shankar0123 6d0f7747df fix(compose): set CERTCTL_DEMO_MODE_ACK=true in demo compose (cold-DB smoke fix) ...

The cold-db-compose-smoke job (Auditable Codebase Bundle item 6) fired
on first run and surfaced a real bug: certctl-server fail-fasts at
startup with:

  Failed to load configuration: CERTCTL_AUTH_TYPE=none with non-loopback
  CERTCTL_SERVER_HOST="0.0.0.0" requires CERTCTL_DEMO_MODE_ACK=true to
  acknowledge that every request will be served as the synthetic admin
  actor `actor-demo-anon`.

Root cause: the 2026-05-10 HIGH-12 closure (Fix 11) added the
fail-fast guard in internal/config/config.go::Validate() but did NOT
update deploy/docker-compose.yml to provide the explicit ACK. The
clean default compose IS the bundled demo path
(CERTCTL_AUTH_TYPE=none + KEYGEN_MODE=server + DEMO_SEED=true per the
inline comments on lines 137-143), so the ACK is correct here by
design.

Latent in master since the HIGH-12 fix landed. Nobody hit it because
warm containers + warm DBs masked the boot-time validation. The
cold-DB compose smoke caught it on the first true cold-boot run —
exactly the bug class it was built for.

Fix:
  - Add CERTCTL_DEMO_MODE_ACK: "true" to the certctl-server env block
    in deploy/docker-compose.yml.
  - Add a head-comment explaining why the ACK is correct in this
    compose (it IS the demo path) and that production deploys override
    AUTH_TYPE + KEYGEN_MODE + DEMO_SEED + DEMO_MODE_ACK via their own
    compose.

Verified:
  - YAML parse clean.
  - scripts/ci-guards/complete-path-config-coverage.sh green (194
    env vars; new CERTCTL_DEMO_MODE_ACK reference in deploy/ counts
    as a consumer).

Audit-Closes: post-v2.1.0-anti-rot/item-6
Audit-Closes: audit-2026-05-10/HIGH-12-followon

2026-05-12 14:58:16 +00:00

..

helm

auth-bundle-2 Phase 0: dependency-add + oidc auth-type literal + runtime guard

2026-05-10 03:31:51 +00:00

test

chore(security): bump Go toolchain 1.25.9 -> 1.25.10 + golang.org/x/net 0.49 -> 0.53

2026-05-09 21:35:46 -04:00

.env.example

fix: externalize credentials and add agent key volume persistence

2026-03-20 01:20:27 -04:00

docker-compose.demo.yml

fix(deploy,db,handler): close fresh-clone postgres init failure + 4 ride-along audit findings (U-3 master)

2026-04-25 13:29:23 +00:00

docker-compose.dev.yml

build: propagate HTTP_PROXY/HTTPS_PROXY/NO_PROXY through Docker build (M-4, Issue #9)

2026-04-17 03:12:45 +00:00

docker-compose.test.yml

fix(deploy/test) + ci(guard): drop dead SCEP profile from test compose

2026-05-01 01:39:18 +00:00

docker-compose.yml

fix(compose): set CERTCTL_DEMO_MODE_ACK=true in demo compose (cold-DB smoke fix)

2026-05-12 14:58:16 +00:00

ENVIRONMENTS.md

docs: fix broken single-file demo invocation in README + qa-prerequisites + ENVIRONMENTS

2026-05-05 20:55:26 +00:00