fix(habit): canonicalize trusted gateway signatures

[seonghobae]

Security/reliability outcome

Fix the current protected-main Habit signed-workspace boundary exposed by PR #179's live-base merge-compatibility run. The controller's forged-signature test mutated only the final base64url character; unused trailing bits can make that textual mutation decode to the exact same HMAC bytes, causing nondeterministic false failures. The same behavior also meant Habit accepted non-canonical base64url aliases for an otherwise valid HMAC.

Test-first repair

• add a regression that constructs a distinct non-canonical base64url alias which decodes to the same SHA-256 HMAC bytes and requires rejection;
• make controller forgery evidence deterministic by mutating decoded signature bytes before re-encoding;
• require the received signature to be the canonical base64url encoding, length-match the expected SHA-256 digest, and pass constant-time byte comparison.

Scope and provenance

Starts exactly from protected main 10f33000e5bda33a34bbd1249b37c3c2c8461d68. Changes only Habit trusted-context source/tests. This is also the smallest LifeOS-owned root-cause repair for the Habit failure seen while #179's merge-compatibility job tested its exact contributor head against a live main integration tree.

Merge gate

Require unchanged exact-head Habit tests/typecheck/build, full CI including live-base merge compatibility, AppGuardrail, Semgrep, Security Scan, Commercial Readiness, current review findings, and live repository approval policy. No evidence from #179 or prior Habit branches transfers.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 38f20b52-1968-4594-bdf1-ea430392fd87

📥 Commits

Reviewing files that changed from the base of the PR and between 10f3300 and d5e0a09.

📒 Files selected for processing (3)

• apps/habit-service/src/habit-controller-authority.test.ts
• apps/habit-service/src/http-boundary.test.ts
• apps/habit-service/src/http-boundary.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}