Four access methods, one owner-authentication scheme

Unified request-processing order

Fragment to HttpOnly cookie

Authentication matrix

ssh -N -L 18100:127.0.0.1:18100 owner@remote-host

openprogram web auth-url \
  --base-url http://127.0.0.1:18100

{
  "web": {
    "host": "127.0.0.1",
    "allowed_origins": ["https://agent.example.com"]
  }
}

# proxy preserves Host and Upgrade,
# overwrites X-Forwarded-Proto, clears unused forwarded headers,
# and disables SSE buffering

Non-retrievable secrets

1. Loopback HTTP, SSE and WS fail without credentials.
2. Correct Bearer succeeds without Origin; wrong tokens perform no action and return the same 401.
3. Clear fragments before other fetches; bootstrap accepts only exact bounded JSON, rejects mixed Authorization and derives the specified HMAC cookie.
4. Unauthenticated GET/HEAD /docs and /docs/** can read prebuilt static docs in both source checkouts and installed packages without scanning source or triggering builds; the wheel must include openprogram_server/_webui/_frontend/docs/index.html. Host validation still applies; unsafe methods and private APIs are excluded.
5. Cookie-authenticated unsafe HTTP and WS reject missing, opaque and cross-site Origins.
6. Loopback, direct bind and proxies reject external, duplicate, unspecified and multicast Hosts and validate HTTP/WS scheme mapping.
7. Default loopback accepts only implicit Origins; other SSH local ports require explicit configuration.
8. Non-loopback bind without a valid Origin list rejects startup; explicit local/overlay HTTP ranges are accepted with warnings, other addresses rejected.
9. Disable Uvicorn proxy-header rewriting; scheme trusts only the original loopback peer, X-Forwarded-For never changes trust, and direct WS/Caddy WSS validate scheme mapping.
10. A second process using the same state directory cannot alter the live token; failure cleanup verifies ownership.
11. Restart rotates tokens and invalidates old Bearer and cookies.
12. Malformed Authorization cannot fall back to a valid cookie.
13. Static assets and minimal health contain no session, filesystem or credential metadata.
14. CSP/X-Frame-Options prevent framing; authentication and sensitive responses use no-store.
15. Legacy account reveal returns 410 and config-key reveal query returns 404. Config keys and accounts enforce exact replace/preserve/delete schemas; 8–11-character values use fixed masks; frontend types contain no plaintext field.
16. HTTP, SSE and WS authenticate behind nginx/Caddy HTTPS while backend stays on loopback.
17. Channel turns retain paired authority tiers rather than gaining Web-owner authority.
18. Profile servers sharing a hostname but using different ports have distinct cookie names and independent authentication.
19. Listener ownership probes verify worker PID/port and access snapshot, send only random nonces, validate versioned token-HMAC proofs and reject foreign listeners, stale snapshots and port/fingerprint/proof/revision mismatches.