audit fixes (P19): cap anonymous provider spend, bound the proxy claims token, scope eval capture

[BigSimmo]

Summary

Audit remediation package P19 — Security design items, from docs/audit/full-repository-audit-2026-09-02.md (PR #2573). Findings fixed: L42, L27, L23, L68. Written test-first in this session; every fix was proved red-then-green before commit.

• c16572307 security: cap total anonymous provider-backed generation (L42)
• a47648371 security: bound and re-key the proxy claims header (L27)
• 68126e54e api: validate eval-capture chunk and file ownership (L23)
• 984a3e61b docs: record why the iPhone Playwright projects stay release-only (L68)
• d6a5eb94f tenancy: declare the eval-capture chunk lookup's ownership proof (L23)

L42 protects provider spend. The answer, streaming-answer, Clinical Ask and speech-transcription routes accept anonymous callers, limited only per hashed client IP — and every caller without a trusted forwarding header shares one unknown-ip bucket. Nothing capped total anonymous spend, so a rotating-address caller had no ceiling. There is now one shared durable bucket (anon:generation:aggregate) drawn down by all four routes on top of the existing per-caller limits, failing closed with a distinct anonymous_generation_ceiling code and a "sign in" message.

Ceiling: 300 requests per 3600 s, across all anonymous callers and all generation routes. The existing per-minute limits already bound bursts (62/min combined); this is the sustained-spend cap, roughly 5/min. Documented beside the rate-limit tables in src/lib/api-rate-limit.ts and operator-side in docs/launch-operator-runbook.md. No migration — it reuses consume_api_subject_rate_limit with a non-bucket key.

L27 removed the undeclared INTERNAL_SERVICE_KEY fallback (a secret name present in no Zod schema, no .env.example, no doc, and no env-parity list — only in tests), derived a dedicated signing key by HKDF-SHA256 of the service-role key under a fixed label rather than using that key directly, and gave the claims envelope an iat with a 60 s verification window (5 s future skew). The compare stays constant-time.

L23 filters top_chunk_ids, cited_chunk_ids and top_files through the owner-scoped document check before insert, with rejections counted alongside the existing malformed-id tally. No scoring, fixture or harness change.

L68 — decided rather than deferred. The iPhone browser projects stay release-only. Promoting them would need an edit to ci.yml, which another package owns, and the timing evidence rules it out regardless: each iPhone project replays the whole production suite, the last recorded full matrix took 38 minutes for three such suites against a 70-minute job timeout, and docs/ci-operations.md records a ~70-minute matrix holding main. Phone behaviour already has a focused blocking owner in verify:phone-chrome. Recorded in docs/testing.md with a cadence table, the accepted residual risk, and a new fail-closed test so no Playwright project can go silently unused again.

Findings in this package not fixed here, with reasons:

• L41 — pinning the Node and gh tarball checksums requires fetching upstream SHASUMS, a network call this work was not authorised to make.

RAG impact: no retrieval behaviour change — eval-case capture validates ownership only; no ranking, ordering, selection, fixture or harness scoring change, and no file under src/lib/rag/** was touched.

Verification

• npm run verify:pr-local — - failed: (none) · - not reached: (none)
• npm run check:diff-integrity — [diff-integrity] PASS — 5 changed test file(s), 23 -> 39 test case(s). No test deleted, skipped or weakened.
• Two existing tests were strengthened, not relaxed. tests/api-rate-limit-fallback.test.ts pinned the anonymous RPC call count; both cases now expect one MORE call (2→3 and 1→2) plus a new assertion that the aggregate bucket is consumed. Verified by reading the diff.
• Red-then-green per finding: L42 failed with bucket answer must consume the aggregate ceiling: expected [] to have a length of 1 but got +0, then Tests 6 passed. L27 failed with expected [ …(2) ] to have a length of 3 and a stale-header expected '…' to be null, then Test Files 2 passed / Tests 13 passed. L23 failed with expected [ …(2) ] to deeply equal [ Array(1) ], then Tests 9 passed. L68 failed with Playwright project "mobile-webkit" is selected by no npm script and documented in no cadence record, then 2 passed.
• npx vitest run over all 12 touched suites — Test Files 12 passed (12) / Tests 264 passed (264); tsc --noEmit exit 0; eslint --max-warnings 0 exit 0; Prettier clean.
• npm run check:owner-scope — ✓ owner-scope phase 1: 60 src/app/api files clean against 26 owner-scoped tables. · ✓ owner-scope phase 2: 87 direct, 18 user-keyed, 30 derived-tier, 1 untiered-table and 1 dynamic-table-dispatch queries scoped on their chain or declared
• npm run plan:browser -- --dry-run — level full; not run, browser proof left to CI.

One point worth a reviewer's attention. The L23 ownership filter must look up chunks by the ids the caller supplies, so that query cannot carry an owner filter on its own chain. The repository's mechanical tenancy scan correctly refused it as an undeclared derived query, failing the gate. It is now declared in scripts/lib/tenancy-scan.mjs under proof kind parent-document-verified — a kind the scanner re-checks in the AST rather than accepting on trust. The proof: the chunk rows are intersected with a documents read filtered on .eq("owner_id", ownerId) in the same function, and only chunk ids whose document appears in that owner-scoped result are returned.

Verification not run: npm run verify:ui — browser proof left to CI; the pinned Chromium is not installed in this container.
Verification not run: npm run verify:release — no release or handoff confidence is claimed.
Verification not run: provider-backed gates — nothing here reaches OpenAI, Supabase, Railway or Sentry at run time; all work was offline.

Note: origin/main was merged in (not rebased) after the gate ran, to pick up #2610. The merge was clean, no file overlaps this package's diff, and the three primary suites were re-run afterwards: Test Files 3 passed (3) / Tests 72 passed (72).

Risk and rollout

• Risk: medium. L42 can refuse anonymous generation that previously succeeded — that is the intent, and signed-in callers are unaffected. L27 changes an internal signing key derivation and adds an expiry, so a stale in-flight header is now rejected after 60 s; the header is stripped unconditionally at the proxy boundary, so there is no external contract to break. L23 narrows what an administrator can capture into eval cases.
• Rollback: revert this pull request's commits; each is one finding and reverts independently.
• Provider or production effects: None at run time. The intended production effect is a reduction in worst-case anonymous provider spend.
• RAG impact: no retrieval behaviour change — eval-case capture validates ownership only.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
  unchanged; no citation, verification or answer-content path touched.
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
  none introduced or expanded.
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
  no Supabase env value, migration target or configured project changes; no migration ships here.
• Service-role keys and private document access remain server-only
  tightened: the service-role key is no longer used directly as a signing secret, and its undeclared fallback secret name is removed.
• Demo/synthetic content remains clearly separated from real clinical sources
  unchanged.
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
  unchanged.
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed
  reviewed; no decision-support behaviour changes — these are access, spend and ownership controls.

Notes

• One owner per file across the remediation programme: no other open remediation pull request edits these files.
• .github/workflows/ci.yml was deliberately not touched; another package owns it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DHSyfuC6mS98ystWFiitAR

---

Generated by Claude Code

---

Note

Medium Risk
Changes affect anonymous API availability (new hard spend ceiling), internal auth header verification (stale headers fail), and what admins can persist in eval cases; authenticated core paths are mostly unchanged but misconfiguration could block legitimate anonymous use.

Overview
Audit remediation (P19) tightens anonymous provider spend, internal proxy auth, and eval-case capture tenancy, plus documents Playwright iPhone project cadence.

Anonymous generation ceiling (L42). api-rate-limit.ts adds a site-wide durable bucket (300 requests / hour) shared by anonymous answer, clinical_ask, speech_transcription, and streamed document summaries, applied after per-caller limits. Over-limit responses use 429 with code anonymous_generation_ceiling and a sign-in message (distinct from rate_limited). Authenticated traffic is unchanged. The operator runbook now states this is the enforced cap, not spend alerts alone.

Proxy claims header (L27). proxy-auth-crypto.ts derives an HMAC key via HKDF from the service-role key (no direct signing, no INTERNAL_SERVICE_KEY fallback), stamps issued-at in a three-part envelope, and rejects stale or legacy two-part headers within a 60s window.

Eval capture ownership (L23). eval-cases/route.ts filters sourceChunkIds, citedChunkIds, and sourceFiles through batched ownedChunkIdSet / ownedFileNameSet checks against documents.owner_id; rejections are tallied in metadata (top_files_rejected, existing chunk reject counts). The tenancy scanner registers the chunk lookup under parent-document-verified.

Testing docs (L68). docs/testing.md adds a Playwright project cadence table and rationale for keeping mobile-webkit and mobile-pwa-standalone release-only; playwright-project-cadence.test.ts fails if any project lacks script or doc coverage.

^{Reviewed by Cursor Bugbot for commit 5fb9a68. Configure here.}

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: b8cfbac9-b58a-4e1f-b703-48ced34cac6d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_8d59a262-c0c4-4784-81d3-dcdb2da85e8a)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_9cb2e75f-ab4f-4096-8f10-085dbf62ae87)

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Lighthouse budget — not baselined: this job did NOT run on the main comparison below (path-scoped skip), so that run says nothing about it either way. Treat the comparison as absent, not green, and inspect the failing step.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #15687 (success). That run's conclusion is an aggregate and did not exercise Lighthouse budget.

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.