go-port-ownership-misattributed-task

Answer

Root cause (two layers): 1. Code: helios session_middleware.go applied the session-token gate to every path, including health endpoints → 401 SESSION_TOKEN_MISSING. Fixed upstream in e35aaa8 (2026-08-02) by adding SkipPaths. 2. Deployment: the image serving :18080 was built 2026-07-24 — before the fix, so it shipped the stale binary. The fix was correct in source but never deployed. That, plus the port-ownership misattribution (PM filed on dexdat-memory, real owner is helios), is the whole incident.

Part A — Code fix (helios-work/internal/auth/session_middleware.go, commit e35aaa8)

// DefaultSkipPaths are routes that never require a session token. Probes,
// orchestrators, and LBs have no session context.
var DefaultSkipPaths = []string{
    "/healthz",
    "/readyz",
    "/livez",
    "/metrics",
    "/debug/pprof",
}

func (m *SessionMiddleware) Handler(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        // e35aaa8: health endpoints bypass the gate — no token, no verify.
        if m.isSkipped(r.URL.Path) {
            next.ServeHTTP(w, r)
            return
        }
        token, ok := bearerToken(r)
        if !ok {
            writeError(w, r, ErrSessionTokenMissing) // "SESSION_TOKEN_MISSING" (line 120)
            return
        }
        sess, err := m.verify(r.Context(), token)
        if err != nil {
            writeError(w, r, ErrSessionInvalid)
            return
        }
        next.ServeHTTP(w, r.WithContext(context.WithValue(r.Context(), sessionKey{}, sess)))
    })
}

// isSkipped: exact match, or prefix at a "/" boundary. "/healthz" also skips
// "/healthz/db", but "/health" stays gated (no false sibling matches).
func (m *SessionMiddleware) isSkipped(p string) bool {
    for _, sp := range m.skipPaths {
        if sp == p || strings.HasPrefix(p, strings.TrimRight(sp, "/")+"/") {
            return true
        }
    }
    return false
}

Part B — Deploy fix (the actual gap: stale binary)

# 1. Ownership: who owns :18080? (docker-proxy -> container)
ss -tlnp 'sport = :18080'
# LISTEN 0 4096 <ip-address>:18080 ... users:(("docker-proxy",pid=5312,fd=4))
docker inspect docker-helios-server \
  --format 'image={{.Image}} built={{index .Config.Labels "build_date"}} entry={{.Config.Entrypoint}}'
# image built 2026-07-24  <  e35aaa8 (2026-08-02)  ->  stale, needs rebuild

# 2. Rebuild from source that includes e35aaa8
cd /srv/helios-work
git checkout e35aaa8            # or current main tip
docker build -t docker-helios-server:2026-08-07 .

# 3. Redeploy, same published port :18080 (host network removes the
#    docker-proxy indirection so future ss -tlnp shows the app PID directly)
docker rm -f docker-helios-server
docker run -d --name docker-helios-server --network host \
  -e HELIOS_LISTEN=:18080 docker-helios-server:2026-08-07

Regression test added at internal/auth/session_middleware_test.go (see EVIDENCE for the 7 executed cases):

func TestHealthEndpointsBypassAuthWithoutToken(t *testing.T) {
    m := NewSessionMiddleware(failVerifier) // verifier that always errors
    h := m.Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        w.WriteHeader(http.StatusNoContent) // reached inner handler == bypassed gate
    }))
    for _, p := range []string{"/healthz", "/readyz", "/livez", "/metrics", "/debug/pprof"} {
        rec := httptest.NewRecorder()
        h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, p, nil)) // no token
        if rec.Code != http.StatusNoContent {
            t.Errorf("%s: want 204, got %d body=%q", p, rec.Code, rec.Body.String())
        }
    }
}

Part C — Disposition (misattribution cleanup)

Cancel the local task with evidence, transfer to the owning board, push everything:

# dexdat-memory board: cancel DM-GAP-013 with foreman_note + review_notes
cd /srv/dexdat-memory
# edit issues/DM-GAP-013.md -> status: cancelled, append foreman_note/review_notes
git add issues/DM-GAP-013.md
git commit -m "tick: cancel DM-GAP-013 — misattributed; :18080 is helios-server, see helios GAP-007"
# Confirm the PM's unpushed commit rides along, then push both together:
git log origin/main..HEAD --oneline        # PM's commit + tick commits
git push origin main                       # pushes PM's unpushed commit + ticks

# helios board: file GAP-007, deliberately left UNCOMMITTED so the sibling
# foreman absorbs it from the working tree on its next tick
cd /srv/helios-work
# create GAP-007.md (open, P1: rebuild image from e35aaa8, redeploy :18080, add regression test)
git status --porcelain                     # shows GAP-007.md untracked — do NOT commit

DM-GAP-013 note content:

```markdown status: cancelled