zeekayandHanzo Dev 0a80225abe auth: every route says whether it needs an identity ...

The check asked whether the config states a policy ANYWHERE. A config written
against the older contract satisfies that with the routes it gated and says
nothing about the routes it left open — so it boots, reports healthy, and every
one of those open routes demands an identity nothing sends. One classified route
out of sixty-three satisfied it too.

It now asks whether every route says which it is: routes == open + gated. A
config with no endpoints still passes, because 0 == 0+0.

The shipped hanzo config states the 216 routes canon gated with auth/validator
as `auth/public: false`, which is what they already were — the migration moved
where that is written down, not which routes are which.
TestShippedConfigMatchesTheGatingItReplaced parses canon's copy through the same
parser and compares route by route, so the two cannot drift apart quietly.

POST /v1/admin on the lux edge reaches a node's admin API and was open by
omission. Written down, that becomes a decision, and it is not one anyone made.
It states false.

The boot test polls the port while the process is alive. Asking once, after the
process is gone, asks about a socket that is closed either way — it answers
"nothing is listening" for a binary that bound the port, served, and then
exited, which is the failure it exists to rule out. TestWatchCatchesATransientBind
holds the watcher to that.

Co-authored-by: Hanzo Dev <[email protected]>

2026-08-21 07:01:11 -07:00

..

gateway.json

auth: every route says whether it needs an identity

2026-08-21 07:01:11 -07:00