fix(security): rebase KV host allowlist onto the SSE tools tip

[cursor]

Summary

Successor to #617 at a1823cc (SSE tools proxy, mock delta.tool_calls, streamed top_p/penalties, fail-closed tool_calls keys and mode/trace). Unique commits on this branch rebase #611/#607 allowlist onto that tip and close the residual #607 review gap:

• ModelClient._validate_provider reads provider_egress.allowed_provider_hosts from the process KV. Env is bootstrap transport via seed_provider_egress_from_environ only.
• Seed holds _runtime_lock across read+write. A detached get_config_store() write is not the request-time source.
• Whitespace-only stored values count as empty so a stored " " cannot freeze fail-open public HTTPS.
• Request-path env-ignore and listed-host tests mock getaddrinfo (offline) and require success.
• exercise_host_allowlist fuzz seam for the CSV parser.

Buyer next action

Call set_runtime_config("provider_egress", "allowed_provider_hosts", "api.example.com"), or start the process with CONTEXTUAL_ORCHESTRATOR_ALLOWED_PROVIDER_HOSTS set so bootstrap can copy it once. Do not write the key only into a new get_config_store(postgres_dsn=...) instance. Changing the env var on a running process no longer changes egress. Send stream=true on tool-calling requests; omit stream_options.include_usage.

Do not merge #598, #607, #608, #611, or #617 in parallel. Prefer this head. Independent non-author APPROVE + Full unit/Semgrep are still required. This automation will not APPROVE or merge.

Test plan

• python3 tests/test_provider_host_allowlist_kv.py — printed ok (seed-once; whitespace-empty seed; process-store isolation; offline env-ignore)
• python3 tests/test_security_hardening.py test_conventions.py test_self_check.py test_paper_contracts.py test_api_contract.py test_sales_readiness.py — printed ok
• python3 tests/test_passthrough_sse_tools_http_honesty.py test_tool_calls_entry_keys_http_honesty.py test_passthrough_trace_mode_http_honesty.py — printed ok
• CI Full unit + Semgrep

Docs

• docs/kv-credentials.md, docs/architecture.md, docs/library_research.md, docs/papers/README.md, CHANGELOG.md, conductor/tracks.md
• APA 7th: Joint Task Force. (2020). Security and privacy controls for information systems and organizations (NIST SP 800-53 Rev. 5). https://doi.org/10.6028/NIST.SP.800-53r5 (SC-7)
• International Organization for Standardization. (2022). Information security, cybersecurity and privacy protection — Information security controls (ISO/IEC 27001:2022). https://www.iso.org/standard/27001 (A.8.20; cite+link, no ISO PDF)

Next loop

Remaining __main__.py bootstrap tokens, then persist provider_egress on the credential KV backend. Do not open another allowlist-only PR.

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Review (unique slice a1823cc..be39a28)

The KV host-allowlist rebase onto the SSE tools tip is sound. ModelClient._validate_provider reads provider_egress.allowed_provider_hosts from the process ConfigStore. Env is bootstrap-only via seed_provider_egress_from_environ under _runtime_lock. Whitespace-only stored values count as empty. Env-ignore and listed-host success paths mock getaddrinfo (offline). Detached get_config_store() writes are not the request-time source.

CodeRabbit CLI is not authenticated in this environment — not a merge blocker. An independent file review of the unique commits found no Critical or Important defects.

Merger next action

Prefer this head over merging #598, #607, #608, #611, or #617 in parallel. Independent non-author APPROVE plus Full unit / Semgrep are still required. This automation will not APPROVE or merge.

Buyer next action

Call set_runtime_config("provider_egress", "allowed_provider_hosts", "api.example.com"), or start once with CONTEXTUAL_ORCHESTRATOR_ALLOWED_PROVIDER_HOSTS set so bootstrap can copy it. Do not write the key only into a new get_config_store(postgres_dsn=...) instance. Changing the env var on a running process no longer changes egress. Send stream=true on tool-calling requests; omit stream_options.include_usage.

Residual (not blocking)

Seed emptiness is str(existing).strip(). An empty sequence ([]) stringifies to a non-empty token, so seed will not recopy env while the parser still yields an empty allowlist. The documented API is a CSV string. Do not open another allowlist-only PR for this.

Next loop

Remaining __main__.py process-bootstrap paths (state/agents sqlite, Clearfolio viewer URL, provider CA bundle) on this tip. Do not fold #621 token KV into that slice. Do not open another allowlist-only PR.

  

_{Sent by Cursor Automation: Fix Issues}

[seonghobae]

Deferring to tip #691 for product-gate focus (Full unit + Semgrep). Reopen if this delta is not on tip substrate.