test(config): preserve protected auth in runtime synthesis

[seonghobae]

Serialized Runtime Configuration/authentication synthesis child for #140 / #310. Base remains exact Runtime Configuration owner feat/runtime-config-bootstrap-snapshot@7d98725cc51b259b0be940385b2245758d098081; dependent PostgreSQL/trusted-proxy lanes remain parked until this child is integrated into #140.

Current exact-head status — 2026-09-17 KST

Current head is 65b887e347d47e3cd29071342c353408c3f14e4a. The production synthesis is now present in src/lib.rs; the temporary one-shot helper has been removed by ordinary fast-forward commit 65b887e347d47e3cd29071342c353408c3f14e4a and is no longer part of the PR diff.

The helper execution that produced the causal source repair is terminal GREEN: run 35160876925 completed success from exact helper input cc8f721775e808ff00961dc8e29540e34720b1c2. It guarded the reviewed predecessor/protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b, reconstructed from protected complete src/lib.rs, applied only the Runtime Configuration/authentication composition, then passed cargo fmt, git diff --check, cargo test --locked --test runtime_configuration_auth_synthesis, and cargo test --locked --lib before committing only src/lib.rs as 0e0f01efbd6e21874c94eed987192534e234f211.

Fresh repository-owned evidence is now being reacquired on unchanged current head 65b887e...: CI run 35180770661 / rust job 105072217366 and Fuzz run 35180770659 / fuzz job 105072216969 are currently queued. Queued evidence is non-passing; predecessor GREEN is retained only as construction evidence and is not promoted to current-head admission evidence.

Hostile RED → causal repair

Exact test-only head 062ea6ab787d0a1d864e429a95f7ed1642fbf37e established the defect: with BIND_ADDR=0.0.0.0:0 and no write-capable administrator, stale run_from_env actually bound the public listener and returned success. The same source left protected #155 authentication primitives unused, producing non-test dead_code warnings rather than consuming them at the bootstrap boundary.

The current source repairs that cause rather than suppressing symptoms:

• consumes non-secret RuntimeConfiguration::from_env() once;
• bootstraps secrets only through CredentialRegistry::bootstrap_from_env();
• strictly parses ADMIN_TOKENS, rejecting blank entries/tokens, duplicate secrets, and unknown roles;
• counts only header-presentable write-capable credentials for public-bind authority;
• calls require_write_auth_for_bind(&runtime.bind_addr, has_write_capable_admin) before TcpListener::bind;
• preserves loopback development mode and publishes auth_mode health/readiness evidence;
• preserves protected fix(auth): fail closed without write-capable admin on public bind #155 constant-time credential comparison and management-write semantics: unauthenticated 401, authenticated-readonly 403;
• preserves the complete gateway/application surface rather than truncating or selecting one conflict side wholesale.

The hostile contract remains explicit: public bind without a write-capable administrator fails closed; readonly-only bootstrap fails closed; a valid header-presentable writer permits bind. No second configuration/credential authority, source copy from foreign owners, cross-service SQL, mutable dependency, force push, destructive rebase, self/model approval, gate weakening, or routine bypass is introduced.

The PR stays Draft until the unchanged 65b887e... head receives fresh repository-native CI/Fuzz GREEN and then-current security/review/thread/base evidence. After that, merge normally into #140 and non-force-restack dependents; do not move the PostgreSQL chain beforehand.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}