Phase 14 étape 8 — Aperture residual cleanup#36
Merged
proofoftrust21 merged 5 commits intomainfrom Apr 24, 2026
Merged
Conversation
Aperture L402 reverse proxy sunset 2026-04-23 (Phase 14D.3.0).
9 jours d'observation prod stable avec le gate L402 natif Express
(src/middleware/l402Native.ts). Retrait du code résiduel.
- src/middleware/auth.ts: supprime la fonction apertureGateAuth
(50 lignes) et la classe PaymentRequiredError (dead code).
- src/routes/{agent,attestation,v2}.ts: remplace le default paidGate
par noopMiddleware (app.ts passe toujours createL402Native explicite).
- src/app.ts: nettoie le commentaire obsolète sur le gate natif.
- src/tests/l402NativeIntegration.test.ts: renomme les describe blocks
de 'feature flag OFF/ON' vers 'noop gate' / 'L402 gate actif'.
Aperture L402 reverse proxy sunset 2026-04-23 (Phase 14D.3.0). Le secret partagé entre Aperture et Express n'a plus aucun consommateur côté code — seul OPERATOR_BYPASS_SECRET reste utilisé par le gate L402 natif. - src/config.ts: retire APERTURE_SHARED_SECRET du schéma zod, du validateur prod, de la garde dev et de l'itération placeholders. Nettoie les commentaires Aperture résiduels. - src/tests/l402Bypass.test.ts: retire les 2 entrées APERTURE_SHARED_SECRET des fixtures env. - .env.example: retire la ligne APERTURE_SHARED_SECRET.
Aperture L402 reverse proxy sunset 2026-04-23 (Phase 14D.3.0).
Les références restantes à Aperture dans les commentaires ou
la langue des tests n'ont plus aucun correspondant dans le code
runtime. Réécriture cosmétique pour que le vocabulaire reflète
la réalité (L402 natif Express).
- src/middleware/{balanceAuth,l402Native,probeRateLimit}.ts:
remplace 'apertureGateAuth' par 'L402 native gate',
'X-Aperture-Token' par 'X-Operator-Token',
'Aperture auto-created' par 'auto-created legacy'.
- src/utils/{l402HeaderParser,macaroonHmac}.ts: retire les
références Aperture dans les docstrings.
- src/controllers/{depositController,probeController}.ts:
nettoie les commentaires obsolètes.
- src/tests/integration.test.ts, src/tests/probeController.test.ts,
src/tests/archive/balanceAuth.test.ts: remplace le vocabulaire
Aperture dans les descriptions de tests.
…ripts
Aperture L402 reverse proxy sunset 2026-04-23 (Phase 14D.3.0).
9 jours d'observation prod stable. Promotion du fichier nginx
canonique, archivage des scripts de migration one-shot et nettoyage
des références Aperture dans l'infra.
- infra/nginx/satrank.conf: fusionné depuis satrank.conf.l402-native
(git mv -f), en-tête nettoyé ('SatRank nginx config, L402 native
gate'), commande deploy mise à jour, paragraphe rollback retiré.
- infra/nginx/satrank.conf.l402-native: supprimé (promu ci-dessus).
- infra/nginx/README.md: réécrit pour décrire nginx comme simple
reverse proxy, L402 natif Express.
- .rsync-exclude: retire la section legacy 'L402/Aperture config'.
- docker-compose.yml: nettoie le commentaire du bypass operator.
- scripts/{cutover,rollback}-l402-native.sh → docs/archive/phase-14d/:
scripts one-shot de la migration archivés.
Aperture L402 reverse proxy sunset 2026-04-23 (Phase 14D.3.0).
Finalisation Phase 14 étape 8 — dernière passe sur la documentation
publique et introduction de l'entrée CHANGELOG [Infrastructure].
- CHANGELOG.md: entrée [Infrastructure] - 2026-04-24 documentant
le retrait complet du middleware apertureGateAuth, du secret
APERTURE_SHARED_SECRET, des scripts de cutover et du résiduel VM1.
- DEPLOY.md: retire APERTURE_SHARED_SECRET de la section secrets
et de la table de rotation.
- SECURITY.md: nettoie la description de l'audit pre-sunset.
- SESSION-BRIEFING.md: reformule l'architecture de façade
('Nginx + L402 native Express' sans Aperture).
- docs/env.example.md: retire la section 'Legacy (required at boot only)'
(APERTURE_SHARED_SECRET).
- SECURITY-AUDIT-2026-04-16-v2.md → docs/archive/: audit historique
archivé.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
src/middleware/l402Native.ts) for 9 days without regression.apertureGateAuthmiddleware,APERTURE_SHARED_SECRETenv var,PaymentRequiredErrordead class; promotessatrank.conf.l402-nativeto the canonicalinfra/nginx/satrank.conf; archives cutover/rollback scripts todocs/archive/phase-14d/.grep -rEn "aperture|Aperture|APERTURE"(excludingdocs/archive/andCHANGELOG.md) returns 0 matches.Commit breakdown
chore(middleware): remove apertureGateAuth middleware (post-sunset)—auth.ts, route factories (agent/attestation/v2),app.ts, l402 integration testschore(config): remove APERTURE_SHARED_SECRET—config.ts,l402Bypass.test.ts,.env.examplechore: scrub Aperture references in comments and tests— middlewares, utils, controllers, testschore(infra): promote L402-native nginx config and archive cutover scripts— nginx config + README,.rsync-exclude,docker-compose.yml, archived scriptsdocs: archive SECURITY audit + document Aperture sunset completion—CHANGELOG.md[Infrastructure] - 2026-04-24entry,DEPLOY.md,SECURITY.md,SESSION-BRIEFING.md,docs/env.example.md, SECURITY audit archivedTest plan
npm run lintclean (tsc --noEmit)npm testgreen — 1166 passed / 169 skipped / 99 test filesmake deploy+ docker rebuild+force-recreateAPERTURE_SHARED_SECRETfrom VM1.env.production, remove aperture systemd unit + Go binary +/root/.aperture/+ sunset backup snapshot