docs: CLAUDE.md and api/app.py both said remote TLS exposure is later -- it already shipped - #609
Open
wshallwshall wants to merge 3 commits into
Open
docs: CLAUDE.md and api/app.py both said remote TLS exposure is later -- it already shipped#609wshallwshall wants to merge 3 commits into
wshallwshall wants to merge 3 commits into
Conversation
… -- it already shipped
ADR 0172 (Accepted 2026-08-22) made the engine always serve TLS: an operator-supplied
[api].tls_cert_file wins if configured, otherwise the engine mints and reuses a self-signed pair
on first run. build_api_ssl_context is wired into serve's uvicorn ssl_context_factory at
__main__.py:2861-2868. Both docs still described the pre-ADR-0172 state.
Left docs/adr/0068-browser-webauthn-passkeys-offloopback.md's citation of the old CLAUDE.md
wording alone -- it is an explicit verbatim historical quote ("CLAUDE.md and test-enforced
invariants, verbatim where quoted"), not a live claim, and rewriting a dated ADR's quotation of
what a doc said at the time would misrepresent the ADR's own history.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
wshallwshall
enabled auto-merge (squash)
August 26, 2026 12:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ADR 0172 (Accepted 2026-08-22) made the engine always serve TLS: an operator-supplied
[api].tls_cert_filewins if configured, otherwise the engine mints and reuses a self-signed pairon first run.
build_api_ssl_contextis wired intoserve's uvicornssl_context_factoryat__main__.py:2861-2868. BothCLAUDE.mdandapi/app.py's module docstring still described thepre-ADR-0172 state ("remote TLS exposure is later"), which is the file every session reads first.
Left
docs/adr/0068-browser-webauthn-passkeys-offloopback.md's citation of the old wording alone-- it's an explicit verbatim historical quote of what CLAUDE.md said at the time that ADR was
written, not a live claim, and rewriting it would misrepresent the ADR's own history.
Flagged by Dispatcher's board (BLOCKERS section), verified directly against the actual wiring
before fixing.
Built by Lander.
🤖 Generated with Claude Code