[calvin-archastro]

Review on ArchCode

Merge order: after the second independent security review of v0.23.1..616b232. This PR changes only the version (Cargo.toml and Cargo.lock), because release.yml requires the tag to match Cargo.toml. After merging, tag v0.24.0 on the merge commit.

Releases (since v0.23.1):

Sign-in and read access for people (aster-srv /v1 without IAP)

1. aster cache login signs a person in through aster-srv: a browser confirm page behind IAP, PKCE, and a single-use code. It mints a read-only, aster-srv-signed token (feat: laptop cache login through aster-srv (aster cache login, person tokens) #182).
   • Copy-code mode for SSH and devboxes (feat(cache): copy-code login for remote shells, logout and sign-in hardening #185).
   • aster cache logout revokes every earlier token for that person (feat(cache): copy-code login for remote shells, logout and sign-in hardening #185).
2. People read every dashboard dataset over /v1 JSON. aster srv cache|flaky|broken|clusters|quarantine|test <id>|get <path> sends the stored token (feat(aster-srv): person tokens read every dashboard dataset; aster srv; route-table auth gate #189).
3. Hardening (feat(aster-srv): harden the non-IAP /v1 channel #188, feat(aster-srv): person tokens read every dashboard dataset; aster srv; route-table auth gate #189, feat(cache): copy-code login for remote shells, logout and sign-in hardening #185):
   • A /v1-only listener.
   • Deny-by-default auth at the router.
   • Strict person-token claims: sub, nbf, iat, jti, a 12h cap, and kid rotation.
   • Per-IP and per-subject rate limits, body caps and timeouts.
   • An audit log and metrics.
   • Fail-closed config.
   • CI cache writes need event_name=push, ref=main, the workflow prefix, and the pinned owner id.
4. Remote cache: a one-line remote: N hits / M misses / K uploads summary per run. A timed-out batch lookup no longer turns the remote off for the whole run (feat(cache): one-line remote cache summary; batch lookup timeout no longer disables the remote #183).
5. Flaky detection: one incident per shared-cause failure, and a per-run quarantine cap (fix(aster-srv): count one failure once; shared-cause failures are one incident #186). Declared test reports via [targets.X.report] (feat: declared test reports for runners hidden behind scripts #187).

Accepted risks (Calvin, 2026-10-23)

• 12h person-token lifetime, no refresh token. Tokens are read-only, and per-person revoke (aster cache logout) and the ASTER_SRV_PERSON_TOKENS=off kill switch bound the exposure. A refresh token would be a second long-lived secret.
• pull_request runs may still upload test results; cache writes are push-only. A test that passes on retry inside a PR is the main flaky signal. Cache poisoning stays closed: writes need a push to main from ci.yml with the pinned owner id. Uploads still refuse pull_request_target, other workflows, and repos off the allowlist.
• The OWASP WAF skips the authenticated CI body routes (POST /v1/test-results/runs, POST /v1/cache/{upload,commit,lookup}). Their free-text bodies false-positive on the signatures. These routes need a verified GitHub OIDC token before the body is read.

Upgrade notes

• Everyone signs in again. Tokens in the feat: laptop cache login through aster-srv (aster cache login, person tokens) #182 shape are rejected.
• Regenerate ASTER_SRV_CLI_TOKEN_KEYS. Keys must be base64 or hex of at least 32 random bytes.
• Required server config when sign-in is on: ASTER_SRV_PUBLIC_URL (https), ASTER_SRV_IAP_AUDIENCE (exact /projects/<n>/global/backendServices/<id>), and ASTER_SRV_UI_EMAIL_DOMAINS.
• Required with ASTER_SRV_CACHE_WRITERS: ASTER_SRV_CACHE_WRITER_WORKFLOWS.
• New: ASTER_SRV_API_ADDR, ASTER_SRV_REPOSITORY_OWNER_IDS, ASTER_SRV_PERSON_TOKENS, and ASTER_SRV_QUARANTINE_RUN_CAP (default 10).
• Migrations run at startup: auth (revocations, code subject, user code) and test_results v6 (target incidents, backfilled).
• [targets.X.report] in aster.toml is rejected by older aster (deny_unknown_fields). Declare reports only after the repo pins ASTER_VERSION ≥ 0.24.0 and dev machines have upgraded.
• Database connections: up to 18 Postgres connections per replica (shared pool plus a 2-connection sign-in pool).

Verification

cargo metadata --locked confirms that the lockfile matches the bump. CI on this PR and the tag's verify job run fmt, clippy and the full test suite.

🤖 Generated with Claude Code