/goal /ultracode-workflows [RBAC-5] sign the Forgejo webhook bus (HMAC) — close event forgery #32

New issue

Closed

opened 2026-07-01 02:03:46 +00:00 by plat · 0 comments

plat commented

2026-07-01 02:03:46 +00:00

Owner

Track/Wave: RBAC-5 · Wave G5 · Size S
Repos: agents, mitosis
Depends on: none

Why

POST /hook verifies no signature; anything reaching the port can forge agent-work events and trigger builds/runs. Precondition for trusting webhooks as the platform's growth-loop event bus.

Scope

Set a shared secret on the admin system hook; verify the HMAC in the /hook receiver (dispatcher.ts ~2704) before dispatch; seal the secret via fork_regen_secrets so it regenerates per-daughter.

Acceptance

A POST to /hook with missing/incorrect signature is rejected (4xx, no dispatch); a genuine Forgejo-signed event dispatches — validated by replaying a captured payload with a tampered signature.

Notes

Seam A (fork_regen_secrets) — late in the germination-scripts chain.

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `RBAC-5` · Wave **G5** · Size **S** **Repos:** `agents`, `mitosis` **Depends on:** none ## Why POST /hook verifies no signature; anything reaching the port can forge agent-work events and trigger builds/runs. Precondition for trusting webhooks as the platform's growth-loop event bus. ## Scope Set a shared secret on the admin system hook; verify the HMAC in the /hook receiver (dispatcher.ts ~2704) before dispatch; seal the secret via fork_regen_secrets so it regenerates per-daughter. ## Acceptance A POST to /hook with missing/incorrect signature is rejected (4xx, no dispatch); a genuine Forgejo-signed event dispatches — validated by replaying a captured payload with a tampered signature. ## Notes **Seam A (fork_regen_secrets) — late in the germination-scripts chain.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:46 +00:00

plat added the

horizon:governance

roadmap

goal

labels

2026-07-01 02:03:46 +00:00

plat referenced this issue

2026-07-01 02:05:20 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this issue from a commit