fix(tls): four insecure-TLS cells now clamp per ADR 0092 (BACKLOG #329, ASVS V12) - #257
Open
wshallwshall wants to merge 2 commits into
Open
fix(tls): four insecure-TLS cells now clamp per ADR 0092 (BACKLOG #329, ASVS V12)#257wshallwshall wants to merge 2 commits into
wshallwshall wants to merge 2 commits into
Conversation
…lamp (BACKLOG #329) LDAPS (auth/ldap.py), SFTP host-key (transports/remotefile.py), the webhook sink (pipeline/alert_sinks.py) and the AI-broker (transports/ai_broker.py) read the raw MEFOR_ALLOW_INSECURE_TLS escape directly; on an enforcing-PHI instance each would otherwise honour the env var on first deployment. Each now routes through the ADR-0092 weakened_tls_escape helper: SFTP is built in-gate so it uses _here(); the other three are built outside the hop scope, so the instance posture is threaded explicitly through AuthService / notifier_from_settings / ai_broker_from_settings (additive, default None = byte-identical for existing callers). The fifth cell the item names (direct.py) was already clamped in #323, so this converts the remaining four. Docs (CONNECTIONS/DEPLOYMENT/ PHI) corrected from 'not clamped'/'unclamped' to clamped.
…d (BACKLOG #329) Banner line only (leaves the 2026-08-03 amendment note); census not recomputed.
wshallwshall
enabled auto-merge (squash)
August 6, 2026 16:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes BACKLOG #329. Plus 3 doc-accuracy files. ASVS V12.
Four cells permitted insecure TLS configurations; they now clamp per ADR 0092.
api/app.pyalso touched by #338 (PR feat(api): report-only TLS kex_groups posture field, and the webconsole seam 17->18 (BACKLOG #338) #254) -- merge-tree vs #338: CLEANauth/service.pyalso touched by #1021 (PR fix(auth): MFA enrollment consume-step, with the MFA test suite restructured (BACKLOG #1021) #245) -- merge-tree vs #1021: CLEANdocs/DEPLOYMENT.mdalso touched by #1013 (above)Each pair was measured rather than assumed. They will still need the usual update-branch as siblings
land, but no hand resolution is expected.
PROVENANCE: this lane finished BUILT-BUT-UNCOMMITTED (the largest lane, ~172 min). The handoff session
ran the verification quartet itself before committing -- green, with the 21 mypy errors confirmed
PRE-EXISTING in optional-extra
_depsand none in #329's own files -- then committed and flipped thebanner. Claimed FROM the lane worktree; no evasion, no force-claim.