feat(security): canonicalize filter modes to strict/lenient/none - #133

Merged

cuioss-oliver merged 14 commits into

mainfrom

feature/plan-15-security-pipeline-modes

Jul 30, 2026

Commits on Jul 30, 2026

feat(security): add the SecurityProfile mode set and wire the posture resolver
cuioss-oliver
committed
feat(pipeline): relocate url-parameter validation and make none a partial disable

cuioss-oliver
and
claude
committed
feat(config): refuse profile 'none' at boot on authenticated and BFF routes

cuioss-oliver
and
claude
committed
test(integration): prove the security profile modes and boot refusals in the Docker tier

cuioss-oliver
and
claude
committed
style(config): apply the pre-commit formatter to the none-refusal tests

cuioss-oliver
and
claude
committed
docs(adr): record ADR-0023 for the inbound-filter mode set and amend ADR-0019

cuioss-oliver
and
claude
committed
docs: correct the stale security-profile documentation across three doc layers

cuioss-oliver
and
claude
committed
fix(gateway): renumber the inbound-filter ADR to 0024 and align the body cap on 413

cuioss-oliver
and
claude
committed
refactor(security): share the global-profile chain and default RouteRuntime.securityConfiguration

cuioss-oliver
and
claude
committed
fix(security): re-run header-name validation under the divergent route configuration

cuioss-oliver
and
claude
committed
test(config): cover the anchor-declared security_filter profile none refusal leg

cuioss-oliver
and
claude
committed
test(it): tighten the out-of-range profile boot-failure marker to its JSON pointer

cuioss-oliver
and
claude
committed
docs(security): align the none-mode and header-cap claims with the canonical contract

cuioss-oliver
and
claude
committed
docs(architecture): name both profile-validation layers

cuioss-oliver
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(security): canonicalize filter modes to strict/lenient/none - #133

feat(security): canonicalize filter modes to strict/lenient/none#133
cuioss-oliver merged 14 commits into
mainfrom
feature/plan-15-security-pipeline-modes

Commits on Jul 30, 2026

feat(security): add the SecurityProfile mode set and wire the posture resolver

feat(pipeline): relocate url-parameter validation and make none a partial disable

feat(config): refuse profile 'none' at boot on authenticated and BFF routes

test(integration): prove the security profile modes and boot refusals in the Docker tier

style(config): apply the pre-commit formatter to the none-refusal tests

docs(adr): record ADR-0023 for the inbound-filter mode set and amend ADR-0019

docs: correct the stale security-profile documentation across three doc layers

fix(gateway): renumber the inbound-filter ADR to 0024 and align the body cap on 413

refactor(security): share the global-profile chain and default RouteRuntime.securityConfiguration

fix(security): re-run header-name validation under the divergent route configuration

test(config): cover the anchor-declared security_filter profile none refusal leg

test(it): tighten the out-of-range profile boot-failure marker to its JSON pointer

docs(security): align the none-mode and header-cap claims with the canonical contract

docs(architecture): name both profile-validation layers