tina4ruby 3.13.138 → 3.13.140

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d0175b940e39eb271fcdda84cecc6893217d9d660febdcd0afc2f96d8c38dfe
-  data.tar.gz: b44423de677c9523749b49db4814e156bc621090167a8870d0335ca46cef7af3
+  metadata.gz: 68bda3e81c456588a9a4db6501cb402b1eaa570d5f2bfbee0efb83bd9cb61beb
+  data.tar.gz: 61271a97c34bf49f68fcaf605d955d6e4f932f72fa370c884f4f0e91ef432e91
 SHA512:
-  metadata.gz: eb1cf1ca28e038b3d3704fd41bfad3a3e176a114e0b82875ae26af0d0a15e7f8117003c6d0f48c5f44c87a3096eaa27f6683f944df80c04845536ee431ed782d
-  data.tar.gz: e48d0a97a012fbc94b256dbddbf1fd911b39dfdff548e63516d9daf3f2b6aad2028e8706fe3da9c2f522aca427ab8440f5c24689d3f448161ea24f748fb91cc3
+  metadata.gz: 847b4f0439265406da7152292469d91b081a04e468f177b78980c9b669c96e60cca17ac06820bbdb5c66034802145ff64b294c7949136e2392236575170aeb3e
+  data.tar.gz: f690d2726ce41de740e44b6db7cc0cd3104ac40cace6c30dc5a4a94eef832f7e09128608b9cfaebf6e167687403917ca14c156d5f4b94bd65b8c46930d191bce

data/CHANGELOG.md

@@ -6,6 +6,29 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.140 — 2026-09-28
+
+A housekeeping release that tightens the guards and dedups the SQLite plumbing. The CLAUDE.md doc-drift gate now watches this repo, so a doc that names a Tina4 method the code no longer has fails loudly instead of drifting on quietly. The SQLite path resolver learnt some manners: an escaping relative path is refused, and it creates the parent folders itself at 0775 (ADR-0086). The framework still carries no required runtime dependencies.
+
+### Fixes
+- SQLite refuses a relative path that escapes the project and creates its parent directories at 0775, hardening ADR-0086.
+- The maintainer skills stale check resolves correctly and warns when an addGlobal closure would go stale (skill bugs 90/91).
+
+### Refactors
+- The SQLite `resolve_path` logic moves into one shared `SqlitePathResolver` module, so every caller reads the same path the same way.
+- `symbolize_rows` and `symbolize_keys` collapse into one shared module, characterised first so the behaviour cannot shift.
+
+### Docs
+- The Web Push skill mirrors sync back to the `.claude` canonical, so the two copies agree.
+
+### CI
+- A CLAUDE.md doc-drift gate lands, the tina4-js rtc.md mirror syncs, and the SQLTranslator doc drift is fixed.
+- The CLI crud generator locks in single pluralisation, so an `Order` model becomes `orders`, never `orderss`.
+
+## 3.13.139
+
+Outbound requests from the Api client and Web Push are guarded against SSRF: private, loopback and link-local targets are refused unless explicitly allowed (ADR-0084). The development admin surface is hardened -- the health endpoint no longer discloses the framework version outside debug, and development binds loopback by default (ADR-0078). Production refuses to boot with a blank or short HMAC secret so tokens cannot be forged (ADR-0079). Queue reject() dead-letters immediately and size("dead") reports the dead-letter depth (ADR-0022, ADR-0023). Session table first-use is concurrency-safe across every engine. Mail encryption follows the configured TLS/STARTTLS contract (ADR-0071). Log output, driver-install hints and WSDL/mail diagnostics redact credentials and URLs. Publishing is gated behind a protected environment with release actions pinned by commit SHA, and a medium-severity API token-leak path is closed. The framework still has no required runtime dependencies.
+
 ## 3.13.138
 
 HTTP clients strip configured-origin Authorization and Cookie credentials from off-origin initial targets across normal, upload, download and streaming paths. Forwarded Host and Proto require a trusted raw transport peer. Every development HTTP method uses the peer, Host and Origin boundary; resolved file paths and database identifiers are confined. Remote non-MCP development routes require the dedicated token while the accepted MCP transport API_KEY fallback remains supported. Development file readers validate and read one descriptor, preserving public in-project symlinks and existing size behavior. Database, MQTT and malformed Redis backplane diagnostics redact connection credentials; raw file responses preserve exact binary bytes.

data/lib/tina4/api.rb

@@ -13,6 +13,7 @@ require "json"
 require_relative "base64"
 require "securerandom"
 require_relative "parse_json"
+require_relative "ssrf"
 
 module Tina4
   # Statuses that warrant an automatic retry when max_retries > 0: rate-limit
@@ -108,7 +109,7 @@ module Tina4
     def initialize(base_url, headers: {}, timeout: 30,
                    bearer_token: nil, username: nil, password: nil,
                    verify_ssl: nil, max_retries: 0, retry_backoff: 0.5,
-                   transport: nil, cookies: false)
+                   transport: nil, cookies: false, allow_hosts: nil)
       if !transport.nil? && !transport.respond_to?(:call)
         raise ArgumentError, "transport must respond to #call(method, url, headers, body, timeout)"
       end
@@ -130,6 +131,8 @@ module Tina4
       @transport = transport
       @cookies_enabled = cookies ? true : false
       @cookies = {}
+      # SSRF guard (ADR-0084): explicit allow-list of hosts / host:port / CIDRs.
+      @allow_hosts = allow_hosts || []
 
       # Bearer wins over basic-auth when both passed
       if bearer_token
@@ -455,6 +458,13 @@ module Tina4
                       when "HEAD"   then Net::HTTP::Head
                       else raise ArgumentError, "unsupported stream method: #{method}"
                       end
+      # SSRF guard (ADR-0084): refuse a private/internal target before connect.
+      begin
+        Tina4::Ssrf.guard_url!(uri, @allow_hosts)
+      rescue Tina4::SsrfError => e
+        raise APIStreamError.new(e.message)
+      end
+
       request = request_class.new(uri)
       apply_headers(request, headers || {})
       cookie = cookie_header
@@ -596,6 +606,12 @@ module Tina4
       current_body = body
 
       loop do
+        # SSRF guard (ADR-0084): re-validated per hop, so a redirect to a
+        # private/internal address is refused even when the initial URL was
+        # public. Raises SsrfError; attempt_request/download turn it into a
+        # status-0 error response.
+        Tina4::Ssrf.guard_url!(current_uri, @allow_hosts)
+
         http = Net::HTTP.new(current_uri.host, current_uri.port)
         http.use_ssl = current_uri.scheme == "https"
         # Only disable verification when EXPLICITLY false — nil/true keep the

data/lib/tina4/auth.rb

@@ -68,13 +68,72 @@ module Tina4
     # rejected for no real reason; RFC 7519 explicitly allows "a small leeway".
     JWT_LEEWAY_SECONDS = 60
 
+    # Token purposes that are never an identity (ADR-0079 s1). Frond's
+    # form_token signs a JWT with the same TINA4_SECRET as an auth token, marked
+    # "type" => "form". A form token proves where a write came from, never who
+    # the caller is, so every identity gate refuses these purposes. valid_token
+    # itself stays purpose-neutral: CsrfMiddleware needs it for form tokens.
+    NON_IDENTITY_TOKEN_TYPES = %w[form].freeze
+
+    # Minimum HMAC key length in bytes (ADR-0079 s2): the HS256 output size,
+    # RFC 7518 s3.2. A blank key is the shortest case - anyone can reproduce an
+    # HMAC made with it.
+    MIN_SECRET_BYTES = 32
+
+    # The HMAC signing key is blank or shorter than MIN_SECRET_BYTES. An
+    # ArgumentError, Ruby's equivalent of Python's ValueError.
+    class InsecureSecretError < ArgumentError; end
+
     class << self
+      # Explicitly provision an RS256 key pair in <root_dir>/.keys (opt-in). The
+      # framework never calls this on its own: a blank TINA4_SECRET used to mint
+      # a key pair implicitly at boot (ADR-0079 s2).
       def setup(root_dir = Dir.pwd)
         @keys_dir = File.join(root_dir, KEYS_DIR)
         FileUtils.mkdir_p(@keys_dir)
         ensure_keys
       end
 
+      # Point RS256 at <root_dir>/.keys WITHOUT creating anything. Boot uses
+      # this, so an operator-provisioned key pair there keeps working.
+      def keys_root=(root_dir)
+        @keys_dir = File.join(root_dir, KEYS_DIR)
+        @private_key = nil
+        @public_key = nil
+      end
+
+      # True when a VERIFIED payload may stand for a caller's identity. A payload
+      # whose "type" is a reserved non-identity purpose (a Frond form token) is
+      # refused; application payloads are otherwise untouched.
+      def identity_payload?(payload)
+        payload.is_a?(Hash) && !NON_IDENTITY_TOKEN_TYPES.include?(payload["type"])
+      end
+
+      # The actionable error for a weak HMAC key, or nil when the key is usable.
+      def insecure_secret_message(secret)
+        length = secret.to_s.bytesize
+        return nil if length >= MIN_SECRET_BYTES
+
+        what = length.zero? ? "is not set" : "is #{length} bytes"
+        "Auth: TINA4_SECRET #{what}; an HMAC JWT secret must be at least " \
+          "#{MIN_SECRET_BYTES} bytes. Generate one with `openssl rand -hex 32` and set " \
+          "TINA4_SECRET in your environment or .env."
+      end
+
+      # Refuse to boot with a secret that makes tokens forgeable (ADR-0079 s2).
+      # Outside dev a blank TINA4_SECRET is refused; in any mode a set-but-short
+      # one is refused. An operator-provisioned RS256 key pair in .keys/ stands
+      # in for the secret. Raises InsecureSecretError with the actionable message.
+      def require_boot_secret!
+        return if rsa_keys_present?
+
+        secret = ENV["TINA4_SECRET"].to_s
+        return if secret.empty? && dev?
+
+        message = insecure_secret_message(secret)
+        raise InsecureSecretError, message if message
+      end
+
       # Boot-time bootstrap (run once after env load, before auth is used).
       #
       # Mirrors the Python master's tina4_python.auth.ensure_dev_secret:
@@ -123,15 +182,17 @@ module Tina4
 
       # ── HS256 helpers (stdlib only, no gem) ──────────────────────
 
-      # Returns true when SECRET env var is set and no RSA keys exist in .keys/
+      # HMAC with TINA4_SECRET unless an RS256 key pair has been provisioned in
+      # .keys/ (kept for existing deployments). A blank secret no longer falls
+      # back to an implicitly generated key pair: it is refused (ADR-0079 s2).
       def use_hmac?
-        secret = ENV["TINA4_SECRET"]
-        return false if secret.nil? || secret.empty?
+        !rsa_keys_present?
+      end
 
-        # If RSA keys already exist on disk, prefer RS256 for backward compat
+      def rsa_keys_present?
         @keys_dir ||= File.join(Dir.pwd, KEYS_DIR)
-        !(File.exist?(File.join(@keys_dir, "private.pem")) &&
-          File.exist?(File.join(@keys_dir, "public.pem")))
+        File.exist?(File.join(@keys_dir, "private.pem")) &&
+          File.exist?(File.join(@keys_dir, "public.pem"))
       end
 
       # Lazy per-call secret resolver. When the secret is blank, emit the
@@ -180,6 +241,9 @@ module Tina4
       # HMAC the signing input with the digest the algorithm actually names, so the
       # header's "alg" can never disagree with the bytes we produced.
       def hmac_signature(algorithm, secret, signing_input)
+        weak = insecure_secret_message(secret)
+        raise InsecureSecretError, weak if weak
+
         OpenSSL::HMAC.digest(HMAC_ALGORITHMS.fetch(algorithm).new, secret.to_s, signing_input)
       end
 
@@ -253,6 +317,15 @@ module Tina4
         # configuration error that must surface, not become a nil "invalid token".
         alg = resolve_algorithm(algorithm)
 
+        # A blank or short key verifies tokens anyone can mint, so the token is
+        # REJECTED (fail closed with a 401, never a 500) and the operator is
+        # told why. ADR-0079 s2.
+        weak = insecure_secret_message(secret)
+        if weak
+          log_warning(weak)
+          return nil
+        end
+
         decode_envelope(token, alg) do |input, signature|
           expected = hmac_signature(alg, secret, input)
           # Constant-time comparison to prevent timing attacks. Lengths must match
@@ -310,7 +383,6 @@ module Tina4
         elsif use_hmac?
           hmac_encode(claims, hmac_secret, algorithm: algorithm)
         else
-          ensure_keys
           rs256_encode(claims)
         end
       end
@@ -327,7 +399,6 @@ module Tina4
         if use_hmac?
           hmac_decode(token, hmac_secret) # returns Hash payload or nil
         else
-          ensure_keys
           rs256_decode(token)
         end
       end
@@ -407,10 +478,11 @@ module Tina4
         # than this process's env-resolved defaults.
         payload = if secret || algorithm
                     hmac_decode(token, secret || hmac_secret, algorithm: algorithm)
-                  elsif valid_token(token)
-                    get_payload(token)
+                  else
+                    valid_token(token)
                   end
-        return payload if payload
+        # A form token is not an identity (ADR-0079 s1).
+        return identity_payload?(payload) ? payload : nil if payload
 
         # API_KEY bypass — timing-safe comparison via validate_api_key
         # (OpenSSL.fixed_length_secure_compare). Parity with Python's
@@ -451,9 +523,13 @@ module Tina4
           token = Regexp.last_match(1)
 
           # JWT first, then the API key — same order and same payload shape as
-          # authenticate_request above (and as Python/PHP/Node).
-          if valid_token(token)
-            env["tina4.auth"] = get_payload(token)
+          # authenticate_request above (and as Python/PHP/Node). A form token is
+          # not an identity (ADR-0079 s1).
+          payload = valid_token(token)
+          if payload
+            return false unless identity_payload?(payload)
+
+            env["tina4.auth"] = payload
             return true
           end
 

data/lib/tina4/cache_backends/base_backend.rb

@@ -78,6 +78,14 @@ module Tina4
       def available?
         true
       end
+
+      # When available? is false because a required gem is not installed, the
+      # sentence that names the gem and the install command; nil otherwise.
+      #
+      # @return [String, nil]
+      def missing_driver_message
+        nil
+      end
     end
   end
 end

data/lib/tina4/cache_backends/mongo_backend.rb

@@ -23,6 +23,7 @@ module Tina4
         @hits = 0
         @misses = 0
         @coll = nil
+        @driver_missing = false
         begin
           require "mongo"
           Mongo::Logger.logger.level = Logger::FATAL if defined?(Mongo::Logger)
@@ -39,7 +40,12 @@ module Tina4
           @coll = client[:tina4_cache]
           @coll.indexes.create_one({ expires_at: 1 }, expire_after: 0)
           client.database.command(ping: 1)
-        rescue LoadError, StandardError
+        rescue LoadError
+          # Recorded apart from a service failure so the factory's fallback
+          # warning names the gem only when the gem is really what is missing.
+          @driver_missing = true
+          @coll = nil
+        rescue StandardError
           @coll = nil
         end
       end
@@ -48,6 +54,15 @@ module Tina4
         !@coll.nil?
       end
 
+      # The install hint for the factory's fallback warning, or nil when the
+      # gem loaded and the service is what failed.
+      def missing_driver_message
+        return nil unless @driver_missing
+
+        "The 'mongo' gem is required for the mongodb cache backend. Install it with: " \
+          "bundle add mongo (or add gem \"mongo\" to your Gemfile)"
+      end
+
       def get(key)
         if @coll.nil?
           @misses += 1

data/lib/tina4/cache_backends.rb

@@ -92,9 +92,11 @@ module Tina4
 
       # Configured backend unusable — degrade to the file backend.
       begin
+        install_hint = be.missing_driver_message
         Tina4::Log.warning(
           "Cache backend '#{backend}' is unavailable " \
-          "(driver missing or service unreachable) — falling back to 'file'."
+          "(driver missing or service unreachable) — falling back to 'file'." \
+          "#{install_hint ? " #{install_hint}" : ""}"
         )
       rescue StandardError
         # Logging must never break cache construction.

data/lib/tina4/cli.rb

@@ -715,6 +715,11 @@ module Tina4
 
       require_relative "../tina4"
 
+      # --production turns debug off: the explicit flag beats .env and the
+      # environment (ADR-0041, ADR-0079 s3). Set before the env files load,
+      # which are first-wins. It used to only choose Puma.
+      ENV["TINA4_DEBUG"] = "false" if options[:production]
+
       root_dir = Dir.pwd
       Tina4.initialize!(root_dir)
 

data/lib/tina4/database/sqlite3_adapter.rb

@@ -7,10 +7,16 @@
 
 
 require_relative "../sqlite3_gem"
+require_relative "../sqlite_path_resolver"
+require_relative "../row_symbolizer"
 
 module Tina4
   module Adapters
     class Sqlite3Adapter
+      # Shared SQLite path resolution — one home for both SQLite resolvers.
+      extend Tina4::SqlitePathResolver
+      include Tina4::RowSymbolizer
+
       attr_reader :connection, :db_path
 
       def initialize(connection_string = nil)
@@ -30,32 +36,6 @@ module Tina4
         self
       end
 
-      # Resolve a SQLite URL / path against the project root (cwd).
-      # Convention matches Tina4::Drivers::SqliteDriver.resolve_path —
-      # three slashes = relative, four = absolute, drive letter = Windows abs.
-      def self.resolve_path(connection_string)
-        return ":memory:" if connection_string == "sqlite::memory:" || connection_string == "sqlite:///:memory:"
-
-        raw = connection_string.to_s
-          .sub(/^sqlite3?:\/\/\//, "")
-          .sub(/^sqlite3?:\/\//, "")
-          .sub(/^sqlite3?:/, "")
-        return ":memory:" if raw == ":memory:"
-
-        is_windows_abs = raw.match?(/^[A-Za-z]:[\/\\]/)
-        is_unix_abs    = raw.start_with?("/")
-
-        if is_windows_abs || is_unix_abs
-          raw
-        else
-          resolved = File.join(Dir.pwd, raw)
-          parent = File.dirname(resolved)
-          require "fileutils"
-          FileUtils.mkdir_p(parent) unless File.directory?(parent)
-          resolved
-        end
-      end
-
       def close
         @connection.close if @connection
         @connection = nil
@@ -163,34 +143,6 @@ module Tina4
       def apply_limit(sql, limit, offset = 0)
         "#{sql}\nLIMIT #{limit} OFFSET #{offset}"
       end
-
-      private
-
-      # Symbolize a whole result set's keys, computing the mapping ONCE per query
-      # rather than per cell. See the matching helper in drivers/sqlite_driver.rb
-      # for the rationale: the per-row form ran k.to_s.to_sym for every cell, so a
-      # 5,000-row x 6-column fetch did 30,000 conversions for 6 distinct keys. The
-      # is_a? guard still drops any positional Integer keys older gems emit.
-      def symbolize_rows(rows)
-        return rows if rows.empty?
-
-        str_keys = rows.first.keys.select { |k| k.is_a?(String) || k.is_a?(Symbol) }
-        sym_keys = str_keys.map(&:to_sym)
-        count = str_keys.length
-        rows.map do |row|
-          out = {}
-          i = 0
-          while i < count
-            out[sym_keys[i]] = row[str_keys[i]]
-            i += 1
-          end
-          out
-        end
-      end
-
-      def symbolize_keys(hash)
-        symbolize_rows([hash]).first
-      end
     end
   end
 end

data/lib/tina4/dev_admin.rb

@@ -822,10 +822,17 @@ module Tina4
         resolved = begin
           safe_project_path(file_path, extra_roots: [scan_root])
         rescue ArgumentError
-          begin
-            scan_root ? safe_project_path(File.join(scan_root, file_path), extra_roots: [scan_root]) : nil
-          rescue ArgumentError
-            nil
+          # A RELATIVE path may be retried against the last scan root; an
+          # absolute path that resolved outside the project is simply outside -
+          # never re-based under the scan root (File.join would fold it into a
+          # bogus in-root path that 404s instead of refusing 403). Parity with
+          # Python/Node: outside -> 403.
+          if scan_root && !file_path.empty? && !File.absolute_path?(file_path)
+            begin
+              safe_project_path(File.join(scan_root, file_path), extra_roots: [scan_root])
+            rescue ArgumentError
+              nil
+            end
           end
         end
         return json_response({ "error" => "Path outside project" }, 403) if !file_path.empty? && resolved.nil?

data/lib/tina4/drivers/sqlite_driver.rb

@@ -8,11 +8,17 @@
 
 require_relative "schema_split"
 require_relative "../sqlite3_gem"
+require_relative "../sqlite_path_resolver"
+require_relative "../row_symbolizer"
 
 module Tina4
   module Drivers
     class SqliteDriver
+      # Shared SQLite path resolution — one home for both SQLite resolvers.
+      extend Tina4::SqlitePathResolver
+
       include Tina4::DatabaseAdapter
+      include Tina4::RowSymbolizer
       include SchemaSplit
       attr_reader :connection
 
@@ -39,54 +45,18 @@ module Tina4
 
         @connection = SQLite3::Database.new(db_path)
         @connection.results_as_hash = true
+        # Wait up to 5 s for another process's write lock instead of failing at
+        # once with SQLite3::BusyException. The sqlite3 gem's default is NO wait,
+        # so two processes writing the same file collided on the first overlap:
+        # MEASURED on the lab, five of six processes racing a first session write
+        # died with "database is locked". 5000 ms matches PHP's busyTimeout(5000)
+        # and Python's sqlite3 default. Set BEFORE the WAL pragma so that write
+        # waits too.
+        @connection.busy_timeout = 5000
         @connection.execute("PRAGMA journal_mode=WAL")
         @connection.execute("PRAGMA foreign_keys=ON")
       end
 
-      # Resolve a SQLite URL / path against the project root (cwd).
-      #
-      # Convention (matches tina4-python, tina4-php, tina4-nodejs):
-      #   sqlite::memory:              → :memory:
-      #   sqlite:///:memory:           → :memory:
-      #   sqlite:///app.db             → {cwd}/app.db  (relative)
-      #   sqlite:///data/app.db        → {cwd}/data/app.db  (relative; auto-mkdir under cwd)
-      #   sqlite:////var/data/app.db   → /var/data/app.db  (absolute; no auto-mkdir)
-      #   sqlite:///C:/Users/app.db    → C:/Users/app.db  (Windows absolute)
-      #
-      # Never mkdir outside cwd — that was the root cause of the
-      # "Read-only file system: '/data'" crash on macOS.
-      def self.resolve_path(connection_string)
-        return ":memory:" if connection_string == "sqlite::memory:" || connection_string == "sqlite:///:memory:"
-
-        # Strip the scheme + up to three slashes, preserving a potential fourth
-        # slash (absolute) or drive letter.
-        # `sqlite3:` is a documented alias for `sqlite:`. Normalise it FIRST or
-        # none of the strips below match and `raw` keeps the whole connection
-        # string, so the database file is literally named "sqlite3:app.db".
-        # Not merely ugly: a colon is an illegal filename character on Windows,
-        # so the documented alias is unusable there. DatabaseUrl already
-        # normalises it; this method duplicates the strip instead of calling
-        # it, which is how the two drifted.
-        normalised = connection_string.sub(/^sqlite3:/, "sqlite:")
-        raw = normalised.sub(/^sqlite:\/\/\//, "").sub(/^sqlite:\/\//, "").sub(/^sqlite:/, "")
-        return ":memory:" if raw == ":memory:"
-
-        is_windows_abs = raw.match?(/^[A-Za-z]:[\/\\]/)
-        is_unix_abs    = raw.start_with?("/")
-
-        if is_windows_abs || is_unix_abs
-          # Absolute — trust the user; don't auto-mkdir outside cwd.
-          raw
-        else
-          # Relative — resolve under cwd; auto-mkdir parent dir.
-          resolved = File.join(Dir.pwd, raw)
-          parent = File.dirname(resolved)
-          require "fileutils"
-          FileUtils.mkdir_p(parent) unless File.directory?(parent)
-          resolved
-        end
-      end
-
       def close
         @connection&.close
       end
@@ -219,43 +189,6 @@ module Tina4
       def identifier?(str)
         str.to_s.match?(/\A[A-Za-z_][A-Za-z0-9_]*\z/)
       end
-
-      # Symbolize the keys of a whole result set, computing the key mapping ONCE.
-      #
-      # results_as_hash=true hands back string-keyed hashes; every row of a query
-      # has the same columns, so the string->symbol conversion is identical for
-      # every row. The old code called `symbolize_keys` per row, which ran
-      # `k.to_s.to_sym` and an `is_a?` guard PER CELL: a 5,000-row x 6-column
-      # fetch did 30,000 conversions for 6 distinct keys and made Tina4 the
-      # slowest of the four frameworks at bulk reads (Select ALL 5,000 rows:
-      # 10.16ms vs raw sqlite3 2.56ms). Hoisting the mapping out of the loop
-      # roughly halves the hydration cost with byte-identical output.
-      #
-      # The is_a?(String|Symbol) guard is preserved: older sqlite3 gems put
-      # positional Integer keys in the hash alongside the string names, and those
-      # must still be dropped.
-      def symbolize_rows(rows)
-        return rows if rows.empty?
-
-        str_keys = rows.first.keys.select { |k| k.is_a?(String) || k.is_a?(Symbol) }
-        sym_keys = str_keys.map(&:to_sym)
-        count = str_keys.length
-        rows.map do |row|
-          out = {}
-          i = 0
-          while i < count
-            out[sym_keys[i]] = row[str_keys[i]]
-            i += 1
-          end
-          out
-        end
-      end
-
-      # Single-hash convenience kept for any external caller; delegates to the
-      # batch path so there is one implementation of the mapping rule.
-      def symbolize_keys(hash)
-        symbolize_rows([hash]).first
-      end
     end
   end
 end

data/lib/tina4/env.rb

@@ -5,8 +5,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
-require "digest"
-
 module Tina4
   # Legacy env var names that v3.12 has retired. If any of these are set in
   # the environment we refuse to boot — silently ignoring them would cause
@@ -90,11 +88,15 @@ module Tina4
     # signal for Auth.ensure_dev_secret to mint a per-machine random dev secret
     # (saved to gitignored .env.local) in dev, or to emit the actionable
     # "set TINA4_SECRET" warning in CI/prod. Parity with the Python master.
+    #
+    # TINA4_DEBUG is deliberately absent too: unset debug means OFF, and a boot
+    # side effect must never switch it on (ADR-0079 s3). `tina4ruby init`, an
+    # explicit developer action, writes TINA4_DEBUG=true into the project it
+    # scaffolds.
     DEFAULT_ENV = {
       "PROJECT_NAME" => "Tina4 Ruby Project",
       "TINA4_SWAGGER_VERSION" => "1.0.0",
       "TINA4_LOCALE" => "en",
-      "TINA4_DEBUG" => "true",
       "TINA4_LOG_LEVEL" => "ALL"
     }.freeze
 
@@ -266,11 +268,11 @@ module Tina4
         File.join(root_dir, ".env")
       end
 
+      # A missing .env gets the neutral defaults only. It no longer mints a
+      # TINA4_API_KEY: an MD5 of the clock is guessable, and that key opened
+      # the route auth gate and the dev-admin write gate (ADR-0079 s3).
       def create_default_env(path)
-        api_key = Digest::MD5.hexdigest(Time.now.to_s)
-        content = DEFAULT_ENV.map { |k, v| "#{k}=\"#{v}\"" }.join("\n")
-        content += "\nTINA4_API_KEY=\"#{api_key}\"\n"
-        File.write(path, content)
+        File.write(path, DEFAULT_ENV.map { |k, v| "#{k}=\"#{v}\"" }.join("\n") + "\n")
       end
 
       # Parse a dotenv file into ENV.

data/lib/tina4/frond.rb

@@ -3258,9 +3258,11 @@ module Tina4
       sid = form_token_session_id.to_s
       payload["session_id"] = sid unless sid.empty?
 
+      # get_token's expires_in is MINUTES, like every framework's. This used to
+      # pass minutes * 60, so a form token lived 60 hours, not 60 minutes
+      # (ADR-0079 s5).
       ttl_minutes = (ENV["TINA4_TOKEN_LIMIT"] || "60").to_i
-      expires_in = ttl_minutes * 60
-      Tina4::Auth.create_token(payload, expires_in: expires_in)
+      Tina4::Auth.create_token(payload, expires_in: ttl_minutes)
     end
 
     def self.generate_form_token(descriptor = "")