archetech / archon / 31276607761

95%

push

github

docs(security): record PR #868 against H-01 and L-06 (#874)

#868 merged, closing the fail-open admin auth on both Gatekeeper ports:
403 when no key is configured, constant-time comparison, and refuse-to-
start without ARCHON_ADMIN_API_KEY. H-01 and L-06 still described all
four services as affected.

H-01 now separates what is fixed from what remains (TS and Python
Keymaster) and records why Keymaster was not done in the same pass: it
mounts the middleware router-wide at keymaster-api.ts:177, so failing
closed rejects every client that does not send a key, not just admin
tooling. L-06, the executive summary, the severity table, section 7, and
the remediation ordering follow.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

3615 of 4070 branches covered (88.82%)

Branch coverage included in aggregate %.

8245 of 8527 relevant lines covered (96.69%)

685.96 hits per line