chore(kan): decide empty KAN_MCP_BEARER_TOKEN runtime hygiene #723

New issue

Open

opened 2026-06-05 07:20:48 +02:00 by codex · 1 comment

codex commented

2026-06-05 07:20:48 +02:00

Collaborator

Context: post-recovery verifier shows KAN_MCP_BEARER_TOKEN as a runtime variable on kan-mcp, but the deployed value is empty. This is not an active bearer secret to rotate, but it creates confusing verifier drift.

Acceptance:

Decide whether Kan MCP should use a real bearer gate in addition to tailnet allowlist, or remove the empty runtime variable.
Keep OpenClaw/VPS1000 compatibility in mind.
Smoke /mcp/health and mcporter/OpenClaw after any change.
Do not expose or log token values.

Non-goal: do not change tailnet allowlist or public exposure in this issue.

Context: post-recovery verifier shows `KAN_MCP_BEARER_TOKEN` as a runtime variable on `kan-mcp`, but the deployed value is empty. This is not an active bearer secret to rotate, but it creates confusing verifier drift. Acceptance: - Decide whether Kan MCP should use a real bearer gate in addition to tailnet allowlist, or remove the empty runtime variable. - Keep OpenClaw/VPS1000 compatibility in mind. - Smoke `/mcp/health` and mcporter/OpenClaw after any change. - Do not expose or log token values. Non-goal: do not change tailnet allowlist or public exposure in this issue.

codex referenced this issue

2026-06-05 07:34:46 +02:00

security: rotate secrets exposed during Kan analytics deploy transcript #711

pdurlej added the

class/security-sensitive

domain:runtime

judge/operator-needed

status:operator-needed

labels

2026-06-17 23:35:36 +02:00

Iskra commented

2026-06-18 03:03:54 +02:00

Collaborator

Iskra judgment

Field	Value
Target	`pdurlej/platform#issue#723`
Priority	p2
Action	operator_needed
Scores	reach 3 / impact 3 / confidence 5
Piotr fit	high
Effort	small
Labels	`judge/p2`, `judge/operator-needed`
Judge	`iskra` via `openclaw`

Rationale: This remains P2 operator-needed runtime hygiene because an empty auth-related variable creates confusing verifier drift and should be resolved without accidentally changing exposure.

Caveat: Do not alter tailnet allowlist, public exposure, or log token material while resolving the empty runtime variable.

Structured openclaw.judge.v0 payload

<!-- openclaw.judge.v0 -->
{
  "confidence": 5,
  "effort_hint": "small",
  "escalation": {
    "kind": "operator",
    "reason": "The target is security-sensitive runtime hygiene with an explicit operator-needed status, and the choice affects auth posture around Kan MCP."
  },
  "evidence_refs": [
    {
      "note": "Issue tracks an empty KAN_MCP_BEARER_TOKEN runtime variable on Kan MCP that creates verifier drift without being an active secret to rotate.",
      "type": "forgejo",
      "value": "issue-title-body-labels-and-target-snapshot"
    },
    {
      "note": "Current labels mark the target as security-sensitive, runtime-risk, exposure-risk, secret-touch, and operator-needed.",
      "type": "forgejo",
      "value": "issue-labels-and-target-snapshot"
    },
    {
      "note": "Acceptance requires deciding bearer-gate posture versus variable removal and smoking MCP health plus mcporter/OpenClaw after change.",
      "type": "forgejo",
      "value": "issue-body-acceptance"
    }
  ],
  "impact": 3,
  "judge_actor": {
    "name": "iskra",
    "runtime": "openclaw"
  },
  "judged_at": "2026-06-18T01:01:00Z",
  "labels_to_apply": [
    "judge/p2",
    "judge/operator-needed"
  ],
  "piotr_fit": "high",
  "priority": "p2",
  "rationale_summary": "This remains P2 operator-needed runtime hygiene because an empty auth-related variable creates confusing verifier drift and should be resolved without accidentally changing exposure.",
  "reach": 3,
  "recommended_next_action": "operator_needed",
  "rerun_reason": "no_prior_judgment",
  "schema": "openclaw.judge.v0",
  "target": {
    "kind": "issue",
    "number": 723,
    "repo": "pdurlej/platform"
  },
  "target_snapshot": {
    "body_hash": "sha256:da16af51f2fd61b93b42833e641b224c0bf807cff1830c3eb7d7de1481e74b84",
    "commit_count": null,
    "evidence_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "head_sha": null,
    "labels": [
      "class/security-sensitive",
      "domain:runtime",
      "judge/operator-needed",
      "kind/ops",
      "owner-attention",
      "priority:p2",
      "risk/exposure",
      "risk/runtime",
      "safety:secret-touch",
      "status:operator-needed"
    ],
    "labels_hash": "sha256:b451cc71843ea7362dbc5620862b1b913806b6736456eda301bdccda0b7933b3",
    "state": "open",
    "title_hash": "sha256:1ab974be59a9fc543ef84580afa4f1ce72a8ad8f3ab0ba81d756e413ea483f94",
    "updated_at": "2026-06-17T23:35:36+02:00"
  },
  "top_caveat": "Do not alter tailnet allowlist, public exposure, or log token material while resolving the empty runtime variable."
}
<!-- /openclaw.judge.v0 -->

### Iskra judgment | Field | Value | | --- | --- | | Target | `pdurlej/platform#issue#723` | | Priority | p2 | | Action | operator_needed | | Scores | reach 3 / impact 3 / confidence 5 | | Piotr fit | high | | Effort | small | | Labels | `judge/p2`, `judge/operator-needed` | | Judge | `iskra` via `openclaw` | **Rationale:** This remains P2 operator-needed runtime hygiene because an empty auth-related variable creates confusing verifier drift and should be resolved without accidentally changing exposure. **Caveat:** Do not alter tailnet allowlist, public exposure, or log token material while resolving the empty runtime variable. <details> <summary>Structured openclaw.judge.v0 payload</summary> ```json  { "confidence": 5, "effort_hint": "small", "escalation": { "kind": "operator", "reason": "The target is security-sensitive runtime hygiene with an explicit operator-needed status, and the choice affects auth posture around Kan MCP." }, "evidence_refs": [ { "note": "Issue tracks an empty KAN_MCP_BEARER_TOKEN runtime variable on Kan MCP that creates verifier drift without being an active secret to rotate.", "type": "forgejo", "value": "issue-title-body-labels-and-target-snapshot" }, { "note": "Current labels mark the target as security-sensitive, runtime-risk, exposure-risk, secret-touch, and operator-needed.", "type": "forgejo", "value": "issue-labels-and-target-snapshot" }, { "note": "Acceptance requires deciding bearer-gate posture versus variable removal and smoking MCP health plus mcporter/OpenClaw after change.", "type": "forgejo", "value": "issue-body-acceptance" } ], "impact": 3, "judge_actor": { "name": "iskra", "runtime": "openclaw" }, "judged_at": "2026-06-18T01:01:00Z", "labels_to_apply": [ "judge/p2", "judge/operator-needed" ], "piotr_fit": "high", "priority": "p2", "rationale_summary": "This remains P2 operator-needed runtime hygiene because an empty auth-related variable creates confusing verifier drift and should be resolved without accidentally changing exposure.", "reach": 3, "recommended_next_action": "operator_needed", "rerun_reason": "no_prior_judgment", "schema": "openclaw.judge.v0", "target": { "kind": "issue", "number": 723, "repo": "pdurlej/platform" }, "target_snapshot": { "body_hash": "sha256:da16af51f2fd61b93b42833e641b224c0bf807cff1830c3eb7d7de1481e74b84", "commit_count": null, "evidence_hash": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "head_sha": null, "labels": [ "class/security-sensitive", "domain:runtime", "judge/operator-needed", "kind/ops", "owner-attention", "priority:p2", "risk/exposure", "risk/runtime", "safety:secret-touch", "status:operator-needed" ], "labels_hash": "sha256:b451cc71843ea7362dbc5620862b1b913806b6736456eda301bdccda0b7933b3", "state": "open", "title_hash": "sha256:1ab974be59a9fc543ef84580afa4f1ce72a8ad8f3ab0ba81d756e413ea483f94", "updated_at": "2026-06-17T23:35:36+02:00" }, "top_caveat": "Do not alter tailnet allowlist, public exposure, or log token material while resolving the empty runtime variable." }  ``` </details>

Iskra added the

judge/p2

label

2026-06-18 03:03:54 +02:00