mosaicstack/stack
16
0
Fork 1
Code Issues 335 Pull Requests 15 Actions Packages Projects Releases 15 Wiki Activity

feat(#707): secure Discord service ingress #716

Merged
jason.woltje merged 1 commits from fix/tess-discord-ingress into main 2026-07-12 23:18:30 +00:00
Conversation 1 Commits 1 Files Changed 9
+484 -68
jason.woltje commented 2026-07-12 21:34:26 +00:00
Owner
Copy Link
Copy Source

Refs #707

Task: TESS-M1-SEC-004

Implements authenticated Discord ingress with default-deny allowlists, correlation metadata, and replay protection.

Refs #707 Task: TESS-M1-SEC-004 Implements authenticated Discord ingress with default-deny allowlists, correlation metadata, and replay protection.
jason.woltje added 1 commit 2026-07-12 21:34:27 +00:00
feat(#707): secure Discord service ingress
ci/woodpecker/push/ci Pipeline was successful
Details
ci/woodpecker/pr/ci Pipeline was successful
Details
2879da1f6a
jason.woltje force-pushed fix/tess-discord-ingress from 2879da1f6a to 55ae77b6fd 2026-07-12 23:01:48 +00:00 Compare
jason.woltje commented 2026-07-12 23:17:25 +00:00
Author
Owner
Copy Link
Copy Source

VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head 55ae77b6fd

Evidence:

  • Exact PR head verified: 55ae77b6fd1c8e6609eb977a4342569a2e0c1c7a.
  • PR CI green: ci/woodpecker/pr/ci pipeline 1706 success.
  • Reviewed Discord ingress hardening: service-token Socket.IO auth, HMAC-signed envelopes, gateway-side guild/channel/user allowlists, service-principal scope, correlation/message metadata, and bounded replay rejection.
  • Plugin startup fails closed when Discord is enabled without service token, service user, or default-deny allowlists.
  • No live secrets in diff; only env names and test-only fixture token strings.
  • git diff --check clean; scope stays within TESS-M1-SEC-004 Discord ingress.
VERIFIED APPROVE reviewer-of-record [W-jarvis:reviewer] head 55ae77b6fd1c8e6609eb977a4342569a2e0c1c7a Evidence: - Exact PR head verified: `55ae77b6fd1c8e6609eb977a4342569a2e0c1c7a`. - PR CI green: `ci/woodpecker/pr/ci` pipeline 1706 success. - Reviewed Discord ingress hardening: service-token Socket.IO auth, HMAC-signed envelopes, gateway-side guild/channel/user allowlists, service-principal scope, correlation/message metadata, and bounded replay rejection. - Plugin startup fails closed when Discord is enabled without service token, service user, or default-deny allowlists. - No live secrets in diff; only env names and test-only fixture token strings. - `git diff --check` clean; scope stays within TESS-M1-SEC-004 Discord ingress.
jason.woltje merged commit 119f64e69d into main 2026-07-12 23:18:30 +00:00
jason.woltje deleted branch fix/tess-discord-ingress 2026-07-12 23:18:31 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#716