docs(config): the external-origin setting is no longer console-scoped on a PHI instance (BACKLOG #1026) - #596
Merged
Conversation
… on a PHI instance (BACKLOG #1026) The doc limb of #1026. CONFIGURATION.md described `[security].web_console_public_address` purely as a console setting -- "with the console served, `serve` exits 2 until it is set". That is now incomplete: a PHI instance behind a declared TLS terminator under `enforce` exits 2 with the origin unset EVEN WITH THE CONSOLE OFF, because the ASVS 12.1.1 startup probe dials that origin to measure the terminator's TLS floor. The paragraph says WHY rather than just restating the rule, because the reason is the transferable part: leaving it unset silently DISABLED the check rather than failing it, and a control that degrades to a no-op reports success forever afterwards. WHY THIS IS A SEPARATE BRANCH FROM THE CODE HALF (94eec26). The collision gate refused the edit when I first tried it, reporting uncommitted peer changes to this file. I asked Builder 2 rather than overriding, and appended once the file was free. *** A CLAIM I MADE HERE AND THEN FALSIFIED, KEPT BECAUSE IT IS THE MORE USEFUL HALF. *** This message originally read "AND THE GATE WAS WRONG, IN THE DIRECTION THAT STOPS WORK." That is FALSE and I am the one who established it is false, after the Dispatcher said the gate had refused me correctly. The timestamps settle it: c28421c Builder 2's commit of that file 13:45:51 196a9cb2 this commit 13:53:28 The gate fired BEFORE 13:45:51 -- I hit it, messaged the peer, waited for a reply, then verified. So at the moment it fired the file genuinely WAS uncommitted in their tree. THE GATE WAS RIGHT. My later probe measured a state that had changed in between, and I read a stale-by-eight-minutes reading as a verdict on the instrument. WHY THIS MATTERS MORE THAN THE FACT: falsely discrediting a working safety control is the expensive direction of error. The next reader who meets a collision refusal now has a commit message telling them the gate cries wolf. I published that about a control that had just done its job, in the same session in which I have been correcting other seats for exactly this shape. WHAT SURVIVES, AND IT IS NARROWER THAN WHAT I WROTE. The gate's EMPTY output really is ambiguous -- it is byte-identical whether it checked and found nothing or timed out at its 16-second budget without looking, and it timed out on me three times today. That is a real limitation and it is why an absent warning cannot clear a decision. But it is a statement about the SILENT case, NOT about the case that actually happened here, which was a correct and specific refusal. METHOD NOTE FOR THE NEXT PERSON. Verifying a peer's tree after a message round-trip measures the tree NOW, not the tree the gate saw. If you want to grade a refusal, you need a timestamp on both sides -- which I had available and did not take until it was pointed out. The probe control still stands and was worth running: their whole tree is clean, so an empty porcelain result is indistinguishable from a dead probe until you show the probe can see dirt. Run across every sibling worktree, four report dirt (1, 8, 14 and 2 files). OWNERSHIP: Builder 2 declined to take the paragraph and was right to -- splitting a doc limb off its own item so it can ride an unrelated commit costs a reviewer the connection between the change and its reason. It stays with #1026. VERIFIED, scope named: pytest 100 passed, 2 warnings over the five modules that read CONFIGURATION.md (test_asvs_file_surface_doc_drift, test_security_doc_rate_limits, test_phi_at_rest_inventory, test_ldap_timeouts, test_adr0114_claim_flags) docs-only change; no code, no test behaviour altered NOT a full-suite run AMENDED rather than followed by a correction commit, deliberately: the branch was never pushed, so nothing shared is rewritten, and a false claim about a security control should not ship in history relying on a later commit nobody is guaranteed to read. The retraction is kept IN the message. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The doc limb of #1026. `docs/CONFIGURATION.md` described `[security].web_console_public_address`
purely as a console setting -- "with the console served, `serve` exits 2 until it is set." That's
incomplete: a PHI instance behind a declared TLS terminator under `enforce` exits 2 with the origin
unset even with the console off, because the ASVS 12.1.1 startup probe dials that origin to
measure the terminator's TLS floor.
Documents already-landed behavior (`91a24061a`, PR #392) -- independently landable, does not depend
on PR #593 (the separate refusal-message limb of the same item).
Cherry-picked cleanly onto current main (this branch was cut before several since-landed PRs; the
flat diff against current main looked like 4 files until checked with `git merge-tree` against the
commit's own parent, which confirmed a clean merge and the claimed 1-file/+9/-1 shape).
Co-Authored-By: Claude Opus 5 noreply@anthropic.com