[E00-S04-T04] No module reads process.env except configuration adapter #403

Merged

kpcto merged 9 commits from feature/185 into main 2026-08-30 05:02:49 +00:00

Conversation 0 Commits 9 Files Changed 16

+1447 -86

9 Commits

Author	SHA1	Message	Date
implementer	ffda249617	docs: document HOST validation and bind control (E00-S04-T04) ... The non-container guide now notes that HOST is validated at the adapter boundary as a hostname/IP (invalid values fail startup naming the field) and that the server passes config.host to server.listen, so a configured HOST binds exactly that interface and the startup log reflects the actual bind. The config-env-adapter CI job comment is refreshed to describe the extended suite (HOST validation + loopback-only boot probe).	2026-08-30 04:42:06 +00:00
implementer	408f33e4e9	test: lock in HOST validation and bind-interface control (E00-S04-T04) ... Extend the env-adapter suite to the issue's reworked acceptance criteria: - static assertions: the adapter resolves HOST via resolveHost (hostname/IP at the adapter boundary) and the server passes config.host to server.listen - deterministic boundary probe: valid HOST forms (IPv4/IPv6/hostname) pass, invalid HOST forms throw ConfigStartupError naming host - boot probes: HOST=127.0.0.1 binds loopback only (no answer on a non-loopback interface) with the startup log reflecting the actual bind; an invalid HOST exits non-zero naming the field without echoing the raw value - mutation probes: bypassing resolveHost or dropping config.host from server.listen both fail - config-startup-error: update the order-asserion mutation probe for the new server.listen(config.port, config.host, ...) signature	2026-08-30 04:42:03 +00:00
implementer	345ceccfad	feat: HOST validated at the adapter boundary and controls the actual bind interface (E00-S04-T04) ... The environment adapter now resolves HOST through resolveHost, validating it at the adapter boundary as a hostname (RFC 1123) or IP address (IPv4/IPv6, node:net isIP); an invalid HOST throws a field-specific ConfigStartupError naming host, so arbitrary env content is never used for binding or echoed verbatim into the startup log (issue acceptance criterion, resolving security review finding SEC-3). The server passes config.host to server.listen(config.port, config.host, ...), so a configured HOST binds exactly that interface and the startup log never claims a bind the process does not enforce (resolving SEC-2).	2026-08-30 04:41:53 +00:00
implementer	73a1ae88cd	chore: drop unused mkdirSync import in the env-adapter suite (E00-S04-T04)	2026-08-30 04:18:11 +00:00
implementer	b9345e205c	docs: document the environment adapter in the non-container guide (E00-S04-T04)	2026-08-30 04:17:22 +00:00
implementer	3214807c9d	test: update suites locked to the old direct process.env wiring for the adapter (E00-S04-T04)	2026-08-30 04:17:22 +00:00
implementer	20173a8241	test: lock in the env adapter as the single owner of process.env with static scan, mutation and deterministic probes (E00-S04-T04)	2026-08-30 04:17:22 +00:00
implementer	1214a33adb	feat: server loads all settings through the config environment adapter (E00-S04-T04)	2026-08-30 04:17:19 +00:00
implementer	7aeeeaaa97	feat: environment adapter is the single owner of process.env reads (E00-S04-T04)	2026-08-30 04:17:19 +00:00