Skip to content

docs(security): document hosted identity rollout order and close #3290 review gaps - #3335

Merged
kojiwakayama merged 2 commits into
mainfrom
docs/hosted-identity-rollout-order
Aug 3, 2026
Merged

docs(security): document hosted identity rollout order and close #3290 review gaps#3335
kojiwakayama merged 2 commits into
mainfrom
docs/hosted-identity-rollout-order

Conversation

@kwakayama

Copy link
Copy Markdown
Contributor

Summary

PR #3290 merged while its review-fix pass was still running. This follow-up ports the remaining review fixes from the stale PR branch (commit 0a0345e, cherry-picked onto main):

  • Rollout runbook in src/security/README.md: safe deploy order for the hosted identity binding (set VERYFRONT_TRUST_FORWARDED_HEADERS=1 on the old runtime first → deploy proxy tier → deploy runtime tier; rollback in reverse), plus rationale for not adding a warn-only old-proxy fallback (would break fail-closed).
  • Actionable crash-loop error: the bootstrap error in hosted proxy mode now states exactly which env var to set and points at the runbook; .env.example comment expanded.
  • Trust boundary & residual risk section documenting the purely topological trust of identity headers and the mTLS / per-hop-secret follow-up.
  • Reviewer nits: canonicalize signed method to POST in resolveVerifiedControlPlaneBranchBinding; best-effort adapter.dispose() when initialize() fails in proxy-manager.ts (+ regression test); coerce non-Error abort reasons to typed CACHE_ERROR in src/server/project-env/cache.ts; drift-guard comment on the intentional asymmetric header gating in extractRequestHeaders.

Complements #3332 (which ports the SSR transport commits); no overlap.

Test plan

  • Targeted suites already green on the source branch: proxy-manager, project-env cache, control-plane-signature, bootstrap, project-resolution, agent-stream.handler, mode-parity
  • CI on this PR runs the full suite

🤖 Generated with Claude Code

…ew gaps

Address the remaining findings from the 85/100 critical review of #3290:

- Document the safe deploy order for the hosted identity hardening (set
  VERYFRONT_TRUST_FORWARDED_HEADERS=1 first, proxy tier before runtime
  tier) in src/security/README.md and .env.example, and point the
  bootstrap fail-closed error at that runbook.
- Document the purely topological proxy-to-runtime trust boundary and
  the mTLS / per-hop-secret follow-up; no warn-only compatibility mode
  is added because it would let unbound identity select tenant data.
- Verify the canonical POST method for control-plane branch-binding
  signatures instead of the raw request casing.
- Dispose the uncached filesystem adapter when initialize() fails so
  repeated failures cannot leak watchers or sockets, with a regression
  test.
- Coerce non-Error abort reasons in the project environment cache into
  the typed CACHE_ERROR contract.
- Explain why release/content-source/path headers are read outside the
  identity-trust gate in extractRequestHeaders to prevent drift.

The residual host-token fallback in agent-stream.handler.ts flagged by
the review was already removed on this branch; existing regression
tests pin the request-scoped credential behaviour.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings August 3, 2026 13:26
@kwakayama
kwakayama requested a review from kojiwakayama as a code owner August 3, 2026 13:26
@chatgpt-codex-connector

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@coderabbitai

coderabbitai Bot commented Aug 3, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@kojiwakayama, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 17 seconds

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9609c7ff-9ed8-4584-890e-78a737520de8

📥 Commits

Reviewing files that changed from the base of the PR and between f56afcd and c90136e.

📒 Files selected for processing (8)
  • .env.example
  • src/platform/adapters/fs/veryfront/proxy-manager.test.ts
  • src/platform/adapters/fs/veryfront/proxy-manager.ts
  • src/proxy/control-plane-signature.ts
  • src/security/README.md
  • src/server/bootstrap.ts
  • src/server/project-env/cache.ts
  • src/server/runtime-handler/project-resolution.ts

Comment @coderabbitai help to get the list of available commands.

@kojiwakayama

Copy link
Copy Markdown
Contributor

Independent exact-head gate complete at 2e64571 against main f56afcd. The full 8-file +114/-4 delta has no correctness, security, dependency, or production-quality blocker; no hacks or fallback behavior were found. Focused coverage passes (11 tests / 204 steps), verify:quick passes, the adversarial non-Error abort-reason probe preserves the typed CACHE_ERROR contract, and the synthetic merge tree is byte-identical to the head tree. Review threads: 0. Code confidence: 97%. Merge remains gated only on terminal hosted CI and merge-queue combined checks.

@kojiwakayama

Copy link
Copy Markdown
Contributor

Merge confidence: 97%.

Reasoning:

  • Exact head 2e64571a5c8aebb302c294359fc1be10f9af9f00 passed git diff --check, deno fmt --check, deno lint, deno check, focused proxy/project-env/signature/project-resolution tests (4 tests, 132 steps), and public-doc validation in an isolated worktree.
  • There are no review threads; only automation/rate-limit comments were present.
  • Residual risk is low because the security rollout docs are paired with direct boundary tests for signed control-plane/project identity behavior, and required hosted/merge-queue checks still gate merge.

@kojiwakayama
kojiwakayama enabled auto-merge August 3, 2026 13:42

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Documents and operationalizes the hosted identity hardening rollout by adding a security runbook (including trust boundary notes and safe upgrade/rollback ordering) and by making runtime failures more actionable, alongside a few small security/robustness fixes in proxy/runtime code paths.

Changes:

  • Adds hosted identity rollout guidance and trust-boundary documentation in src/security/README.md.
  • Improves proxy-mode bootstrap messaging and expands .env.example guidance for VERYFRONT_TRUST_FORWARDED_HEADERS.
  • Hardens a few implementation details: canonicalizes signed method verification, disposes adapters on failed initialization (with a regression test), and ensures abort reasons in project-env cache are always Error instances.

Verification:

  • Not run in this review environment (rely on CI as stated in the PR).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
src/server/runtime-handler/project-resolution.ts Adds a drift-guard comment clarifying intentional asymmetric header trust gating.
src/server/project-env/cache.ts Ensures abort paths always surface an Error (typed fallback for non-Error abort reasons).
src/server/bootstrap.ts Makes proxy-mode crash-loop guidance more explicit, pointing to the rollout runbook.
src/security/README.md Adds trust boundary/residual risk and a detailed rollout/rollback ordering runbook.
src/proxy/control-plane-signature.ts Canonicalizes verified request method to POST for signature verification.
src/platform/adapters/fs/veryfront/proxy-manager.ts Best-effort adapter.dispose() when initialize() fails to avoid resource leaks.
src/platform/adapters/fs/veryfront/proxy-manager.test.ts Adds a regression test asserting disposal on initialization failure and no caching.
.env.example Expands operator guidance for VERYFRONT_TRUST_FORWARDED_HEADERS and rollout ordering.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .env.example Outdated
@kojiwakayama
kojiwakayama disabled auto-merge August 3, 2026 13:43
Copilot AI review requested due to automatic review settings August 3, 2026 13:48
@kojiwakayama

Copy link
Copy Markdown
Contributor

Exact-head follow-up at c90136e: replaced the non-ASCII dash in .env.example with sentence punctuation required by AGENTS.md. The prior exact-head 11-test/204-step gate and synthetic-main gate were green; the final one-line documentation delta passes git diff --check and verify:quick. The Copilot thread was replied to and resolved only after the fix was pushed. Merge confidence remains 97%, pending fresh hosted checks.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

@kojiwakayama
kojiwakayama added this pull request to the merge queue Aug 3, 2026
@kojiwakayama

Copy link
Copy Markdown
Contributor

Merge confidence: 94%.

Reasoning: exact head c90136efb9fc7f525e851395534181b8862f3dbc has zero unresolved review threads, mergeStateStatus is CLEAN, and all required hosted checks are green: Analyze, format, lint, typecheck, coverage gate, binary e2e, integration, rsc browser e2e, and unit. Local verification in the PR worktree also passed for the changed modules: fmt --check, lint, check, git diff --check, and the targeted Deno tests for proxy-manager, project-env cache, control-plane signature, bootstrap, project resolution, and proxy mode parity.

Risk notes: this is mostly docs plus narrow hardening around hosted proxy trust gating and cleanup on adapter init failure. I reproduced the broader agent-stream.handler.test.ts local failure on main with the same assertion shape, so I am treating that as a pre-existing local environment/test issue rather than a #3335 regression.

Scheduling for merge with exact-head protection.

@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Aug 3, 2026
@kojiwakayama
kojiwakayama added this pull request to the merge queue Aug 3, 2026
Merged via the queue into main with commit 8c2b6e9 Aug 3, 2026
31 checks passed
@kojiwakayama
kojiwakayama deleted the docs/hosted-identity-rollout-order branch August 3, 2026 14:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants