feat(notifications): define bounded W66 delivery contracts by ammarheidari · Pull Request #240 · araditc/Kafdeck

ammarheidari · 2026-09-28T16:58:54Z

Authority

W66 #215 is ACTIVE after W62 shared telemetry/event contracts stabilized.

Slice 1 — contract foundation

closed notification provider and event-class identities;
bounded destination profile identity/display/event selection;
server-owned delivery attempt/backoff/lifetime/payload/rate/concurrency budgets;
durable safe delivery state stores payload fingerprint and safe provider metadata only;
configured HTTPS endpoint policy rejects credentials/query/fragment and local/private/link-local/metadata/multicast IP literals;
Webhook profiles require an explicit configured HTTPS endpoint;
no outbound adapter, DNS resolution, credential resolution or HTTP execution is introduced by this slice.

Safety

no arbitrary per-request URL or headers;
no generic HTTP proxy;
no redirect capability;
no raw protected payload or secret/token in durable delivery state;
hostname DNS/IP revalidation and provider-specific adapters remain later W66 work.

Exact head: 730402f79cba52ed666364967c5550523d1e9142.

Canonical remediation

protected-main parent: 4beeab13ab9d251024d95aa28bcf4c6b8f3e9f8a;
canonical exact head: 13671a6b288a309422dafc1460406232b1a0aa30;
credential references are typed env:/file: locators and cannot carry a raw secret value;
IPv6 site-local literals are denied by endpoint SSRF policy;
durable next-attempt timestamps cannot exceed the hard delivery lifetime;
no outbound adapter or network execution is introduced;
fresh exact-head CI, CODEOWNER approval and Codex review are required.

Final canonical gate

protected-main parent: c1e6f1f53ed9c4677b131fa1352a404f7ba6e731;
exact head: 6e78003cbd996f6f7f3a476089be15580d5c657a;
one DCO-signed commit;
W66 final contract reuses one destination-ID grammar and rejects mapped/translatable/NAT64/6to4/Teredo IPv6 literals in configured endpoint policy.
fresh exact-head CI, CODEOWNER approval and Codex review are required before merge.

DNS/credential execution boundary closeout

canonical exact head: 730402f79cba52ed666364967c5550523d1e9142;
adapters receive a pinned connection-time resolution object whose entire DNS answer set is revalidated by Core SSRF policy;
translated/tunneled IPv6 literals remain rejected before resolution;
credential references expose only typed locator metadata and are consumed through a dedicated resolver port;
secret values remain separate and redacted;
fresh exact-head gates required.

chatgpt-codex-connector · 2026-09-28T16:59:04Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-28T18:07:55.178038Z	`730402f`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

ammarheidari · 2026-09-28T16:59:11Z

@codex review

Please review exact W66 Slice 1 head 2460e87f3ef3a300b3889004aa5a0eee98c05d6a, especially endpoint SSRF boundaries, delivery hard caps and absence of raw payload/secret durable state.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2460e87f3e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ammarheidari · 2026-09-28T17:06:52Z

@codex review

Please review canonical exact W66 head 13671a6b288a309422dafc1460406232b1a0aa30, especially typed secret references, IPv6 SSRF coverage and retry-lifetime durability.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 13671a6b28

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

ammarheidari · 2026-09-28T17:57:16Z

@codex review

Please review final canonical exact head 6e78003cbd996f6f7f3a476089be15580d5c657a.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6e78003cbd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Refs #215 Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

ammarheidari · 2026-09-28T18:03:00Z

@codex review

Please review final exact W66 head 730402f79cba52ed666364967c5550523d1e9142, especially pinned DNS resolution and credential resolver boundaries.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 730402f79c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-28T18:07:52Z

+            var locator =
+                value[4..];
+            if (!IsValidEnvironmentVariableName(
+                    locator))


Scope credential locators before resolving them

When a principal creates or updates a destination, a reference such as env:KAFDECK_DEPLOYMENT_TOKEN passes because this validation checks only environment-variable syntax; fully qualified paths to unrelated server secrets are likewise accepted. Since ResolveAsync receives only that unrestricted reference and a cancellation token, a caller with notification-profile authority can bind a process-wide secret it is not otherwise authorized to read to a destination it controls and have the adapter transmit or use the resolved value. Use opaque pre-provisioned credential IDs, or enforce a notification-specific locator allowlist and authorization at the resolution boundary.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-09-28T18:07:52Z

+            rfc6145 ||
+            nat64WellKnown ||
+            nat64LocalUse ||


Validate configured NAT64 prefixes before admitting DNS answers

On deployments using an RFC 6052 network-specific NAT64 prefix, an attacker-controlled hostname can resolve to that prefix with an embedded private or metadata IPv4 address, and this check admits it because it recognizes only the well-known and local-use NAT64 prefixes; the translator can then reach the prohibited IPv4 target. Fresh evidence in this head is that the newly added transition checks explicitly return only nat64WellKnown and nat64LocalUse, leaving network-specific /32, /40, /48, /56, /64, and /96 prefixes uncovered. Make the address policy aware of configured translation prefixes and validate the extracted IPv4 address before returning the pinned endpoint.

Useful? React with 👍 / 👎.

ammarheidari · 2026-09-28T18:13:25Z

Post-merge P1 security findings are being corrected fail-closed in PR #242 on exact head 147e37aed5d8c23ef0416bb2741601ceaff04a45. I am keeping both #240 threads unresolved until the correction merges and protected-main verification succeeds.

ammarheidari requested a review from akhiabanchian as a code owner September 28, 2026 16:58

chatgpt-codex-connector Bot reviewed Sep 28, 2026

View reviewed changes

Comment thread src/backend/Kafdeck.Core/Notifications/NotificationContracts.cs Outdated

Comment thread src/backend/Kafdeck.Core/Notifications/NotificationContracts.cs

Comment thread src/backend/Kafdeck.Core/Notifications/NotificationContracts.cs Outdated

akhiabanchian previously approved these changes Sep 28, 2026

View reviewed changes

ammarheidari dismissed akhiabanchian’s stale review via 36c9ba4 September 28, 2026 17:05

ammarheidari force-pushed the w66-notification-contracts branch from 07df716 to 13671a6 Compare September 28, 2026 17:06

ammarheidari requested a review from akhiabanchian September 28, 2026 17:06

akhiabanchian previously approved these changes Sep 28, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Sep 28, 2026

View reviewed changes

Comment thread src/backend/Kafdeck.Core/Notifications/NotificationContracts.cs

Comment thread src/backend/Kafdeck.Core/Notifications/NotificationContracts.cs Outdated

ammarheidari dismissed akhiabanchian’s stale review via ea5f08d September 28, 2026 17:51

ammarheidari force-pushed the w66-notification-contracts branch from fb329d6 to 6e78003 Compare September 28, 2026 17:56

ammarheidari requested a review from akhiabanchian September 28, 2026 17:57

akhiabanchian previously approved these changes Sep 28, 2026

View reviewed changes

ammarheidari mentioned this pull request Sep 28, 2026

v0.8 — Observability, Automation & Platform APIs planning and implementation tracker #209

Open

4 of 11 tasks

chatgpt-codex-connector Bot reviewed Sep 28, 2026

View reviewed changes

Comment thread src/backend/Kafdeck.Core/Notifications/NotificationContracts.cs

Comment thread src/backend/Kafdeck.Core/Notifications/NotificationContracts.cs Outdated

ammarheidari dismissed akhiabanchian’s stale review via c28324a September 28, 2026 18:02

feat(notifications): define bounded W66 delivery contracts

730402f

Refs #215 Signed-off-by: Ammar Heidari <ammar@arad-itc.org>

ammarheidari force-pushed the w66-notification-contracts branch from fe94290 to 730402f Compare September 28, 2026 18:02

ammarheidari requested a review from akhiabanchian September 28, 2026 18:02

akhiabanchian approved these changes Sep 28, 2026

View reviewed changes

akhiabanchian merged commit c27ae8d into main Sep 28, 2026
8 checks passed

akhiabanchian deleted the w66-notification-contracts branch September 28, 2026 18:07

chatgpt-codex-connector Bot reviewed Sep 28, 2026

View reviewed changes

ammarheidari mentioned this pull request Sep 28, 2026

fix(notifications): scope credentials and NAT64 resolution #242

Merged

ammarheidari mentioned this pull request Sep 28, 2026

v0.8 W66 — Alert routing adapters and activity/event webhooks #215

Open

ammarheidari mentioned this pull request Oct 4, 2026

feat(notifications): add W66 bounded webhook runtime #255

Merged

Conversation

ammarheidari commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Authority

Slice 1 — contract foundation

Safety

Canonical remediation

Final canonical gate

DNS/credential execution boundary closeout

Uh oh!

chatgpt-codex-connector Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

ammarheidari commented Sep 28, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ammarheidari commented Sep 28, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

ammarheidari commented Sep 28, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

ammarheidari commented Sep 28, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Sep 28, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Sep 28, 2026

Choose a reason for hiding this comment

Uh oh!

ammarheidari commented Sep 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ammarheidari commented Sep 28, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Sep 28, 2026 •

edited

Loading