Proposal: gate-hosted-owner-exposure

in progresstasks12/16gate-hosted-owner-exposure

openspec/changes/gate-hosted-owner-exposure/View on GitHub →

Artifacts

Official change artifacts tracked under openspec/.

Two confirmed vulnerabilities (program audit wave 2, S-1 + S-2) let an internet-facing reference deployment expose its owner control plane to anyone:

Design

Not present for this change.

Tasks (12/16)

Spec Deltas (1)

Affected capabilities

Capability specs this change proposes to modify.

reference-implementation-architecture (delta)

The reference implementation SHALL distinguish a local-development posture (loopback, password-optional convenience) from a hosted posture (internet-facing intent) and SHALL NOT silently expose the owner control plane when no owner password is configured.

reference-implementation-architecture