fix(auth): fail closed without write-capable admin on public bind

[seonghobae]

Fixes #78 only when this exact candidate reaches protected main.

Security boundary

Wardnet must never expose unauthenticated management writes on a non-loopback listener. Loopback-only development may remain credential-free, but production-facing binds require a write-capable administrator credential before readiness. The bounded delta rejects missing/ambiguous write authority, preserves 401 vs 403, constant-time token comparison, readonly/write separation, and auth_mode=development only for loopback credential-free operation.

Protected/default main remains 5829a0f08d78de464dd24393ce5d0f25fba9d126. Current exact head f74ff25a321dfb1d7109719e2a1fc77e47dc4898 is non-destructively aligned with that protected truth; no force push or destructive rebase was used.

Exact-head evidence — 2026-09-06 KST

• CI 33904633002 — SUCCESS;
• Fuzz 33904632999 — SUCCESS;
• Security Scan 33904633208 — SUCCESS;
• SAST Semgrep 33904633082 — SUCCESS;
• CodeQL PR 33904632978 — historical terminal FAILURE in the central delegated dispatch/verdict path, not an authentication source finding.

The central implementation has advanced since that CodeQL failure: .github#1926 and .github#1932 are protected. Remaining trusted-dispatcher settings/canary convergence is .github#1929, which must preserve both intended senders github-actions[bot] and opencode-agent[bot] with actor==sender validation. Do not no-op churn or repeatedly rerun this unchanged clean authentication head before that owner plane can produce an authenticated verdict.

Live ruleset 18156473 still carries the structurally impossible generic one-approval requirement for the declared solo-maintainer model and routine administrator bypass. .github#772 owns that governance repair; self/model approval and routine bypass remain forbidden.

Merge only through the ordinary protected path after unchanged f74ff25... has every then-live deterministic/security/coverage/package/SBOM/provenance/review/thread gate terminal-valid, fresh protected-base compatibility, and governance satisfiable without fabricated approval. No force push/destructive rebase, gate weakening, predecessor-evidence reuse or routine bypass.

[coderabbitai]

Warning

Review limit reached

Next included review available in 53 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 7b65faa0-cb92-4b5a-a6fc-c195c00e3eec

📥 Commits

Reviewing files that changed from the base of the PR and between 5829a0f and f74ff25.

⛔ Files ignored due to path filters (1)

• docs/papers/nist-sp-800-218-ssdf.pdf is excluded by !**/*.pdf

📒 Files selected for processing (12)

• README.md
• docs/deployment/production.md
• docs/doctoring/fail-closed-management-auth.md
• docs/security/threat-model.md
• fuzz/fuzz_targets/fuzz_parse_admin_tokens.rs
• scripts/smoke.sh
• src/credentials.rs
• src/lib.rs
• tests/admin_auth_properties.rs
• tests/binary.rs
• tests/fuzz_invariants.rs
• tests/smoke_script_security.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 3 potential issues.

[seonghobae]

Fresh exact-head revalidation (2026-09-03 KST): protected base is still main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128; head is unchanged e6f05d77858e91c176cff25c4b11e790bc5dcdd1, merge-base exact and behind_by=0. Repository-owned CI 33590350994, Fuzz 33590350997, Security Scan 33590350967, and SAST Semgrep 33590350991 are now terminal SUCCESS. All returned inline review threads remain resolved.

The current-PR required OpenCode lane is still non-terminal: run 33590351182 executed required-workflow-bootstrap job 100122902000 successfully on an assigned ubuntu-24.04 runner, then coverage-source-tree job 100272722468 remained queued with runner_id=0 and no steps. This stage-local runner-admission evidence was advanced to central owner issue .github#712 with exact RED/GREEN criteria. An older same-SHA required run belongs to predecessor PR #138 and is not #155 merge evidence.

No source churn, self-approval, routine bypass, or predecessor/wrong-PR evidence reuse is warranted. Re-read the unchanged head after the central lane becomes terminal, then apply the live solo-maintainer ruleset once its owner repair converges.