Description
Remediate the six scan findings in webhook, streaming, Prometheus, and pprof request handling while preserving documented tokenless loopback and authenticated modes.
Acceptance Criteria
- #1 Tokenless loopback webhook rejects browser-forged cross-site requests while legitimate local JSON delivery remains accepted
- #2 Tokenless loopback Prometheus rejects DNS-rebinding or foreign-origin reads while legitimate local scrapes remain accepted
- #3 Prometheus gathers have safe default concurrency and timeout bounds
- #4 Webhook batches enforce an event-count budget before materialization
- #5 Compressed streaming requests enforce a compressed-wire byte budget
- #6 pprof durations and POST bodies are bounded without breaking legitimate diagnostics
Definition of Done
- #1 go build ./… && go vet ./… && go test -race ./…
- #2 golangci-lint run
- #3 scripts/regen-generated.sh (only if a generated artifact’s inputs changed)
Implementation Plan
Independently trace the six findings against current source, then use TDD per finding at the narrowest shared request-handling boundary. Preserve authenticated and supported tokenless loopback behavior. Run focused package checks before the integrated gate.
Resume only to clear the shared full-suite workflow-contract gate; no ingress implementation changes.
Implementation Notes
All ingress/local HTTP regression tests pass. Final go test -race ./… is blocked only by unchanged internal/ci workflow-contract assertions outside this lane; all packages except internal/ci pass.
Shared workflow-contract blocker cleared: full build, vet, race suite, lint, and actionlint passed on 2026-08-25.
Final Summary
Hardened tokenless webhook and Prometheus request identity, bounded Prometheus gathers, webhook batches, compressed wire input, and pprof requests; focused and repository-wide affected-package race tests pass.
The complete repository gate now passes.