoc should follow the repository contract):

pub async fn run_from_env(
    shutdown: std::pin::Pin<Box<dyn std::future::Future<Output = ()> + Send>>,
) -> Result<(), Box<dyn std::error::Error>> {
    let runtime = RuntimeConfiguration::from_env()?;
    let listen_loopback = listen_is_loopback_only(&runtime.bind_addr);
    let (credentials, _) = CredentialRegistry::bootstrap_from_env()?;
    let config = runtime.app_config(&credentials);

    let admin_tokens = match credentials.get_credential(CRED_ADMIN_TOKENS) {
        Some(raw) if !raw.trim().is_empty() => parse_admin_tokens_strict(raw)?,
        _ => HashMap::new(),
    };
    let has_write_capable_admin = if !admin_tokens.is_empty() {
        admin_tokens.iter().any(|(token, principal)| {
            principal.can_write && admin_secret_supports_header_auth(token)
        })
    } else {
        credentials
            .get_credential(CRED_ADMIN_TOKEN)
            .is_some_and(admin_secret_supports_header_auth)
    };
    require_write_auth_for_bind(&runtime.bind_addr, has_write_capable_admin)?;

    let listener = tokio::net::TcpListener::bind(&runtime.bind_addr).await?;
    let local_addr = listener.local_addr()?;
    let auth_mode = if listen_loopback && !has_write_capable_admin {
        "development"
    } else {
        "production"
    };
    let state = AppState::load(config)
        .await
        .map_err(|message| std::io::Error::new(std::io::ErrorKind::InvalidData, message))?
        .with_rate_limit(runtime.rate_limit, runtime.rate_limit_window)
        .with_admin_tokens(admin_tokens)
        .with_credentials_source(credentials.source())
        .with_listen_loopback(listen_loopback)
        .with_max_body_size(runtime.max_body_bytes);
    println!("waf-ids-ai-soc listening on http://{local_addr} auth_mode={auth_mode}");
    std::io::Write::flush(&mut std::io::stdout())?;
    let served = axum::serve(listener, build_app(state))
        .with_graceful_shutdown(shutdown)
        .await;
    served?;
    Ok(())
}

This preserves the already-reconciled credential adapter as secret authority and makes the immutable RuntimeConfiguration snapshot the sole non-secret bootstrap source. In particular, do not restore std::env::var reads in lib.rs, do not take #140's older permissive parse_admin_tokens startup call, and do not weaken require_write_auth_for_bind.

Hostile GREEN on the resulting unchanged exact head must include both lineages together: #140 recursive env-authority fitness + zero-bound/runtime snapshot tests, and #155 non-loopback/no-admin, unpresentable token, readonly-only principal, strict duplicate/blank/unknown-role parsing, health auth_mode, 401/403 and shutdown/bind tests. Then reacquire repository CI/Fuzz/Security/SAST/CodeQL/review/thread evidence on that exact head before moving #140 dependents.

seonghobae · 2026-09-12T05:51:56Z

Fresh protected-base repair update: root #140 advanced non-force to exact c039776bb15a3af936cd93720c60c27f777dd4aa; protected main remains f8260f1e03836039ff9463dd99fa982e4e270c4b. The intervening #140 delta is confined to src/runtime_config.rs: the architecture-fitness scanner now keeps lifetime apostrophes visible and adds a hostile regression proving fn bypass<'a>() { ... std::env::var(...) ... &'a ... } cannot hide executable environment access. This does not change the remaining protected-base conflict: src/lib.rs is still the sole semantic integration point, and CodeRabbit's non-loopback/write-admin finding remains unresolved until #155 strict parsing + write-capable admin gate + loopback/auth_mode semantics and #140 RuntimeConfiguration bootstrap coexist on one exact head. No predecessor check evidence transfers to c039776...; run/merge only after ordinary non-force integration and exact-head repository Rust/security/coverage evidence.

seonghobae · 2026-09-15T18:11:16Z

A serialized child now carries the hostile RED prerequisite for this synthesis: Draft #430, base #140@e05df185c50a3792cf487c404c4dac68bc2daf36, test-only exact 1bf400f9df0ea96e27905adf87cd26dd329736cb. Its production tree is unchanged from #140; the added contract requires the combined RuntimeConfiguration + protected #155 source to fail closed for public bind with no write-capable administrator or read-only-only RBAC, and to allow a usable write-capable principal. CI 35005821304 is queued. Keep this reverse-direction lane and all #193+ dependents parked until exact child RED materializes, then synthesize only the already-scoped src/lib.rs conflict and reacquire GREEN. No force/rebase/ours-theirs/bypass.

seonghobae · 2026-09-17T04:36:45Z

Fresh synthesis-status correction, 2026-09-17 KST: the PR body’s #430 helper-only status is superseded. Serialized child #430 is now exact 65b887e347d47e3cd29071342c353408c3f14e4a. One-shot run 35160876925 completed SUCCESS, produced the bounded src/lib.rs composition commit 0e0f01efbd6e21874c94eed987192534e234f211, and the temporary helper was removed by ordinary fast-forward at 65b887e.... Fresh exact-current #430 CI 35180770661 and Fuzz 35180770659 remain QUEUED, so #430 is still Draft and no root reconciliation should happen yet. Once that unchanged head earns required admission/review/security evidence and normally merges into #140, re-evaluate this reverse-direction lane against the new #140 head; do not force/rebase or restack dependents beforehand.

This was referenced Sep 11, 2026

[DDD] Replace direct runtime env reads with a bounded configuration registry #139

Open

refactor(config): centralize runtime bootstrap snapshot #140

Draft

docs(gaps): add exact-head readiness baseline #130

Draft

seonghobae marked this pull request as draft September 11, 2026 07:20

This was referenced Sep 9, 2026

feat(state): make production authority explicit #193

Draft

feat(gateway): trust forwarded client IPs only from trusted proxies #165

Draft

seonghobae added maintenance priority: high High-priority or P1 work labels Sep 12, 2026 — with ChatGPT Codex Connector

seonghobae merged commit 973223f into feat/runtime-config-bootstrap-snapshot Sep 17, 2026
43 of 44 checks passed

Navigation Menu

chore(restack): adopt protected auth baseline into runtime configuration - #310

chore(restack): adopt protected auth baseline into runtime configuration#310
seonghobae merged 1 commit into
feat/runtime-config-bootstrap-snapshotfrom
main

seonghobae commented Sep 11, 2026 •

edited

Loading

Uh oh!

github-advanced-security AI commented Sep 11, 2026

Uh oh!

coderabbitai Bot commented Sep 11, 2026

Review skipped

Uh oh!

seonghobae commented Sep 11, 2026

Uh oh!

seonghobae commented Sep 11, 2026

Uh oh!

seonghobae commented Sep 11, 2026

Uh oh!

seonghobae commented Sep 11, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 15, 2026

Uh oh!

seonghobae commented Sep 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

seonghobae commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Current conflict / serialized synthesis — 2026-09-17 KST

Exact-current admission state

Remaining repair acceptance

Uh oh!

github-advanced-security AI commented Sep 11, 2026

What Enabling Code Scanning Means:

Uh oh!

coderabbitai Bot commented Sep 11, 2026

Review skipped

Uh oh!

seonghobae commented Sep 11, 2026

Uh oh!

seonghobae commented Sep 11, 2026

Uh oh!

seonghobae commented Sep 11, 2026

Uh oh!

seonghobae commented Sep 11, 2026

Uh oh!

seonghobae commented Sep 12, 2026

Uh oh!

seonghobae commented Sep 15, 2026

Uh oh!

seonghobae commented Sep 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

seonghobae commented Sep 11, 2026 •

edited

Loading