[scan] Phase 1 auth/security fixes under 0.19.0 CHANGELOG

CHANGELOG.md

@@ -22,6 +22,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 - **Conventions + release-readiness I/O no longer blocks the API event loop.** `ConventionsService.get_map/health/restore` and `ReleaseManagerEngine._production_assess` ran sync `git rev-parse`, filesystem walks, and yaml parses inline on the orchestrator's shared uvicorn event loop, stalling API responsiveness during conventions reads (reachable from `GET /api/projects/{id}/conventions` and the agent spawn-prepare path) and the release-manager background loop. Each blocking call is now wrapped in `asyncio.to_thread` at the async boundary; no signature changes. A concurrency audit confirmed the rest of the heavy paths (agent spawn via `docker run -d`, the video render loop, git ops via the 16-worker ThreadPoolExecutor, workspace subprocess calls) already offload correctly — no API/worker container split is warranted.
 
+### Security
+
+- **Agent-token 401 signature-mismatch loop (root cause).** The agent HMAC token was signed over the agent **slug** while the MCP servers sent `X-Agent-ID` as the **UUID** (since 2026-05-02 / 453a7ae2), so once MCP servers started forwarding the token (6ed4e139 / 53391f22) every agent→API call failed `verify_agent_token` with "signature mismatch" and the `pr_reviewer`/agent fleet 401-looped. The token is now signed over the UUID, the container env sets `ROBOCO_AGENT_ID` to the UUID, and the orchestrator self-heal resolves slug→UUID before verifying — so a stale slug-signed token is correctly rejected and reissued. Closes the 0.19.0 prod `pr-reviewer-1` 401 class.
+- **Cloud-auth header-spoof hole closed for every role (C1).** `get_current_agent_id` / `get_current_agent_slug` (the A2A, notification, and stream endpoint deps) routed through header-trust even under cloud auth, so a bare `X-Agent-ID` spoofed any non-CEO role. Both now delegate to `_cloud_auth_agent_context` when `cloud_auth_enabled` is on — a verified agent HMAC token resolves the real identity, a CEO session cookie resolves to `ceo`, and a bare header is 401. Dev mode (cloud auth off) is byte-for-byte unchanged.
+- **UNSIGNED agent token omitted at the sixth header builder (H1).** `mcp/utils._get_agent_headers` still sent `X-Agent-Token: UNSIGNED` (the dev-mode sentinel) — the 2b8bc10d fix covered the other five builders. The sentinel is now omitted, matching the rest, so an UNSIGNED token never reaches the API middleware to be rejected as a signature mismatch.
+- **Startup guard: cloud auth + nginx CEO-token is a misconfig (H2).** `ROBOCO_CLOUD_AUTH_ENABLED=true` with a set `ROBOCO_PANEL_AGENT_TOKEN` (nginx CEO-token injection) now fails loud at startup — the injected token is an alternative human-auth tier that bypasses the login cookie, so layering both is a public-exposure footgun the operator must resolve by unsetting the token.
+- **Panel auth-probe last-known-good cache (C2).** `panel/src/proxy.ts` re-probed `/api/auth/status` on every request and failed open to `false` (cloud auth off) on any probe error, so a transient orchestrator hiccup could silently un-gate the dashboard. The probe result is now cached for 30s and reused on a probe failure; only when there is no fresh cache does it fail open to the safe `false` default.
+- **Per-IP rate limit on `POST /auth/login` under cloud auth (L31).** A `LoginRateLimiter` middleware (mounted only when cloud auth is on) increments a Redis key `auth:login:rl:{ip}` with a 60s TTL and returns 429 past `ROBOCO_LOGIN_MAX_ATTEMPTS` (default 10) so the CEO login endpoint can't be brute-forced. Non-login paths pass through; on Redis-down it fails open (login is already password-gated). Production opens a per-request Redis connection; `app.state.login_redis` is a test seam.
+
 ## [0.18.0] - 2026-07-04
 
 ### Added