fix(security): read provider host allowlist from KV at request time

[cursor]

Summary

• Rebase the unique KV allowlist slice (a50911f) onto the current honesty-stack landing vehicle fix(api): fail-closed seed/stop/n/logprobs on tools passthrough #601 (7e9a339), which already includes omit-real tool.function nulls and streamed request temperature.
• Request-time egress still reads provider_egress.allowed_provider_hosts from the process-wide runtime ConfigStore via allowed_provider_hosts(). CONTEXTUAL_ORCHESTRATOR_ALLOWED_PROVIDER_HOSTS is bootstrap transport only (seed_provider_egress_from_environ in __main__.main and serve()).
• Close the review gaps on fix(security): read provider host allowlist from KV at request time #598: a second seed() after an env edit must keep the first set; _validate_provider with env-only example.com and an empty process store must not reject https://api.openai.com; a detached get_config_store() write is not the request-time source; seed read+write holds _runtime_lock; _parse_host_allowlist has a Hypothesis / exercise_host_allowlist fuzz seam.
• Docs state the process store is InMemoryConfigStore unless bootstrap installed another backend with set_runtime_config_store(). Writes to a new Postgres com_config instance are ignored.

Merger next action

• Prefer this PR over fix(security): read provider host allowlist from KV at request time #598. fix(security): read provider host allowlist from KV at request time #598 is the same unique allowlist commit stacked on fix(api): fail-closed empty messages on tools passthrough #589, not on fix(api): fail-closed seed/stop/n/logprobs on tools passthrough #601, and is missing the seed-once / process-store contract tests.
• Do not merge fix(security): read provider host allowlist from KV at request time #598, fix(api): fail-closed empty messages on tools passthrough #589, or fix(api): fail-closed stream, model, and sampling range on tools passthrough #591 in parallel with this head.
• Independent non-author APPROVE still required. Product gates: Full unit + Semgrep.

Test plan

• python3 tests/test_provider_host_allowlist_kv.py
• python3 tests/test_security_hardening.py
• python3 tests/test_self_check.py test_paper_contracts.py test_conventions.py test_api_contract.py test_product_planning_contract.py
• python3 tests/test_provider_tls.py test_provider_reliability.py test_repository_security_metadata.py
• Hypothesis test_host_allowlist_parser_never_crashes
• CI Full unit + Semgrep

Buyer next action

Call set_runtime_config("provider_egress", "allowed_provider_hosts", "api.example.com") (or start the process with CONTEXTUAL_ORCHESTRATOR_ALLOWED_PROVIDER_HOSTS set so bootstrap can copy it once). Do not write the key only into a new get_config_store(postgres_dsn=...) instance. Do not expect a later env edit to change egress on a live process.

References

• Joint Task Force. (2020). Security and privacy controls for information systems and organizations (NIST Special Publication 800-53 Rev. 5). https://doi.org/10.6028/NIST.SP.800-53r5
• International Organization for Standardization. (2022). Information security, cybersecurity and privacy protection — Information security controls (ISO/IEC 27001:2022). https://www.iso.org/standard/27001

  

[cursor]

Stale comment

Parallel successor note — rebase onto #613, do not land this stack beside #601

This KV allowlist slice (c91629e on #601 7e9a339) is still the right unique work. Do not merge #598 or draft #607 in parallel.

The mode/trace fail-open that was listed as the next honesty slice is now #613 (37f1224): _validate_chat_passthrough_orchestration_controls before proxy_completion. Live HTTP on #601: tools + mode=explode billed a chat.completion.

Merger next action: land #613 as the honesty tip, then rebase these two unique commits (af26158, c91629e) onto that tip. Do not open a third ALLOWED_PROVIDER_HOSTS PR. Independent non-author APPROVE + Full unit / Semgrep still required. This automation will not approve or merge.

Buyer next action after this lands: seed provider_egress.allowed_provider_hosts in the KV (or start once with CONTEXTUAL_ORCHESTRATOR_ALLOWED_PROVIDER_HOSTS so bootstrap can copy it). Do not expect a later env edit to change egress on a live process.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Unique slice (7e9a339..c91629e) — ready for an independent reviewer

The two unique commits are the right ALLOWED_PROVIDER_HOSTS work. ModelClient._validate_provider reads allowed_provider_hosts() only. seed_provider_egress_from_environ() copies env into provider_egress.allowed_provider_hosts once, under _runtime_lock. Detached get_config_store() writes are not the request-time source. Local scripts printed ok: tests/test_provider_host_allowlist_kv.py, tests/test_security_hardening.py, tests/test_conventions.py.

Do not merge #598 or draft #607 in parallel. Do not open another allowlist PR.

Landing order

• Prefer #616 (fe444d2 on this tip) when landing allowlist plus trusted-trace email together. This PR remains the allowlist-only slice.
• #613 (37f1224) is the mode/trace honesty tip on the same #601 substrate. Rebase #613 onto this tip or onto #616 after the allowlist lands. Do not merge this stack and #613 onto main side by side.
• Independent non-author APPROVE plus Full unit / Semgrep are still required. This automation will not approve or merge.

Buyer next action

Seed provider_egress.allowed_provider_hosts on the process runtime ConfigStore (or start once with CONTEXTUAL_ORCHESTRATOR_ALLOWED_PROVIDER_HOSTS so bootstrap can copy it). Do not edit the env var on a live process and expect egress to change. Do not write the key only into a new get_config_store(postgres_dsn=...) instance.

Next unique slice after this lands: move remaining __main__.py bootstrap tokens into the credential KV. Do not wait on queued Checks to start that work.

  

_{Sent by Cursor Automation: Fix Issues}