BUG-0802project-10高已修复backend-auth

R1+R2 trust chain — vault exempt removal + policy auth enable + wildcard hardening

发现：2026-10-09验证：2026-10-27置信度：70%

症状

commit cbefdd834969 (2026-09-11) fix(security): R1+R2 trust chain — vault exempt removal + policy auth enable + wildcard hardening

根因

commit message 描述: fix(security): R1+R2 trust chain — vault exempt removal + policy auth enable + wildcard hardening

修复方案

修复 94 行，删除 12 行。改动文件: services/policy/Cargo.toml, services/policy/src/lib.rs, services/policy/src/main.rs, services/vault/src/main.rs

错误签名

fix(security): R1+R2 trust chain — vault exempt removal + policy auth enable + wildcard hardening R1 Trust Chain Hardening:
- Vault main.rs: 移除 cap/issue, cap/redeem, credentials, audit 四个业务路径 exempt
  只剩 /health, /readyz → 强制 Ed25519 验签
- Policy main.rs: 新增 auth_middleware + PKS 动态加载 (CVX_PKS_<ID_UPPER> env)
  之前完全没有 auth → 任何人可 evaluate → 现在 Gateway 统一验签后透传 trusted source
- Gateway proxy_request 已注入 X-CVX-Trusted-Source: api-gateway
  下游 auth_middleware 识别后跳过重复验签

R2 Wildcard Subject_id Harden

技术信息

来源项目

project-10

涉及文件

services/policy/Cargo.toml, services/policy/src/lib.rs, services/policy/src/main.rs +1

标签

git-sweep, auto-ingested, project-10, mcp-reported, source-agent