Found by a six-perspective adversarial review of #60 before it merged.
packages/guardian/src/validate-envelope.ts:68 declares a signature?: { algorithm, value, key_id } field. A grep for reads of it across the tree returns nothing. packages/guardian/src/server.ts:55-60 states the consequence in its own comment: "this endpoint has no authentication, no origin check and no request signing... Until the wire is authenticated, reachability IS the access control."
ACS-Core requires an HMAC-SHA256 signature over the JCS-canonicalized envelope with an HKDF-derived per-session key. The reference implementation therefore does not meet the mandatory floor of the standard it demonstrates. The tree README says so in its gap table, which is the right posture, and this issue exists so the gap is tracked rather than only disclosed.
Two consequences worth separating. Any local process that reaches the socket can answer as the Guardian and allow every tool call, and packages/host-adapter/src/guardian-client.ts:33 names that path directly. And ACS_GUARDIAN_HOST widens the bind past loopback, which removes the only control that currently exists rather than degrading it.
Not a regression. This is the largest known gap between the reference implementation and ACS-Core, and it should be the first thing anyone reads before citing the tree as conformant.
Found by a six-perspective adversarial review of #60 before it merged.
packages/guardian/src/validate-envelope.ts:68declares asignature?: { algorithm, value, key_id }field. A grep for reads of it across the tree returns nothing.packages/guardian/src/server.ts:55-60states the consequence in its own comment: "this endpoint has no authentication, no origin check and no request signing... Until the wire is authenticated, reachability IS the access control."ACS-Core requires an HMAC-SHA256 signature over the JCS-canonicalized envelope with an HKDF-derived per-session key. The reference implementation therefore does not meet the mandatory floor of the standard it demonstrates. The tree README says so in its gap table, which is the right posture, and this issue exists so the gap is tracked rather than only disclosed.
Two consequences worth separating. Any local process that reaches the socket can answer as the Guardian and allow every tool call, and
packages/host-adapter/src/guardian-client.ts:33names that path directly. AndACS_GUARDIAN_HOSTwidens the bind past loopback, which removes the only control that currently exists rather than degrading it.Not a regression. This is the largest known gap between the reference implementation and ACS-Core, and it should be the first thing anyone reads before citing the tree as conformant.