[calvin-archastro]

Review on ArchCode

Merge order: after #191 (merged). This PR changes only the version (Cargo.toml and Cargo.lock), because release.yml requires the tag to match Cargo.toml. After merging, tag v0.24.1 on the merge commit. The third independent review covers v0.24.0..v0.24.1 before any deploy.

Releases (since v0.24.0). v0.24.0 is not deployed; deploy v0.24.1 instead. Everything in the v0.24.0 notes (sign-in, /v1 reads, accepted risks, upgrade notes) still applies.

Security fixes from the second review (#191)

1. N1: cache-writer routes check the whole writer policy (repo allowlist, owner-id pin, writer ref, event_name=push, ci.yml@ prefix) before reading any body. A semaphore bounds concurrent large bodies.
2. N2: uploaded test runs are tied to the uploading job's OIDC claims (run id prefix gh:<repo>:<run>:<attempt>:, sha must match the token, branch and attempt come from the claims). Quarantine uses only trusted default-branch evidence.
3. N3: short body timeout on unauthenticated routes, a per-IP connection cap, and idle keep-alive bounded by the header timeout.
4. N4: with ASTER_SRV_API_ADDR set, the server refuses to start on static tokens, the dev blob route, an allowlisted repo without an owner-id pin, an unset writer-workflow list, or trusted_proxy_hops=0. The owner check fails closed.
5. N5: cache lookups are bounded: 4096 blobs per lookup, 16 concurrent per request, a 3s budget (the rest are misses), 1h existence memory, signed-URL reuse, and a global signBlob rate bound. Measured: 512 blobs 17.5s → 1.11s cold, 23ms warm.
6. N6: every aster-srv client refuses http:// except to loopback.
7. N7: sharded rate-limit overflow, so a flood of keys can't starve real subjects.
8. N8, N9: README runbooks for revoking a departed person (SQL tested verbatim) and rotating ASTER_SRV_CLI_TOKEN_KEYS. ASTER_SRV_PERSON_TOKENS is in the env table.
9. N9b: a failed or unknown-kid key fetch no longer hides a real rotation for 60s (person tokens and IAP).
10. N10: a run id from another repo returns a plain 404.
11. N11: the confirm page labels each detail by its source. Copy mode and the CLI paste prompt warn against codes someone else sent.
12. N12: repeated X-Forwarded-For lines are joined into one list before the trusted hop is chosen.
13. N13: only writer-eligible CI lookups update hit counts and last-used.
14. N15: 401 logging is sampled per (reason, route, client IP), with exact counters.
15. N14 (Cloud Armor) is in firstlanding #19927.

Upgrade notes

• New startup refusals with ASTER_SRV_API_ADDR set (N4): set ASTER_SRV_REPOSITORY_OWNER_IDS for every allowlisted repo, ASTER_SRV_CACHE_WRITER_WORKFLOWS, and a non-zero trusted proxy hop count. firstlanding #19856 already sets all of these.
• Migration at startup: test_results v7 (additive).
• Test-result uploads need per-run OIDC claims (N2): the run id must start with gh:<repo>:<run_id>:<run_attempt>: from the uploading job's token. Clients since at least 0.20.0 build it that way; firstlanding CI pins 0.22.0.
• aster-srv URLs must be https (N6) unless they point at this machine.
• ASTER_SRV_CLI_TOKEN_TTL is capped at 43200s (12h); the doc comment now says so.

Scope

Release metadata only. The code is in #191.

Risk

Low for this PR (version only). The release risk is in #191 (medium: auth boundary and resource limits, each with a test).

User impact

None from this PR. The release: clearer confirm-page labels, the paste warning, and cold lookups on big CI builds answer within about 3s with partial hits instead of timing out.

Verification

cargo metadata --locked confirms that the lockfile matches the bump. CI on this PR and the tag's verify job run fmt, clippy and the full test suite.

🤖 Generated with Claude Code