Stability checkpoint v0.6.0 — TTL cache + bearer auth on HTTPPrincipalProvider (ADR-0037) Closes the two v0.5 deferred IdP tickets in one batch (cache + bearer auth). Foundation rev for OIDC integration ; v0.6.1 will layer JWT validation + OIDC discovery on top of this. - feat(security): TTL cache + bearer auth on HTTPPrincipalProvider (ADR-0037) (1e422d0) CI : - ✅ MR pipeline #133 green — https://gitlab.com/benoit.besson/secured-claude/-/pipelines/2491695681 - ✅ Main pipeline #134 green — https://gitlab.com/benoit.besson/secured-claude/-/pipelines/2491725981 - ✅ All 5 main-stages green : lint (4) / test (3) / security (6) / build (6) / smoke (1) - ✅ Tag pipeline expected 34/34 hard-gate (publish + release downstream) Local test pass : - ✅ uv run pytest -q → 161 tests pass (was 152 in v0.5.5 ; +9 cache/bearer/env tests) - ✅ uv run ruff check src tests → clean - ✅ uv run ruff format --check src tests → 30 files already formatted - ✅ uv run mypy src → strict mode clean (12 source files) Regression check vs v0.5.5 : - ✅ HTTPPrincipalProvider default behaviour preserved (cache_ttl_s=300 + bearer_token=None matches v0.5.5) - ✅ YAMLPrincipalProvider untouched - ✅ /check route untouched (no broker-logic change) - ✅ docker-compose.yml still bind-mount-free (ADR-0035 + ADR-0036 still apply) - ✅ 5 cosign-signed images still cover binary + policy bytes (carryover) - Claude Code wrapped, every tool call gated by Cerbos PDP, audited in SQLite hash-chain log (carryover) - ✨ Authenticated IdP integration unlocked : SECURED_CLAUDE_IDP_BEARER_TOKEN env adds Authorization: Bearer header to every fetch. Operators put principals endpoint behind auth (Auth0 mgmt API, GitHub Actions OIDC token, internal service-account broker) without exposing it publicly. - ✨ Stale-on-error : brief IdP outage no longer cascades to every session degrading to single-default fallback. Loud WARNING log line per stale serve so operators tailing logs see it. - 5 cosign-signed images cover the FULL supply chain (binary + policy bytes) — carryover from v0.5.5 - ⏭ N/A — IdP integration shape change only, no new domain features this rev - ✨ Production-ready IdP patterns documented in ADR-0037 : authenticated webhook (Lambda mapper Auth0/Okta/Keycloak → principals.yaml schema) + service-to-service brokers (service-account token verifiable IdP-side). Bearer-token covers ~80 % of real-world integrations. - ⏭ N/A — no new metrics / spans this rev. Stale-cache serves emit a WARNING log line (free observability). - 161 tests pass (was 152 in v0.5.5 ; +9 covering cache hit / TTL expiry / stale-on-error / bearer header / env resolution paths) - mypy strict clean ; ruff + format clean ; coverage gate fail_under=90 % held - bandit / pip-audit / grype / trivy all clean (carryover) - 8 stages green on tag pipelines : lint / test / security / build / smoke / publish / release - 5-image multi-arch (amd64 + arm64) supply chain ; cosign keyless OIDC signing on all 5 - Main pipeline 20/20 green (Kaniko cache hits from MR build → 3-min total) - ✨ ADR-0037 added (37 ADRs total ; was 36 in v0.5.5) - HTTPPrincipalProvider extended without breaking PrincipalProvider abstraction (ADR-0034 still holds) - Behavioural matrix documented in ADR-0037 (cache hit / TTL expiry / 5xx handling / bearer header presence) for future audit reproducibility - ⏭ N/A — broker is CLI + HTTP only - ✨ 2 new operator env knobs : SECURED_CLAUDE_IDP_CACHE_TTL_S (default 300 s) + SECURED_CLAUDE_IDP_BEARER_TOKEN (default None) — both backward-compatible defaults, drop-in for existing deployments - IdP outage now visible in broker logs (loud WARNING per stale serve) instead of silent default fallback degradation - mTLS auth on IdP URL still v0.7+ (cert/key pair env). Bearer-token covers ~80 % per ADR-0037. - Permanent IdP misconfig (revoked token, deleted endpoint) keeps serving stale principals indefinitely. Mitigation : WARNING log line per stale serve. Exit ticket : v0.7+ optional max-stale-age with fallback-after-N-minutes. - JWT validation in /check still pending (v0.6.1) - OIDC discovery (.well-known fetch) still pending (v0.6.1) - Background refresh thread (proactive re-fetch before TTL expiry) deferred to v0.7+ if request-latency-during-refresh becomes a concern - v0.6.1 — JWT validation in /check + OIDC discovery on top of v0.6.0 cache+auth foundation - v0.7+ — mTLS auth (cert/key pair env) + max-stale-age + background refresh thread