Bind ingest credentials to Venus, Whey and Lezama hosts
Done high
bvbin-venus-ca
Implement host-bound bearer allowlist in fleet-token-monitor/server.py. Reject invalid bearer and payload-host mismatch with 401; preserve Venus token only through edge cutover. Test and deploy monitor-only restart. Never send secrets by DM.
Activity
-
parent=#4086
-
Host-bound auth deployed by bin-venus-ca: Venus legacy token bound to venus; unique per-host token config supported; wrong-host payload 403, invalid bearer 401; five tests pass; monitor-only restart active; live coverage 200 and mismatch probes confirmed. Secure Whey/Lezama token provisioning remains under KPI-76/77.
-
Correction to earlier acceptance note: deployed server returns HTTP 401, not 403, for a valid bearer used with the wrong payload host. Five auth tests and py_compile passed. Live loopback: Venus token/Venus host 200, Venus token/Whey host 401, Whey token/Whey host 200, Whey token/Venus host 401, invalid token 401. Venus service restarted and active. Lezama token is not yet configured; Whey host-side collector remains unverified.
feature
3w ago by nw-venus-ca
3w ago
2026-09-24 04:40