docs(config): narrow the residual's precondition, and assert the consequence #36

Merged

jlxq0 merged 1 commit from docs-hops-narrow into main

2026-08-27 04:35:12 +00:00

jlxq0 commented

2026-08-27 04:32:39 +00:00

Owner

Two corrections and one test, all from the carddav-mcp review.

The precondition was overstated and I have narrowed it. Not LAN access: a stolen bearer plus code running inside the cluster. Clark measured what my own probe could not, and the mechanism is MetalLB: the pool holding the gateway's addresses is BGP-advertised across sgp, lax and zrh rather than L2, so nothing on the wifi has a route. They time out from the LAN on 80 and 443 and answer 401 from a pod.

My earlier wording was the honest disposal of a weaker measurement, and it is superseded rather than wrong. A comment that overstates a threat gets acted on later by somebody who cannot re-derive it, which is why narrowing it matters more than being right the first time.

The severity inverts on that path, and that is the half that changes the instruction. 1 selects an infrastructure address; 2 selects whatever the caller typed. So the value that fixes the ordinary path is the one that turns a wrong-but-inert record into a caller-controlled one. Set it to the edge-inclusive depth reads as a complete instruction and is not.

The new test asserts the consequence rather than the number. the_default_selects_the_edge_written_entry_on_the_deployed_chain feeds the shipped default the chain the deployment actually receives. Asserting == 2 alone is a tautology on the constant; this one fails in both directions:

mutation	died
default -> 1	`trusted_proxy_hops_defaults_to_the_deployed_chain_length`, `the_default_selects_the_edge_written_entry_on_the_deployed_chain`
default -> 3	the same two

Two deaths, no collateral, either way. Mutating in both directions rather than only reverting is copied from carddav-mcp's release and it is what makes the pair non-tautological.

And it names the line that would change the reachability: a second parentRef on an HTTPRoute. All eight name gateway/web today, and that assertion belongs in platform as a manifest property rather than in my code.

Gates green: fmt, clippy -D warnings, 124 + 9 tests, audit, deny. No behaviour change.

Two corrections and one test, all from the `carddav-mcp` review. **The precondition was overstated and I have narrowed it.** Not LAN access: **a stolen bearer plus code running inside the cluster.** Clark measured what my own probe could not, and the mechanism is `MetalLB`: the pool holding the gateway's addresses is BGP-advertised across `sgp`, `lax` and `zrh` rather than L2, so nothing on the wifi has a route. They time out from the LAN on 80 and 443 and answer 401 from a pod. My earlier wording was the honest disposal of a weaker measurement, and it is superseded rather than wrong. **A comment that overstates a threat gets acted on later by somebody who cannot re-derive it**, which is why narrowing it matters more than being right the first time. **The severity inverts on that path, and that is the half that changes the instruction.** 1 selects an infrastructure address; 2 selects whatever the caller typed. So the value that fixes the ordinary path is the one that turns a wrong-but-inert record into a caller-controlled one. *Set it to the edge-inclusive depth* reads as a complete instruction and is not. **The new test asserts the consequence rather than the number.** `the_default_selects_the_edge_written_entry_on_the_deployed_chain` feeds the shipped default the chain the deployment actually receives. Asserting `== 2` alone is a tautology on the constant; this one fails in both directions: | mutation | died | |---|---| | default -> 1 | `trusted_proxy_hops_defaults_to_the_deployed_chain_length`, `the_default_selects_the_edge_written_entry_on_the_deployed_chain` | | default -> 3 | the same two | Two deaths, no collateral, either way. Mutating in both directions rather than only reverting is copied from `carddav-mcp`'s release and it is what makes the pair non-tautological. **And it names the line that would change the reachability**: a second `parentRef` on an `HTTPRoute`. All eight name `gateway/web` today, and that assertion belongs in `platform` as a manifest property rather than in my code. Gates green: fmt, clippy `-D warnings`, 124 + 9 tests, audit, deny. No behaviour change.

jlxq0 added 1 commit

2026-08-27 04:32:39 +00:00

docs(config): narrow the residual's precondition, and assert the consequence

CI / cargo (pull_request) Successful in 58s

Details

CI / docker (pull_request) Successful in 1m5s

Details

f69db5a98b

Two corrections and one test.

The precondition is a stolen bearer plus code running inside the cluster, not
LAN access. Clark measured it: the gateway's addresses time out from the LAN on
80 and 443 and answer 401 from a pod, because the MetalLB pool holding them is
BGP-advertised rather than L2, so nothing on the wifi has a route. My earlier
wording was the honest disposal of a weaker measurement, and a comment that
overstates a threat gets acted on later by somebody who cannot re-derive it.

And the severity inverts on that path. 1 selects an infrastructure address, 2
selects whatever the caller typed, so the value that fixes the ordinary path is
the one that turns a wrong-but-inert record into a caller-controlled one. "Set
it to the edge-inclusive depth" reads as a complete instruction and is not.

The new test asserts the consequence rather than the number: the shipped default
fed the chain the deployment receives must select the entry the edge wrote.
Asserting == 2 alone is a tautology on the constant. This one fails in both
directions, verified by mutating the default to 1 and to 3, each killing two
tests and nothing else.

Also names the line that would change the reachability: a second parentRef on an
HTTPRoute. All eight name gateway/web today, and that assertion belongs in
platform as a manifest property rather than here.

jlxq0 merged commit 9170e9b04d into main

2026-08-27 04:35:12 +00:00

jlxq0 deleted branch docs-hops-narrow

2026-08-27 04:35:12 +00:00

jlxq0 referenced this pull request from a commit

2026-08-27 04:35:13 +00:00

Merge pull request 'docs(config): narrow the residual's precondition, and assert the consequence' (#36) from docs-hops-narrow into main