mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 15:11:29 +00:00
shankar0123
155f1fec98
Closure commit for Phase 13 (ARCH-H1 OpenAPI ↔ handler gap + ARCH-M1 per-process rate-limit ceiling). Tightens the parity-script CI guard to a HARD zero-exact pin on the rest-deferred bucket: any future PR adding a new REST route MUST author its OpenAPI op or fail CI. The `category: rest-deferred` escape hatch is now closed for good. The sibling monotonic-decrease guard (openapi-rest-deferred- monotonic.sh) stays in tree as belt-and-suspenders — both must hold. The monotonic guard catches baseline-drift accidents (operator edits the baseline up without surfacing rationale); this guard catches the underlying rest-deferred bucket re-growing at all. Phase 13 commit chain (six prior commits, ordered):67f346cdSprint 13.1 — two-bucket exception categorization + monotonic guard (rest-deferred=28 baseline, wire-protocol=36, fail-on-drift)c8347d74Sprint 13.2 — ARCH-M1 Postgres sliding-window limiter (SELECT FOR UPDATE arbitration) + migration 000046 rate_limit_buckets + falsifiable multi-replica integration test (TestRateLimit_PostgresBackend_CapEnforced AcrossReplicas: 100 concurrent allows across 3 limiters cap=10 → exactly 10 succeed / 90 ErrRateLimited)a41fc2d7Sprint 13.3 — backend selector (CERTCTL_RATE_LIMIT_BACKEND={memory|postgres}) + scheduler janitor sweeping updated_at<NOW()-maxWindow + helm chart wiring + docs/operator/observability.md operator decision tree952682ebSprint 13.4 — OpenAPI authoring batch 1 (13 ops + 8 schemas: sessions cluster + OIDC CRUD + JWKS + test + refresh + group-mappings). rest-deferred 28 → 15.9135c449Sprint 13.5 — OpenAPI authoring batch 2 (8 ops + 5 schemas: breakglass admin + users + runtime -config). rest-deferred 15 → 7.29cb13e7Sprint 13.6 — OpenAPI authoring batch 3 final 7 ops + 2 schemas (audit/export + demo-residual + auth/logout + breakglass/login + 3 OIDC browser flows modeled as 302+Location). rest-deferred 7 → 0. ARCH-H1 substantive close. Sprint 13.7 deliverables (this commit): • scripts/ci-guards/openapi-handler-parity.sh: append inline hard zero-exact check after the bucket-counts report. Fails CI immediately on any rest-deferred entry, enumerating offenders with the suggested-fix narrative. • Header docstring updated to reflect post-Sprint-13.7 state: 220 router routes 186 OpenAPI operations 36 documented exceptions (36 wire-protocol + 0 rest-deferred) 0 unaccounted router routes Falsifiable closure proofs (re-run in CI on every PR): $ bash scripts/ci-guards/openapi-handler-parity.sh Router routes: 220 OpenAPI operations: 186 Documented exceptions: 36 wire-protocol: 36 rest-deferred: 0 openapi-handler-parity: clean. $ bash scripts/ci-guards/openapi-rest-deferred-monotonic.sh openapi-rest-deferred-monotonic: clean — rest-deferred = 0, baseline = 0. $ cat api/openapi-handler-exceptions-baseline.txt 0 Negative test (synthetic rest-deferred entry, restored after): $ # append GET /scep with category: rest-deferred … $ bash scripts/ci-guards/openapi-handler-parity.sh ::error::rest-deferred bucket is non-empty (1 entries) — Phase 13 Sprint 13.7 closure pins this at zero. Offending entries: GET /scep exit 1 ← guard fails correctly $ gofmt -l . (no output — clean) Findings flipped to ✓ Shipped in cowork/certctl-architecture-diligence-audit.html: • ARCH-H1 — OpenAPI surface diverges from REST handlers (commit chain67f346cd+952682eb+9135c449+29cb13e7) • ARCH-M1 — Per-process rate limiter caps single instance only (commit chainc8347d74+a41fc2d7) Progress widget: 46 / 56 findings shipped (82%) + 2 scaffolded. The remaining 8 open findings are v3-scope strategic items (multi-tenancy, EAB/External Account Binding, cluster coordination primitives) — explicitly out of v2.2 scope per audit triage. OPERATOR ACTION REQUIRED (one toggle, no code change): Promote TestRateLimit_PostgresBackend_CapEnforcedAcrossReplicas in deploy/test/integration_test.go to a required status check in GitHub branch-protection settings for master. Code-side wiring (.github/workflows/ci.yml) is done; the missing piece is the GitHub Settings → Branches → Branch protection rules toggle. Without that toggle, the test runs on every PR but isn't gating. After flipping the toggle, ARCH-M1 closure is fully load-bearing at the CI gate — a regression in the Postgres sliding-window backend (e.g. a future refactor that breaks SELECT FOR UPDATE arbitration) cannot reach master.
scripts/ci-guards/ — Regression-guard scripts
Each <id>.sh script in this directory pins one closed audit finding from
regressing. CI runs the full set on every push via the
Regression guards step in .github/workflows/ci.yml. Operators can
run any script locally:
bash scripts/ci-guards/G-3-env-docs-drift.sh
Contract
Every script in this directory MUST:
- Be exit-code 0 on a clean repo (no regression present).
- Be exit-code non-zero on regression, with a
::error::annotation prefix so PR reviewers see the failing line in the GitHub Actions UI. - Be runnable from repo root via
bash scripts/ci-guards/<id>.shwith NO arguments and NO env-var requirements. The CI loop step (for g in scripts/ci-guards/*.sh; do bash "$g"; done) iterates every.shhere without args; any script that requires an arg or env var WILL fail in that loop. - Carry a head-comment block matching the in-source justification from the original ci.yml entry: the audit-finding reference, the closure rationale, the exempt-surface list (if any).
- Use
set -eearly to fail-fast on internal command errors. - Produce no output on the happy path beyond a final
echo "<id>: clean."confirmation line.
Helpers vs guards
Scripts that consume input artifacts (a test-output log, a
coverage.out file) or env vars (PR_NUMBER, GH_TOKEN) are
HELPERS, not guards. They live in scripts/, NOT scripts/ci-guards/.
Current helpers:
scripts/vendor-e2e-skip-check.sh— consumestest-output.logarg from the deploy-vendor-e2e jobscripts/coverage-pr-comment.sh— consumescoverage.out+PR_NUMBER+GH_TOKENenv from the go-build-and-test jobscripts/check-coverage-thresholds.sh— consumescoverage.out.github/coverage-thresholds.yml
Adding a new guard
- Drop a new
<id>.shin this directory with the head-comment block describing the audit finding it closes. - Make it executable:
chmod +x scripts/ci-guards/<id>.sh. - Verify it fails on a deliberate regression and passes on clean repo.
- CI auto-picks up new scripts via the
for g in scripts/ci-guards/*.shloop in theRegression guardsstep — no ci.yml change required.
Guards in this directory
Count: re-derive on demand via ls scripts/ci-guards/*.sh | wc -l. The table below names each one — keep it in sync as guards are added.
Per-finding regression guards
| ID | Finding | Catches |
|---|---|---|
G-1-jwt-auth-literal |
G-1 JWT silent auth downgrade | "jwt" literal in additive auth-type surfaces |
L-001-insecure-skip-verify |
L-001 unjustified InsecureSkipVerify | InsecureSkipVerify: true without //nolint:gosec |
H-001-bare-from |
H-001 (CWE-829) tag-swap attack | Bare FROM line without @sha256 digest pin |
M-012-no-root-user |
M-012 (CWE-250) container-as-root | Dockerfile missing terminal USER <non-root> |
H-009-readme-jwt |
H-009 README JWT advertising | README.md re-introducing JWT-as-supported claim |
G-2-api-key-hash-json |
G-2 cat-s5-apikey_leak | api_key_hash in JSON-emitting surface |
U-2-plaintext-healthcheck |
U-2 healthcheck protocol mismatch | Plaintext http:// in HEALTHCHECK directive |
U-3-migration-mount |
U-3 seed initdb schema drift | Migration file mounted into postgres initdb |
D-1-D-2-statusbadge-phantom |
D-1 + D-2 dead keys + TS phantoms | StatusBadge dead keys + 5 Certificate / 5 Agent / 1 Issuer / 1 Notification phantom fields |
L-1-bulk-action-loop |
L-1 client-side bulk loops | for ... await triggerRenewal/updateCertificate in CertificatesPage |
B-1-orphan-crud |
B-1 orphan-CRUD client fns | 8 update/create/delete fns lose their page consumer |
S-2-strings-contains-err |
S-2 brittle error-dispatch | strings.Contains(err.Error(), "not found"|"violates foreign key") in handlers |
G-3-env-docs-drift |
G-3 env-var docs drift | CERTCTL_* env var defined OR documented but not both |
test-naming-convention |
I-001-extended | func TestXxx (lowercase first letter) — Go silently skips |
S-1-hardcoded-source-counts |
S-1 stale numeric prose | Hardcoded "N issuer connectors" / "N MCP tools" in README + docs |
P-1-documented-orphan-fns |
P-1 documented orphans | 16 read-fn names removed from client.ts exports |
T-1-frontend-page-coverage |
T-1 untested frontend pages | New page in web/src/pages/ without sibling .test.tsx and not on the deferred allowlist |
bundle-8-L-015-target-blank-rel-noopener |
L-015 (CWE-1022) reverse-tabnabbing | target="_blank" without rel="noopener noreferrer" |
bundle-8-L-019-dangerously-set-inner-html |
L-019 (CWE-79) XSS | dangerouslySetInnerHTML outside safeHtml.ts |
bundle-8-M-009-bare-usemutation |
M-009 + M-029 mutation contract | Bare useMutation() outside useTrackedMutation wrapper |
H-1-encryption-key-min-length |
H-1 closure follow-up (post-Phase-5 surfacing) | CERTCTL_CONFIG_ENCRYPTION_KEY literal in any deploy/docker-compose*.yml shorter than the 32-byte floor enforced by internal/config/config.go::Validate() |
test-compose-scep-coherence |
post-Phase-5 surfacing of dead SCEP test config | CERTCTL_SCEP_ENABLED=true in test compose without (a) a CI job that runs the SCEP integration test, (b) the ra.crt + ra.key + intune_trust_anchor.pem fixtures committed to deploy/test/fixtures/, AND (c) the matching volume mount |
openapi-handler-parity |
ARCH-H1 OpenAPI ↔ handler drift | Router routes vs OpenAPI operations vs documented exceptions (wire-protocol vs rest-deferred buckets). Supports --bucket=wire-protocol|rest-deferred subcommand for sibling guards. |
openapi-rest-deferred-monotonic |
ARCH-H1 Phase 13 Sprint 13.1 — rest-deferred bucket monotonic-decrease | category: rest-deferred count growing vs the checked-in baseline at api/openapi-handler-exceptions-baseline.txt. Sprints 13.4-13.6 drive this to zero; Sprint 13.7 tightens to a zero-exact pin. |
Forward-looking guards (Auditable Codebase Bundle, post-v2.1.0 anti-rot)
These guards catch defect classes BEFORE they get audit findings — they pin invariants on the codebase that the v2.0 audit history showed are easy to lose.
| ID | Item | Catches |
|---|---|---|
complete-path-config-coverage |
post-v2.1.0 / item-1 | "Lying field" — CERTCTL_* env var defined in internal/config/config.go that no consumer outside internal/config/ actually reads. Operator-facing config that the docs claim works but the code never honors. Companion Go test at internal/config/coverage_test.go. |
doc-rot-detector |
post-v2.1.0 / item-5 | Docs older than 90 days warn (yellow), older than 120 days fail (red). Uses HEAD commit timestamp for reproducibility. docs/archive/ allowlisted in bulk. |
The cold-DB compose smoke (post-v2.1.0 / item-6) is NOT a script in this directory — it is inlined directly into .github/workflows/ci.yml::cold-db-compose-smoke because there is no value in a developer running it locally (the whole point of the gate is that CI owns the cold-DB state). To inspect or modify the smoke logic, read that workflow job; there is intentionally no scripts/ci-guards/cold-db-compose-smoke.sh.
The fourth Bundle artifact (internal/ciparity/) is Go tests, not shell guards — runs under the standard Go test step. Pins the MCP tool catalogue floor + naming convention; reports CLI/MCP/OpenAPI surface counts as a trend metric.
Running the full set locally
for g in scripts/ci-guards/*.sh; do
echo "=== $(basename "$g") ==="
bash "$g" || echo " FAILED"
done
ARCH-H1 OpenAPI exception two-bucket contract (Phase 13 Sprint 13.1)
api/openapi-handler-exceptions.yaml lists every router route that is intentionally NOT in api/openapi.yaml. Each entry carries a required category: field with one of two values:
-
category: wire-protocol— the route's wire shape is dictated by an IETF RFC (SCEP RFC 8894, ACME RFC 8555, ACME ARI RFC 9773, EST RFC 7030) or it's a sibling/shorthand variant of one. The canonical reference for these endpoints lives indocs/acme-server.md+docs/operator/scep.md+docs/operator/est.md— duplicating their wire contract inopenapi.yamlwould add no information. Wire-protocol entries never burn down. -
category: rest-deferred— the route is REST-shaped (resource CRUD, JSON request/response, RBAC-gated) but its OpenAPI operation was deferred when the handler shipped. Rest-deferred entries must monotonically decrease to zero. Authoring an OpenAPI op for a deferred route + deleting the corresponding exception entry + decrementingapi/openapi-handler-exceptions-baseline.txtin the same PR is the canonical close path.
Adding a new exception entry
The default category for new entries is rest-deferred. Only set wire-protocol when:
- The
why:field cites a specific RFC anchor (e.g. "RFC 8555 §7.1.1 directory"), AND - The route's wire shape is dictated by the RFC (not a REST resource that happens to live alongside one).
When in doubt, default to rest-deferred and author the OpenAPI op. The two guards in this directory enforce both buckets:
openapi-handler-parity.shreports bucket counts + fails on missing/unknowncategory:fields + fails on stale exceptions / undocumented router routes.openapi-rest-deferred-monotonic.shfails ifrest-deferredgrows vs the baseline file atapi/openapi-handler-exceptions-baseline.txt.
Inspecting bucket counts
# Full report.
bash scripts/ci-guards/openapi-handler-parity.sh
# Just one bucket count (used by sibling guards).
bash scripts/ci-guards/openapi-handler-parity.sh --bucket=wire-protocol
bash scripts/ci-guards/openapi-handler-parity.sh --bucket=rest-deferred