54 lines
6.6 KiB
Markdown
54 lines
6.6 KiB
Markdown
# DWH REST per-installation authentication SDD progress
|
|
|
|
Plan: `docs/superpowers/plans/2026-08-20-dwh-rest-per-installation-auth.md`
|
|
Branch: `feat/dwh-rest-installation-auth`
|
|
Worktree: `/home/chirone/ThothII-next/.worktrees/dwh-rest-installation-auth`
|
|
Baseline: workspace docs PASS; Go unavailable on host (use containerized Go 1.26.5); default Compose pre-existing path-sensitive false positive under `/home/chirone`.
|
|
|
|
Task 1: complete (commits 3bc84b0..1e82fd3, review clean after bounded-digest fix wave).
|
|
Task 1 plan note: the dotted-import grep was resolved by the exact module assertion in `09290a0`; `go list -m all` confirms the DWH module only.
|
|
|
|
Task 2: complete (commits 541ef45, 971a0e6, e90a1a1; independent vet fix d2415b5; review clean after bounded-read, expiry/JSON, same-Store, and cross-Store synchronization fix waves).
|
|
|
|
Task 3: complete (commits ebb360f, 055dcab, b1079bd; independent review clean after CLI grammar, metadata validation, and ambiguous-publication cleanup fix waves).
|
|
|
|
Task 4: complete (commits 943f809, 419c344, 134dc19; independent review PASS after legacy multiplicity, fail-closed handler/socket, SGID 2750, O_RDONLY shared lock, OpenReadOnly, and safe socket-parent waves). Task 5 must precreate `.writer.lock` as `0640 root:dwh-auth`; add a non-owner group/cross-process integration proof when packaging permits.
|
|
|
|
Task 5: complete (commits 87606c7, 62ec29f; independent review PASS after auth-subrequest header isolation and target-Nginx duplicate-header verification). No runtime installation or service/Nginx mutation performed.
|
|
|
|
Task 6: complete (commits 1b18a0f, d0f7e04; independent review PASS after regex/duplicate bypass, exact-PID TCP, and bounded-cleanup hardening). Minor for final review: remove or rename the redundant legacy `negative_postgrest_bypass` fixture and align the historical fixture-count prose if useful. No active Nginx/runtime mutation performed.
|
|
|
|
Task 7: complete (commits 7b9b8b3, 707c13d, f616aab, 7b86ea9, 7fe5316; Terra review PASS). Documentation and rollout-contract alignment completed; no runtime mutation performed.
|
|
|
|
Task 8: complete at frozen SHA `6499d24892b4383ac492579303e766cfb51fe44e` (fix commits `09290a0`, `6499d24`; Terra review PASS). Focused, portability, scanner, DWH Go, and two full tools/tht matrix runs PASS; evidence recorded at `.artifacts/dwh-auth/source-verification.md`. Broad coupling remains `BASELINE_RED` debt; immutable paths remain unchanged.
|
|
|
|
Task 9: PASS at frozen SHA `0c4ff3750d3ecd3fc514e50e511cf7475fbe0446`. Built and installed the exact local candidate, enabled and started `dwh-auth`, imported the protected legacy credential under public ID `legacy-shared`, and created `psd-mac-primary` with public key ID `oNPdOfoH7ypLtVb1`. Registry check, AF_UNIX-only listener, v1/legacy `204`, random/missing `401`, bounded journal scan, installed-file hashes, and `nginx -t` all PASS. Protected report: `/root/dwh-auth-provision/gate9-20260821T054514Z.report.md`, SHA-256 `65ce1e0d8be5f74355eca2b1dca901da16f2864f68eafb7dede9d23ef36b82d5`. Nginx was not changed or reloaded; the legacy key remains active; the old stack was not changed or stopped. Terra final review: PASS with no Critical or Important findings.
|
|
|
|
Task 10: NOT STARTED and requires a second explicit authorization. Public Nginx cutover, Mac-key delivery/configuration, and legacy revocation have not occurred. Activity 1 remains `IN_DISCUSSION`; external deployment remains `SURVEY_NO_GO`.
|
|
|
|
Final clarification (bookkeeping): initial authorization at `6499d24` stopped before installation because the protected legacy file was missing and a journal-scan finding remained. A secret-safe legacy file was prepared without emit/hash; Nginx metadata remained unchanged and `nginx -t` PASS. Fix commits `6fb4886`, `dee0f9c`, `0c4ff37` received Terra PASS, followed by a detached complete re-freeze PASS at full `0c4ff3750d3ecd3fc514e50e511cf7475fbe0446`. The owner then explicitly authorized Gate 9 at that exact SHA; Gate 9 completed as recorded above. Task 10 remains a separate gate.
|
|
|
|
## Project A authentication runtime projection
|
|
|
|
Plan: `docs/superpowers/plans/2026-08-21-project-a-server-auth-runtime-projection.md`
|
|
Plan commit: `64f46c7019e11a74dae35a7cdb447cd881e17061`
|
|
Implementation baseline: `64f46c7019e11a74dae35a7cdb447cd881e17061`
|
|
Runtime constraint: source, synthetic tests, and documentation only; Project A, `/srv`, Nginx,
|
|
the legacy stack, and shared services remain untouched.
|
|
|
|
Task 1: complete (commits `8a8f2c2`, `f9e2950`, `de86760`; independent Terra review PASS after descriptor-relative rewrite, full-history validation, crash recovery, destructive replacement guards, deterministic failure seams, and interrupted-retention recovery).
|
|
Task 2: complete (commits `05f8615`, `da2f4a6`, `1e2c4e6`; independent review PASS after exact GID enforcement, bounded descriptor-bound namespace enumeration, strict trailing-slash parity, OIDC coverage, and complete one-retry `CURRENT` publication linearization).
|
|
Task 3: complete (commit `903c0b4`; independent Terra review PASS after retained-FD outer locking, cancellable runtime/canonical waits, public transaction-context propagation, deterministic swap/metadata/creator-race tests, and fail-closed pre/post-commit error handling).
|
|
Task 4: complete (commit `3d9a9f0`; independent Terra review PASS after moving the Linux/root restore gate before secret-bearing checkpoint creation). Exact focused Go, race, vet, Node 24 focused/full, TypeScript, projected Compose, secret-policy, Windows backup compile, and full serialized tools/tht gates PASS. Historical canonical/unified Compose failures were reproduced as baseline-only documentation/path coupling failures and were not weakened.
|
|
Task 5: complete (commit `ef7ae70`; independent Terra review PASS after read-only Vitest gate repair,
|
|
remote-Docker/context hardening, and adversarial canonical-mount/`sudo printenv` verifier fixes).
|
|
All 14 cross-layer acceptance cases, documentation verifiers, shell syntax, full Go/race/vet,
|
|
backend Node 24 Vitest/typecheck, projected Compose, and secret-policy gates PASS. The three known
|
|
default/canonical/unified Compose policy failures were reproduced at `a21e2c1` and remain
|
|
unmodified baseline debt. Project A has not been started; applying the descriptor or any runtime
|
|
root under `/srv/thothii` still requires a new explicit authorization.
|
|
Final Project A source review: PASS for `a21e2c1..ef7ae70`; independent Terra review found no
|
|
remaining Critical or Important issue after validating restore admission/order, backend path and
|
|
identity controls, transaction cancellation, lifecycle gating, portability, dependency scope, and
|
|
redaction. Pre-live stop boundary remains in force.
|