fix(docs): correct two stale THREAT_MODEL.md line anchors for auth_middleware.py

[mrveiss]

Thinking Path

Found while diagnosing red python-suite shards on #17016 (an unrelated PR): repo_tests/threat_model_anchors_resolve_test.py::test_anchor_points_at_its_symbol failed for two symbols in autobot-backend/auth_middleware.py. Confirmed the drift exists on origin/main itself, not a stale-branch artifact -- check_admin_permission is really defined at line 964 but THREAT_MODEL.md cites :967, and verify_internal_api_key is really at 951 but cited as :954. Both off by exactly 3 lines, consistent with #17042 (which touched auth_middleware.py) adding lines above both functions without updating the doc's anchors.

What Changed

• docs/developer/THREAT_MODEL.md: corrected both anchors (:967 -> :964, :954 -> :951) to match the real current line numbers.

Verification

$ python3 -m pytest repo_tests/threat_model_anchors_resolve_test.py -q
41 passed

Failed with the exact two assertions this fixes before the change; all 41 pass after.

Model Used

Claude Sonnet 5

Single-issue rationale

A base-branch doc/code drift blocking a repo-wide guard test for every PR; needs its own immediate, minimal fix rather than riding along with unrelated work.

Issue Link

No issue -- a two-line doc-anchor fix this PR both finds and fixes; filing one would only add ceremony ahead of a fix already verified and ready to land.

Checklist

• Tests added/updated and passing locally
• No hardcoded values introduced
• Commit message follows <type>(scope): <description> (#issue)

Summary by CodeRabbit

• Documentation
  • Updated line references in the threat model to reflect current implementation locations.
  • No behavioural or security-rule changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: mrveiss/AutoBot-AI/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3aa9fa47-deb7-49ae-a282-758a14dbc5ab

📥 Commits

Reviewing files that changed from the base of the PR and between 4f09d9c and 11d13ee.

📒 Files selected for processing (1)

• docs/developer/THREAT_MODEL.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The threat model updates the declaration line references for check_admin_permission and verify_internal_api_key. No behaviour or security rule changed.

Changes

Threat model references

Layer / File(s)	Summary
Update security check references docs/developer/THREAT_MODEL.md	The references for check_admin_permission and verify_internal_api_key now use their current declaration lines. The required admin dependency and service-to-service authentication rule remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: correcting two stale line anchors in THREAT_MODEL.md for auth_middleware.py.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• chore(train): security-kb + docparser vehicle — 4 approved members, supersedes #17046 and #17063 #17077 chore(train): security-kb + docparser vehicle — 4 approved members, supersedes chore(vehicle): land security & KB hardening — 5 approved PRs (#16930, #16895, #16937, #16954, #16989) #17046 and chore(vehicle): land document-parser stack — 3 approved PRs (#16783, #16788, #16790) #17063
• fix(reconciler): stop a DB-level failure poisoning the heartbeat session (#17070) #17075 fix(reconciler): stop a DB-level failure poisoning the heartbeat session (bug(slm): one DB timeout in heartbeat service sync poisons the session — every remaining service fails with PendingRollbackError, and logins time out #17070)
• refactor(approvals): unify the general and LLC approval systems (#17043, #17056) #17072 refactor(approvals): unify the general and LLC approval systems (refactor(approvals): consolidate the general and LLC approval systems into one platform approval service with optional company scope (#17038) #17043, fix(approvals): approval-gate comments are recorded as author_type=human whoever the caller is #17056)
• security(desktop): authenticate to VNC server-side, close the VITE_* password leak (#16299) #17069 security(desktop): authenticate to VNC server-side, close the VITE_* password leak (security: guessable default credentials ship in templates, ansible defaults and the compose file #16299)
• chore(deps): bump the uv group across 1 directory with 2 updates #17066 chore(deps): bump the uv group across 1 directory with 2 updates
• chore(vehicle): land ChatInterface fixes — 2 approved PRs (#16472, #16911) #17064 chore(vehicle): land ChatInterface fixes — 2 approved PRs (feat(collaboration): surface pending invitations in the collaboration panel (#16470) #16472, fix(chat): the init stops at its first await once the component unmounts (#16274) #16911)
• chore(vehicle): land ansible provisioning fix — 1 approved PR (#17037) #17062 chore(vehicle): land ansible provisioning fix — 1 approved PR (security: guessable-default fixes for #16299 (baseline-reasons guard, generate-on-first-run secrets) #17037)
• feat(backend): orphan-storage detector framework + code-source clone detector (#17038, #17039) #17050 feat(backend): orphan-storage detector framework + code-source clone detector (Umbrella: SLM Data hygiene page — detect and safely clean up orphaned data across services #17038, feat(backend): orphan-storage detector framework + code-source clone detector, delete through the owning service (#17038) #17039)
• chore(vehicle): land WebSocket auth stack — 4 approved PRs (#16891, #16939, #17018, #17027) #17048 chore(vehicle): land WebSocket auth stack — 4 approved PRs (security(websocket): auth token travels via Sec-WebSocket-Protocol, not the URL (#16457) #16891, security(websocket): every authenticated WebSocket echoes the bearer subprotocol through one helper (#16457) #16939, fix(security): authenticate nine WebSocket endpoints before accept, owner-scope the overseer and workflow sockets, admin-only /api/long-running (#17009, #17010) #17018, fix(ops): long-running operations — create works and records its creator, creator-or-admin access, the panel reads real data, unimplemented starts answer 501 (#17017) #17027)
• chore(vehicle): land CI & hooks infra — 6 approved PRs (#16938, #17032, #16952, #16958, #16882, #16959) #17047 chore(vehicle): land CI & hooks infra — 6 approved PRs (fix(ci): chain formatter dispatch after the branch guard in pre-commit (#16923) #16938, chore(hooks): track the commit-msg hook, install it, and enforce the subject convention (#17029) #17032, fix(tests): prune SKIP dirs during the walk, not after rglob returns (#16601) #16952, test(security): a delegated subagent runs a write its parent is held from (#16950) #16958, security(infra): stop binding ChromaDB to every interface by default (#15317) #16882, fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (#16934) #16959)
• fix(hooks): use stdin JSON instead of $TOOL_ARGS in settings.json hooks (#17024) #17044 fix(hooks): use stdin JSON instead of $TOOL_ARGS in settings.json hooks (Suspected dead hooks in .claude/settings.json: $TOOL_ARGS may not be a real env var #17024)
• security: guessable-default fixes for #16299 (baseline-reasons guard, generate-on-first-run secrets) #17037 security: guessable-default fixes for security: guessable default credentials ship in templates, ansible defaults and the compose file #16299 (baseline-reasons guard, generate-on-first-run secrets)
• chore(hooks): track the commit-msg hook, install it, and enforce the subject convention (#17029) #17032 chore(hooks): track the commit-msg hook, install it, and enforce the subject convention (commit-msg hook should reject a subject with no issue reference #17029)
• fix(ops): long-running operations — create works and records its creator, creator-or-admin access, the panel reads real data, unimplemented starts answer 501 (#17017) #17027 fix(ops): long-running operations — create works and records its creator, creator-or-admin access, the panel reads real data, unimplemented starts answer 501 (long-running: the four start routes cannot create an operation — create_operation gets estimated_items/context it does not accept (TypeError → 500) #17017)
• fix(security): authenticate nine WebSocket endpoints before accept, owner-scope the overseer and workflow sockets, admin-only /api/long-running (#17009, #17010) #17018 fix(security): authenticate nine WebSocket endpoints before accept, owner-scope the overseer and workflow sockets, admin-only /api/long-running (security(ws): nine WebSocket endpoints accept without authentication — PTY execution, workflow control and KB writes among them #17009, security: /api/long-running has no authentication — anyone can start test runs, scans and KB population, or cancel any operation #17010)
• security(kb): re-scope #16985 to a guard -- every connector already reaches store_fact #17016 security(kb): re-scope security(secrets): wire credential redaction into the remaining 11 KB connectors (#13708 follow-up) #16985 to a guard -- every connector already reaches store_fact
• feat(agents): one-shot idle notice (#16949) #17015 feat(agents): one-shot idle notice (feat(agents): subscribe once to be told when a peer is next idle #16949)
• feat(ci): add an open-PR cap to the pre-push gate (#17006) #17008 feat(ci): add an open-PR cap to the pre-push gate (Open-PR cap: refuse new-branch pushes at/above AUTOBOT_OPEN_PR_CAP (default 40) #17006)
• security(websocket): authenticate /api/intelligent_agent/stream before processing (#17000) #17003 security(websocket): authenticate /api/intelligent_agent/stream before processing (security(websocket): /api/intelligent_agent/stream runs agent goals with no authentication — an unauthenticated bypass of POST /process #17000)
• fix(agents): the peer channel delivers to the recipient, not the sender; broadcast reaches every other agent (#16986) #17001 fix(agents): the peer channel delivers to the recipient, not the sender; broadcast reaches every other agent (agents: the peer channel never delivers to the recipient — a request lands in the sender's own inbox and the sender answers itself #16986)
• feat(agents): peer-to-peer messaging and idle notice (#16948, #16949) #16996 feat(agents): peer-to-peer messaging and idle notice (feat(agents): deliver peer messages at the recipient's next turn, not mid-task #16948, feat(agents): subscribe once to be told when a peer is next idle #16949)
• fix(test): give result.metadata a real dict in 3 multimodal perf/scalability mocks (#16990) #16995 fix(test): give result.metadata a real dict in 3 multimodal perf/scalability mocks (bug(test): 3 multimodal performance/scalability tests fail — metadata Mock lacks __setitem__ since #15234 #16990)
• feat(auth): SLM API keys only on declared routes, 403 elsewhere, every key request audited; main backend accepts none (#16040, #16294, #16999) #16989 feat(auth): SLM API keys only on declared routes, 403 elsewhere, every key request audited; main backend accepts none (API key scopes are stored and displayed but never enforced — keys inherit full user authority #16040, feat(auth): decide which routes accept API keys, and wire X-API-Key through the #16040 mechanism #16294, docs(api): the public API docs tell integrators to send a user API key to the main backend, which accepts none #16999)
• fix(ci): bump the mcp CI floor mirror to match the backend's declared floor (#16449) #16983 fix(ci): bump the mcp CI floor mirror to match the backend's declared floor (chore(mcp): autobot-backend/mcp/ shadows the real mcp PyPI SDK, making it unreachable by name #16449)
• fix(deploy): enable rendered nginx sites on self-update, not just full provision #16980 fix(deploy): enable rendered nginx sites on self-update, not just full provision
• feat(agents): capture a terminal session's tenant at creation (#16975) #16978 feat(agents): capture a terminal session's tenant at creation (feat(agents): capture a terminal session's tenant at creation — it cannot be recovered afterwards #16975)
• feat(security): bound every Company OS run by its org role, per adapter (#16950) #16974 feat(security): bound every Company OS run by its org role, per adapter (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• fix(deploy): the user-frontend build sites publish through a staged swap (#15603) #16970 fix(deploy): the user-frontend build sites publish through a staged swap (bug(deploy): the user-frontend build sites still publish their own failures, and three SLM build sites sit outside the shared staged publish #15603)
• fix(security): A2A trust keyed on the verified pair, capabilities enforced where they apply (#16957, #16950) #16969 fix(security): A2A trust keyed on the verified pair, capabilities enforced where they apply (security(a2a): three of four trust-matrix capabilities are enforced nowhere — a level that denies them denies nothing #16957, security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.