Network Operations Status

June 21, 2026 ยท View on GitHub

Last Reviewed: 2026-05-26 Audience: Engineering, Procurement, Security Vetting, CISO Scope: Outbound and proxied network operations in the network boundary

Executive Summary

This document tracks network-side operations in git-lrc as an auditable inventory for enterprise due diligence.

  • Network boundary: outbound HTTP API operations and response handling in network package.
  • Modes represented: api.
  • Operation count tracked: 24 operations.
  • Severity distribution: High 10, Medium 7, Low 2.
  • Current diff note: self-hosted setup now uses LiveReview email/password auth endpoints (/api/v1/auth/login, /api/v1/auth/setup-status, /api/v1/auth/setup) in addition to existing cloud ensure-cloud-user setup path.
  • Current diff note: internal reviewapi helper evidence links were revalidated after git path helper additions; network inventory scope is unchanged.
  • Primary sensitive data in scope: API keys, bearer tokens, org-context headers, diff content, connector validation payloads, update manifest metadata, binary download stream.
  • Highest-risk operation classes: review submission/polling, setup credential operations, proxy forwarding paths, binary download operations.
  • Primary compensating controls already present: explicit auth header usage by flow, URL normalization helpers, host allowlist check for self-update download sources, timeout-based polling with cancellation support.

Severity Rubric

  • High: operation sends/receives sensitive auth material, drives core review workflow, or downloads executable artifacts.
  • Medium: operation forwards or requests operational payloads with constrained impact and bounded scope.
  • Low: best-effort telemetry or low-impact ancillary calls.

Risk Acknowledgement Rules

  • Every operation row must state known risk and compensation status.
  • High-severity rows must include explicit compensation or explicit suggestion marker.
  • Suggestion marker format: Suggestion:
  • Acceptable residual risk must be called out when controls are considered sufficient.

Inventory: Review Submission And Polling APIs

OperationModeData HandledPurposeSeverityRisk AcknowledgementCompensation StatusEvidence
ReviewSubmitapiBase64 diff review payload, review metadataSubmit review request to LiveReview endpointHighConfidentiality and integrity risk for source diff payload in transitCompensated by authenticated API path and bounded endpoint model; residual risk acceptable with TLS assumptionsnetwork/review_operations.go
ReviewPollapiReview status payload and commentsPoll asynchronous review completionHighAvailability risk from polling loop and timeout behaviorCompensated by timeout-bound polling with cancellation support; residual risk acceptablenetwork/review_operations.go
ReviewTrackCLIUsageapiTelemetry event payloadBest-effort CLI usage trackingLowLow impact telemetry data transmission riskCompensated by best-effort non-blocking behavior; acceptable risknetwork/review_operations.go

Inventory: Setup, Auth, And Connector APIs

OperationModeData HandledPurposeSeverityRisk AcknowledgementCompensation StatusEvidence
SetupEnsureCloudUserapiAccess-token-authenticated identity payloadEnsure cloud user record exists during setupHighAuthentication-context misuse riskCompensated by bearer token boundary and scoped setup endpoint; residual risk acceptablenetwork/setup_operations.go
SetupAuthLoginapiEmail/password credentials and returned session tokensAuthenticate against self-hosted LiveReview during setupHighCredential and token handling riskCompensated by HTTPS/TLS deployment assumptions and setup caller no-log handling for secrets; residual risk acceptablenetwork/setup_operations.go
SetupUIConfigapiBase URLCheck if the target server is cloud hostedLowLow sensitivity configuration infoCompensated by public endpoint without secrets; acceptable risknetwork/setup_operations.go
SetupAuthSetupStatusapiSetup readiness metadataDetect whether initial self-hosted admin setup is requiredMediumLow sensitivity operational metadata exposure riskCompensated by public setup-status endpoint contract; acceptable risknetwork/setup_operations.go
SetupInitialAdminapiInitial admin credentials and returned session tokensCreate first self-hosted admin user during setupHighCredential and token handling riskCompensated by one-time setup gate on backend and setup caller secret-handling policy; residual risk acceptablenetwork/setup_operations.go
SetupRefreshTokensapiRefresh token request payload and returned token setRefresh auth session tokens during setup and re-auth flowsHighToken handling and session integrity riskCompensated by scoped auth-refresh endpoint and typed request path in setup operations; residual risk acceptablenetwork/setup_operations.go
SetupCreateAPIKeyapiAPI key label and returned plaintext API keyCreate connector/review API keyHighHigh sensitivity secret material exposure riskCompensated by explicit auth flow and setup caller no-log/no-echo handling for create-key error paths; residual risk acceptablenetwork/setup_operations.go
SetupValidateConnectorKeyapiProvider key and validation request bodyValidate AI connector key before persistenceHighThird-party key exposure/handling riskCompensated by authenticated request path plus connector key redaction in setup error surfaces; residual risk acceptablenetwork/setup_operations.go
SetupCreateConnectorapiConnector configuration payloadPersist connector configuration via LiveReview APIHighMisconfiguration and sensitive metadata transmission riskCompensated by bearer auth plus org context boundary; residual risk acceptablenetwork/setup_operations.go
SetupListConnectorsapiExisting connector inventory for current orgInspect minimum AI readiness during setup and re-auth preflightHighSensitive connector metadata and auth-context exposure riskCompensated by bearer auth plus org context boundary; residual risk acceptablenetwork/setup_operations.go
SetupOnboardapiOnboarding API key (X-API-Key header) and returned token setNon-interactively onboard a new machine using an onboarding API keyHighExposure of onboarding key and returned credentialsCompensated by direct, secure binary execution, atomic config writes (0600), and short-lived setup context; residual risk acceptablenetwork/setup_operations.go

Inventory: Proxy And Forwarding APIs

OperationModeData HandledPurposeSeverityRisk AcknowledgementCompensation StatusEvidence
ReviewProxyRequestapiGeneric forwarded payloads with API key authProxy events/webhook-style calls to configured endpointMediumMedium abuse risk due to forwarding flexibilityPartially compensated by API key auth; Suggestion: document allowed method/path policy for deploymentsnetwork/review_operations.go
ReviewForwardJSONWithBearerapiJSON body, bearer token, org contextForward authenticated JSON requests across setup flowsMediumMedium risk from header/context propagation mistakesCompensated by explicit bearer plus org-context request construction; acceptable risknetwork/review_operations.go

Inventory: Self-Update Network Operations

OperationModeData HandledPurposeSeverityRisk AcknowledgementCompensation StatusEvidence
SelfUpdateFetchManifestapiUpdate manifest metadata and checksum referencesRetrieve global update manifestMediumMedium integrity risk if manifest source is untrustedCompensated by controlled update source design and follow-on verification path; acceptable risknetwork/selfupdate_operations.go
SelfUpdateFetchReleaseManifestapiPlatform-specific release manifestRetrieve release details for current target platformMediumMedium integrity risk from release metadata tamperingCompensated by expected-host model and verification pipeline assumptions; acceptable risknetwork/selfupdate_operations.go
SelfUpdateDownloadBinaryToapiBinary stream bytes for executable update artifactDownload release binary to target pathHighHigh integrity and supply-chain risk for executable downloadCompensated by source host validation and SHA256 verification during staging in internal/selfupdate downloadVersionBinaryFromManifest; residual risk acceptablenetwork/selfupdate_operations.go

Inventory: HTTP Transport And Error Handling Utilities

OperationModeData HandledPurposeSeverityRisk AcknowledgementCompensation StatusEvidence
Client.DoJSONapiRequest/response JSON payload bytesStandard JSON HTTP call wrapperMediumMedium risk from broad transport usage and status-handling varianceCompensated by centralized transport wrapper with timeout controls; acceptable risknetwork/http_client.go
Client.DoapiRaw HTTP request/response bytesGeneric HTTP call wrapper for non-JSON/raw workflowsMediumMedium risk from raw payload handling flexibilityPartially compensated by shared client boundary; Suggestion: document callsite expectations for raw bodiesnetwork/http_client.go
SetupEnsureCloudUserURLapiBase URL plus endpoint normalization inputsNormalize endpoint composition and reduce path ambiguityMediumMedium risk if normalization logic diverges from endpoint assumptionsCompensated by centralized URL builder utility; acceptable risknetwork/endpoints.go
SetupOnboardURLapiBase URL plus endpoint normalization inputsBuild onboarding endpoint URLMediumMedium risk if normalization logic diverges from endpoint assumptionsCompensated by centralized URL builder utility; acceptable risknetwork/endpoints.go
SetupAuthLoginURLapiBase URL plus endpoint normalization inputsBuild self-hosted login endpoint URLMediumMedium risk if normalization logic diverges from endpoint assumptionsCompensated by centralized URL builder utility; acceptable risknetwork/endpoints.go
SetupUIConfigURLapiBase URLBuild UI config URLLowLow riskCompensated by public endpoint utility; acceptable risknetwork/endpoints.go
SetupAuthSetupStatusURLapiBase URL plus endpoint normalization inputsBuild self-hosted setup-status endpoint URLMediumMedium risk if normalization logic diverges from endpoint assumptionsCompensated by centralized URL builder utility; acceptable risknetwork/endpoints.go
SetupAuthSetupURLapiBase URL plus endpoint normalization inputsBuild self-hosted initial-admin setup endpoint URLMediumMedium risk if normalization logic diverges from endpoint assumptionsCompensated by centralized URL builder utility; acceptable risknetwork/endpoints.go
PollReviewapiReview IDs, status payloads, timeout stateTimeout-bounded polling orchestration in review runtimeHighHigh availability/latency risk if review service is degradedCompensated by bounded timeout and interval controls; residual risk acceptableinternal/reviewapi/helpers.go
formatJSONParseErrorapiResponse body text for parse diagnosticsImprove operator diagnostics when endpoint/port mismatches occurLowLow risk diagnostic utility behaviorCompensated by safer error interpretation path; acceptable riskinternal/reviewapi/helpers.go

Control Signals For Security Review

  • Auth separation by flow: API-key and bearer-token paths are distinct and explicit in operation wrappers.
  • URL hygiene: endpoint normalization centralizes path composition.
  • Update source restrictions: self-update path validates expected host family before binary download.
  • Self-update integrity verification: staged binaries are checksum-verified against release-manifest SHA256 before chmod/install.
  • Timeout controls: review polling uses bounded timeout and cancellation semantics.
  • Diagnostic hardening: parse-error helpers improve unsafe endpoint detection and operator triage.
  • Setup secret-handling hardening: create-key failures avoid response-body echo and connector setup errors redact submitted provider keys.

Known Gaps And Follow-Ups

GapWhy It MattersFollow-Up
Retry and backoff strategy is not centralized in network client wrappersTransient failures can reduce reliability and affect user trustDecide whether retries belong in network layer or explicit call sites, then document policy
429/rate-limit handling is not represented as a standard control in operation docsCan affect enterprise traffic reliability expectationsDocument expected behavior and operator guidance for rate-limit scenarios
Proxy forwarding operation is intentionally flexible and may need tighter guardrails for some deploymentsSecurity teams may ask for explicit path/method constraintsDocument deployment-time constraints and threat model assumptions
Binary download integrity chain is split across components and not summarized hereProcurement and CISO reviews expect clear integrity storyAddressed: integrity path now documented with checksum verification owner at self-update staging control point

Review Cadence

  • Update this file when any function is added/removed/renamed in the network package.
  • Re-evaluate severity when auth model, payload sensitivity, or execution criticality changes.
  • Security review trigger: any new High operation or changes to auth headers, proxy behavior, update download logic, or timeout/error policy.