fix(security): Z890 gap analysis remediation — 4 findings

pmoves/services/cast-tts-gateway/auth.py

@@ -4,12 +4,15 @@
 with optional development mode bypass for local testing.
 """
 
+import logging
 import os
 from typing import Callable, Awaitable
 
 from aiohttp import web
 import jose.jwt
 
+logger = logging.getLogger(__name__)
+
 
 async def get_user_context(request: web.Request) -> dict:
     """
@@ -34,9 +37,10 @@ async def get_user_context(request: web.Request) -> dict:
 
     # Allow unauthenticated requests in development mode
     if os.getenv("CAST_AUTH_REQUIRED", "true") == "false":
+        logger.warning("SECURITY: CAST_AUTH_REQUIRED=false — authentication bypassed (dev mode)")
         return {
             "user_id": "dev_user",
-            "role": "admin",
+            "role": "dev",
             "email": "dev@pmoves.ai"
         }
 

pmoves/services/consciousness-service/Dockerfile

@@ -31,7 +31,7 @@ USER pmoves
 ENV SERVICE_NAME=consciousness-service
 ENV SERVICE_PORT=8105
 ENV NATS_URL=nats://nats:pmoves@nats:4222
-ENV CHIT_PROD_PASSPHRASE=pmoves-chit-default
+# CHIT_PROD_PASSPHRASE injected at runtime via docker-compose
 ENV SUPABASE_URL=http://supabase-kong:8000
 ENV PYTHONUNBUFFERED=1
 

pmoves/services/consciousness-service/main.py

@@ -37,7 +37,9 @@
 SERVICE_NAME = os.environ.get("SERVICE_NAME", "consciousness-service")
 SERVICE_PORT = int(os.environ.get("SERVICE_PORT", "8105"))
 NATS_URL = os.environ.get("NATS_URL", "nats://nats:pmoves@nats:4222")
-CHIT_PASSPHRASE = os.environ.get("CHIT_PROD_PASSPHRASE", "pmoves-chit-default")
+CHIT_PASSPHRASE = os.environ.get("CHIT_PROD_PASSPHRASE", "")
+if not CHIT_PASSPHRASE:
+    logger.warning("CHIT_PROD_PASSPHRASE not set — CGP signing disabled")
 SUPABASE_URL = os.environ.get("SUPABASE_URL", "http://supabase-kong:8000")
 SUPABASE_ANON_KEY = os.environ.get("SUPABASE_ANON_KEY", "")
 

pmoves/services/flute-gateway/main.py

@@ -98,6 +98,7 @@ def _build_nats_url() -> str:
         return f"nats://{user}:{password}@{host}:{port}"
     if user:
         return f"nats://{user}@{host}:{port}"
+    logger.warning("NATS connection without credentials — set NATS_URL or NATS_USER/NATS_PASSWORD")
     return f"nats://{host}:{port}"
 
 

pmoves/ui/app/api/audit/summary/route.ts

@@ -350,7 +350,6 @@ export async function GET(request: NextRequest) {
   return NextResponse.json(
     {
       generatedAt: new Date().toISOString(),
-      docsRoot,
       warnings,
       productionAudit: {
         source: dashboardMarkdown ? dashboardPath : null,