Feat/hcg smoke unknown path canary#239
Closed
hyperpolymath wants to merge 5 commits into
Closed
Conversation
… (Phase E)
Adds one new probe to `scripts/hcg-policy-smoke.sh` so the §1.5 operator
pre-check isolates the no-match → default-deny branch of the gateway's
three-tier lookup (exact → regex → global) at the `{:error, :no_match}`
clause in `http-capability-gateway/lib/http_capability_gateway/gateway.ex`.
Before this PR the smoke script's verb-canary block covered six
unknown-method regressions (DELETE/PUT/PATCH on listed exact paths,
OPTIONS on a listed path, DELETE on a regex-matched route, GET on a
POST-only public route). All six exercise a known path with a verb
outside `global_verbs`. None of them exercises the symmetric pathway: a
verb that *is* in `global_verbs` against a path that has no matching
rule at all. That branch is independently possible to break (a regression
in the global-fallback handling alone would leak there without
triggering any of the existing canaries) so the operator pre-check now
fails closed on both classes.
The new probe targets `GET /__phase-e-canary-unknown-path__` — a
synthetic path that cannot collide with any real route in
`config/gateway-policy-boj.yaml` or any future addition (the prefix is
reserved for this probe by the comment in the script). GET is in
`global_verbs`, so the only way this can default-deny is the no-match
branch.
Runbook §1.5 prose updated to describe the new canary alongside the
existing verb canaries; version bumped 0.5 → 0.6. The §1.5 checkbox
itself stays open — it requires the operator to actually run the script
against staging, which is unchanged.
`bash -n scripts/hcg-policy-smoke.sh` passes. No Elixir / Idris / CI
workflow files touched.
Refs hyperpolymath/standards#91
Refs hyperpolymath/standards#100
(Per rollout runbook §6.5 — single-lane channel discipline — this PR
deliberately does NOT `Closes #100`. Phase E close is owner-driven and
gated on §3.3 (100% soak), §6.4 (Trustfile flip), and cerro-torre
`.ctp` signing. Each Phase E sub-task PR is a `Refs`-only advance.)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Owner
Author
|
Closing as superseded by current main: the HCG unknown-path canary and runbook update are present, and the bridge boot/runtime fixes from this branch have also landed. Main additionally preserves the newer workflow wrapper pins and stealth-profile canary work, so merging this older branch would regress CI/workflow state. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes
RSR Quality Checklist
Required
just testor equivalent)just fmtor equivalent)unsafeblocks without// SAFETY:commentsbelieve_me,unsafeCoerce,Obj.magic,Admitted,sorry).envfiles includedAs Applicable
.machine_readable/STATE.a2mlupdated (if project state changed).machine_readable/ECOSYSTEM.a2mlupdated (if integrations changed).machine_readable/META.a2mlupdated (if architectural decisions changed)TOPOLOGY.mdupdated (if architecture changed)CHANGELOGor release notes updatedsrc/abi/andffi/zig/consistent)Testing
Screenshots