Grant Whitmer 1c3b5b0638 telemetry: synthetic:true on canary refusals (keyed, not a bare flag) ...

The canary deliberately sends forged tokens every 10 min; those refusal
rows read as attacks. It now sends X-Windy-Synthetic carrying a shared
secret (Gitea repo secret CANARY_SYNTHETIC_KEY = WINDYGIT_SYNTHETIC_KEY in
Veron .env); the API marks the row synthetic only on a constant-time
match, so an attacker cannot label their own refusals synthetic to hide.
synthetic is declared on forge.auth.failed (Telemetry Boss, UPDATE 3).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-23 11:54:56 -04:00

..

__init__.py

G0: cell substrate — invariants made executable

2026-08-11 14:19:28 -04:00

test_ept_and_throttle.py

throttle: stop claiming to limit pushes we cannot see

2026-08-13 23:33:30 -04:00

test_hub_jwt.py

auth: token contract v1 (aud windy_git, both issuers); CI for eternitas

2026-09-23 02:58:56 -04:00

test_invariants.py

security: never bundle credential repos to R2 in plaintext

2026-09-23 10:48:42 -04:00

test_pr_status_bridge.py

ci: windy-pro desktop/installer jobs are NON-BLOCKING (Grant, 09-23)

2026-09-23 10:58:07 -04:00

test_telemetry.py

telemetry: synthetic:true on canary refusals (keyed, not a bare flag)

2026-09-23 11:54:56 -04:00

test_webhooks_behavior.py

test: behavioral G3.5 webhook tests (audit: tests were source-string asserts)

2026-09-23 03:26:14 -04:00