fix(nightly): repair WSS compat-auth skew + stale enterprise-gate test assertions - #381
Merged
Merged
Conversation
The nightly suite has been red since it was created (2026-05-28) and never
green. Categorising every failure showed most were either real regressions
or CPU-starvation artifacts of -parallel 4, not genuine env limits.
Real fixes in this commit (all fail deterministically in isolation):
- daemon WSS compat auth: pkg/daemon/transport/wss signed the pre-v0.2.6
challenge shape "compat_auth:<node>:<nonce>", but beacon v0.2.6 binds the
server timestamp and verifies "compat_auth:<node>:<ts>:<nonce>". Real
production skew — compat daemons could not authenticate to a v0.2.6
beacon. Parse the challenge `ts` and sign the new shape; update the
fake-beacon unit test to match. Fixes TestCompatRegistryTLSPinned,
TestCompatRegistryTrustSystemRejectsBadCert, TestCompatDaemonDialUDPPeerThroughWSS.
- invite signer: common@v0.5.7's InviteToNetwork/RespondInvite/PollInvites
now always sign, so every test issuing an invite must set a signer. Set
the inviter's signer before each InviteToNetwork call across the invite,
RBAC, audit, enterprise-gate, network and pilotctl suites. Several
rejection-path tests were passing for the wrong reason (rejected on the
missing signer, not the intended authz check) — they now sign so the
registry performs the real authorization.
- TestAdminKicksAdmin: registry policy PILOT-266 (2026-05-29) forbids an
admin kicking another admin; assert the guard and that the owner can
still kick an admin.
- TestInviteRequiresAdmin: premise was stale (owner invites via signature
without an admin token). Reworked to assert owner-by-signature succeeds
and an unauthorized outsider is rejected.
- dashboard /api/stats is now admin-gated (rich payload behind
requireAdminToken; anonymous uses /api/public-stats). Set an admin token
and authenticate. Fixes TestDashboard{HTTPEndpoints,APIShape,BannerEndpoint,NoIPLeak}.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This was referenced Jul 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The nightly suite had been red for 46 runs. Triaging the failures surfaced a real 6-week production bug plus stale test assertions.
Production bug: compat-mode WSS auth broken since 2026-05-29
The beacon adopted a server-timestamp in the auth-challenge signed payload on 2026-05-29 (PILOT-145, beacon #9) — it verifies
compat_auth:<nodeID>:<ts>:<nonce>and does not accept the old 2-part shape. But the web4 WSS client never got the client side and still signedcompat_auth:<nodeID>:<nonce>. So every UDP-blocked daemon falling back to WSS/compat has failed beacon auth for 6+ weeks (unnoticed because compat is a rarely-exercised fallback).pkg/daemon/transport/wss/wss.gonow signs the 3-part payload the deployed beacon (v0.2.6) actually verifies. Cannot regress anything — no beacon accepts the old shape.Stale test assertions (registry behavior changed, tests didn't)
TestAdminKicksAdminasserted an admin can kick another admin; the registry now forbids it (PILOT-266 privilege-escalation guard,rendezvous/membership/membership.go:1052). Rewrote to assert the block AND keep the owner-kicks-admin success path under test.InviteToNetwork/KickMembernow require a signed request; tests weren't signing. AddedsetClientSigner(...)as the owner/inviter.Verified locally (GOWORK=off):
go build ./...clean; WSS package green; the fixed enterprise/invite/admin tests green.🤖 Generated with Claude Code