v0.4.24 — Management access before equipment control

v0.4.24 — Management access before equipment control

General access-control improvements prompted by the France supermarket refrigeration incident. These changes apply to management interfaces across connected equipment and services; no refrigeration-specific control rules were added.

Changes

• A write-key-protected POST /api/v1/access/check lets a trusted gateway obtain an explicit decision before forwarding management requests.
• Access requires a configured IP/CIDR, an exact allowed operator, and independently verified identity context. Empty policies deny all requests.
• Public management exposure alerts and Internet-to-sensitive-zone segmentation detection extend IoT Shield's existing event handling.
• Config validation rejects malformed policies; policy changes require restart and cannot be partially applied by reload.
• Bounded, strict request parsing; accurate OT alert wording; shared-config regression coverage for the Rust sidecar.

Deployment requirements

Upgrade the Go CLI to v0.4.24. Configure management_access.allowed_sources and allowed_operators, enable IoT Shield, and integrate the decision API with your trusted gateway. Forward only after HTTP 200 and allowed: true; errors and timeouts must deny access. Keep the write key private to that gateway and use TLS for networked API calls.

The gateway must independently verify operator sessions, derive trustworthy client addresses, and enforce resource/action permissions. Target/action fields are audit context. The new API does not install a proxy, validate identity tokens, or protect a controller reachable around the gateway. Telemetry alerts remain distinct from request rejection; existing alert-response dry-run defaults remain available.

Linux, macOS, and Windows Go archives and portable Rust sidecars are available for amd64 and arm64, with checksums, Sigstore bundles, Go SBOMs, and GitHub provenance. Optional packet capture/PQC sidecar features require a source build.

Evidence and limits

The regression suite includes a simulated management gateway that rejects outside-network and forged-session requests before backend access, permits an authorized request, and denies access when the policy API is unavailable. This is not a replay of the France attack. We do not claim that 1-SEC was deployed at affected stores or prevented the historical incident.

See the integration contract and implementation notes.