Skip to content

[P0] Fail closed when management credentials are absent #78

Closed
#155
#138
Closed
[P0] Fail closed when management credentials are absent#78
#155
#138
Labels
area: authAuthentication, authorization, identity, or tenant isolationarea: ci-cdCI, GitHub Actions, checks, release, or supply chainarea: dependenciesDependency or lockfile maintenancearea: securitySecurity boundary, hardening, or vulnerability preventionbugSomething isn't workingpriority: criticalImmediate blocker, P0, urgent deadlock, or critical incidentstatus: triagedOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behaviortype: featureNew or expanded product capability

Description

@seonghobae
seonghobae
opened on Aug 19, 2026

Production blocker

Wardnet must not become ready with unauthenticated management writes on a non-loopback listener. Credential-free operation is permitted only for explicit loopback development and must remain visibly non-production.

Protected/default truth is main@a52ccd0a24a727d9349bb32def7713882d8cad1e.

Current owning candidate — 2026-09-08 KST

PR #155 is the bounded authentication candidate at exact fb93b61a4a4da30a3471453051ebfb0ed3f63d34, Ready/mechanically mergeable on exact protected main. It non-force adopted #171 with a two-parent merge; compare is behind 0 with merge base exact protected main. The effective 13-path delta preserves fail-closed startup for public binds, explicit loopback development mode, blank/ambiguous credential rejection, constant-time token comparison, readonly/write separation, 401 versus 403, and the protected external administrator-Secret lifecycle.

Ready metadata is review admission only, not merge authorization.

Exact-current evidence

On unchanged fb93b61a4a4da30a3471453051ebfb0ed3f63d34:

  • CI 34020141305 — SUCCESS;
  • Fuzz 34020141277 — SUCCESS;
  • Security Scan 34020141306 — SUCCESS;
  • SAST Semgrep 34020141279 — SUCCESS;
  • CodeQL PR 34020141314 — FAILURE only at delegated terminal-verdict enforcement.

CodeQL detect job 101451083576 succeeded. Compatibility job 101455725295 acquired hosted compute and successfully requested the exact current-head scan, then failed closed because the authenticated terminal receipt was absent. This is the central producer/publication boundary tracked by .github#1929; active .github#1902 is mutable owner repair, not a Wardnet dependency. No source churn or predecessor verdict is authorized.

Live ruleset 18156473 still has generic approving-review count 1 with no named required reviewer/team/code-owner/last-push reviewer and exposes OrganizationAdmin/always; .github#772 remains the solo-maintainer governance repair. Self/model approval, routine administrator bypass, merge-as-probe, force push, destructive rebase and gate weakening remain forbidden.

Completion gate

Close only after #155 or a verified successor carrying every unique authentication/runtime/security delta reaches protected main, the resulting protected source is revalidated, and one unchanged integration candidate has terminal-valid current repository/security/coverage/package/SBOM/provenance/review/thread/governance evidence plus fresh protected-base compatibility. Ordinary approval or CodeQL deadlock never qualifies for emergency bypass.

Activity

  1. opencode-agent
    added
    area: authAuthentication, authorization, identity, or tenant isolation
    area: ci-cdCI, GitHub Actions, checks, release, or supply chain
    area: dependenciesDependency or lockfile maintenance
    area: securitySecurity boundary, hardening, or vulnerability prevention
    priority: criticalImmediate blocker, P0, urgent deadlock, or critical incident
    status: triagedOpen issue has an organization taxonomy assignment
    type: featureNew or expanded product capability
    on Aug 22, 2026
  2. seonghobae
    added a commit that references this issue on Aug 23, 2026

    chore(pr): remove unrelated destination and WAF drift

    868a7e5
  3. seonghobae
    added a commit that references this issue on Aug 31, 2026

    merge(main): keep fail-closed public-bind auth with KEV catalog

    0d2c495

  4. seonghobae commented on Sep 3, 2026

    @seonghobae
    seonghobae
    on Sep 3, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Fresh exact-head evidence correction — 2026-09-03

    Re-read PR #155 at unchanged head e6f05d77858e91c176cff25c4b11e790bc5dcdd1 on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128.

    • Repository-owned CI 33590350994, Fuzz 33590350997, Security Scan 33590350967, and SAST Semgrep 33590350991 remain terminal GREEN.
    • All three returned inline review threads remain resolved.
    • In Required OpenCode run 33590351182, bootstrap job 100122902000 is GREEN and coverage-source-tree job 100272722468 is now GREEN. The still-nonterminal current-PR gate is coverage-evidence job 100479589911, which remains queued before execution. An older same-SHA coverage-evidence success has no fix(auth): fail closed without write-capable admin on public bind #155 PR identity and is not accepted as substitute evidence.
    • Auto-merge is enabled for fix(auth): fail closed without write-capable admin on public bind #155 so the normal protected path can complete automatically if the unchanged exact head later satisfies the central coverage/governance requirements. This does not bypass the current nonterminal gate or the live one-approval ruleset defect.

    .github#712 already carries the exact 100479589911 runner-acquisition RCA; .github#1644 / #772 remains the governance reconciliation owner. No leaf source churn or routine bypass is justified.

  5. seonghobae commented on Sep 3, 2026

    @seonghobae
    seonghobae
    on Sep 3, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Fresh exact-state correction (2026-09-04 KST): the current-PR Required OpenCode lane for #155@e6f05d77858e91c176cff25c4b11e790bc5dcdd1 has progressed beyond the older issue-body snapshot without any Wardnet source/base change. coverage-source-tree 100272722468 and coverage-evidence 100479589911 are both terminal success after acquiring hosted runners. The sole remaining job in run 33590351182 is opencode-review 100659819151, still queued pre-checkout with runner_id=0, empty runner/group identity, and steps=[] since 2026-09-03T13:03:28Z. Repository-owned CI/Fuzz/Security/SAST remain terminal GREEN and all current inline review threads remain resolved. Central .github#712 now carries the narrowed selective model-review acquisition RED/GREEN acceptance; no no-op source churn, predecessor evidence reuse, or routine bypass is justified.

  6. seonghobae commented on Sep 4, 2026

    @seonghobae
    seonghobae
    on Sep 4, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    2026-09-04 exact-current revalidation supersedes the stale central-lane paragraph in the issue body. PR #155 remains unchanged at e6f05d77858e91c176cff25c4b11e790bc5dcdd1 on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128; repository-owned CI/Fuzz/Security/SAST remain terminal GREEN. Required OpenCode run 33590351182 has advanced: required-workflow-bootstrap 100122902000, coverage-source-tree 100272722468, and coverage-evidence 100479589911 are now terminal success. The only remaining current-PR review job is opencode-review 100659819151, still queued pre-checkout with steps=null. Same-SHA predecessor PR evidence remains non-transferable. The exact queue specimen and GREEN acceptance were advanced to .github#712; solo-maintainer ruleset reconciliation remains .github#772 / .github#1644. No Wardnet source churn, synthetic approval, predecessor-evidence reuse, or routine bypass is justified by this state.

  7. seonghobae commented on Sep 4, 2026

    @seonghobae
    seonghobae
    on Sep 4, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Fresh exact-current evidence supersedes the queued coverage snapshot in the issue body without changing the acceptance contract. Canonical candidate remains #155@e6f05d77858e91c176cff25c4b11e790bc5dcdd1 on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128. Repository CI/Fuzz/Security/SAST remain terminal GREEN. Required OpenCode run 33590351182 now has bootstrap 100122902000, coverage-source-tree 100272722468, and coverage-evidence 100479589911 terminal success. Current-PR opencode-review 100659819151 acquired runner 1001655142, started 2026-09-04T01:37:43Z, completed setup and the current-head review request, and remains in_progress at the fail-closed verdict boundary. This queue→execution transition is also recorded on central owner .github#712 (issuecomment-5534622023). Do not rerun/churn the unchanged leaf while it is legitimately executing; predecessor #138 evidence still does not transfer. Closure still requires protected-main integration through satisfiable live governance.

  8. seonghobae commented on Sep 4, 2026

    @seonghobae
    seonghobae
    on Sep 4, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Current exact #155 central-gate transition, 2026-09-04 KST: #155@e6f05d77858e91c176cff25c4b11e790bc5dcdd1 and protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128 remain unchanged. Repository CI 33590350994, Fuzz 33590350997, Security Scan 33590350967, and SAST 33590350991 remain terminal GREEN. In Required OpenCode run 33590351182, bootstrap/source-tree/coverage-evidence are terminal success. Final job 100659819151 eventually acquired GitHub-hosted runner 1001655142 at 2026-09-04T01:37:43Z; setup and Request current-head OpenCode review execution succeeded, then the fail-closed verdict wait ran to the central three-hour administrative boundary and the job/run ended non-passing/cancelled without a current-head verdict. Runner acquisition is therefore no longer the terminal cause for this canary. Exact RCA/RED-GREEN acceptance was handed to .github#712 in owner comment 5535918616: persist/consume a verdict bound to repo+PR+head+request identity, distinguish provider/request completion from admin timeout, and do not terminate legitimate long review merely by elapsed time. No leaf churn or rerun storm is justified while that owner repair is pending; the current terminal timeout remains non-bypass-eligible under the declared emergency policy.

  9. seonghobae commented on Sep 4, 2026

    @seonghobae
    seonghobae
    on Sep 4, 2026 – with ChatGPT Codex Connector
    ContributorAuthor

    Fresh protected-main integration state — 2026-09-05 KST: #155 remains at exact f74ff25a321dfb1d7109719e2a1fc77e47dc4898 on protected main@5829a0f08d78de464dd24393ce5d0f25fba9d126, Ready/mergeable and behind_by=0. This head exists for the real non-destructive #159 ancestry adoption; no source-neutral redispatch commit has been added.

    The prior queued snapshot is superseded. Exact-current Wardnet-owned repository/security evidence is terminal GREEN:

    • CI 33904633002 — SUCCESS;
    • Fuzz 33904632999 — SUCCESS;
    • Security Scan 33904633208 — SUCCESS;
    • SAST Semgrep 33904633082 — SUCCESS.

    CodeQL PR 33904632978 remains a central current-head-verdict failure rather than a Wardnet auth-source failure. Separately, Required OpenCode run 33904630655 has now fully materialized: bootstrap 101126549783, superseded-run cancellation 101126550052, exact-head admission 101188868905, coverage-source-tree 101221028466, and coverage-evidence 101247706677 are all SUCCESS. The sole failing job is opencode-review 101281544719.

    That job acquired a real Ubuntu 24.04 runner, verified the live Ready PR and exact SHA, loaded the trusted receipt gate, obtained OIDC plus the repository-scoped app token, and successfully POSTed event_type=opencode-review with exact repository/PR/base/head/run identity. The fail-closed verifier then found no authenticated APPROVED or CHANGES_REQUESTED receipt from opencode-agent on the same SHA and terminated. This proves current runner/coverage materialization is no longer the cause for this canary; the missing artifact is the downstream authenticated review verdict.

    The exact downstream specimen and RED/GREEN acceptance are now on central owner .github#1929 comment 5552078997. That owner path must repair the dispatcher-identity contract without breaking the scheduler dispatcher, then let the exact current-head review publish its authenticated receipt and rerun only the failed required OpenCode job. No source churn, synthetic/self/model approval, predecessor evidence, routine administrator bypass, or gate weakening is justified.

    Issue closure still requires this fail-closed management-auth delta to reach protected main through then-live exact-head CodeQL/OpenCode/governance gates. The remaining central failures are non-bypass-eligible under the declared emergency policy.

  10. seonghobae
    added
    bugSomething isn't working
    type: bugDefect or incorrect behavior
    on Sep 7, 2026
  11. seonghobae
    closed this as completedin #155on Sep 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: authAuthentication, authorization, identity, or tenant isolationarea: ci-cdCI, GitHub Actions, checks, release, or supply chainarea: dependenciesDependency or lockfile maintenancearea: securitySecurity boundary, hardening, or vulnerability preventionbugSomething isn't workingpriority: criticalImmediate blocker, P0, urgent deadlock, or critical incidentstatus: triagedOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behaviortype: featureNew or expanded product capability

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions