aaronrene / knowtation public
BREAKING feat/sec-kn-1-gateway-auth-fail-closed #1 / 1
aaronrene · 41 days ago · Jul 26, 2026 · Diff

SEC-KN-1: fail-closed gateway auth when secret empty.

Empty gateway_auth_secret now denies; health stays public with gateway_auth_configured. Seven-tier regression coverage; ROADMAP/handover synced. Canister upgrade not deployed.

sha256:f4218ad0bf9e439d1473063b5fc756ab0a6ac7d3e1799f6eed3f3b6fb3b8053d sha
sha256:95b6b75c347b2380eb91e89a52c4a94e425acf88c5e3896f86265d459f232edf parent
+12 ~11 −5 symbols
sha256:043a2bf0c27b39b90e3d20003f83d9a119ce535a8f09d1bc917839cd41827cab snapshot
+12
symbols added
~11
symbols modified
−5
symbols removed
0
dead code introduced
Semantic Changes 28 symbols
~ lib/gateway-authorized.mjs .mjs 3 symbols added
+ gatewayAuthorized function function gatewayAuthorized L17–24
+ healthPayload function function healthPayload L46–50
+ httpRequestRequiresGatewayAuth function function httpRequestRequiresGatewayAuth L34–38
~ test/sec-kn-1-gateway-auth-fail-closed.test.mjs .mjs 4 symbols added
+ decide function function decide L128–142
+ extractGatewayAuthorizedBlock function function extractGatewayAuthorizedBlock L31–37
+ gatewayAuthorizedFailOpenLegacy function function gatewayAuthorizedFailOpenLegacy L40–45
+ readMainMo function function readMainMo L27–29
~ docs/OVERSEER-HANDOVER.md .md 5 symbols added, 5 symbols removed, 5 symbols modified
− NEXT SESSION — SEC-KN-1 fail-closed gateway auth (PRIMARY) section NEXT SESSION — SEC-KN-1 fail-closed gateway auth (PRIMARY) L20–100
− Governance gates checklist section Governance gates checklist L85–100
− Knowtation-owned findings (from Pass 2) section Knowtation-owned findings (from Pass 2) L65–85
− table section table L67–77
− code[text] variable variable code[text] L36–64
+ NEXT SESSION — SEC-KN-2 server-only evaluation fields (PRIMARY) section NEXT SESSION — SEC-KN-2 server-only evaluation fields (PRIMARY) L20–95
+ Governance gates checklist section Governance gates checklist L80–95
+ Knowtation-owned findings (from Pass 2) section Knowtation-owned findings (from Pass 2) L60–80
+ table section table L62–72
+ code[text] variable variable code[text] L30–59
~ Overseer Handover — Knowtation
~ Change log
~ table
~ Verified snapshot (what exists now)
~ table
~ docs/ROADMAP.md .md 5 symbols modified
~ Roadmap — knowtation
~ Build queue
~ table
~ Current status (2026-07-26)
~ table
~ hub/gateway/canister-auth-headers.mjs .mjs
~ hub/icp/src/hub/main.mo .mo
~ test/phase0-security.test.mjs .mjs 1 symbol modified
~ gatewayAuthorized
← Older Oldest on feat/sec-kn-1-gateway-auth-fail-closed
All commits
Newer → Latest on feat/sec-kn-1-gateway-auth-fail-closed

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:f4218ad0bf9e439d1473063b5fc756ab0a6ac7d3e1799f6eed3f3b6fb3b8053d --body "your comment"