fix(auth): fail closed without write-capable admin on public bind

[seonghobae]

Fixes #78 only when this exact candidate reaches protected main.

Security boundary

Wardnet must never expose unauthenticated management writes on a non-loopback listener. Loopback-only development may remain credential-free, but production-facing binds require a write-capable administrator credential before readiness. The bounded delta rejects missing/ambiguous write authority, preserves 401 vs 403, constant-time token comparison, readonly/write separation, and auth_mode=development only for loopback credential-free operation.

Protected-main adoption

Prior exact candidate f74ff25a321dfb1d7109719e2a1fc77e47dc4898 was already non-destructively aligned with protected 5829a0f08d78de464dd24393ce5d0f25fba9d126. Protected/default main then advanced through #171 to exact a52ccd0a24a727d9349bb32def7713882d8cad1e.

Fresh comparison proved the intervening protected delta is only docs/adr/2026-09-05-anti-bot-acquisition-boundary.md plus docs/adr/README.md, neither overlapping this authentication/security delta. Two-parent merge fb93b61a4a4da30a3471453051ebfb0ed3f63d34 adopted that protected truth without force push or destructive rebase. Current compare remains merge-base=a52ccd0..., behind 0; the effective feature delta remains the same 13 authentication/deployment/test/doctoring paths.

Exact-current evidence — 2026-09-07 KST

Current exact source remains unchanged fb93b61a4a4da30a3471453051ebfb0ed3f63d34, Ready/mechanically mergeable on protected main. The earlier no-run snapshot is superseded. Without source churn, current gates have executed:

• CI 34020141305: SUCCESS;
• Fuzz 34020141277: SUCCESS;
• Security Scan 34020141306: SUCCESS;
• SAST Semgrep 34020141279: SUCCESS;
• CodeQL PR 34020141314: FAILURE only at delegated terminal-verdict enforcement.

CodeQL detect-language job 101451083576 is terminal success. Compatibility job 101455725295 also acquired a hosted runner and completed Request current-head CodeQL scan dispatch; it fails only at Release runner or enforce current-head CodeQL verdict. This is the same central authenticated dispatcher/verdict boundary tracked in .github#712 / the live CodeQL owner path, not a management-authentication source/test failure. Do not source-churn this unchanged security candidate, transfer predecessor verdicts, or weaken CodeQL.

Ready metadata is not merge authorization. Live organization ruleset 18156473 still carries the structurally incompatible solo-maintainer generic approval count plus routine OrganizationAdmin/always bypass tracked by .github#772. Self/model approval, routine or implicit administrator bypass, force push, destructive rebase and merge-as-probe remain forbidden.

Merge only through the ordinary protected path after one unchanged exact head has an authenticated terminal current-source CodeQL verdict, zero valid unresolved findings/threads, fresh candidate-base compatibility, and every then-live deterministic/security/coverage/package/SBOM/provenance/governance requirement terminal-valid.

[coderabbitai]

Warning

Review limit reached

Next included review available in 53 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: e11602de-3904-4534-98d8-9cfb22b174db

📥 Commits

Reviewing files that changed from the base of the PR and between a52ccd0 and fb93b61.

⛔ Files ignored due to path filters (1)

• docs/papers/nist-sp-800-218-ssdf.pdf is excluded by !**/*.pdf

📒 Files selected for processing (12)

• README.md
• docs/deployment/production.md
• docs/doctoring/fail-closed-management-auth.md
• docs/security/threat-model.md
• fuzz/fuzz_targets/fuzz_parse_admin_tokens.rs
• scripts/smoke.sh
• src/credentials.rs
• src/lib.rs
• tests/admin_auth_properties.rs
• tests/binary.rs
• tests/fuzz_invariants.rs
• tests/smoke_script_security.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 3 potential issues.