From 602032bfac5a9f0035a7e0dfe100df08d2189971 Mon Sep 17 00:00:00 2001 From: Eric Wendland Date: Sun, 5 Jul 2026 17:59:47 +0200 Subject: [PATCH] docs: update authorization matrix progress --- docs/production-readiness-roadmap.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/production-readiness-roadmap.md b/docs/production-readiness-roadmap.md index 72a87ba..56a7a80 100644 --- a/docs/production-readiness-roadmap.md +++ b/docs/production-readiness-roadmap.md @@ -152,13 +152,13 @@ it. Goal: finish the authorization and remote-input audit before deployment. -- `[ ]` Complete remote authorization matrix coverage. +- `[~]` Complete remote authorization matrix coverage. Acceptance criteria: - `[ ]` Denied and allowed paths are tested for CAS, KV, DB, document, pubsub, pipe, SSH proxy/admin shell, SSH cert metadata, and revocations. - - `[ ]` Every remote mutating or service-opening operation has an explicit + - `[x]` Every remote mutating or service-opening operation has an explicit resource capability check before mutation or host access. - - `[ ]` The matrix fails tests when a new remote operation lacks a guard. + - `[x]` The matrix fails tests when a new remote operation lacks a guard. - `[ ]` Add adversarial identity and bearer tests. Acceptance criteria: