fix(guard): https enforcement is nginx's layer + calibrate the prose validators (#599)

mirror of https://github.com/rennf93/roboco.git synced 2026-08-03 07:23:24 +02:00

The 2026-07-19 outage root cause: enforce_https keyed off
environment==production, but nginx is the single entry point — the app
only ever sees proxy-HTTP, and the production NAS terminates no TLS at
all — so the moment the guard went active, https_enforcement blocked
the entire request stream. It is now hardcoded off at the guard-config
level (TLS and http->https redirects belong to nginx, not the app).
Same calibration pass for the two prose validators the flip armed: the
secret-exfil key pattern requires a real b64-shaped value so the
documented placeholder lines can't block, and the injection override
pattern requires the second-person 'your' so neutral engineering prose
about the guard subsystem passes.

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

This commit is contained in:

Renzo F

2026-07-19 23:28:54 +02:00

committed by

GitHub

co-authored by

Renn F

parent bab53e31ca

commit 81bd5e722b

3 changed files with 59 additions and 4 deletions

.gitignore

View File

@@ -121,3 +121,6 @@ docs/internal/
 # Private per-repo uv cache (see Makefile UV_CACHE_DIR)
 .uv-cache/
 # Local uv python pin (machine-specific)
 .python-version