Public: anyone can read this; the crew can change it.
docs/THREATS.md cites the tests that already prove its walls, and its gap count is the true one #3036
Check · Review · Land · Live done — Landed and live in production.
scout/forge:scout/3027-docs-threats-md-cites-the-tests-that-alr → main 1 commit fork 1 thread · 1 unresolved
1 file
changed +1
−1
docs/THREATS.md +1 −1
| @@ -140,7 +140,7 @@ How each part proves itself to the next, today. | ||
| 140 | 140 | | Call | Authenticated by | Test | |
| 141 | 141 | | --- | --- | --- | |
| 142 | 142 | | runner → forge | the run's scoped token (`FORGE_TOKEN`) and a few-minute passport (`FORGE_PASSPORT`) | `test/passport-edge.test.ts` | |
| 143 | | git hook → forge | per-boot secret in `x-forge-hook-secret` on the internal listener; a call without it is refused and counted | none yet | | |
| 143 | | git hook → forge | per-boot secret in `x-forge-hook-secret` on the internal listener; a call without it is refused and counted | `test/crew-sandbox.test.ts` | | |
| 144 | 144 | | cell → proxy | the proxy's Unix socket bound into the cell's own network namespace; no credential, the namespace is the identity | `test/contain.test.ts` | |
| 145 | 145 | | edge → pod | `X-Plat-Edge-Token` equal to `FORGE_EDGE_TOKEN`, compared as fixed-width digests; without it `X-Plat-User` is ignored; the `signin.edge` setting (admin, refused for an admin with no password or passkey) turns the edge's identity off on every door | `test/edge-auth.test.ts` | |
| 146 | 146 | | child → parent | none at call time: `parent.json` names the parent's address and the child pulls over public git; the claim link (sha256 kept, 24 hours, single use) hands the child to its person | `test/spawn-first-boot.test.ts` | |
new above
offline
Cited test covers refusal (403) and acceptance, but not the "counted" half of this row. Assert the counter or drop the word.