fix: Rule 5 accept canonical internal and public host base_url #122

2026-09-19T11:37:27Z

abiba-bot commented

2026-09-19 11:37:27 +00:00

Rule 5 in audit-hermes-config.py had an inverted check: it expected base_url=http://192.168.68.116/v1, but the contract hermes-key-enforcement.prose.md names http://192.168.68.116/litellm/v1 as CORRECT/CANONICAL in multiple places. The audit script would FAIL a config using the contract's canonical internal path and PASS one using a path the contract does not name.

Fix: Rule 5 now accepts the canonical internal base (http://192.168.68.116/litellm/v1) AND the public base (https://litellm.sysloggh.net/v1), and FAILS anything else. The internal nginx serves both /litellm/v1 and /v1; the public host serves /v1 only (per 2026-09-19 probe from CT 116).

Tests aligned: BASE template updated to use the canonical internal path, and new test cases added to prove the canonical internal path PASSES, a wrong path FAILS, and the public host path PASSES.

Files changed: 2, 75 insertions(+), 5 deletions(-)

Rule 5 in audit-hermes-config.py had an inverted check: it expected base_url=http://192.168.68.116/v1, but the contract hermes-key-enforcement.prose.md names http://192.168.68.116/litellm/v1 as CORRECT/CANONICAL in multiple places. The audit script would FAIL a config using the contract's canonical internal path and PASS one using a path the contract does not name. Fix: Rule 5 now accepts the canonical internal base (http://192.168.68.116/litellm/v1) AND the public base (https://litellm.sysloggh.net/v1), and FAILS anything else. The internal nginx serves both /litellm/v1 and /v1; the public host serves /v1 only (per 2026-09-19 probe from CT 116). Tests aligned: BASE template updated to use the canonical internal path, and new test cases added to prove the canonical internal path PASSES, a wrong path FAILS, and the public host path PASSES. Files changed: 2, 75 insertions(+), 5 deletions(-)

abiba-bot added 1 commit 2026-09-19 11:37:27 +00:00

fix: Rule 5 accept canonical internal and public host base_url

PR Pipeline — Authorize → Validate → Review → Merge / auth (pull_request) Successful in 3s

Details

PR Pipeline — Authorize → Validate → Review → Merge / validate (pull_request) Successful in 5s

Details

PR Pipeline — Authorize → Validate → Review → Merge / lint (pull_request) Successful in 4s

Details

PR Pipeline — Authorize → Validate → Review → Merge / ai-review (pull_request) Successful in 6s

Details

PR Pipeline — Authorize → Validate → Review → Merge / gate (pull_request) Successful in 1s

Details

fa458afa26

Rule 5 in audit-hermes-config.py had an inverted check: it expected
base_url=http://192.168.68.116/v1, but the contract hermes-key-enforcement.prose.md
names http://192.168.68.116/litellm/v1 as CORRECT/CANONICAL in multiple places.
The audit script would FAIL a config using the contract's canonical internal path
and PASS one using a path the contract does not name.

Fix: Rule 5 now accepts the canonical internal base (http://192.168.68.116/litellm/v1)
AND the public base (https://litellm.sysloggh.net/v1), and FAILS anything else.
The internal nginx serves both /litellm/v1 and /v1; the public host serves /v1 only
(per 2026-09-19 probe from CT 116).

Tests aligned: BASE template updated to use the canonical internal path, and new
test cases added to prove the canonical internal path PASSES, a wrong path FAILS,
and the public host path PASSES.

abiba-bot added 1 commit 2026-09-19 11:48:53 +00:00

fix: internal /v1 WARN not FAIL; align prose

PR Pipeline — Authorize → Validate → Review → Merge / auth (pull_request) Successful in 1s

Details

PR Pipeline — Authorize → Validate → Review → Merge / validate (pull_request) Successful in 5s

Details

PR Pipeline — Authorize → Validate → Review → Merge / lint (pull_request) Successful in 3s

Details

PR Pipeline — Authorize → Validate → Review → Merge / ai-review (pull_request) Successful in 4s

Details

PR Pipeline — Authorize → Validate → Review → Merge / gate (pull_request) Successful in 3s

Details

e71ded3c8c

Rule 5 now treats internal http://192.168.68.116/v1 as non-canonical
but working (authenticated via nginx), producing a WARNING instead of a
FAILURE. The canonical internal path /litellm/v1 and the public host
https://litellm.sysloggh.net/v1 both PASS. Everything else FAILS.

Prose aligned: hermes-key-enforcement.prose.md now states the canonical
internal form, notes that internal /v1 still works but is flagged as
non-canonical (WARN not FAIL), and clarifies that the public host serves
/v1 ONLY (404 on /litellm/v1). Corrected the 'unauthenticated path'
wording at line 116, which was factually wrong.

Tests updated: BASE template uses canonical internal path; new test
cases prove canonical /litellm/v1 PASSES, wrong path FAILS, public host
PASSES, and internal /v1 WARNS (not FAILS). Fixed backwards comment in
test_old_rule5_check_would_fail_canonical.

abiba-bot merged commit 58033f39c5 into master

2026-09-19 11:57:37 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: SyslogSolution/prose-contracts#122