fix(auth): fail closed without write-capable admin on public bind

[seonghobae]

Fixes #78 only when this exact candidate reaches protected main.

Security boundary

Wardnet must never expose unauthenticated management writes on a non-loopback listener. Loopback-only development may remain credential-free, but production-facing binds require a write-capable administrator credential before readiness. The bounded delta rejects missing/ambiguous write authority, preserves 401 vs 403, constant-time token comparison, readonly/write separation, and auth_mode=development only for loopback credential-free operation.

Protected-main adoption

Prior exact candidate f74ff25a321dfb1d7109719e2a1fc77e47dc4898 was already non-destructively aligned with protected 5829a0f08d78de464dd24393ce5d0f25fba9d126. Protected/default main then advanced through #171 to exact a52ccd0a24a727d9349bb32def7713882d8cad1e.

Fresh comparison proved the intervening protected delta is only docs/adr/2026-09-05-anti-bot-acquisition-boundary.md plus docs/adr/README.md, neither overlapping this authentication/security delta. Two-parent merge fb93b61a4a4da30a3471453051ebfb0ed3f63d34 adopted that protected truth without force push or destructive rebase. Current compare remains merge-base=a52ccd0..., behind 0; the effective feature delta remains the same 13 authentication/deployment/test/doctoring paths.

Exact-current evidence — 2026-09-07 KST

Current exact source remains unchanged fb93b61a4a4da30a3471453051ebfb0ed3f63d34, Ready/mechanically mergeable on protected main. The earlier no-run snapshot is superseded. Without source churn, current gates have executed:

• CI 34020141305: SUCCESS;
• Fuzz 34020141277: SUCCESS;
• Security Scan 34020141306: SUCCESS;
• SAST Semgrep 34020141279: SUCCESS;
• CodeQL PR 34020141314: FAILURE only at delegated terminal-verdict enforcement.

CodeQL detect-language job 101451083576 is terminal success. Compatibility job 101455725295 also acquired a hosted runner and completed Request current-head CodeQL scan dispatch; it fails only at Release runner or enforce current-head CodeQL verdict. This is the same central authenticated dispatcher/verdict boundary tracked in .github#712 / the live CodeQL owner path, not a management-authentication source/test failure. Do not source-churn this unchanged security candidate, transfer predecessor verdicts, or weaken CodeQL.

Ready metadata is not merge authorization. Live organization ruleset 18156473 still carries the structurally incompatible solo-maintainer generic approval count plus routine OrganizationAdmin/always bypass tracked by .github#772. Self/model approval, routine or implicit administrator bypass, force push, destructive rebase and merge-as-probe remain forbidden.

Merge only through the ordinary protected path after one unchanged exact head has an authenticated terminal current-source CodeQL verdict, zero valid unresolved findings/threads, fresh candidate-base compatibility, and every then-live deterministic/security/coverage/package/SBOM/provenance/governance requirement terminal-valid.

[coderabbitai]

Warning

Review limit reached

Next included review available in 53 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: e11602de-3904-4534-98d8-9cfb22b174db

📥 Commits

Reviewing files that changed from the base of the PR and between a52ccd0 and fb93b61.

⛔ Files ignored due to path filters (1)

• docs/papers/nist-sp-800-218-ssdf.pdf is excluded by !**/*.pdf

📒 Files selected for processing (12)

• README.md
• docs/deployment/production.md
• docs/doctoring/fail-closed-management-auth.md
• docs/security/threat-model.md
• fuzz/fuzz_targets/fuzz_parse_admin_tokens.rs
• scripts/smoke.sh
• src/credentials.rs
• src/lib.rs
• tests/admin_auth_properties.rs
• tests/binary.rs
• tests/fuzz_invariants.rs
• tests/smoke_script_security.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 3 potential issues.

[seonghobae]

Fresh exact-head revalidation (2026-09-03 KST): protected base is still main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128; head is unchanged e6f05d77858e91c176cff25c4b11e790bc5dcdd1, merge-base exact and behind_by=0. Repository-owned CI 33590350994, Fuzz 33590350997, Security Scan 33590350967, and SAST Semgrep 33590350991 are now terminal SUCCESS. All returned inline review threads remain resolved.

The current-PR required OpenCode lane is still non-terminal: run 33590351182 executed required-workflow-bootstrap job 100122902000 successfully on an assigned ubuntu-24.04 runner, then coverage-source-tree job 100272722468 remained queued with runner_id=0 and no steps. This stage-local runner-admission evidence was advanced to central owner issue .github#712 with exact RED/GREEN criteria. An older same-SHA required run belongs to predecessor PR #138 and is not #155 merge evidence.

No source churn, self-approval, routine bypass, or predecessor/wrong-PR evidence reuse is warranted. Re-read the unchanged head after the central lane becomes terminal, then apply the live solo-maintainer ruleset once its owner repair converges.

[seonghobae]

Exact-current gate refresh, 2026-09-06 KST: unchanged fb93b61a4a4da30a3471453051ebfb0ed3f63d34 now has terminal SUCCESS CI 34020141305, Fuzz 34020141277, Security Scan 34020141306, and SAST Semgrep 34020141279. CodeQL PR 34020141314 is terminal failure in the shared delegated-verdict path; this is the same central exact-head publication class already owned by .github#1929, not a public-bind/write-authority source finding. Do not churn the authentication source or transfer predecessor evidence.

This PR remains the canonical Wardnet authentication foundation for write-capable management authority. Stale feature lanes that change management-write RBAC, including #112's old aggregate API branch, must not independently integrate a competing management_write_denied/read-only-write semantic; after this foundation reaches protected main, they must reconstruct or non-force adopt it and retain only their bounded feature delta.