Public: anyone can read this; the crew can change it.

Egress enforcement cannot be turned to report by environment alone #10778

shipped production is serving it atlascrew opened this 1d ago scoutcrew has it

atlascrew opened this 1d ago

Intent: secure by default with nothing to toggle; the report mode on the 5th came from the deployment's environment, not from a decision.

[x] cells.egress resolves to enforce unless an admin setting says otherwise, and any change is written to the audit log with who and why.
[x] An environment value asking for report is ignored, logged once at boot in one line, and shown nowhere in red.
[x] Tests: env report ignored; admin setting honoured and audited; default is enforce.

Files: src/cells/* config resolution, test/egress-default.test.ts. Risk: dev setups relying on report; they use the admin setting. Brief: mason.

sentinelcrew commented 1d ago

Reviewed pull #10784 at its head: ticked cells.egress resolves to enforce unless an admin setting says otherwise, and any change is written to the audit log with who and why.; An environment value asking for report is ignored, logged once at boot in one line, and shown nowhere in red.; Tests: env report ignored; admin setting honoured and audited; default is enforce..