diff --git a/.gitignore b/.gitignore
index 408e06d1..2156b24e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 /target
 /waf-ids-state*.json
 /runtime-state*.json
+/.codegraph
diff --git a/AGENTS.md b/AGENTS.md
index 2a32694b..192c3dad 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -24,7 +24,7 @@ Cross-agent conventions for any agent (Claude, Codex, Cursor, opencode, …) wor
 
 ### Code exploration
 
-- There is no `.codegraph/` index in this repo, so use normal search (grep/ripgrep, `cargo` tooling, editor navigation). If a `.codegraph/` index is added later, prefer CodeGraph (`codegraph explore "<query>"` or the code-review-graph MCP tools) before grep/find — it surfaces callers/callees/impact that text search misses.
+- A local `.codegraph/` index may exist at the repo root (gitignored, not committed). If it is present, prefer CodeGraph (`codegraph explore "<query>"` or the code-review-graph MCP tools) before grep/find — it surfaces callers/callees/impact that text search misses. If it is absent, use grep/`cargo`/editor navigation, and `codegraph init` is permitted. If `codegraph status` reports an unhealthy index, run `codegraph sync`.
 
 ### Config & secrets (KV, not env)
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 00000000..84e4e0ba
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,22 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## Unreleased
+
+### Security
+
+- Fail closed before readiness when `BIND_ADDR` is not loopback-only and no write-capable admin principal is configured (`ADMIN_TOKEN`, `ADMIN_TOKENS`, or `WAF_IDS_CREDENTIALS_PATH`). Loopback development may still start without a token and reports `auth_mode=development` on `/healthz`.
+- A blank `WAF_IDS_STATE_PATH` is treated as in-memory state instead of becoming ready and then failing to replace an empty path.
+- Management writes now distinguish `401` (unauthenticated) from `403` (authenticated, not permitted to write) without naming the expected role.
+- Presented admin secrets are compared in constant time, including when lengths differ by a multiple of 256. Duplicate, blank, and unknown `ADMIN_TOKENS` roles fail startup. A blank `WAF_IDS_CREDENTIALS_PATH` is treated as unset.
+- `scripts/smoke.sh` generates a per-process admin token instead of embedding a shared secret (CWE-798).
+
+### Documentation
+
+- Product/technical gap baseline at `docs/product-technical-gap-baseline.md` (open PRs/Issues inventory, operator-perceptible gaps, Figma file IDs, UI-UX areas).
+- File://-openable admin-console scene and edge-case inventory at `docs/ui-ux/storybook-scene-inventory.md`.
+- Figma file IDs recorded in `docs/adr/0001-figma-and-design-system.md` and `docs/architecture.md`.
diff --git a/CLAUDE.md b/CLAUDE.md
index 742e3096..6218da6b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -62,7 +62,7 @@ The core stays an in-repo workspace crate on purpose (no git submodule) until it
 
 ## Runtime Configuration
 
-Read in `run_from_env` (`src/lib.rs`): `BIND_ADDR` (default `127.0.0.1:8080`), `WAF_IDS_STATE_PATH` (optional JSON state file; omitted = seeded in-memory state), `DNSBL_ORIGIN` (default `dnsbl.local`), `EVENT_LIMIT` (default 1000, must be > 0), `RATE_LIMIT` / `RATE_LIMIT_WINDOW`, `WAF_IDS_CREDENTIALS_PATH` (optional JSON bootstrap file for process-local credentials/config), `ADMIN_TOKEN` (bootstrap transport for the shared write token), and `ADMIN_TOKENS` (bootstrap transport for comma-separated `token:actor[:role]` RBAC entries). `ADMIN_TOKEN` and `ADMIN_TOKENS` are loaded into `CredentialRegistry` before the server starts; handlers read the in-process registry/AppState copy, not raw env vars. KEV imports use the built-in CISA endpoint at runtime; only in-crate tests can override it through `AppState::with_kev_catalog_url` to point at a loopback mock server.
+Read in `run_from_env` (`src/lib.rs`): `BIND_ADDR` (default `127.0.0.1:8080`; non-loopback requires a write-capable admin principal before bind), `WAF_IDS_STATE_PATH` (optional JSON state file; omitted or blank = seeded in-memory state), `DNSBL_ORIGIN` (default `dnsbl.local`), `EVENT_LIMIT` (default 1000, must be > 0), `RATE_LIMIT` / `RATE_LIMIT_WINDOW`, `WAF_IDS_CREDENTIALS_PATH` (optional JSON bootstrap file; omitted or blank = unset; file values take precedence over environment values for the same key), `ADMIN_TOKEN` (bootstrap transport for the shared write token), and `ADMIN_TOKENS` (bootstrap transport for comma-separated `token:actor[:role]` RBAC entries). `ADMIN_TOKEN` and `ADMIN_TOKENS` are loaded into `CredentialRegistry` before the server starts; handlers read the in-process registry/AppState copy, not raw env vars. KEV imports use the built-in CISA endpoint at runtime; only in-crate tests can override it through `AppState::with_kev_catalog_url` to point at a loopback mock server.
 
 ## Key Conventions
 
diff --git a/README.md b/README.md
index d1587583..668182e0 100644
--- a/README.md
+++ b/README.md
@@ -65,7 +65,7 @@ Open `http://127.0.0.1:8080/admin`.
 Useful environment variables:
 
 - `BIND_ADDR`: listen address, default `127.0.0.1:8080`
-- `ADMIN_TOKEN`: optional write token for management writes via `X-Admin-Token`
+- `ADMIN_TOKEN`: write token for management writes via `X-Admin-Token`. Optional only for numeric loopback binds (`127.0.0.0/8` or `::1`). Hostnames such as `localhost` fail closed because Wardnet cannot prove before binding that every resolved address is loopback. Required before readiness on any other `BIND_ADDR` (`0.0.0.0`, `::`, LAN, public).
 - `WAF_IDS_STATE_PATH`: optional JSON state path. When omitted, the service runs with seeded in-memory state.
 - `DNSBL_ORIGIN`: DNSBL zone origin, default `dnsbl.local`
 - `EVENT_LIMIT`: retained event count, default `1000`; must be greater than zero
diff --git a/docs/adr/0001-figma-and-design-system.md b/docs/adr/0001-figma-and-design-system.md
new file mode 100644
index 00000000..acfa7ce9
--- /dev/null
+++ b/docs/adr/0001-figma-and-design-system.md
@@ -0,0 +1,40 @@
+# ADR 0001 — Figma design-system source and embedded admin console
+
+Status: accepted  
+Date: 2026-08-23
+
+## Context
+
+Wardnet ships an operator console as vanilla HTML/CSS/JS embedded in the Rust
+binary (`ADMIN_HTML` in `src/lib.rs`, served at `GET /` and `/admin`). Repeating
+objects (KPI tiles, cards, tables, badges, buttons, forms, toasts) must stay
+token-based. A Node Storybook toolchain cannot be loaded by that console without
+a separate static site.
+
+## Decision
+
+- Canonical design-system tokens live in CSS custom properties on `:root`
+  (`docs/design-system.md` matches the running `/admin` CSS).
+- Figma is the visual mirror, not a runtime dependency. **Figma Code Connect is
+  not used** (repo `AGENTS.md`).
+- Record file IDs here so operators and agents can open the same files.
+
+## Figma file IDs
+
+| Artifact | File ID | URL |
+| --- | --- | --- |
+| Design system / console frames | `QTH5UuU0FJv2VyM2xb02Fp` | https://www.figma.com/design/QTH5UuU0FJv2VyM2xb02Fp |
+| Enterprise product architecture FigJam | `JExziD87eUWKLERECUGhWQ` | https://www.figma.com/board/JExziD87eUWKLERECUGhWQ |
+
+## Scene and edge-case events
+
+Scene-by-scene and edge-case event definitions for the ten UI-UX areas live in
+`docs/ui-ux/storybook-scene-inventory.md`, which opens from disk (`file://`)
+without a Node Storybook server. That inventory is the Storybook-equivalent
+contract for this embedded-console architecture.
+
+## Consequences
+
+- Token changes must land in `ADMIN_HTML` and `docs/design-system.md` together.
+- Do not add a frontend framework to `/admin`; it would break the
+  binary-embedded load path used by `scripts/smoke.sh`.
diff --git a/docs/architecture.md b/docs/architecture.md
index e1ee578b..882d79cf 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -59,6 +59,7 @@ flowchart LR
 
 - Default bind address is localhost.
 - Remote management requires `ADMIN_TOKEN` plus external TLS and identity controls.
+- Non-loopback listeners fail closed before readiness unless a write-capable admin principal is configured.
 - `WAF_IDS_STATE_PATH` enables JSON state persistence for standalone operation. Without it, the service uses seeded in-memory state.
 - File-backed writes use temporary sibling files followed by atomic rename. Management API mutations roll back in memory if the state file cannot be replaced.
 - Block mode is route-scoped to avoid global accidental enforcement.
@@ -68,7 +69,17 @@ flowchart LR
 
 ## Product Architecture Evidence
 
+- Figma design-system file ID: `QTH5UuU0FJv2VyM2xb02Fp` (see `docs/design-system.md` and `docs/adr/0001-figma-and-design-system.md`)
+- FigJam architecture file ID: `JExziD87eUWKLERECUGhWQ` (`docs/figma/enterprise-product-architecture.md`)
 - FigJam: `docs/figma/enterprise-product-architecture.md`
 - Product workflows: `docs/product-design/enterprise-operator-workflows.md`
 - Enterprise scorecard: `docs/analytics/enterprise-value-scorecard.md`
 - Complexity audit: `docs/ponytail/2026-07-02-complexity-audit.md`
+- UI-UX scene / edge-case inventory (file://-openable): `docs/ui-ux/storybook-scene-inventory.md`
+- Product/technical gap baseline: `docs/product-technical-gap-baseline.md`
+
+## Security Boundaries (credentials)
+
+- Default bind address is loopback. Loopback-only development may start without an admin token and reports `auth_mode=development` on `/healthz`.
+- Any non-loopback `BIND_ADDR` fails closed before readiness unless a write-capable principal is present in the credential registry (`ADMIN_TOKEN`, `ADMIN_TOKENS`, or `WAF_IDS_CREDENTIALS_PATH`).
+- Management writes return `401` when unauthenticated and `403` when authenticated but not permitted to write. Response bodies do not name the expected role.
diff --git a/docs/deployment/production.md b/docs/deployment/production.md
index 34ff1978..a8d5eca1 100644
--- a/docs/deployment/production.md
+++ b/docs/deployment/production.md
@@ -40,7 +40,7 @@ kubectl apply -f deploy/kubernetes/waf-ids-ai-soc.yaml
 - Terminate TLS in front of the service.
 - Expose `/admin` and `/api/*` only through identity-aware access.
 - Configure upstream allowlists and egress policy.
-- Store `ADMIN_TOKEN` in a secret manager.
+- Store `ADMIN_TOKEN` in a secret manager. The process **will not become ready** on `BIND_ADDR=0.0.0.0:8080` (or any non-loopback address) if no write-capable credential is configured. That is intentional fail-closed behavior (issue #78). Recovery: inject the Secret, restart; do not disable the gate.
 - Mount persistent state or replace JSON persistence with a database.
 - Run `scripts/smoke.sh` before promoting a release.
 - Keep block mode route-scoped and reversible.
diff --git a/docs/design-system.md b/docs/design-system.md
index c30523ac..4826ec3e 100644
--- a/docs/design-system.md
+++ b/docs/design-system.md
@@ -53,7 +53,13 @@ carried by token swaps only, no component markup changes between modes.
 | `--fs-metric` | 28px/700 | KPI tile value |
 | `--radius` | 8px | cards, inputs (6px), badges (pill) |
 
-Controls (`button`, `input`, `select`) are `min-height: 44px` (WCAG 2.5.5 target size).
+Primary form controls (`button`, `input`, `select`) use `min-height: 44px` as a
+Wardnet ergonomic floor. **Height alone is not target-size conformance evidence.**
+WCAG 2.2 SC 2.5.8 Target Size (Minimum), Level AA, requires a pointer target to be
+at least 24 × 24 CSS pixels or satisfy one of the criterion's specified exceptions,
+including its spacing rule. SC 2.5.5 Target Size (Enhanced), Level AAA, requires
+44 × 44 CSS pixels except its specified exceptions. Do not claim SC 2.5.5 from the
+44px height rule unless both axes of the actual target/hit area have been measured.
 
 ## Components
 
@@ -87,7 +93,7 @@ Each entry: **anatomy · states · usage · a11y · data**.
 
 ### Button
 - **Variants** `btn-primary` (brand fill — one primary action per form), `btn-secondary` (bordered, on surface), `btn-ghost` (in the brand header).
-- **States** default / `:focus-visible` ring / `aria-pressed` (toggle). 44px min.
+- **States** default / `:focus-visible` ring / `aria-pressed` (toggle). Runtime CSS guarantees a 44px minimum height; target width/hit area must still be verified before making a WCAG target-size claim.
 
 ### Form field
 - **Anatomy** `label.field` wrapping caption + control + optional `.field-help`.
@@ -124,7 +130,8 @@ First tab stop, off-screen until focused, jumps to `#main`.
 ## Accessibility checklist (per screen)
 
 - [ ] All text pairs ≥ 4.5:1 (see table); non-text state has a text label too.
-- [ ] Every control ≥ 44×44 and reachable by keyboard with a visible focus ring.
+- [ ] Every pointer target is verified against WCAG 2.2 SC 2.5.8: at least 24 × 24 CSS px or a documented applicable exception/spacing result. Important controls should aim for 44 × 44 CSS px; SC 2.5.5 Level AAA is not claimed from height alone.
+- [ ] Every interactive control is reachable by keyboard with a visible focus ring.
 - [ ] Tables use `<table>/<th scope>`; forms use wrapping `<label>`.
 - [ ] Live regions announce KPI refresh and write results.
 - [ ] High Contrast mode usable (borders `#000`, text ≥ 17:1).
@@ -144,4 +151,10 @@ never inline hex on an element; put it in a token first.
   A single admin-token field in the header authorizes writes (`X-Admin-Token`);
   server validation is surfaced verbatim via toast.
 - Single brand; only Default + High Contrast themes (no dark, no density).
-- No automated a11y/visual regression test yet; contrast is verified manually.
+- No automated accessibility/visual target-size regression test yet; contrast is verified manually and target-size claims remain fail-closed until measured.
+
+## Standards evidence (APA 7)
+
+World Wide Web Consortium. (n.d.). *Understanding Success Criterion 2.5.8: Target Size (Minimum).* Retrieved August 25, 2026, from https://www.w3.org/WAI/WCAG22/Understanding/target-size-minimum.html
+
+World Wide Web Consortium. (n.d.). *Understanding Success Criterion 2.5.5: Target Size (Enhanced).* Retrieved August 25, 2026, from https://www.w3.org/WAI/WCAG22/Understanding/target-size-enhanced.html
diff --git a/docs/doctoring/fail-closed-management-auth.md b/docs/doctoring/fail-closed-management-auth.md
new file mode 100644
index 00000000..3e8a7654
--- /dev/null
+++ b/docs/doctoring/fail-closed-management-auth.md
@@ -0,0 +1,60 @@
+# Doctoring — fail-closed management authentication
+
+This note grounds the issue #78 implementation (non-loopback listeners refuse to
+become ready without a write-capable admin principal; `401` vs `403`;
+constant-time secret compare). IEEE PDFs are not redistributed; freely licensed
+standards are cited by URL.
+
+## Adopted standards and literature
+
+Saltzer, J. H., & Schroeder, M. D. (1975). The protection of information in
+computer systems. *Proceedings of the IEEE*, *63*(9), 1278–1308.
+https://doi.org/10.1109/PROC.1975.9939
+
+- **Design impact:** Fail-safe defaults — a missing access rule is deny, not
+  allow. Wardnet previously treated an empty credential registry as “auth
+  disabled” for management writes. That violates fail-safe defaults as soon as
+  `BIND_ADDR` is not loopback-only. Startup now refuses readiness in that case.
+
+OWASP Foundation. (2025). *OWASP Application Security Verification Standard
+5.0.0*. https://owasp.org/www-project-application-security-verification-standard/
+
+- **Design impact:** ASVS V6 authentication and V4 access control require
+  authentication for administrative functions and distinct authorization
+  outcomes. Management writes use `401` when no valid principal is presented and
+  `403` when a readonly principal attempts a mutation. Bodies do not name the
+  expected secret or role.
+
+National Institute of Standards and Technology. (2022). *Secure Software
+Development Framework (SSDF) version 1.1* (NIST SP 800-218).
+https://doi.org/10.6028/NIST.SP.800-218
+
+- **Design impact:** PW.1 / PW.5 — produce well-secured software and protect
+  authentication data. Secrets bootstrap into `CredentialRegistry`; health
+  exposes `credentials_source` and `auth_mode` labels only.
+
+MITRE. (n.d.). *CWE-306: Missing authentication for critical function*.
+https://cwe.mitre.org/data/definitions/306.html
+
+- **Design impact:** Management APIs that mutate routes, threat indicators,
+  DNSBL, license, and feeds are critical functions. The CWE-306 anti-pattern is
+  “auth optional on a reachable listener.” The shipped gate is
+  `require_write_auth_for_bind` in `src/credentials.rs`, invoked from
+  `run_from_env` before `TcpListener::bind`.
+
+## Exact-head binding
+
+| Decision | Implementation |
+| --- | --- |
+| Fail closed on public bind | `require_write_auth_for_bind` + `run_from_env` |
+| Loopback development remains usable | `listen_is_loopback_only`; `/healthz.auth_mode=development` |
+| 401 vs 403 | `reject_management_write` |
+| Constant-time compare | `constant_time_eq` mixes a length-inequality flag, not `(len ^ len) as u8` |
+| Blank credentials path | empty/whitespace `WAF_IDS_CREDENTIALS_PATH` is unset |
+| Smoke-test token | `scripts/smoke.sh` generates a per-process secret (CWE-798) |
+| Ambiguous token registry | `parse_admin_tokens_strict` (duplicate / blank / unknown role) |
+
+PII is **not** masked on security events: SOC operators cannot do their job if
+client IPs, paths, and indicator values are redacted. Access control, audit,
+and encryption-at-rest (when a durable store lands) are the alternatives to
+masking. See `docs/product-technical-gap-baseline.md`.
diff --git a/docs/fuzzing.md b/docs/fuzzing.md
index b252299c..539fe02e 100644
--- a/docs/fuzzing.md
+++ b/docs/fuzzing.md
@@ -18,7 +18,7 @@ entry points for arbitrary input.
 | --------------------------- | ------------------------------------------- | ---------- |
 | `fuzz_score_request`        | `waf_ids_core::score_request`               | no panic on arbitrary path/query/body/IP; `reason` never empty; scoring deterministic |
 | `fuzz_appdata_json`         | `serde_json::from_str::<AppData>` (state file) | no panic; parsed values round-trip through serde |
-| `fuzz_parse_admin_tokens`   | `waf_ids_ai_soc::parse_admin_tokens`        | no panic; no empty token key; no empty principal actor value |
+| `fuzz_parse_admin_tokens`   | `waf_ids_ai_soc::parse_admin_tokens` / `parse_credentials_json` | no panic; no empty token key or actor; present blank/null file credentials are rejected instead of falling back to environment transport |
 | `fuzz_dnsbl_zone`           | `waf_ids_core::export_dnsbl_zone` / `validate_dnsbl` | no panic; every TXT payload fully escaped (no zone break-out); every published A-record response code is an IPv4 loopback literal (127.0.0.0/8) |
 
 ## Layout
diff --git a/docs/product-technical-gap-baseline.md b/docs/product-technical-gap-baseline.md
new file mode 100644
index 00000000..4c635367
--- /dev/null
+++ b/docs/product-technical-gap-baseline.md
@@ -0,0 +1,163 @@
+# Product and technical gap baseline
+
+Snapshot date: 2026-08-23 (point-in-time inventory of then-open GitHub PRs and
+Issues plus operator-perceptible gaps). Update this file on every hourly loop.
+
+Commercial contract and `/api/commercial/readiness` remain **2B KRW**. The
+**$20 billion USD** figure is the long-loop quality bar for this program, not a
+number to rewrite into the readiness API this pass.
+
+PII policy: **do not mask** client IPs, paths, indicator values, or actor names
+on SOC surfaces. Masking blinds incident response. Alternative controls: fail-closed
+authentication, RBAC, audit log, credential registry (no secrets in health/support
+bundle), encryption-at-rest when PostgreSQL lands, purpose limitation in runbooks.
+CSAP/SOC 2 remain uncertified; see `docs/security/compliance-mapping.md`.
+
+## Then-open pull requests
+
+Org ruleset `CWL Central required workflows` (id `18156473`) requires
+**two** approving reviews, `require_last_push_approval=true`, and
+`required_review_thread_resolution=true`. Code-owner review is disabled
+(solo maintainer). This actor (`seonghobae`) cannot satisfy a second
+independent human approval on self-authored PRs and cannot bypass the
+ruleset (`current_user_can_bypass: never`). That is a **policy blocker**,
+not “waiting on review/CI time”.
+
+| PR | Title | Head | Checks | Reviews | Merge blocker |
+| --- | --- | --- | --- | --- | --- |
+| [#94](https://github.com/ContextualWisdomLab/wardnet/pull/94) | fix(auth): fail closed without write-capable admin on public bind | `fix/issue-78-fail-closed-credentials` | local fmt/test/clippy + two smokes green; GitHub Checks pending at open | Author this pass. | Org 2-approval ruleset + self-author (same as other self-authored PRs). Runtime gap #78 is in this PR. |
+| [#93](https://github.com/ContextualWisdomLab/wardnet/pull/93) | test(persistence): replace permission-based fault injection with a deterministic seam | `fix/issue-74-deterministic-persistence-fault` | rust + Security Scan green; **strix FAILURE** (job `97189711094`). Run log HTTP 404 from this token against wardnet and org `.github`. | Author `seonghobae`; Devin comments (info). | (1) strix FAILURE — log not readable (404); (2) org 2-approval ruleset + self-author. |
+| [#92](https://github.com/ContextualWisdomLab/wardnet/pull/92) | build(deps): bump github/codeql-action/upload-sarif from 4.37.6 to 4.37.7 | dependabot | All green (27). | Maintainer APPROVED (1 of 2). | Org ruleset: 2 approving reviews. Last pusher is dependabot so this approval counts; **second independent APPROVE missing**. |
+| [#91](https://github.com/ContextualWisdomLab/wardnet/pull/91) | build(deps): bump futures-util from 0.3.33 to 0.3.34 | dependabot | All green (27). | Maintainer APPROVED (1 of 2). | Same as #92: second independent APPROVE missing. |
+| [#90](https://github.com/ContextualWisdomLab/wardnet/pull/90) | feat(observability): export Wardnet events to SIEM and OpenTelemetry | `feat/siem-opentelemetry-export` | All green (35). | Author `seonghobae`; CodeRabbit/Devin/GHAS comments (redaction of `key: value` credential shapes; `python` vs `python3` in runbook). | Org 2-approval + self-author; unresolved review threads (`required_review_thread_resolution`). |
+| [#88](https://github.com/ContextualWisdomLab/wardnet/pull/88) | feat(security): reject non-LiteLLM credentials before upstream | `feat/litellm-virtual-key-ingress-guard` | All green (35). | Author `seonghobae`; CodeRabbit (header length cap, fuzz target, literature). | Org 2-approval + self-author; unresolved threads. |
+| [#77](https://github.com/ContextualWisdomLab/wardnet/pull/77) | build(rust): pin and track Rust 1.97.1 | `agent/rust-toolchain-refresh-2026-08-19` | rust green; **strix FAILURE** (job `97001450437`, log 404). | Author `seonghobae`. | strix FAILURE (unread log) + org 2-approval + self-author. |
+| [#76](https://github.com/ContextualWisdomLab/wardnet/pull/76) | feat(ai): delegate SOC analysis to adaptive orchestration | `agent/adaptive-orchestrator-default` | All green (35). | Author `seonghobae`; CodeRabbit; opencode DISMISSED. | Org 2-approval + self-author. |
+| [#72](https://github.com/ContextualWisdomLab/wardnet/pull/72) | fix(deploy): require externally provisioned admin secret | `automation/remove-placeholder-admin-secret` | All green (35). | Author `seonghobae`; **opencode-agent CHANGES_REQUESTED** (latest); some CodeRabbit threads confirmed fixed but unresolved in GitHub. | `CHANGES_REQUESTED` (opencode-agent) + unresolved threads + org 2-approval + self-author. |
+
+Dependabot #91 and #92 were approved by this actor; `gh pr merge` was rejected
+by the base-branch policy (not by failing Checks). Do not `--admin` merge.
+
+## Then-open issues
+
+| Issue | Title | Priority |
+| --- | --- | --- |
+| [#89](https://github.com/ContextualWisdomLab/wardnet/issues/89) | Fail closed on invalid LiteLLM Virtual Keys and preserve safe upstream auth headers | medium |
+| [#87](https://github.com/ContextualWisdomLab/wardnet/issues/87) | [Production readiness] Close the evidence-backed Wardnet production gate | medium |
+| [#86](https://github.com/ContextualWisdomLab/wardnet/issues/86) | [P0] Put proven WAF/IDS engines in the enforcement path and publish detection-quality evidence | **critical** |
+| [#85](https://github.com/ContextualWisdomLab/wardnet/issues/85) | [P1] Establish production telemetry, SLOs, incident response, and disaster-recovery evidence | high |
+| [#84](https://github.com/ContextualWisdomLab/wardnet/issues/84) | [P1] Build an immutable signed release, promotion, and rollback pipeline | high |
+| [#83](https://github.com/ContextualWisdomLab/wardnet/issues/83) | [P1] Add bounded distributed admission control, trusted client attribution, and overload behavior | high |
+| [#82](https://github.com/ContextualWisdomLab/wardnet/issues/82) | [P1] Integrate Keyverse identity, tenant authorization, consent, and human approval evidence | high (blocked) |
+| [#81](https://github.com/ContextualWisdomLab/wardnet/issues/81) | [P0] Add a transactional outbox and idempotent leased workers for external effects | **critical** |
+| [#80](https://github.com/ContextualWisdomLab/wardnet/issues/80) | [P0] Add an authoritative PostgreSQL control plane with tenant isolation and recoverable migrations | **critical** |
+| [#79](https://github.com/ContextualWisdomLab/wardnet/issues/79) | [P0] Enforce a fail-closed destination policy for all outbound traffic | **critical** |
+| [#78](https://github.com/ContextualWisdomLab/wardnet/issues/78) | [P0] Fail closed when management credentials are absent | **critical — closed in runtime this pass** |
+| [#75](https://github.com/ContextualWisdomLab/wardnet/issues/75) | Rename Kubernetes manifest to wardnet.yaml after external-secret hardening lands | medium |
+| [#74](https://github.com/ContextualWisdomLab/wardnet/issues/74) | Make persistence failure tests deterministic across root and constrained filesystems | medium (PR #93) |
+| [#38](https://github.com/ContextualWisdomLab/wardnet/issues/38) | AI SOC: quarantine-sandbox malware analysis for attachment/link lures | medium (blocked) |
+| [#11](https://github.com/ContextualWisdomLab/wardnet/issues/11) | 서버를 켜고 Strix가 포트를 향해 각종 공격을 할 때 감지해내야 함 (CI) | medium |
+
+## Operator-perceptible product / technical gaps
+
+### Crate / repo name split
+
+GitHub repo and product name are **wardnet**. Cargo package and process log
+still say `waf-ids-ai-soc`. Kubernetes manifest remains
+`deploy/kubernetes/waf-ids-ai-soc.yaml` (issue #75 waits on #72). Cheap alias
+this pass: docs and health copy already mention Wardnet in newer surfaces;
+wholesale crate rename is deferred (not a merge blocker).
+
+### Proven-engine enforcement (issue #86)
+
+Coraza audit JSON and Suricata EVE ingest exist as **admin-token import
+adapters**. They are not an in-process enforcement engine on `/gateway`.
+Scoring still uses in-repo indicators + DNSBL. Do not invent CRS replacements.
+
+### Identity (issue #82, Keyverse)
+
+Management auth is shared secrets (`X-Admin-Token`) plus optional multi-token
+RBAC. Keyverse (OIDC/SCIM/FIDO2) is not wired. Fail-closed (#78) is the
+prerequisite shipped this pass.
+
+### Durable control plane (issue #80)
+
+Optional JSON file + atomic rename. Not PostgreSQL, no tenant isolation, no
+migrations, no hot-partition strategy. 3NF/snake_case two-word names apply when
+the store lands.
+
+### Fail-closed credentials (issue #78) — **closed this pass**
+
+Shipped:
+
+- `require_write_auth_for_bind` in `src/credentials.rs` (driven by unit tests
+  and by `run_from_env` / the real binary).
+- Non-loopback `BIND_ADDR` without a write-capable admin principal from
+  `ADMIN_TOKEN`, a write-capable entry in `ADMIN_TOKENS`, or
+  `WAF_IDS_CREDENTIALS_PATH` exits before bind
+  (`tests/binary.rs::binary_fail_closes_non_loopback_listen_without_admin`).
+- Loopback remains usable; `/healthz.auth_mode` is `development` or `production`.
+- `401` vs `403` on management writes; constant-time compare; strict
+  `ADMIN_TOKENS` parser.
+
+Doctoring: `docs/doctoring/fail-closed-management-auth.md` (APA 7th).
+
+### Destination policy (issue #79)
+
+Upstream scheme validation exists; no fail-closed destination allowlist for all
+outbound (feed fetch, proxy, LLM, Clearfolio). Next-loop candidate after #78.
+
+### SIEM / OpenTelemetry (issue #85 / PR #90)
+
+`/api/events.ndjson` and stdout JSON lines exist on main. Full exporter binary
+and OTel sit on PR #90, blocked by the 2-approval ruleset.
+
+### UI-UX / Storybook / Figma
+
+| Item | Status |
+| --- | --- |
+| Design tokens | CSS custom properties in `ADMIN_HTML`; documented in `docs/design-system.md` |
+| Figma design file | `QTH5UuU0FJv2VyM2xb02Fp` — ADR 0001 |
+| FigJam architecture | `JExziD87eUWKLERECUGhWQ` |
+| Figma Code Connect | Not used |
+| Ten UI-UX areas | Inventoried in `docs/ui-ux/storybook-scene-inventory.md` |
+| Node Storybook | **Not hosted in `/admin`** (embedded-console architecture). File:// inventory is the scene/edge-case contract this pass. |
+
+### CSAP / SOC 2 vs PII unmasking
+
+No certification claim. Compliance map lists SSDLC, access control, audit,
+availability gaps (signed releases, SSO, HA storage). PII masking would stop
+SOC work; we do not ship it. Controls: authn/z, audit, secret hygiene,
+future encryption-at-rest.
+
+### Coverage / docstring bar
+
+Org 100% line/branch/docstring applies to **changed** surfaces this loop
+(credentials gate, health `auth_mode`, 401/403 helper, binary fail-closed).
+Remaining holes on untouched handlers stay listed for later loops.
+
+### Ecosystem connectors (leverage order)
+
+1. **keyverse** — identity for management plane (#82).
+2. **contextual-orchestrator** — SOC LLM already optional via
+   `SOC_LLM_BASE_URL`; keep adapter, do not fork routing.
+3. **naruon** / **clearfolio** — document viewer already optional.
+4. **TEPP / RankWeave / ThreadWeave / LineageWeave / disksage / fast-mlsirm** —
+   not on the gateway data path; no connector this pass.
+
+## This loop’s shipped gap
+
+Issue **#78**: fail-closed management credentials on non-loopback listen.
+Operator-visible: a cluster bind (`0.0.0.0:8080`) without a write-capable admin
+principal from `ADMIN_TOKEN`, a write-capable `ADMIN_TOKENS` entry, or
+`WAF_IDS_CREDENTIALS_PATH` no longer becomes ready with open management writes.
+
+## Next hourly loop (do, do not report)
+
+1. Second independent APPROVE on #91/#92 (or OpenCode review agent APPROVE
+   without rotating review-agent secrets).
+2. Fetch strix logs with an Actions-capable token; fix #93/#77 or re-run.
+3. Address remaining CodeRabbit threads on #90/#88 if still on exact head.
+4. Destination allowlist (#79) or in-path Coraza evidence (#86) — pick the
+   closer mergeable runtime gap.
+5. Refresh this file’s PR/Issue tables from `gh pr list` / `gh issue list`.
diff --git a/docs/runbooks/operations.md b/docs/runbooks/operations.md
index 9b6b7015..71736507 100644
--- a/docs/runbooks/operations.md
+++ b/docs/runbooks/operations.md
@@ -50,8 +50,9 @@ WAF_IDS_STATE_PATH=./waf-ids-state.local.json \
 cargo run
 ```
 
-Health reports `credentials_source` (`file` / `env` / `none`) and
-`admin_auth_configured` (boolean) without exposing secret values.
+Health reports `credentials_source` (`file` / `env` / `none`),
+`admin_auth_configured` (boolean), and `auth_mode` (`development` /
+`production`) without exposing secret values.
 
 ## Health Check
 
@@ -66,7 +67,8 @@ Expected fields:
 - `dnsbl_origin`: configured DNSBL origin without a trailing dot
 - `event_limit`: retained security event count
 - `credentials_source`: `file`, `env`, or `none`
-- `admin_auth_configured`: whether any admin write token is configured
+- `admin_auth_configured`: whether any admin token is configured
+- `auth_mode`: `development` only on a loopback listener with no write-capable principal; otherwise `production`. A non-loopback process refuses to become ready without credentials (issue #78).
 
 ## Smoke Test
 
diff --git a/docs/security/threat-model.md b/docs/security/threat-model.md
index 8cf0a35b..88afd112 100644
--- a/docs/security/threat-model.md
+++ b/docs/security/threat-model.md
@@ -16,13 +16,14 @@
 - Operators use management APIs and the embedded admin console.
 - Upstream services are outside the process trust boundary.
 - The state file is trusted only after JSON deserialization succeeds.
+- A non-loopback listener is untrusted until a write-capable admin principal exists in the credential registry. Missing credentials are a startup failure, not “auth disabled”.
 - Threat feed import payloads are untrusted operator-supplied data.
 
 ## Primary Threats
 
 | Threat | Impact | Current Control | Required Hardening |
 | --- | --- | --- | --- |
-| Unauthorized management write | Route takeover or false blocking | `X-Admin-Token` write gate; multi-token RBAC with actor labels and readonly role; audit log for successful writes | SSO/OIDC, mTLS or identity proxy, SCIM |
+| Unauthorized management write | Route takeover or false blocking | `X-Admin-Token` write gate; multi-token RBAC with actor labels and readonly role; audit log for successful writes; **fail-closed startup** on non-loopback bind without a write-capable principal; `401` vs `403` without leaking expected role; constant-time secret compare | SSO/OIDC via Keyverse, mTLS or identity proxy, SCIM |
 | Malicious threat feed import | False positives or broad blocks | Validation, route-scoped enforcement | Source signing, feed confidence, staged promotion |
 | State file corruption | Startup failure or stale policy | JSON parse failure surfaces startup error | Database, backup, schema migration |
 | Upstream SSRF through routes | Internal network exposure | Upstream scheme validation | Upstream allowlists, egress policy |
diff --git a/docs/ui-ux/storybook-scene-inventory.md b/docs/ui-ux/storybook-scene-inventory.md
new file mode 100644
index 00000000..2dd61207
--- /dev/null
+++ b/docs/ui-ux/storybook-scene-inventory.md
@@ -0,0 +1,73 @@
+# Admin console — scene and edge-case event inventory
+
+**Open this file from disk:** `file://` on
+`docs/ui-ux/storybook-scene-inventory.md`. It is the Storybook-equivalent
+contract for Wardnet’s **embedded** console (`ADMIN_HTML` in `src/lib.rs`).
+
+A Node Storybook (`storybookjs/storybook`) cannot be hosted inside `/admin`
+without a separate static site the binary does not serve. This inventory
+defines scenes, edge-case events, and the ten UI-UX areas so operators and
+agents can review interaction without a JS toolchain. Tokens remain the source
+for repeating objects (`docs/design-system.md`, Figma `QTH5UuU0FJv2VyM2xb02Fp`).
+
+Companion skills used while authoring: Storybook scene thinking, UI-UX Pro Max
+checklists, Anti-Slop-UI (no generic dashboard chrome; this console is an
+operator instrument panel).
+
+## How to exercise each scene
+
+1. `cargo run` on loopback; no admin credential is required for read-only development startup. For authenticated scenes, generate a unique per-process `ADMIN_TOKEN` outside the source tree and do not reuse a repository literal.
+2. Open `http://127.0.0.1:8080/admin`.
+3. Drive the event in the table. Expected result is the operator’s next action,
+   not a status narrative.
+
+## Ten UI-UX areas
+
+| Area | Console contract | Edge-case events |
+| --- | --- | --- |
+| Accessibility | Skip link, wrapping labels, `th scope`, live regions, High Contrast `aria-pressed`, text+colour badges | Keyboard-only create-route; High Contrast + focus ring visible on every control; screen-reader hears KPI refresh (`aria-live=polite`) and toast (`assertive`) |
+| Touch & Interaction | Primary controls use a 44px minimum height as an ergonomic floor. This height alone is **not** evidence of WCAG 2.5.5 conformance. WCAG 2.2 SC 2.5.8 (Level AA) requires pointer targets to be at least 24 × 24 CSS px or satisfy a specified exception/spacing rule; SC 2.5.5 (Level AAA) requires 44 × 44 CSS px except its specified exceptions. | Tap primary save on a 390px-wide viewport; verify the actual target/hit-area on both axes before claiming target-size conformance; toast auto-dismiss ~4.5s; do not rely on hover |
+| Performance | No framework, no extra network for CSS/JS; `Promise.allSettled` per card | One failing `/api/*` card shows `.err` and does not blank the page; large event list capped at 25 with truncation copy |
+| Style Selection | Default tokens vs High Contrast (`data-theme=hc`, `localStorage["waf-theme"]`) | Toggle High Contrast, reload, theme persists; never raw hex on a component |
+| Layout & Responsive | Card grid `repeat(auto-fit, minmax(340px, 1fr))` | 1280px desktop and 390px mobile: header, KPI strip, and create forms remain usable; no horizontal trap |
+| Typography & Color | `--fs-h1/h2/body/cap/metric`; WCAG table in design-system.md | Body `--ink` vs `--sub`; destructive `--fail` always with the word Block/Fail/Stale |
+| Animation | None beyond toast dismiss; no decorative motion | Toast appears and leaves without blocking the next write |
+| Forms & Feedback | `label.field` + `.field-help` matching server validators; toast `ok`/`bad` | Path without leading `/` → server error in toast; valid route → toast + table refresh; empty collection → `.empty` “No entries.” |
+| Navigation Patterns | Single-page console; skip link to `#main`; header token field | Tab order: skip → token → High Contrast → main cards; `/` and `/admin` render the same console |
+| Charts & Data | KPI tiles (not charts) + tables + raw `pre` for NDJSON/JSON/zone | KPI `…` while loading then numbers from `/api/kpis`; readiness checklist pass/fail rows; raw DNSBL zone is faithful text, not a redesigned chart |
+
+## Scene catalog (Storybook CSF analogue)
+
+Each scene is `(id, setup, event, expected next action)`.
+
+| Scene ID | Setup | Event | Expected next action |
+| --- | --- | --- | --- |
+| `kpi.strip.loaded` | Seeded state | Page load | Read route/threat/DNSBL/block counts; if Block is non-zero, open Events |
+| `kpi.strip.error` | Stop API | Page load | Card/strip shows error copy; rest of page remains |
+| `routes.table.empty` | No routes | Open Routes | “No entries.” then open the create `<details>` |
+| `routes.create.ok` | Token set | Submit path `/secure`, upstream `mock://x`, mode Block | Toast success; table shows the row; next: send a gateway request |
+| `routes.create.validation` | Token set | Submit path `secure` (no slash) | Toast with server validator text; fix the path |
+| `routes.create.unauth` | Empty token, auth required | Submit create | Toast unauthorized; paste `X-Admin-Token` |
+| `routes.create.forbidden` | Readonly token | Submit create | HTTP 403 / toast; switch to a write token |
+| `threats.import.feed` | Token set | Import a reviewed feed | Toast upsert counts; open Freshness |
+| `feeds.freshness.stale` | TTL expired feed | Open Freshness | Stale badge (text+colour); re-import or disable |
+| `license.detail` | Seeded license | Open License | Definition list; missing optionals render `—` |
+| `readiness.not-ready` | Missing license fields | Open Commercial readiness | Not-ready badge + one evidence string per failed check |
+| `events.ndjson.export` | At least one blocked event | Open raw export | Copy NDJSON for SIEM; do not reformat |
+| `dnsbl.zone.export` | Seeded DNSBL | Open zone | Copy RFC 5782 zone text to the authoritative DNS publisher |
+| `audit.readonly` | Readonly token | Open audit logs | Table of writes; no create controls succeed |
+| `theme.high-contrast` | Default theme | Toggle High Contrast | Borders `#000`; reload keeps theme |
+| `gateway.block.demo` | Block route `/secure` | `GET /gateway/secure` | Blocked event appears; next: confirm KPI blocked count |
+
+## Storybook (Node) — deferred
+
+If a future pass adds a static `storybook/` package, CSF stories must mount
+the same CSS tokens (not a parallel palette) and replay the events above.
+Until then this file is the inventory of record. Do not claim `/admin` loads
+Storybook.
+
+## Standards evidence (APA 7)
+
+World Wide Web Consortium. (n.d.). *Understanding Success Criterion 2.5.8: Target Size (Minimum).* Retrieved August 25, 2026, from https://www.w3.org/WAI/WCAG22/Understanding/target-size-minimum.html
+
+World Wide Web Consortium. (n.d.). *Understanding Success Criterion 2.5.5: Target Size (Enhanced).* Retrieved August 25, 2026, from https://www.w3.org/WAI/WCAG22/Understanding/target-size-enhanced.html
diff --git a/fuzz/fuzz_targets/fuzz_parse_admin_tokens.rs b/fuzz/fuzz_targets/fuzz_parse_admin_tokens.rs
index 80fadda8..043c773c 100644
--- a/fuzz/fuzz_targets/fuzz_parse_admin_tokens.rs
+++ b/fuzz/fuzz_targets/fuzz_parse_admin_tokens.rs
@@ -1,15 +1,21 @@
 #![no_main]
-//! Fuzz the admin-token config parser: `waf_ids_ai_soc::parse_admin_tokens`.
+//! Fuzz both admin-token config parsers:
+//! `waf_ids_ai_soc::parse_admin_tokens` and
+//! `waf_ids_ai_soc::parse_admin_tokens_strict`.
 //!
-//! This parses the `ADMIN_TOKENS` operator config string
+//! Both parse the untrusted `ADMIN_TOKENS` operator config string
 //! (`token:actor[:role],...`) into an RBAC principal map. Malformed or
-//! adversarial config must never panic, and the parser's structural invariants
-//! must hold for every input:
+//! adversarial config must never panic. Whenever either parser accepts an
+//! input, its structural invariants must hold:
 //!   * no empty token key ever ends up in the map;
 //!   * every actor value is non-empty (defaults to "admin").
+//!
+//! The strict startup parser may reject duplicate tokens, blank token entries,
+//! or unknown roles; those errors are expected fuzz outcomes rather than
+//! crashes.
 
 use libfuzzer_sys::fuzz_target;
-use waf_ids_ai_soc::parse_admin_tokens;
+use waf_ids_ai_soc::{parse_admin_tokens, parse_admin_tokens_strict, parse_credentials_json};
 
 fuzz_target!(|data: &[u8]| {
     let Ok(raw) = std::str::from_utf8(data) else {
@@ -24,4 +30,20 @@ fuzz_target!(|data: &[u8]| {
             "actor value must never be empty"
         );
     }
+
+    if let Ok(tokens) = parse_admin_tokens_strict(raw) {
+        for (token, principal) in &tokens {
+            assert!(!token.is_empty(), "strict token key must never be empty");
+            assert!(
+                !principal.actor.is_empty(),
+                "strict actor value must never be empty"
+            );
+        }
+    }
+
+    if let Ok(credentials) = parse_credentials_json(raw) {
+        for value in credentials.values() {
+            assert!(!value.trim().is_empty(), "credential value must never be blank");
+        }
+    }
 });
diff --git a/scripts/smoke.sh b/scripts/smoke.sh
index 5df0c730..0cc18e0f 100755
--- a/scripts/smoke.sh
+++ b/scripts/smoke.sh
@@ -5,7 +5,11 @@ ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TMP_DIR="$(mktemp -d)"
 STATE_FILE="$TMP_DIR/state.json"
 LOG_FILE="$TMP_DIR/server.log"
-ADMIN_TOKEN_VALUE="dev-secret"
+ADMIN_TOKEN_VALUE="$(python3 - <<'PY'
+import secrets
+print(secrets.token_hex(16))
+PY
+)"
 PORT="$(python3 - <<'PY'
 import socket
 s = socket.socket()
@@ -27,10 +31,14 @@ cleanup() {
 trap cleanup EXIT
 
 start_server() {
+  # Compile before the health wait so rustc time is not counted as a hang.
+  cargo build --quiet --manifest-path "$ROOT_DIR/Cargo.toml"
   (
     cd "$ROOT_DIR"
     BIND_ADDR="127.0.0.1:$PORT" \
       ADMIN_TOKEN="$ADMIN_TOKEN_VALUE" \
+      ADMIN_TOKENS= \
+      WAF_IDS_CREDENTIALS_PATH= \
       WAF_IDS_STATE_PATH="$STATE_FILE" \
       DNSBL_ORIGIN="dnsbl.test" \
       EVENT_LIMIT="5" \
@@ -77,6 +85,8 @@ assert_json_field "$health" 'data["status"] == "ok"'
 assert_json_field "$health" 'data["persistence"] == "file"'
 assert_json_field "$health" 'data["dnsbl_origin"] == "dnsbl.test"'
 assert_json_field "$health" 'data["event_limit"] == 5'
+assert_json_field "$health" 'data["admin_auth_configured"] is True'
+assert_json_field "$health" 'data["auth_mode"] == "production"'
 
 curl -fsS "$BASE_URL/admin" | grep -q "ContextualWisdomLab WAF/IDS/AI SOC Gateway"
 
@@ -187,7 +197,7 @@ assert_json_field "$support_bundle" 'data["kpis"]["fresh_threat_feed_count"] ==
 assert_json_field "$support_bundle" 'data["audit_log_count"] >= 3'
 assert_json_field "$support_bundle" 'data["threat_feed_freshness"][0]["stale"] is False'
 
-audit_logs="$(curl -fsS "$BASE_URL/api/audit-logs")"
+audit_logs="$(curl -fsS -H "x-admin-token: $ADMIN_TOKEN_VALUE" "$BASE_URL/api/audit-logs")"
 assert_json_field "$audit_logs" 'any(log["action"] == "upsert_route" and log["resource_id"] == "block" for log in data)'
 assert_json_field "$audit_logs" 'any(log["action"] == "update_commercial_license" and log["resource_id"] == "cwlab-enterprise" for log in data)'
 assert_json_field "$audit_logs" 'any(log["action"] == "import_threat_feed" and log["resource_id"] == "misp-seoul" for log in data)'
@@ -212,7 +222,7 @@ license="$(curl -fsS "$BASE_URL/api/commercial/license")"
 assert_json_field "$license" 'data["license_status"] == "active"'
 feeds="$(curl -fsS "$BASE_URL/api/threat-feeds")"
 assert_json_field "$feeds" 'len(data) == 1'
-audit_logs="$(curl -fsS "$BASE_URL/api/audit-logs")"
+audit_logs="$(curl -fsS -H "x-admin-token: $ADMIN_TOKEN_VALUE" "$BASE_URL/api/audit-logs")"
 assert_json_field "$audit_logs" 'len(data) >= 3'
 
 echo "smoke ok: $BASE_URL with state $STATE_FILE"
diff --git a/src/credentials.rs b/src/credentials.rs
index bcc07e50..3be38e60 100644
--- a/src/credentials.rs
+++ b/src/credentials.rs
@@ -59,7 +59,7 @@ impl CredentialRegistry {
 
     pub fn has_admin_auth(&self) -> bool {
         self.get_credential(CRED_ADMIN_TOKEN)
-            .is_some_and(|v| !v.is_empty())
+            .is_some_and(|v| !v.trim().is_empty())
             || self
                 .get_credential(CRED_ADMIN_TOKENS)
                 .is_some_and(|v| !v.trim().is_empty())
@@ -83,25 +83,16 @@ impl CredentialRegistry {
         let mut admin_from_file = false;
         let mut admin_from_env = false;
 
-        if let Some(path) = credentials_path {
+        if let Some(path) = credentials_path.and_then(nonempty_credentials_path) {
             match std::fs::read_to_string(path) {
                 Ok(content) => {
-                    let file_map: HashMap<String, serde_json::Value> =
-                        serde_json::from_str(&content).map_err(|error| {
-                            format!(
-                                "credentials file {} is not valid JSON: {error}",
-                                path.display()
-                            )
-                        })?;
-                    for key in [CRED_ADMIN_TOKEN, CRED_ADMIN_TOKENS] {
-                        if let Some(raw) = file_map.get(key) {
-                            let text = json_value_as_nonempty_string(raw);
-                            if let Some(text) = text {
-                                values.insert(key.to_string(), text);
-                                admin_from_file = true;
-                            }
-                        }
+                    let file_values = parse_credentials_json(&content).map_err(|error| {
+                        format!("credentials file {} is invalid: {error}", path.display())
+                    })?;
+                    if !file_values.is_empty() {
+                        admin_from_file = true;
                     }
+                    values.extend(file_values);
                 }
                 Err(error) if error.kind() == ErrorKind::NotFound => {}
                 Err(error) => {
@@ -114,13 +105,13 @@ impl CredentialRegistry {
         }
 
         if !values.contains_key(CRED_ADMIN_TOKEN)
-            && let Some(token) = env_admin_token.filter(|value| !value.is_empty())
+            && let Some(token) = env_admin_token.filter(|value| !value.trim().is_empty())
         {
             values.insert(CRED_ADMIN_TOKEN.to_string(), token);
             admin_from_env = true;
         }
         if !values.contains_key(CRED_ADMIN_TOKENS)
-            && let Some(tokens) = env_admin_tokens.filter(|value| !value.is_empty())
+            && let Some(tokens) = env_admin_tokens.filter(|value| !value.trim().is_empty())
         {
             values.insert(CRED_ADMIN_TOKENS.to_string(), tokens);
             admin_from_env = true;
@@ -137,13 +128,106 @@ impl CredentialRegistry {
     }
 }
 
+/// Parse the secret-bearing keys from credentials JSON.
+///
+/// Missing keys may use bootstrap transport fallback, but an explicitly null
+/// or blank key is invalid and cannot be silently replaced by another source.
+pub fn parse_credentials_json(content: &str) -> Result<HashMap<String, String>, String> {
+    let file_map: HashMap<String, serde_json::Value> =
+        serde_json::from_str(content).map_err(|error| format!("not valid JSON: {error}"))?;
+    let mut values = HashMap::new();
+    for key in [CRED_ADMIN_TOKEN, CRED_ADMIN_TOKENS] {
+        if let Some(raw) = file_map.get(key) {
+            let text = json_value_as_nonempty_string(raw)
+                .ok_or_else(|| format!("{key} must not be blank or null"))?;
+            values.insert(key.to_string(), text);
+        }
+    }
+    Ok(values)
+}
+
+/// Return a credentials path only when it contains a non-whitespace path value.
+///
+/// `WAF_IDS_CREDENTIALS_PATH` is an optional bootstrap transport. Treating an
+/// empty environment value as a real path makes startup behavior depend on how
+/// the host platform classifies `read_to_string("")`; normalizing it here keeps
+/// the credential registry portable and fail-closed without inventing a file.
+fn nonempty_credentials_path(path: &Path) -> Option<&Path> {
+    if path.as_os_str().to_string_lossy().trim().is_empty() {
+        None
+    } else {
+        Some(path)
+    }
+}
+
+/// Constant-time equality for presented admin secrets.
+///
+/// Length inequality is mixed in as a boolean flag, not a truncated integer
+/// XOR. Folding `(left.len() ^ right.len()) as u8` would treat lengths that
+/// differ by a multiple of 256 as equal when the extra bytes are `0x00`.
+pub fn constant_time_eq(left: &[u8], right: &[u8]) -> bool {
+    let max = left.len().max(right.len());
+    let mut diff = u8::from(left.len() != right.len());
+    for i in 0..max {
+        let l = left.get(i).copied().unwrap_or(0);
+        let r = right.get(i).copied().unwrap_or(0);
+        diff |= l ^ r;
+    }
+    diff == 0
+}
+
+/// True when `bind_addr` can only be reached from the local host.
+///
+/// Unparseable addresses return `false` (fail closed: require credentials).
+pub fn listen_is_loopback_only(bind_addr: &str) -> bool {
+    let trimmed = bind_addr.trim();
+    if trimmed.is_empty() {
+        return false;
+    }
+    if let Ok(addr) = trimmed.parse::<std::net::SocketAddr>() {
+        return addr.ip().is_loopback();
+    }
+    let Some(host) = bind_host(trimmed) else {
+        return false;
+    };
+    host.parse::<std::net::IpAddr>()
+        .map(|ip| ip.is_loopback())
+        .unwrap_or(false)
+}
+
+fn bind_host(bind_addr: &str) -> Option<&str> {
+    if let Some(rest) = bind_addr.strip_prefix('[') {
+        let end = rest.find(']')?;
+        return Some(&rest[..end]);
+    }
+    bind_addr.rsplit_once(':').map(|(host, _)| host)
+}
+
+/// Fail closed before readiness when a non-loopback listener has no write-capable
+/// admin principal. Loopback-only development remains available without a token.
+///
+/// This is the shipped gate behind [`crate::run_from_env`]; tests drive it
+/// directly so the bind/listen path is not required to prove the policy.
+pub fn require_write_auth_for_bind(
+    bind_addr: &str,
+    has_write_capable_admin: bool,
+) -> Result<(), String> {
+    if has_write_capable_admin || listen_is_loopback_only(bind_addr) {
+        Ok(())
+    } else {
+        Err(format!(
+            "refusing to bind {bind_addr} without a write-capable admin credential: set ADMIN_TOKEN, ADMIN_TOKENS, or WAF_IDS_CREDENTIALS_PATH before listening on a non-loopback address"
+        ))
+    }
+}
+
 fn json_value_as_nonempty_string(value: &serde_json::Value) -> Option<String> {
     match value {
-        serde_json::Value::String(text) if !text.is_empty() => Some(text.clone()),
+        serde_json::Value::String(text) if !text.trim().is_empty() => Some(text.clone()),
         serde_json::Value::Null | serde_json::Value::String(_) => None,
         other => {
             let text = other.to_string();
-            if text.is_empty() || text == "null" {
+            if text.trim().is_empty() || text == "null" {
                 None
             } else {
                 Some(text)
@@ -182,6 +266,54 @@ mod tests {
         assert!(!registry.has_admin_auth());
     }
 
+    #[test]
+    fn whitespace_env_admin_token_does_not_authorize_public_bind() {
+        let registry =
+            CredentialRegistry::bootstrap_secrets(None, Some("   \t".to_string()), None).unwrap();
+        let has_write_capable_admin = registry
+            .get_credential(CRED_ADMIN_TOKEN)
+            .is_some_and(|token| !token.is_empty());
+        assert_eq!(registry.source(), CredentialSource::None);
+        assert_eq!(registry.get_credential(CRED_ADMIN_TOKEN), None);
+        assert!(require_write_auth_for_bind("0.0.0.0:0", has_write_capable_admin).is_err());
+    }
+
+    #[test]
+    fn whitespace_file_admin_token_cannot_fall_back_to_env() {
+        let dir = std::env::temp_dir().join(format!(
+            "wardnet-creds-whitespace-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("credentials.json");
+        std::fs::write(&path, r#"{"admin_token":"   \t"}"#).unwrap();
+
+        let error = CredentialRegistry::bootstrap_secrets(
+            Some(&path),
+            Some("must-not-replace-file-value".to_string()),
+            None,
+        )
+        .unwrap_err();
+        assert!(error.contains("admin_token must not be blank or null"));
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn explicit_null_file_admin_token_is_invalid() {
+        assert!(parse_credentials_json(r#"{"admin_token":null}"#).is_err());
+    }
+
+    #[test]
+    fn non_string_file_value_preserves_existing_serialization_policy() {
+        let values = parse_credentials_json(r#"{"admin_token":42}"#).unwrap();
+        assert_eq!(values.get(CRED_ADMIN_TOKEN).map(String::as_str), Some("42"));
+    }
+
     #[test]
     fn file_overrides_env_per_key() {
         let dir = std::env::temp_dir().join(format!(
@@ -288,4 +420,57 @@ mod tests {
         assert!(err.contains("not valid JSON"));
         let _ = std::fs::remove_dir_all(&dir);
     }
+
+    #[test]
+    fn constant_time_eq_matches_equal_secrets_and_rejects_others() {
+        assert!(constant_time_eq(b"secret", b"secret"));
+        assert!(!constant_time_eq(b"secret", b"secreT"));
+        assert!(!constant_time_eq(b"secret", b"secret!"));
+        assert!(!constant_time_eq(b"secret", b""));
+        assert!(constant_time_eq(b"", b""));
+    }
+
+    #[test]
+    fn constant_time_eq_rejects_lengths_differing_by_256_with_zero_suffix() {
+        let short = vec![0_u8; 1];
+        let long = vec![0_u8; 257];
+        assert!(!constant_time_eq(&short, &long));
+    }
+
+    #[test]
+    fn nonempty_credentials_path_filters_blank_values() {
+        assert!(nonempty_credentials_path(Path::new("")).is_none());
+        assert!(nonempty_credentials_path(Path::new("   ")).is_none());
+        let path = Path::new("credentials.json");
+        assert_eq!(nonempty_credentials_path(path), Some(path));
+    }
+
+    #[test]
+    fn listen_is_loopback_only_classifies_bind_addresses() {
+        assert!(listen_is_loopback_only("127.0.0.1:0"));
+        assert!(listen_is_loopback_only("127.0.0.1:8080"));
+        assert!(listen_is_loopback_only("[::1]:8080"));
+        assert!(!listen_is_loopback_only("localhost:8080"));
+        assert!(!listen_is_loopback_only("LOCALHOST:9"));
+        assert!(!listen_is_loopback_only("0.0.0.0:0"));
+        assert!(!listen_is_loopback_only("0.0.0.0:8080"));
+        assert!(!listen_is_loopback_only("[::]:8080"));
+        assert!(!listen_is_loopback_only("192.0.2.10:8080"));
+        assert!(!listen_is_loopback_only(""));
+        assert!(!listen_is_loopback_only("not-an-address"));
+    }
+
+    #[test]
+    fn require_write_auth_for_bind_fail_closes_public_listeners() {
+        require_write_auth_for_bind("127.0.0.1:0", false).unwrap();
+        require_write_auth_for_bind("0.0.0.0:0", true).unwrap();
+        let err = require_write_auth_for_bind("0.0.0.0:0", false).unwrap_err();
+        assert!(
+            err.contains("refusing to bind 0.0.0.0:0"),
+            "operator error must name the refused address: {err}"
+        );
+        assert!(err.contains("ADMIN_TOKEN"), "{err}");
+        let err = require_write_auth_for_bind("[::]:8080", false).unwrap_err();
+        assert!(err.contains("refusing to bind [::]:8080"), "{err}");
+    }
 }
diff --git a/src/lib.rs b/src/lib.rs
index ab902cae..e5c61586 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -44,7 +44,10 @@ mod opencti_import;
 mod stix_import;
 mod suricata_eve;
 mod taxii;
-pub use credentials::{CRED_ADMIN_TOKEN, CRED_ADMIN_TOKENS, CredentialRegistry, CredentialSource};
+pub use credentials::{
+    CRED_ADMIN_TOKEN, CRED_ADMIN_TOKENS, CredentialRegistry, CredentialSource,
+    listen_is_loopback_only, parse_credentials_json, require_write_auth_for_bind,
+};
 
 #[derive(Clone)]
 pub struct AppState {
@@ -58,6 +61,10 @@ pub struct AppState {
     admin_tokens: HashMap<String, AdminPrincipal>,
     /// Where admin secrets were bootstrapped from (file/env/none). Never holds values.
     credentials_source: CredentialSource,
+    /// True when the process listener is loopback-only (in-process tests default
+    /// to this). Combined with missing write credentials, `/healthz` reports
+    /// `auth_mode=development`.
+    listen_loopback: bool,
     state_path: Option<PathBuf>,
     dnsbl_origin: String,
     event_limit: usize,
@@ -132,6 +139,7 @@ impl AppState {
             admin_token: config.admin_token,
             admin_tokens: HashMap::new(),
             credentials_source: CredentialSource::None,
+            listen_loopback: true,
             state_path: config.state_path,
             dnsbl_origin: normalized_origin(&config.dnsbl_origin),
             event_limit: config.event_limit.max(1),
@@ -209,12 +217,27 @@ impl AppState {
         self
     }
 
+    /// Record whether the process listener is loopback-only. Builder-style.
+    pub fn with_listen_loopback(mut self, listen_loopback: bool) -> Self {
+        self.listen_loopback = listen_loopback;
+        self
+    }
+
+    fn has_write_capable_admin(&self) -> bool {
+        if !self.admin_tokens.is_empty() {
+            self.admin_tokens
+                .values()
+                .any(|principal| principal.can_write)
+        } else {
+            self.admin_token
+                .as_deref()
+                .is_some_and(|token| !token.is_empty())
+        }
+    }
+
     /// The principal mapped to the request's `X-Admin-Token`, if configured.
     fn principal_for_token(&self, headers: &HeaderMap) -> Option<&AdminPrincipal> {
-        headers
-            .get("x-admin-token")
-            .and_then(|value| value.to_str().ok())
-            .and_then(|token| self.admin_tokens.get(token))
+        presented_admin_token(headers).and_then(|token| matching_rbac_principal(self, token))
     }
 
     /// The actor name mapped to the request's `X-Admin-Token`, if that token is a
@@ -283,6 +306,11 @@ impl AppState {
             event_limit: self.event_limit,
             credentials_source: self.credentials_source.as_str().to_string(),
             admin_auth_configured: self.admin_token.is_some() || !self.admin_tokens.is_empty(),
+            auth_mode: if self.listen_loopback && !self.has_write_capable_admin() {
+                "development".to_string()
+            } else {
+                "production".to_string()
+            },
         }
     }
 }
@@ -402,8 +430,11 @@ pub struct HealthStatus {
     pub event_limit: usize,
     /// Bootstrap origin for admin secrets: `file`, `env`, or `none` (never secret values).
     pub credentials_source: String,
-    /// True when at least one admin write token is configured.
+    /// True when at least one admin token (write or readonly) is configured.
     pub admin_auth_configured: bool,
+    /// `development` when the listener is loopback-only and no write-capable
+    /// admin principal is configured; otherwise `production`.
+    pub auth_mode: String,
 }
 
 const PHISHING_DATABASE_DEFAULT_FEED_ID: &str = "phishing-database-active";
@@ -620,8 +651,8 @@ async fn clearfolio_submit(
     PathParam(kind): PathParam<String>,
     headers: HeaderMap,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     let Some(config) = state.clearfolio.clone() else {
         return error(
@@ -667,8 +698,8 @@ async fn clearfolio_status(
     PathParam(job_id): PathParam<String>,
     headers: HeaderMap,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     let Some(config) = state.clearfolio.clone() else {
         return error(
@@ -810,8 +841,8 @@ async fn soc_analyze(
     headers: HeaderMap,
     Json(request): Json<SocAnalyzeRequest>,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     let Some(config) = state.soc_llm.clone() else {
         return error(
@@ -918,8 +949,8 @@ async fn create_route(
     headers: HeaderMap,
     Json(route): Json<RouteConfig>,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     if let Err(message) = validate_route(&route) {
         return error(StatusCode::BAD_REQUEST, message);
@@ -948,8 +979,8 @@ async fn create_threat(
     headers: HeaderMap,
     Json(indicator): Json<ThreatIndicator>,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     if let Err(message) = validate_threat(&indicator) {
         return error(StatusCode::BAD_REQUEST, message);
@@ -985,8 +1016,8 @@ async fn create_dnsbl(
     headers: HeaderMap,
     Json(entry): Json<DnsblEntry>,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     if let Err(message) = validate_dnsbl(&entry) {
         return error(StatusCode::BAD_REQUEST, message);
@@ -1124,8 +1155,8 @@ async fn update_commercial_license(
     headers: HeaderMap,
     Json(profile): Json<CommercialProfile>,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     if let Err(message) = validate_commercial_profile(&profile) {
         return error(StatusCode::BAD_REQUEST, message);
@@ -1180,8 +1211,8 @@ async fn import_threat_feed(
     headers: HeaderMap,
     Json(feed): Json<ThreatFeedImport>,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     if let Err(message) = validate_threat_feed_import(&feed) {
         return error(StatusCode::BAD_REQUEST, message);
@@ -1232,8 +1263,8 @@ async fn import_stix_document(
     Query(query): Query<StixImportQuery>,
     body: Bytes,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     if query.feed_id.trim().is_empty() || query.source.trim().is_empty() {
         return error(
@@ -1323,8 +1354,8 @@ async fn import_misp_document(
     Query(query): Query<MispImportQuery>,
     body: Bytes,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     if query.feed_id.trim().is_empty() || query.source.trim().is_empty() {
         return error(
@@ -1414,8 +1445,8 @@ async fn import_opencti_document(
     Query(query): Query<OpenCtiImportQuery>,
     body: Bytes,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     if query.feed_id.trim().is_empty() || query.source.trim().is_empty() {
         return error(
@@ -1526,8 +1557,8 @@ async fn poll_taxii_collection(
     headers: HeaderMap,
     Json(request): Json<TaxiiPollRequest>,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     if request.feed_id.trim().is_empty() || request.source.trim().is_empty() {
         return error(
@@ -1710,8 +1741,8 @@ async fn import_suricata_eve(
     headers: HeaderMap,
     body: Bytes,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     let body_text = match std::str::from_utf8(&body) {
         Ok(text) => text,
@@ -1813,8 +1844,8 @@ async fn import_coraza_audit(
     headers: HeaderMap,
     body: Bytes,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     let body_text = match std::str::from_utf8(&body) {
         Ok(text) => text,
@@ -1979,8 +2010,8 @@ async fn import_phishing_database_feed(
     headers: HeaderMap,
     Json(request): Json<PhishingDatabaseImportRequest>,
 ) -> Response {
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     if let Err(message) = validate_phishing_database_import_request(&request) {
         return error(StatusCode::BAD_REQUEST, message);
@@ -2112,8 +2143,8 @@ async fn import_kev_feed(
             "KEV import requires a configured write-capable admin credential",
         );
     }
-    if !admin_authorized(&state, &headers) {
-        return error(StatusCode::UNAUTHORIZED, "missing or invalid X-Admin-Token");
+    if let Some(denied) = reject_management_write(&state, &headers) {
+        return denied;
     }
     if let Err(message) = validate_kev_import_request(&request) {
         return error(StatusCode::BAD_REQUEST, message);
@@ -2559,41 +2590,65 @@ pub struct AdminPrincipal {
     pub can_write: bool,
 }
 
+fn presented_admin_token(headers: &HeaderMap) -> Option<&str> {
+    headers
+        .get("x-admin-token")
+        .and_then(|value| value.to_str().ok())
+}
+
+/// Scan every configured RBAC secret with constant-time compare so a miss does
+/// not return early and leak which token slot matched.
+fn matching_rbac_principal<'a>(state: &'a AppState, presented: &str) -> Option<&'a AdminPrincipal> {
+    let mut found = None;
+    for (token, principal) in &state.admin_tokens {
+        if credentials::constant_time_eq(token.as_bytes(), presented.as_bytes()) {
+            found = Some(principal);
+        }
+    }
+    found
+}
+
 /// True when the request presents a valid admin credential (write or readonly).
-/// When no admin credentials are configured, returns true (auth disabled).
+/// When no admin credentials are configured (loopback development), returns true.
 fn admin_authenticated(state: &AppState, headers: &HeaderMap) -> bool {
-    let presented = headers
-        .get("x-admin-token")
-        .and_then(|value| value.to_str().ok());
     if !state.admin_tokens.is_empty() {
-        return presented.is_some_and(|token| state.admin_tokens.contains_key(token));
+        return presented_admin_token(headers)
+            .is_some_and(|token| matching_rbac_principal(state, token).is_some());
     }
     let Some(expected) = state.admin_token.as_deref() else {
         return true;
     };
-    presented.is_some_and(|actual| actual == expected)
+    presented_admin_token(headers)
+        .is_some_and(|actual| credentials::constant_time_eq(expected.as_bytes(), actual.as_bytes()))
 }
 
 /// True when the request may perform management **writes**.
 /// Readonly RBAC tokens authenticate but cannot write.
 fn admin_authorized(state: &AppState, headers: &HeaderMap) -> bool {
-    let presented = headers
-        .get("x-admin-token")
-        .and_then(|value| value.to_str().ok());
-    // RBAC tokens take precedence when configured.
     if !state.admin_tokens.is_empty() {
-        return presented.is_some_and(|token| {
-            state
-                .admin_tokens
-                .get(token)
-                .is_some_and(|principal| principal.can_write)
+        return presented_admin_token(headers).is_some_and(|token| {
+            matching_rbac_principal(state, token).is_some_and(|principal| principal.can_write)
         });
     }
-    // Fallback: single shared token (None means auth is disabled).
     let Some(expected) = state.admin_token.as_deref() else {
         return true;
     };
-    presented.is_some_and(|actual| actual == expected)
+    presented_admin_token(headers)
+        .is_some_and(|actual| credentials::constant_time_eq(expected.as_bytes(), actual.as_bytes()))
+}
+
+/// 401 when the caller is not authenticated; 403 when authenticated but not
+/// permitted to write. Same body either way so the expected role is not leaked.
+fn reject_management_write(state: &AppState, headers: &HeaderMap) -> Option<Response> {
+    if admin_authorized(state, headers) {
+        return None;
+    }
+    let status = if admin_authenticated(state, headers) {
+        StatusCode::FORBIDDEN
+    } else {
+        StatusCode::UNAUTHORIZED
+    };
+    Some(error(status, "missing or invalid X-Admin-Token"))
 }
 
 fn has_write_admin_credential(state: &AppState) -> bool {
@@ -2668,6 +2723,53 @@ pub fn parse_admin_tokens(raw: &str) -> HashMap<String, AdminPrincipal> {
         .collect()
 }
 
+/// Startup parser for `ADMIN_TOKENS`. Rejects blank tokens, duplicates, and
+/// unknown role labels so an ambiguous registry cannot become ready.
+pub fn parse_admin_tokens_strict(raw: &str) -> Result<HashMap<String, AdminPrincipal>, String> {
+    let mut map = HashMap::new();
+    for item in raw.split(',') {
+        let item = item.trim();
+        if item.is_empty() {
+            return Err(
+                "ADMIN_TOKENS contains a blank entry; remove repeated, leading, or trailing commas"
+                    .to_string(),
+            );
+        }
+        let mut parts = item.splitn(3, ':').map(str::trim);
+        let token = parts.next().unwrap_or("");
+        if token.is_empty() {
+            return Err(
+                "ADMIN_TOKENS contains a blank token; remove the empty entry or supply a secret"
+                    .to_string(),
+            );
+        }
+        if map.contains_key(token) {
+            return Err(
+                "ADMIN_TOKENS contains a duplicate token; each secret must map to one principal"
+                    .to_string(),
+            );
+        }
+        let actor_raw = parts.next().unwrap_or("");
+        let role_raw = parts.next().unwrap_or("");
+        let actor = if actor_raw.is_empty() {
+            "admin".to_string()
+        } else {
+            actor_raw.to_string()
+        };
+        let can_write = match role_raw.to_ascii_lowercase().as_str() {
+            "" | "admin" | "write" | "writer" | "operator" => true,
+            "readonly" | "read" | "reader" | "ro" => false,
+            other => {
+                return Err(format!(
+                    "ADMIN_TOKENS role {other:?} is not recognised; use admin, write, or readonly"
+                ));
+            }
+        };
+        map.insert(token.to_string(), AdminPrincipal { actor, can_write });
+    }
+    Ok(map)
+}
+
 fn record_successful_audit_log(
     data: &mut AppData,
     actor: String,
@@ -3291,7 +3393,10 @@ pub async fn run_from_env(
         admin_token: credentials
             .get_credential(CRED_ADMIN_TOKEN)
             .map(str::to_owned),
-        state_path: std::env::var("WAF_IDS_STATE_PATH").ok().map(PathBuf::from),
+        state_path: std::env::var("WAF_IDS_STATE_PATH")
+            .ok()
+            .filter(|path| !path.trim().is_empty())
+            .map(PathBuf::from),
         dnsbl_origin: std::env::var("DNSBL_ORIGIN")
             .unwrap_or_else(|_| AppConfig::DEFAULT_DNSBL_ORIGIN.to_string()),
         event_limit: parse_event_limit(std::env::var("EVENT_LIMIT").ok().as_deref())?,
@@ -3302,11 +3407,24 @@ pub async fn run_from_env(
         std::env::var("RATE_LIMIT_WINDOW").ok().as_deref(),
         60,
     )?;
-    let admin_tokens = parse_admin_tokens(
+    let admin_tokens = match credentials.get_credential(CRED_ADMIN_TOKENS) {
+        Some(raw) if !raw.trim().is_empty() => parse_admin_tokens_strict(raw)?,
+        _ => HashMap::new(),
+    };
+    if !admin_tokens.is_empty() && !admin_tokens.values().any(|principal| principal.can_write) {
+        return Err(
+            "ADMIN_TOKENS does not contain a write-capable principal; add an admin/write role"
+                .into(),
+        );
+    }
+    let has_write_capable_admin = if !admin_tokens.is_empty() {
+        true
+    } else {
         credentials
-            .get_credential(CRED_ADMIN_TOKENS)
-            .unwrap_or_default(),
-    );
+            .get_credential(CRED_ADMIN_TOKEN)
+            .is_some_and(|token| !token.is_empty())
+    };
+    require_write_auth_for_bind(&bind_addr, has_write_capable_admin)?;
     let max_body_bytes = parse_u64_env(
         "MAX_BODY_BYTES",
         std::env::var("MAX_BODY_BYTES").ok().as_deref(),
@@ -3314,17 +3432,23 @@ pub async fn run_from_env(
     )? as usize;
     let listener = tokio::net::TcpListener::bind(&bind_addr).await?;
     let local_addr = listener.local_addr()?;
-    println!("waf-ids-ai-soc listening on http://{local_addr}");
-    // Flush so a supervising parent process (the e2e test) sees the readiness
-    // line immediately even though stdout is block-buffered when piped.
-    std::io::Write::flush(&mut std::io::stdout())?;
     let state = AppState::load(config)
         .await
         .map_err(|message| std::io::Error::new(std::io::ErrorKind::InvalidData, message))?
         .with_rate_limit(rate_limit, rate_limit_window)
         .with_admin_tokens(admin_tokens)
         .with_credentials_source(credentials.source())
+        .with_listen_loopback(listen_is_loopback_only(&bind_addr))
         .with_max_body_size(max_body_bytes);
+    let auth_mode = if listen_is_loopback_only(&bind_addr) && !has_write_capable_admin {
+        "development"
+    } else {
+        "production"
+    };
+    println!("waf-ids-ai-soc listening on http://{local_addr} auth_mode={auth_mode}");
+    // Flush so a supervising parent process (the e2e test) sees the readiness
+    // line immediately even though stdout is block-buffered when piped.
+    std::io::Write::flush(&mut std::io::stdout())?;
     let served = axum::serve(listener, build_app(state))
         .with_graceful_shutdown(shutdown)
         .await;
@@ -3490,7 +3614,7 @@ mod tests {
             std::env::set_var("BIND_ADDR", "127.0.0.1:0");
             std::env::set_var("WAF_IDS_STATE_PATH", path.to_str().unwrap());
         }
-        // Bind succeeds, but loading corrupt persisted state maps to an error.
+        // Corrupt persisted state fails closed before the listener binds.
         assert!(
             run_from_env(Box::pin(std::future::ready(())))
                 .await
@@ -3500,6 +3624,73 @@ mod tests {
         std::fs::remove_file(&path).ok();
     }
 
+    #[tokio::test]
+    async fn run_from_env_fail_closes_non_loopback_without_admin() {
+        let _guard = ENV_GUARD.lock().await;
+        clear_run_env();
+        unsafe {
+            std::env::set_var("BIND_ADDR", "0.0.0.0:0");
+        }
+        let err = run_from_env(Box::pin(std::future::ready(())))
+            .await
+            .unwrap_err()
+            .to_string();
+        assert!(
+            err.contains("refusing to bind 0.0.0.0:0"),
+            "startup must fail closed before readiness: {err}"
+        );
+        clear_run_env();
+    }
+
+    #[tokio::test]
+    async fn run_from_env_does_not_rewrite_state_when_bind_fails() {
+        let _guard = ENV_GUARD.lock().await;
+        clear_run_env();
+        let occupied = StdTcpListener::bind("127.0.0.1:0").unwrap();
+        let addr = occupied.local_addr().unwrap();
+        let path = std::env::temp_dir().join(format!(
+            "wardnet-bind-fail-state-{}-{}.json",
+            std::process::id(),
+            now_unix()
+        ));
+        let seeded = serde_json::to_string(&AppData::seeded()).unwrap();
+        std::fs::write(&path, &seeded).unwrap();
+
+        unsafe {
+            std::env::set_var("BIND_ADDR", addr.to_string());
+            std::env::set_var("WAF_IDS_STATE_PATH", path.to_str().unwrap());
+            std::env::set_var("ADMIN_TOKEN", "startup-secret");
+        }
+        let err = run_from_env(Box::pin(std::future::ready(())))
+            .await
+            .unwrap_err()
+            .to_string();
+        assert!(
+            err.to_ascii_lowercase().contains("address already in use"),
+            "bind failure should surface before state load: {err}"
+        );
+        let after = std::fs::read_to_string(&path).unwrap();
+        assert_eq!(after, seeded, "bind failure must not rewrite state");
+
+        clear_run_env();
+        drop(occupied);
+        std::fs::remove_file(&path).ok();
+    }
+
+    #[tokio::test]
+    async fn run_from_env_allows_non_loopback_when_admin_token_is_set() {
+        let _guard = ENV_GUARD.lock().await;
+        clear_run_env();
+        unsafe {
+            std::env::set_var("BIND_ADDR", "0.0.0.0:0");
+            std::env::set_var("ADMIN_TOKEN", "startup-secret");
+        }
+        run_from_env(Box::pin(std::future::ready(())))
+            .await
+            .unwrap();
+        clear_run_env();
+    }
+
     #[tokio::test]
     async fn run_from_env_ignores_kev_catalog_url_env_override() {
         let _guard = ENV_GUARD.lock().await;
@@ -3517,6 +3708,40 @@ mod tests {
         clear_run_env();
     }
 
+    #[tokio::test]
+    async fn run_from_env_treats_blank_state_path_as_memory() {
+        let _guard = ENV_GUARD.lock().await;
+        clear_run_env();
+        unsafe {
+            std::env::set_var("BIND_ADDR", "127.0.0.1:0");
+            std::env::set_var("WAF_IDS_STATE_PATH", "   ");
+            std::env::set_var("ADMIN_TOKEN", "startup-secret");
+        }
+        run_from_env(Box::pin(std::future::ready(())))
+            .await
+            .unwrap();
+        clear_run_env();
+    }
+
+    #[tokio::test]
+    async fn run_from_env_fail_closes_when_admin_tokens_are_readonly_only() {
+        let _guard = ENV_GUARD.lock().await;
+        clear_run_env();
+        unsafe {
+            std::env::set_var("BIND_ADDR", "127.0.0.1:0");
+            std::env::set_var("ADMIN_TOKENS", "tokR:reader:readonly");
+        }
+        let err = run_from_env(Box::pin(std::future::ready(())))
+            .await
+            .unwrap_err()
+            .to_string();
+        assert!(
+            err.contains("does not contain a write-capable principal"),
+            "readonly-only ADMIN_TOKENS must fail closed: {err}"
+        );
+        clear_run_env();
+    }
+
     fn route() -> RouteConfig {
         RouteConfig {
             id: "api".to_string(),
@@ -3799,7 +4024,7 @@ mod tests {
             ),
         )
         .await;
-        assert_eq!(denied.status(), StatusCode::UNAUTHORIZED);
+        assert_eq!(denied.status(), StatusCode::FORBIDDEN);
 
         let created = app_request(
             &app,
@@ -4340,6 +4565,8 @@ mod tests {
             json_body(app_request(&app, empty_request(Method::GET, "/healthz")).await).await;
         assert_eq!(health.persistence, "file");
         assert_eq!(health.dnsbl_origin, "dnsbl.example");
+        assert_eq!(health.auth_mode, "production");
+        assert!(health.admin_auth_configured);
 
         let block_route = RouteConfig {
             id: "secure".to_string(),
@@ -5066,6 +5293,23 @@ mod tests {
         .await;
         assert_eq!(unauthorized.status(), StatusCode::UNAUTHORIZED);
 
+        let readonly = build_app(
+            AppState::seeded(None)
+                .with_admin_tokens(parse_admin_tokens("tokW:writer,tokR:reader:readonly"))
+                .with_kev_catalog_url(format!("http://{addr}/kev.json")),
+        );
+        let forbidden = app_request(
+            &readonly,
+            json_request(
+                Method::POST,
+                "/api/threat-intel/cisa-kev",
+                Some("tokR"),
+                &payload,
+            ),
+        )
+        .await;
+        assert_eq!(forbidden.status(), StatusCode::FORBIDDEN);
+
         let invalid_request = KevImportRequest {
             ttl_seconds: 0,
             ..payload.clone()
@@ -7635,6 +7879,7 @@ mod tests {
                 event_limit: 25,
                 credentials_source: "none".to_string(),
                 admin_auth_configured: false,
+                auth_mode: "development".to_string(),
             }
         );
 
@@ -7645,6 +7890,22 @@ mod tests {
         let health = authed.health_status();
         assert_eq!(health.credentials_source, "file");
         assert!(health.admin_auth_configured);
+        assert_eq!(health.auth_mode, "production");
+    }
+
+    #[test]
+    fn parse_admin_tokens_strict_rejects_duplicates_and_unknown_roles() {
+        let map = parse_admin_tokens_strict("tokA:alice,tokR:reader:readonly").unwrap();
+        assert!(map.get("tokA").is_some_and(|p| p.can_write));
+        assert!(map.get("tokR").is_some_and(|p| !p.can_write));
+        let dup = parse_admin_tokens_strict("tokA:alice,tokA:bob").unwrap_err();
+        assert!(dup.contains("duplicate token"), "{dup}");
+        let role = parse_admin_tokens_strict("tokA:alice:superuser").unwrap_err();
+        assert!(role.contains("not recognised"), "{role}");
+        let blank = parse_admin_tokens_strict(":noname").unwrap_err();
+        assert!(blank.contains("blank token"), "{blank}");
+        let blank_entry = parse_admin_tokens_strict("tokA:alice,,tokB:bob").unwrap_err();
+        assert!(blank_entry.contains("blank entry"), "{blank_entry}");
     }
 
     fn clearfolio_test_config(base_url: &str) -> ClearfolioConfig {
diff --git a/tests/binary.rs b/tests/binary.rs
index ea49034f..bc4ca0a8 100644
--- a/tests/binary.rs
+++ b/tests/binary.rs
@@ -40,9 +40,80 @@ fn binary_serves_until_force_stopped_on_windows() {
     );
 }
 
+#[test]
+fn binary_fail_closes_non_loopback_listen_without_admin() {
+    let output = Command::new(env!("CARGO_BIN_EXE_waf-ids-ai-soc"))
+        .env("BIND_ADDR", "0.0.0.0:0")
+        .env_remove("ADMIN_TOKEN")
+        .env_remove("ADMIN_TOKENS")
+        .env_remove("WAF_IDS_CREDENTIALS_PATH")
+        .env_remove("WAF_IDS_STATE_PATH")
+        .output()
+        .expect("spawn gateway binary for fail-closed check");
+    assert!(
+        !output.status.success(),
+        "public bind without credentials must exit non-zero: {:?}",
+        output.status
+    );
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let combined = format!("{stdout}{stderr}");
+    assert!(
+        combined.contains("refusing to bind 0.0.0.0:0"),
+        "operator error must name the refused address:\n{combined}"
+    );
+    assert!(
+        !combined.contains("waf-ids-ai-soc listening on"),
+        "process must not print readiness after fail-closed startup:\n{combined}"
+    );
+}
+
+#[test]
+fn binary_does_not_report_readiness_before_state_validation() {
+    let state_path = std::env::temp_dir().join(format!(
+        "wardnet-corrupt-state-{}-{}.json",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .expect("clock after epoch")
+            .as_nanos()
+    ));
+    std::fs::write(&state_path, "not-json").expect("write corrupt state fixture");
+
+    let output = Command::new(env!("CARGO_BIN_EXE_waf-ids-ai-soc"))
+        .env("BIND_ADDR", "127.0.0.1:0")
+        .env("WAF_IDS_STATE_PATH", &state_path)
+        .env_remove("ADMIN_TOKEN")
+        .env_remove("ADMIN_TOKENS")
+        .env_remove("WAF_IDS_CREDENTIALS_PATH")
+        .output()
+        .expect("spawn gateway binary for startup validation check");
+    let _ = std::fs::remove_file(&state_path);
+
+    assert!(
+        !output.status.success(),
+        "corrupt state must fail startup: {:?}",
+        output.status
+    );
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let combined = format!("{stdout}{stderr}");
+    assert!(
+        combined.contains("is not valid JSON"),
+        "startup error should explain the invalid state file:\n{combined}"
+    );
+    assert!(
+        !combined.contains("waf-ids-ai-soc listening on"),
+        "readiness must not be reported until persisted state validates:\n{combined}"
+    );
+}
+
 fn spawn_ready_gateway() -> Child {
     let mut child = Command::new(env!("CARGO_BIN_EXE_waf-ids-ai-soc"))
         .env("BIND_ADDR", "127.0.0.1:0")
+        .env_remove("ADMIN_TOKEN")
+        .env_remove("ADMIN_TOKENS")
+        .env_remove("WAF_IDS_CREDENTIALS_PATH")
         .env_remove("WAF_IDS_STATE_PATH")
         .env_remove("EVENT_LIMIT")
         .env_remove("RATE_LIMIT")
@@ -58,7 +129,7 @@ fn spawn_ready_gateway() -> Child {
     let mut line = String::new();
     reader.read_line(&mut line).expect("read readiness line");
     assert!(
-        line.contains("listening on"),
+        line.contains("waf-ids-ai-soc listening on"),
         "unexpected startup line: {line:?}"
     );
     child
diff --git a/tests/fuzz_invariants.rs b/tests/fuzz_invariants.rs
index 746fc3cb..3f078794 100644
--- a/tests/fuzz_invariants.rs
+++ b/tests/fuzz_invariants.rs
@@ -6,7 +6,7 @@
 //! actor value.
 
 use proptest::prelude::*;
-use waf_ids_ai_soc::parse_admin_tokens;
+use waf_ids_ai_soc::{parse_admin_tokens, parse_credentials_json};
 
 proptest! {
     #[test]
@@ -17,4 +17,27 @@ proptest! {
             prop_assert!(!principal.actor.is_empty(), "actor value must never be empty");
         }
     }
+
+
+    #[test]
+    fn credentials_json_preserves_nonblank_values(raw in ".*") {
+        if let Ok(credentials) = parse_credentials_json(&raw) {
+            for value in credentials.values() {
+                prop_assert!(!value.trim().is_empty(), "credential value must never be blank");
+            }
+        }
+    }
+}
+
+#[test]
+fn present_blank_and_null_credentials_are_rejected() {
+    assert!(parse_credentials_json(r#"{"admin_token":"   "}"#).is_err());
+    assert!(parse_credentials_json(r#"{"admin_token":null}"#).is_err());
+    assert_eq!(
+        parse_credentials_json(r#"{"admin_token":7}"#)
+            .unwrap()
+            .get("admin_token")
+            .map(String::as_str),
+        Some("7")
+    );
 }