Review follow-up on #469: the data plane held the same control-plane secret
that authorizes every route, so a compromised egress/git-gate could queue a
supervise proposal AND approve it (or rewrite policy, read injected tokens) —
the (source_ip, identity_token) checks attribute the *bottle*, not the caller.
Replace the single shared bearer secret with role-scoped, HMAC-signed tokens
(compact HS256 JWTs, stdlib-only — no new dependency):
* new `control_auth` mints/verifies `{role}` tokens; roles are `gateway`
(data plane) and `cli` (host operator/launcher).
* the orchestrator holds only the signing *key* and verifies; `dispatch`
gates each route by role — `gateway` reaches /resolve + /supervise/
{propose,poll}, everything else is `cli`-only (401 unauthenticated,
403 wrong role).
* the gateway is handed a pre-minted `gateway` token it cannot rewrite into
`cli`; the host CLI mints its own `cli` token from the host key.
* `gateway_init` scopes the signing key to the orchestrator process and the
gateway token to the data-plane daemons, so even in the combined infra
container a compromised data-plane daemon never sees the key.
Launchers (docker gateway + infra, macOS infra) inject the minted token(s);
Firecracker stays open behind its nft boundary. Open mode (no key) still grants
full `cli` access — the fail-visible fallback for tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two complementary fixes for the egress gateway OOM:
1. gateway_init: auto-restart any daemon that dies unexpectedly. The
supervisor already had restart_daemon()/request_restart() logic; this
wires it into tick() so an OOM-killed mitmdump is respawned without
operator intervention. Implements the "eventual" failure policy
described in the original module docstring.
2. egress_addon: cap response body bytes passed to the DLP inbound scan
at EGRESS_INBOUND_SCAN_LIMIT_BYTES (default 1 MiB). mitmproxy buffers
the full response before the hook fires; capping at scan time limits
the additional amplification from decoded text and regex strings. Bodies
over the limit emit an egress_scan_truncated log event. Set to 0 to
disable the cap.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
NixOS doesn't populate /bin (no /bin/sleep), so the gateway-init
end-to-end tests that spawn a real `sleep` errored with
FileNotFoundError. Add tests/_bin.py with a PATH-resolved SLEEP
constant (falling back to /bin/sleep on FHS hosts) and import it in
test_gateway_init.py instead of hardcoding the path.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A9qa3xoavjQScufDfZaXKR
Part of the de-sidecar cleanup (#385 discussion): the per-bottle companion
container is the old architecture.
- Rename `bot_bottle/sidecar_init.py` → `gateway_init.py` (it's the gateway
image's PID-1 supervisor); env var `BOT_BOTTLE_SIDECAR_DAEMONS` →
`BOT_BOTTLE_GATEWAY_DAEMONS`; log prefix `sidecar-init:` → `gateway-init:`.
Update Dockerfile.gateway COPY/ENTRYPOINT and the test.
- Remove the dead per-bottle compose renderer from `backend/docker/compose.py`
(`bottle_plan_to_compose`, `_sidecar_bundle_service`, `_agent_service`, and
the network/bind/proxy helpers). Docker's live path uses
`consolidated_agent_compose`; only the compose *lifecycle* helpers
(up/down/ls/write) remain. Trim `test_compose.py` to the surviving helpers.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WBMWTEtQdJ4W5UrWuLHCck
didericis-claude
didericis-codex
didericis