archetech / archon / 31275648752

95%

push

github

docs(security): scope H-02 to the Python service (#869)

* docs(security): scope H-02 to the Python service

H-02 listed the TS and Python Keymaster as equivalent. They are not.

config.keymasterPassphrase feeds both /login and the Keymaster constructor
(keymaster-api.ts:290), and that constructor rejects an empty passphrase
(keymaster.ts:223, asserted by tests/keymaster/utils.test.ts:109). So on
TS an empty passphrase throws in the app.listen callback and Node
terminates the process — the dev-mode branch is unreachable in steady
state. What remains is a startup window, because the callback runs after
listen and gatekeeper.connect({waitUntilReady:true}) can block.

Python has no such guard — core.py:126 assigns the passphrase without
validation, so the service runs indefinitely serving that branch.

Splits the severity, records the reachability analysis, and fixes the
executive summary, H-03, M-04, and the remediation ordering, which all
carried the same over-generalization.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs(security): narrow H-02's Python case to fresh deployments

The Python service only survives startup with an empty passphrase when no
wallet exists yet: load_wallet falls through to new_wallet, which encrypts
the mnemonic with encrypt_with_passphrase(mnemonic, "") — PBKDF2 over an
empty string is valid, so it saves and round-trips. That is the exposed
case.

On an already-initialised node whose wallet was encrypted under a real
passphrase, clearing ARCHON_ENCRYPTED_PASSPHRASE makes decrypt_wallet
raise "Incorrect passphrase." (core.py:219) and startup fails — safe, but
by accident rather than design.

Also names keymaster_service as the location explicitly, since
python/keymaster is a library and only the FastAPI service exposes /login.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs(security): Gatekeeper's published port is by design, not the defect

H-01 presented Gatekeeper's all-interfaces port public... (continued)

3616 of 4070 branches covered (88.85%)

Branch coverage included in aggregate %.

8245 of 8527 relevant lines covered (96.69%)

685.96 hits per line