Repository navigation
fix(gateway): bind denied-peer probe to verified transport - #5820
Merged
devantler merged 8 commits intoNov 8, 2026
Merged
Conversation
Contributor
Author
Validation at Affected Go tests, ShellCheck, Actionlint, GolangCI-Lint and CI routing regressions pass locally. The native Envoy container proof could not run locally because Docker is unavailable; its required hosted CI result remains outstanding. No production trial or listener change has been made by this PR. After protected merge, the existing main-only diagnostic still needs one production run and independently verified cleanup. This does not complete the remaining client-identity, forged-forwarding or recovery acceptance in #5448. |
Contributor
Author
@coderabbitai review |
Contributor
Action not completed
|
Contributor
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 40 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Contributor
Author
cr:no-gate@4917f52. The authenticated command response reports review rate limiting; the summary also reports an unserved review. The native no-gate guard admits progression, with no review or actionable finding delivered. Continue to the next permitted reviewer. |
Contributor
Author
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Contributor
Author
Current head is At the earlier head, hosted CI independently passed the full Go regressions, native gateway receiver proof and this diagnostic's actual wire/fixture regression step. Production use remains blocked on completed current-head gates and a healthy deployment lane. No production diagnostic has been dispatched. |
Contributor
Author
@coderabbitai review |
Contributor
Action not completed
|
Contributor
Author
cr:no-gate@57c42c4. The authenticated current request reports rate limiting and no completed review. The native guard admits progression; no review finding was discarded. Continue to the next permitted reviewer. |
Contributor
Author
@codex review |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
4 tasks
Contributor
Author
Current-head Codex review at The causal cleanup defect is tracked as #5824 and repaired separately in #5825, with a deterministic child-handler RED/GREEN control and the full affected package passing locally. This PR remains draft and must not be promoted on a blind rerun. Resume after the reviewed cleanup repair is delivered, integrate its main revision, then require fresh passing CI and current-head review. No production denied-peer trial has run. |
devantler
added a commit
that referenced
this pull request
Nov 3, 2026
Contributor
Author
Prepared head Affected gateway and Email backup Go packages pass; both rendered real-curl framing modes and the missing-TLS-preamble mutation pass; ShellCheck, Actionlint and affected Go lint pass. Earlier reviews are stale for this combined head. Fresh hosted CI, current-head review and the protected production diagnostic with verified cleanup remain required. No production listener or diagnostic was changed by this preparation. |
Contributor
Author
All hosted checks are now settled green/skipped at Provider availability observed 2026-11-03T12:03Z: CodeRabbit's authenticated account-limit response, event 11:47:02Z, states the included review capacity is exhausted and resets in 48 minutes. Allowing the minute margin gives 12:36:02Z; no paid fallback will be used. Codex delivered a review at 11:53:39Z in the same repository. The portfolio health helper remains UNKNOWN because GraphQL discovery failed; that failure is not provider-unavailability evidence. Skip only the verified ongoing CodeRabbit limit and request Codex for this current head under the native request lock. |
Contributor
Author
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
devantler
added a commit
that referenced
this pull request
Nov 3, 2026
Contributor
Author
Readiness rechecked at All 56 reported checks are settled green/skipped; required aggregate and three required workflows pass. The configured code-quality rule has no readable head result; native This evaluates the repaired diagnostic's executable framing and refusal behavior, not production acceptance. #5825 retains first merge order. The main-only production diagnostic remains outstanding behind healthy protected delivery; #5448's broader client-identity, forged-forwarding and recovery criteria stay open. |
devantler
added a commit
that referenced
this pull request
Nov 3, 2026
devantler
marked this pull request as ready for review
November 3, 2026 12:14
Contributor
Author
Blocker: none Cleared 2026-11-08: platform#5852 closed 2026-11-08T02:39Z after platform#5909 merged; update the base next Previous record (historical): |
devantler
marked this pull request as draft
November 3, 2026 20:19
Contributor
Author
Prerequisite #5825 merged as Returned to draft for current-head validation and review. Twenty reported checks are pending; the earlier clean review does not cover this new head. The previously missing required Go workflow must now complete, together with every other required check, before another review and queue admission. No production diagnostic or acceptance was run; #5448 remains open. |
Contributor
❌MegaLinter analysis: Error❌ REPOSITORY / betterleaks - 11 errors❌ REPOSITORY / checkov - 27 errors❌ HTML / djlint - 8 errors❌ REPOSITORY / grype - 38 errors❌ DOCKERFILE / hadolint - 1 error❌ HTML / htmlhint - 21 errors❌ REPOSITORY / osv-scanner - 1 error❌ GO / revive - 1 error❌ REPOSITORY / secretlint - 1 error❌ BASH / shellcheck - 1 error❌ REPOSITORY / trivy - 1 error❌ YAML / v8r - 1 error❌ YAML / yamllint - 293 errors❌ ACTION / zizmor - 40 errors
|
Contributor
Author
@coderabbitai full review |
Contributor
Action not completed
|
Contributor
✅
|
Code coverage overviewLanguages: Go Go / code-coverage/go
Line coverage data for the main branch is not yet available. View coverage of the 10 most covered files.
ℹ️ Calculations represent line coverage. Results may change as calculations are updated. Updated |
Contributor
Author
@coderabbitai full review |
Contributor
Action not completed
|
devantler
commented
Nov 8, 2026
devantler
left a comment
devantler
left a comment
Contributor
Author
There was a problem hiding this comment.
🤖 Generated by the Agentic Engineer
Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable) at 69b4848
Reviewed commit: 69b4848528df7b0b6e188b29acacb501b3e4cdf6
Lane availability, read directly on 2026-11-08 ~04:10Z:
- CodeRabbit: refused the full-review request at this head at ~04:07Z with "Review limit reached" for this repository (next included review stated as 40 minutes later).
- Codex: usage limit since 2026-11-08T00:09Z (review-lane-health DOWN, maintainer-only).
- Cursor Bugbot: usage limit since 2026-11-08T01:32Z (review-lane-health DOWN, maintainer-only).
What I checked (this PR's code was written by the codex lane, so this is an independent read):
- Transport selection fails closed. The workflow accepts only the exact single-line receipt
GATEWAY_RECEIVER_SOURCE=VERIFIED public_probes=4 fence_selected=true proxy_protocol=(true|false), anchored on the whole captured output. A missing field,fence_selected=false, an unknown mode,UNVERIFIEDor extra output selects nothing and writes no step output. The test runs the workflow's actual parser against each of those receipts.proxy_protocol=falsemaps toplain,truetoproxy-v1; the script refuses any other--transport. - The probe still distinguishes the fence from a parser rejection. In
proxy-v1mode every control and TLS request sends a PROXY v1 preamble, so a refusal cannot come from Envoy rejecting a preamble-less connection. The new wire test runs the rendered pod shell with real curl against loopback peers that inspect the bytes. Its mutant (TLS without the preamble) must fail, and the 301 controls must arrive before and after. - Cleanup now proves absence. Both the script's EXIT cleanup and the workflow's always-run step re-list run-labelled pods and policies after deletion. They fail on anything remaining, and a failed read counts as remaining (
|| remaining='unknown'in the script,set -ein the workflow). Fixtures cover a delete that keeps objects and a failed read. - Consumers of the extended receipt line: only this workflow and its test parse it; the operations doc names the token in prose only.
- Security. The probe stays dispatch-only on main, labels everything it creates with the run id, and prints no addresses; nothing new reaches the public log.
- CI at this head: all checks complete, none failing.
Verdict: no P0/P1 findings
Contributor
Author
Readiness at
|
devantler
marked this pull request as ready for review
November 8, 2026 04:09
devantler
deleted the
codex/gateway-denied-peer-5448-23e2-01a1a04b-main
branch
November 8, 2026 05:32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The ingress security diagnostic cannot establish its control connection after the transport change, leaving its result inconclusive.
What
Use the verified listener mode for the existing diagnostic and confirm that its temporary resources are gone afterward. Production acceptance remains a protected, manually dispatched check after merge.
Part of #5448