feat(viewer): control plane — Tier 1/2 actions behind a defense ladder, Tier 3 stays deliberate (Event 175)#159
Merged
Merged
Conversation
…r, Tier 3 stays deliberate (Event 175) Operator-ratified boundary: Tier 1 diagnostics (doctor, kernel verify, docs lint, index --check) and Tier 2 reversible maintenance (sync, docs index, doc-map rebuild) become buttons; Tier 3 governance mutations (kernel update, review verdicts, profile acks, rigor/mode) render as copyable commands and have NO endpoints — the kernel's deliberate-friction thesis applied to its own UI; the absence of the endpoint is the enforcement (positive system). Read-only-on-unauthenticated-localhost was a conscious trade; mutation is not. Defense ladder on every control POST, each rung tested independently: (1) control hard-disabled on non-loopback binds, (2) Host-header loopback allowlist (DNS-rebinding defense), (3) per-server-start session token minted with secrets and templated into index.html — foreign origins can neither read it nor send the custom header without a preflight this server never grants. Single-flight lock (409 busy), 120s timeout, 64KB output cap with a visible truncation marker. Live-verified end-to-end through the authenticated path: doctor 115ms, kernel_verify 44ms, docs_lint 66ms, docmap_rebuild 188ms, sync 99ms — and sync fired from the viewer during a live governed session left doctor at 12/0/0. Suite 1821+91.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…iming-safe token, byte-accurate cap Security review (0 blockers) applied: - CONTROL_ENABLED now defaults False — a module preaching fail-closed had its kill-switch fail-open; only serve() enables control after confirming a loopback bind. Fresh-interpreter test pins the default (reload() in-test would remint the shared server's token). - run_action wraps the action body in a broad guard: docmap_rebuild in a non-git project escaped as a raw 500 traceback (reproduced by review); every failure is now structured JSON and the lock provably frees. - hmac.compare_digest on the session token (hardening; 256-bit + loopback made == practically safe, but a security boundary compares safely). - Byte-accurate output cap (char slice let multibyte output exceed 64KB ~4x) and process-group kill on timeout (sync/doctor grandchildren would orphan). - _host_allowed: exact [::1] forms only — the prefix test accepted '[::1].evil.com' (not browser-producible; defense-in-depth). - Tier-1 end-to-end test decoupled from live lint state. Residual (review nit 7, accepted): the tier label is self-asserted — no test binds label to effect; the guard is TIER3_CATALOG cross-check + PR review. Suite 1823+91.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Operator-ratified control boundary for the E174 dashboard:
Security
Read-only on unauthenticated localhost was a conscious trade — mutation is not. Defense ladder on every control POST, each rung independently tested: (1) hard-disable on non-loopback binds, (2) Host-header loopback allowlist (DNS-rebinding defense), (3) per-server-start
secretstoken templated into the page (foreign origins can't read it, and the custom header forces a preflight this server never grants). Single-flight lock, 120s timeout, 64KB cap with visible truncation.Verification
Suite 1821 + 91 (+15: defense-ladder rungs, tier-absence assertion, busy lock, truncation marker, real-server end-to-end). Live smoke through the authenticated path: doctor 115ms · kernel_verify 44ms · docs_lint 66ms · docmap_rebuild 188ms · sync 99ms — fired from the viewer during this live session, doctor stayed 12/0/0.