@mriekki/project-forge 4.19.1 → 4.21.0

package/assets/components.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.19.1",
+  "version": "4.21.0",
   "defaultProfile": "greenfield-project",
   "profiles": {
     "greenfield-project": {
@@ -21,7 +21,7 @@
       "canonicalDescriptor": "distributions/greenfield-workspace.json"
     },
     "deployment": {
-      "revision": "4ce2c2f76556c85a5bc4836a10e197cad425688d",
+      "revision": "f2d20ec7aac61494ef9fdb7f3702060b8d8d8865",
       "distribution": "greenfield-project",
       "descriptor": "assets/deployment/distribution.json",
       "sourceRoot": "assets/generated/deployment",

package/assets/generated/ASSEMBLY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.19.1",
+  "version": "4.21.0",
   "components": {
     "core": {
       "revision": "4c74c1801b82d3aa438447d392024d32ca5697b0",
@@ -361,7 +361,7 @@
       ]
     },
     "deployment": {
-      "revision": "4ce2c2f76556c85a5bc4836a10e197cad425688d",
+      "revision": "f2d20ec7aac61494ef9fdb7f3702060b8d8d8865",
       "distribution": "greenfield-project",
       "files": [
         {
@@ -392,7 +392,7 @@
         {
           "source": "src/project_forge_deployment/app_cli.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/app_cli.py",
-          "sha256": "f27704c80b1eff45888bf56745bcf8755f2fad88851147600af7056953757825"
+          "sha256": "b44ec913fd1080ff66bff6643d2d9fad17262725c0f35557c56f52c86090c060"
         },
         {
           "source": "src/project_forge_deployment/app_deployment.py",
@@ -402,12 +402,12 @@
         {
           "source": "src/project_forge_deployment/app_runtime.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/app_runtime.py",
-          "sha256": "73736aada7c3db0e2a7c74a3e88990316b89e6c34a71b4997cdc4c79c7e31708"
+          "sha256": "6f4ae7f663dc7a4e51225c1420f7aa6be5d2b77445b792f9e4495ba3eeb059ad"
         },
         {
           "source": "src/project_forge_deployment/app_runtime_remote.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/app_runtime_remote.py",
-          "sha256": "791cc7592cff93555f7b6facdd31fbe58de5e711732d9dfcb9321500a0d79cdf"
+          "sha256": "5b6ddffcc1105d3a401ae17456cdfdb279c3005bfcb6c81bbd1eabc27479de05"
         },
         {
           "source": "src/project_forge_deployment/app_runtime_workstation.py",
@@ -437,12 +437,12 @@
         {
           "source": "src/project_forge_deployment/cloudflare_ingress.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_ingress.py",
-          "sha256": "f462bcc1cb9d1fd20a93cf7fa6ea00402df0be69507308ffbd7e2af0d0f2900f"
+          "sha256": "d07c79b7f9f6c9a0f9b417fd0a1d4502101075b128a12d23b2791c31e03d4f01"
         },
         {
           "source": "src/project_forge_deployment/cloudflare_ingress_remote.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_ingress_remote.py",
-          "sha256": "6f92ec8b50baeb6894f096935450f3cf1f86abf5313a681ee3c5bca2283ddc99"
+          "sha256": "73d9f68cbece33155ccac8ce2e24da8f0ec6698a7b66fba18cb9bf38734ea686"
         },
         {
           "source": "src/project_forge_deployment/cloudflare_route_apply.py",
@@ -502,7 +502,7 @@
         {
           "source": "src/project_forge_deployment/ingress_cli.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/ingress_cli.py",
-          "sha256": "59ff40843573da74dc430b517130f300b3eb2f2e4f00de0eb6dab5f9efb27692"
+          "sha256": "973b89daa7e57d925f0be56fbfc0dc4c6f79ab082036c7fb26462691f2f16d02"
         },
         {
           "source": "src/project_forge_deployment/keys.py",
@@ -647,7 +647,7 @@
         {
           "source": "docs/CLOUDFLARE_INGRESS.md",
           "destination": "docs/project-forge/CLOUDFLARE_INGRESS.md",
-          "sha256": "603cf5e732439efdb4f628a16555eba1226db9ef0a665872fd0341c85f9050ee"
+          "sha256": "b47bfb1ef1dcd7be3c501b88add0dea675907ce3f9e65cf7852c5ffddbe0ce46"
         },
         {
           "source": "docs/DEVELOPER_ENVIRONMENTS.md",

package/assets/generated/deployment/docs/CLOUDFLARE_INGRESS.md

@@ -200,6 +200,12 @@ without a zone or public hostname. Once a domain is registered and active in Clo
 
 The shared Cloudflare zone is environment infrastructure and should not be copied into every Project as a credential-like default. The exact application hostname remains Project/environment state.
 
+## Experimental authenticated public-origin mode (new scopes only)
+
+For an isolated test scope, `ingress cloudflare configure` supports `--authenticated-origin`. This explicit opt-in provisions a private Caddy Unix listener and mounts its socket directory only in the pinned cloudflared connector. Public hostname rules use `unix:/run/project-forge-origin/origin.sock` and the public hostname as Host; the LAN TCP listener and the existing default mode remain unchanged. The remote adapter derives each authenticated route's upstream from its still-owned LAN registry entry and strips/replaces forwarding headers before proxying.
+
+**Not a supported Production setting yet:** origin mount possession is not end-user login. Real pinned cloudflared edge-to-app forwarding, canonical client-IP semantics, app proxy-peer trust, socket replacement, and rollback still need live proof. Do not grant the socket mount to unrelated containers or treat forwarded IP headers as an authorization credential. An installed ingress scope cannot switch modes in place; use a new dedicated scope and the normal host/route write gates. See the canonical Kit's `docs/EXPERIMENTAL_AUTHENTICATED_ORIGIN.md` and issue #78 for the detailed evidence boundary.
+
 ## Current cloudflared runtime
 
 The first partial implementation selects Cloudflare release `2026.10.4` and pins the actual Docker pull to the verified multi-platform image index digest:

package/assets/generated/deployment/src/project_forge_deployment/app_cli.py

@@ -49,6 +49,16 @@ def _parse_env(items: list[str]) -> list[tuple[str, str]]:
     return result
 
 
+def _parse_materials(items: list[str]) -> list[tuple[str, str]]:
+    values: list[tuple[str, str]] = []
+    for item in items:
+        if "=" not in item:
+            raise DeploymentKitError("--read-only-material requires NAME=/absolute/container/directory.")
+        name, target = item.split("=", 1)
+        values.append((name, target))
+    return values
+
+
 def _confirm(args: argparse.Namespace, phrase: str, action: str) -> None:
     if args.yes:
         return
@@ -91,6 +101,13 @@ def _add_runtime_contract(parser: argparse.ArgumentParser) -> None:
     parser.add_argument("--health-path", required=True)
     parser.add_argument("--run-as", required=True)
     parser.add_argument("--data-container-path")
+    parser.add_argument(
+        "--read-only-material",
+        action="append",
+        default=[],
+        metavar="NAME=/container/directory",
+        help="Opt-in root-owned remote material directory; source derived from Project/environment/name",
+    )
     parser.add_argument(
         "--env",
         action="append",
@@ -185,6 +202,7 @@ def main(argv: list[str] | None = None) -> int:
             persistence_mode=args.persistence_mode,
             data_container_path=args.data_container_path,
             environment_variables=_parse_env(args.env),
+            read_only_materials=_parse_materials(args.read_only_material),
         )
         assert_app_spec_matches_persistence(args.name, spec)
 

package/assets/generated/deployment/src/project_forge_deployment/app_runtime.py

@@ -19,6 +19,8 @@ from .app_runtime_remote import REMOTE_SCRIPT
 
 APP_ROOT = "/srv/project-forge-apps"
 APP_SCHEMA_VERSION = 1
+# Operator-provisioned remote sources: never workstation paths or auto-created directories.
+REMOTE_MATERIAL_ROOT = "/srv/project-forge-material"
 APP_DEPLOY_WRITE_PHRASE = "[APP DEPLOY WRITE]"
 PRODUCTION_APP_DEPLOY_WRITE_PHRASE = "[PRODUCTION APP DEPLOY]"
 
@@ -84,6 +86,67 @@ def _container_path(value: str | None) -> str | None:
     return value.rstrip("/") or "/"
 
 
+
+def _normalize_read_only_materials(
+    materials: Iterable[tuple[str, str]] | None,
+    *,
+    data_path: str | None,
+) -> list[dict[str, str]]:
+    if materials is None:
+        return []
+    result: list[dict[str, str]] = []
+    names: set[str] = set()
+    paths: list[str] = []
+    for name, target in materials:
+        if len(result) >= 8:
+            raise DeploymentKitError("Remote read-only material mount count must not exceed eight.")
+        name = _slug(name, "read-only material name")
+        if name in names:
+            raise DeploymentKitError(f"Duplicate read-only material name: {name}")
+        if not isinstance(target, str) or _CONTAINER_PATH_RE.fullmatch(target) is None:
+            raise DeploymentKitError("Read-only material target must be a safe absolute container directory.")
+        parts = target.split("/")[1:]
+        if not parts or any(part in {"", ".", ".."} for part in parts):
+            raise DeploymentKitError("Read-only material target must be normalized and cannot be root.")
+        if parts[0] in {"proc", "sys", "dev", "run"} or parts[:2] == ["var", "run"]:
+            raise DeploymentKitError("Read-only material cannot mask a container system runtime directory.")
+        for other in paths + ([data_path] if data_path else []):
+            if target == other or target.startswith(other.rstrip("/") + "/") or other.startswith(target + "/"):
+                raise DeploymentKitError("Read-only material target overlaps another mount.")
+        names.add(name)
+        paths.append(target)
+        result.append({"name": name, "containerPath": target})
+    return sorted(result, key=lambda item: item["name"])
+
+
+def _material_evidence_for_spec(name: str, spec: dict[str, Any]) -> dict[str, str] | None:
+    materials = spec.get("readOnlyMaterials")
+    if not materials:
+        return None
+    profile = load_profile(name)
+    evidence = verify_access(profile)
+    output = _run_remote(profile, evidence["address"], "material-inspect", spec=spec)
+    observed: dict[str, str] = {}
+    for line in output.splitlines():
+        parts = line.split("\t")
+        if len(parts) != 3 or parts[0] != "MATERIAL":
+            raise DeploymentKitError("Malformed remote material source evidence.")
+        _, material_name, identity = parts
+        if not re.fullmatch(r"[a-z0-9](?:[a-z0-9-]*[a-z0-9])?", material_name) or not re.fullmatch(r"[0-9]+:[0-9]+", identity):
+            raise DeploymentKitError("Malformed remote material source identity.")
+        if material_name in observed:
+            raise DeploymentKitError("Duplicate remote material source evidence.")
+        observed[material_name] = identity
+    if set(observed) != {item["name"] for item in materials}:
+        raise DeploymentKitError("Remote material inspection omitted or added a source.")
+    return dict(sorted(observed.items()))
+
+
+def _verify_material_evidence(name: str, plan: dict[str, Any]) -> None:
+    if plan["spec"].get("readOnlyMaterials"):
+        if _material_evidence_for_spec(name, plan["spec"]) != plan["readOnlyMaterialEvidence"]:
+            raise DeploymentKitError("Remote material directory identity changed after planning; review a new plan.")
+
 def _normalize_environment_variables(items: dict[str, str] | Iterable[tuple[str, str]]) -> dict[str, str]:
     pairs = items.items() if isinstance(items, dict) else items
     result: dict[str, str] = {}
@@ -111,6 +174,7 @@ def normalize_app_spec(
     persistence_mode: str,
     data_container_path: str | None,
     environment_variables: dict[str, str] | Iterable[tuple[str, str]],
+    read_only_materials: Iterable[tuple[str, str]] | None = None,
 ) -> dict[str, Any]:
     if persistence_mode not in {"none", "directory"}:
         raise DeploymentKitError("persistenceMode must be 'none' or 'directory'.")
@@ -135,6 +199,9 @@ def normalize_app_spec(
         },
         "environmentVariables": _normalize_environment_variables(environment_variables),
     }
+    materials = _normalize_read_only_materials(read_only_materials, data_path=data_path)
+    if materials:
+        spec["readOnlyMaterials"] = materials
     spec["specSha256"] = _spec_sha(spec)
     return spec
 
@@ -150,8 +217,13 @@ def _b64(value: str) -> str:
     return base64.b64encode(value.encode("utf-8")).decode("ascii")
 
 
-def build_remote_script(spec: dict[str, Any] | None = None) -> str:
+def build_remote_script(
+    spec: dict[str, Any] | None = None, *, expected_materials: dict[str, str] | None = None,
+) -> str:
     env_keys: list[str] = []
+    material_names: list[str] = []
+    material_targets: list[str] = []
+    material_expected: list[str] = []
     env_values: list[str] = []
     desired = {
         "ownerRepo": "",
@@ -183,9 +255,14 @@ def build_remote_script(spec: dict[str, Any] | None = None) -> str:
         for key, value in spec["environmentVariables"].items():
             env_keys.append(_b64(key))
             env_values.append(_b64(value))
+        for item in spec.get("readOnlyMaterials", []):
+            material_names.append(_b64(item["name"]))
+            material_targets.append(_b64(item["containerPath"]))
+            material_expected.append((expected_materials or {}).get(item["name"], ""))
 
     replacements = {
         "__APP_ROOT__": APP_ROOT,
+        "__MATERIAL_ROOT__": REMOTE_MATERIAL_ROOT,
         "__APP_SCHEMA_VERSION__": str(APP_SCHEMA_VERSION),
         "__NETWORK_NAME__": NETWORK_NAME,
         "__CADDY_CONTAINER__": CADDY_CONTAINER,
@@ -203,6 +280,9 @@ def build_remote_script(spec: dict[str, Any] | None = None) -> str:
         "__D_SPEC_SHA__": desired["specSha256"],
         "__D_ENV_KEYS__": " ".join(f"'{item}'" for item in env_keys),
         "__D_ENV_VALUES__": " ".join(f"'{item}'" for item in env_values),
+        "__D_MATERIAL_NAMES__": " ".join(shlex.quote(x) for x in material_names),
+        "__D_MATERIAL_TARGETS__": " ".join(shlex.quote(x) for x in material_targets),
+        "__D_MATERIAL_EXPECTED__": " ".join(shlex.quote(x) for x in material_expected),
     }
     script = REMOTE_SCRIPT
     for placeholder, value in replacements.items():
@@ -224,7 +304,7 @@ def _parse_inventory(output: str) -> dict[str, Any]:
                 raise DeploymentKitError("Malformed or duplicate application inventory summary.")
             summary[parts[1]] = parts[2]
             continue
-        if parts[0] != "APP" or len(parts) != 15:
+        if parts[0] != "APP" or len(parts) not in (15, 17):
             raise DeploymentKitError("Malformed application inventory record.")
         try:
             port = int(parts[7])
@@ -258,6 +338,29 @@ def _parse_inventory(output: str) -> dict[str, Any]:
             "connectedToSharedNetwork": parts[13] == "true",
             "httpHealthy": parts[14] == "true",
         }
+        if len(parts) == 17:
+            if parts[15] not in {"true", "false"} or not parts[16]:
+                raise DeploymentKitError("Malformed remote material mount readiness.")
+            materials: list[dict[str, str]] = []
+            for encoded in parts[16].split(";"):
+                pieces = encoded.split("@")
+                if len(pieces) != 3 or re.fullmatch(r"[0-9]+:[0-9]+", pieces[2]) is None:
+                    raise DeploymentKitError("Malformed remote material inventory identity.")
+                materials.append({
+                    "name": pieces[0],
+                    "containerPath": pieces[1],
+                    "sourceIdentity": pieces[2],
+                })
+            normalized = _normalize_read_only_materials(
+                [(item["name"], item["containerPath"]) for item in materials],
+                data_path=None,
+            )
+            if [(item["name"], item["containerPath"]) for item in normalized] != [
+                (item["name"], item["containerPath"]) for item in materials
+            ]:
+                raise DeploymentKitError("Remote material inventory is unordered or conflicting.")
+            app["readOnlyMaterials"] = materials
+            app["materialMountsVerified"] = parts[15] == "true"
         apps.append(app)
     if set(summary) != {"appCount"}:
         raise DeploymentKitError("Application inventory omitted appCount.")
@@ -280,8 +383,9 @@ def _run_remote(
     *,
     spec: dict[str, Any] | None = None,
     expected_spec_sha: str = "",
+    expected_materials: dict[str, str] | None = None,
 ) -> str:
-    if action not in {"inventory", "deploy"}:
+    if action not in {"inventory", "deploy", "material-inspect"}:
         raise DeploymentKitError(f"Unsupported application-runtime action: {action}")
     args = [action]
     if action == "deploy":
@@ -293,7 +397,7 @@ def _run_remote(
     )
     completed = subprocess.run(
         command,
-        input=build_remote_script(spec).encode("utf-8"),
+        input=build_remote_script(spec, expected_materials=expected_materials).encode("utf-8"),
         check=False,
         capture_output=True,
     )
@@ -360,9 +464,10 @@ def plan_app_deploy(name: str, spec: dict[str, Any]) -> dict[str, Any]:
         and existing["containerRunning"]
         and existing["connectedToSharedNetwork"]
         and existing["httpHealthy"]
+        and existing.get("materialMountsVerified", True)
     ):
         raise DeploymentKitError("The exact application runtime spec is already deployed and healthy.")
-    return {
+    plan = {
         "targetName": name,
         "action": "deploy",
         "environment": spec["environment"],
@@ -385,6 +490,9 @@ def plan_app_deploy(name: str, spec: dict[str, Any]) -> dict[str, Any]:
         "expectedSpecSha256": existing["specSha256"] if existing is not None else None,
         "spec": spec,
     }
+    if spec.get("readOnlyMaterials"):
+        plan["readOnlyMaterialEvidence"] = _material_evidence_for_spec(name, spec)
+    return plan
 
 
 def deploy_write_phrase(plan: dict[str, Any]) -> str:
@@ -428,7 +536,7 @@ def render_locked_app_deploy_stage(
         "expectedSpecSha256",
         "spec",
     }
-    if not isinstance(plan, dict) or set(plan) != required or plan["action"] != "deploy":
+    if not isinstance(plan, dict) or set(plan) != required | ({"readOnlyMaterialEvidence"} if plan.get("spec", {}).get("readOnlyMaterials") else set()) or plan["action"] != "deploy":
         raise DeploymentKitError("Malformed application deployment plan.")
     if (plan["changeType"] != "update" or plan["retainsPreviousRelease"] is not True
             or not isinstance(plan["expectedSpecSha256"], str)
@@ -456,7 +564,8 @@ def render_locked_app_deploy_stage(
         )
     profile = load_profile(plan["targetName"])
     evidence = verify_access(profile)
-    script = build_remote_script(plan["spec"])
+    _verify_material_evidence(plan["targetName"], plan)
+    script = build_remote_script(plan["spec"], expected_materials=plan.get("readOnlyMaterialEvidence"))
     delimiter = "PROJECT_FORGE_APP_DEPLOY_STAGE_" + hashlib.sha256(script.encode()).hexdigest()[:24]
     if delimiter in script:
         raise DeploymentKitError("Unsafe application deployment script delimiter collision.")
@@ -495,7 +604,7 @@ def apply_app_deploy(plan: dict[str, Any]) -> dict[str, Any]:
         "expectedSpecSha256",
         "spec",
     }
-    if not isinstance(plan, dict) or set(plan) != required or plan["action"] != "deploy":
+    if not isinstance(plan, dict) or set(plan) != required | ({"readOnlyMaterialEvidence"} if plan.get("spec", {}).get("readOnlyMaterials") else set()) or plan["action"] != "deploy":
         raise DeploymentKitError("Malformed application deployment plan.")
 
     current = app_inventory(plan["targetName"])
@@ -507,6 +616,7 @@ def apply_app_deploy(plan: dict[str, Any]) -> dict[str, Any]:
     if platform["state"] != "ready":
         raise DeploymentKitError("Shared host platform is no longer ready; application deployment is blocked.")
 
+    _verify_material_evidence(plan["targetName"], plan)
     profile = load_profile(plan["targetName"])
     evidence = verify_access(profile)
     _run_remote(
@@ -515,6 +625,7 @@ def apply_app_deploy(plan: dict[str, Any]) -> dict[str, Any]:
         "deploy",
         spec=plan["spec"],
         expected_spec_sha=plan["expectedSpecSha256"] or "",
+        expected_materials=plan.get("readOnlyMaterialEvidence"),
     )
     final = app_inventory(plan["targetName"])
     deployed = _find_app(final, plan["appSlug"], plan["environment"])
@@ -526,6 +637,7 @@ def apply_app_deploy(plan: dict[str, Any]) -> dict[str, Any]:
         deployed["containerRunning"]
         and deployed["connectedToSharedNetwork"]
         and deployed["httpHealthy"]
+        and deployed.get("materialMountsVerified", True)
     ):
         raise DeploymentKitError("Application deployment completed but runtime readiness is not healthy.")
     final["mutated"] = True

package/assets/generated/deployment/src/project_forge_deployment/app_runtime_remote.py

@@ -8,6 +8,7 @@ EXPECTED_SPEC_SHA="${2:-}"
 DEPLOY_USER="${3:-}"
 HELD_LOCK_FD="${4:-}"
 APP_ROOT="__APP_ROOT__"
+MATERIAL_ROOT="__MATERIAL_ROOT__"
 APP_SCHEMA_VERSION="__APP_SCHEMA_VERSION__"
 NETWORK_NAME="__NETWORK_NAME__"
 CADDY_CONTAINER="__CADDY_CONTAINER__"
@@ -26,6 +27,9 @@ D_DATA_TARGET_B64="__D_DATA_TARGET_B64__"
 D_SPEC_SHA="__D_SPEC_SHA__"
 D_ENV_KEYS=(__D_ENV_KEYS__)
 D_ENV_VALUES=(__D_ENV_VALUES__)
+D_MATERIAL_NAMES=(__D_MATERIAL_NAMES__)
+D_MATERIAL_TARGETS=(__D_MATERIAL_TARGETS__)
+D_MATERIAL_EXPECTED=(__D_MATERIAL_EXPECTED__)
 
 b64d() { printf '%s' "$1" | base64 --decode; }
 meta_value() {
@@ -53,6 +57,92 @@ network_has_container() {
         grep -Fxq "$container"
 }
 
+
+material_source() {
+    printf '%s/%s/%s/%s' "$MATERIAL_ROOT" "$D_APP" "$D_ENV" "$1"
+}
+material_identity() {
+    local source="$1" run_as="$2" uid gid dir owner mode hazards
+    uid="${run_as%%:*}"
+    gid="$uid"
+    [[ "$run_as" != *:* ]] || gid="${run_as#*:}"
+    command -v setpriv >/dev/null 2>&1 || {
+        echo "setpriv is required to verify read-only material access for runAs." >&2; return 1;
+    }
+    for dir in /srv "$MATERIAL_ROOT" "$MATERIAL_ROOT/$D_APP" "$MATERIAL_ROOT/$D_APP/$D_ENV" "$source"; do
+        [[ -d "$dir" && ! -L "$dir" ]] || {
+            echo "Read-only material directory missing or linked: $dir" >&2; return 1;
+        }
+        owner="$(stat -c '%u' "$dir")"
+        mode="$(stat -c '%a' "$dir")"
+        [[ "$owner" == 0 ]] && (( (8#$mode & 022) == 0 )) || {
+            echo "Read-only material directory ownership or mode is unsafe: $dir" >&2; return 1;
+        }
+    done
+    hazards="$(find -P "$source" -mindepth 1 \( -type l -o ! -uid 0 -o -perm /022 -o \( ! -type f -a ! -type d \) \) -print -quit)" || return 1
+    [[ -z "$hazards" ]] || {
+        echo "Read-only material tree has linked, writable, unowned or special entries." >&2; return 1;
+    }
+    setpriv --reuid "$uid" --regid "$gid" --clear-groups -- bash -c '
+        path="$1"
+        [[ -r "$path" && -x "$path" ]] || exit 1
+        invalid="$(find -P "$path" \( -type d \( ! -readable -o ! -executable \) -o -type f ! -readable \) -print -quit)" || exit 1
+        [[ -z "$invalid" ]]
+    ' -- "$source" || {
+        echo "Read-only material tree is not readable/traversable by runAs." >&2; return 1;
+    }
+    stat -c '%d:%i' "$source"
+}
+validate_material_entries() {
+    [[ "${#D_MATERIAL_NAMES[@]}" -eq "${#D_MATERIAL_TARGETS[@]}" &&
+       "${#D_MATERIAL_NAMES[@]}" -eq "${#D_MATERIAL_EXPECTED[@]}" ]] || {
+        echo "Read-only material argument count mismatch." >&2; exit 33;
+    }
+    local index name target part prior data
+    local -a segments targets=()
+    data="$D_DATA_TARGET"
+    for index in "${!D_MATERIAL_NAMES[@]}"; do
+        name="$(b64d "${D_MATERIAL_NAMES[$index]}")"
+        target="$(b64d "${D_MATERIAL_TARGETS[$index]}")"
+        valid_slug "$name" || { echo "Invalid read-only material name." >&2; exit 33; }
+        [[ "$target" == /* && "$target" != / && "$target" =~ ^/[A-Za-z0-9._~+:/-]+$ ]] || {
+            echo "Invalid read-only material target." >&2; exit 33;
+        }
+        IFS='/' read -r -a segments <<< "${target#/}"
+        for part in "${segments[@]}"; do
+            [[ -n "$part" && "$part" != . && "$part" != .. ]] || {
+                echo "Read-only material target is not normalized." >&2; exit 33;
+            }
+        done
+        case "$target/" in
+            /proc/*|/sys/*|/dev/*|/run/*|/var/run/*)
+                echo "Read-only material target overlaps a system path." >&2; exit 33;;
+        esac
+        for prior in "${targets[@]}" "$data"; do
+            [[ -z "$prior" ]] && continue
+            if [[ "$target" == "$prior" || "$target" == "$prior/"* || "$prior" == "$target/"* ]]; then
+                echo "Read-only material target overlaps another mount." >&2; exit 33
+            fi
+        done
+        targets+=("$target")
+    done
+}
+material_probe() {
+    local check_expected="$1" index name source identity expected
+    for index in "${!D_MATERIAL_NAMES[@]}"; do
+        name="$(b64d "${D_MATERIAL_NAMES[$index]}")"
+        source="$(material_source "$name")"
+        identity="$(material_identity "$source" "$D_RUN_AS")" || return 1
+        expected="${D_MATERIAL_EXPECTED[$index]}"
+        if [[ "$check_expected" == true && "$identity" != "$expected" ]]; then
+            echo "Read-only material directory changed after planning: $name" >&2; return 1
+        fi
+        if [[ "$check_expected" != true ]]; then
+            printf 'MATERIAL\t%s\t%s\n' "$name" "$identity"
+        fi
+    done
+}
+
 probe_http() {
     local container="$1" port="$2" path="$3"
     docker exec "$CADDY_CONTAINER" \
@@ -75,6 +165,47 @@ wait_ready() {
     return 1
 }
 
+
+material_inventory_state() {
+    local file="$1" app="$2" env="$3" container="$4" persistence="$5"
+    local number index name target source recorded current raw mounts run_as data_target line
+    number="$(meta_value "$file" MATERIAL_COUNT || true)"
+    MATERIAL_OK=true
+    MATERIAL_ENTRIES=""
+    [[ -n "$number" ]] || return 0
+    [[ "$number" =~ ^[1-8]$ ]] || { echo "Invalid saved material count." >&2; return 1; }
+    D_APP="$app"
+    D_ENV="$env"
+    run_as="$(meta_value "$file" RUN_AS || true)"
+    valid_run_as "$run_as" || { echo "Invalid saved material runAs." >&2; return 1; }
+    mounts="$(docker inspect --format '{{range .Mounts}}{{printf "%s@%s@%t@%s\n" .Source .Destination .RW .Type}}{{end}}' "$container" 2>/dev/null)" || {
+        MATERIAL_OK=false
+        mounts=""
+    }
+    local expected_count="$number"
+    if [[ "$persistence" == directory ]]; then
+        data_target="$(b64d "$(meta_value "$file" DATA_TARGET_B64 || true)")"
+        line="$APP_ROOT/$app/$env/data@$data_target@true@bind"
+        grep -Fxq -- "$line" <<< "$mounts" || MATERIAL_OK=false
+        expected_count="$((number + 1))"
+    fi
+    [[ "$(grep -c '.' <<< "$mounts" || true)" == "$expected_count" ]] || MATERIAL_OK=false
+    for ((index=0; index < number; index++)); do
+        name="$(b64d "$(meta_value "$file" MATERIAL_NAME_B64_"$index" || true)")"
+        target="$(b64d "$(meta_value "$file" MATERIAL_TARGET_B64_"$index" || true)")"
+        recorded="$(meta_value "$file" MATERIAL_ID_"$index" || true)"
+        valid_slug "$name" && [[ "$target" =~ ^/[A-Za-z0-9._~+:/-]+$ && "$recorded" =~ ^[0-9]+:[0-9]+$ ]] || {
+            echo "Invalid saved material mount metadata." >&2; return 1;
+        }
+        source="$(material_source "$name")"
+        current="$(material_identity "$source" "$run_as" 2>/dev/null)" || { MATERIAL_OK=false; current=""; }
+        [[ "$current" == "$recorded" ]] || MATERIAL_OK=false
+        grep -Fxq -- "$source@$target@false@bind" <<< "$mounts" || MATERIAL_OK=false
+        [[ -z "$MATERIAL_ENTRIES" ]] || MATERIAL_ENTRIES+=";"
+        MATERIAL_ENTRIES+="$name@$target@$recorded"
+    done
+}
+
 inventory() {
     local count=0 state current previous release_file
     local owner env app container image spec_sha port health persistence
@@ -114,9 +245,16 @@ inventory() {
             if [[ "$running" == true && "$connected" == true ]]; then
                 probe_http "$container" "$port" "$health" && healthy=true || true
             fi
-            printf 'APP\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
-                "$owner" "$env" "$app" "$container" "$image" "$spec_sha" "$port" "$health" "$persistence" \
-                "$current" "$previous" "$running" "$connected" "$healthy"
+            material_inventory_state "$release_file" "$app" "$env" "$container" "$persistence" || exit 31
+            if [[ -n "$MATERIAL_ENTRIES" ]]; then
+                printf 'APP\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
+                    "$owner" "$env" "$app" "$container" "$image" "$spec_sha" "$port" "$health" "$persistence" \
+                    "$current" "$previous" "$running" "$connected" "$healthy" "$MATERIAL_OK" "$MATERIAL_ENTRIES"
+            else
+                printf 'APP\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
+                    "$owner" "$env" "$app" "$container" "$image" "$spec_sha" "$port" "$health" "$persistence" \
+                    "$current" "$previous" "$running" "$connected" "$healthy"
+            fi
             count=$((count + 1))
         done < <(find "$APP_ROOT" -mindepth 3 -maxdepth 3 -type f -name deployment.env -print 2>/dev/null | sort)
     fi
@@ -173,6 +311,7 @@ decode_desired() {
         exit 33
     }
     valid_run_as "$D_RUN_AS" || { echo "Invalid numeric runAs value." >&2; exit 33; }
+    validate_material_entries
     [[ "$D_PERSISTENCE" == "none" || "$D_PERSISTENCE" == "directory" ]] || {
         echo "Invalid persistence mode." >&2
         exit 33
@@ -216,6 +355,14 @@ write_release_metadata() {
         printf 'PERSISTENCE_MODE=%s\n' "$D_PERSISTENCE"
         printf 'DATA_TARGET_B64=%s\n' "$D_DATA_TARGET_B64"
         printf 'SPEC_SHA256=%s\n' "$D_SPEC_SHA"
+        if (( ${#D_MATERIAL_NAMES[@]} > 0 )); then
+            printf 'MATERIAL_COUNT=%s\n' "${#D_MATERIAL_NAMES[@]}"
+            for index in "${!D_MATERIAL_NAMES[@]}"; do
+                printf 'MATERIAL_NAME_B64_%s=%s\n' "$index" "${D_MATERIAL_NAMES[$index]}"
+                printf 'MATERIAL_TARGET_B64_%s=%s\n' "$index" "${D_MATERIAL_TARGETS[$index]}"
+                printf 'MATERIAL_ID_%s=%s\n' "$index" "${D_MATERIAL_EXPECTED[$index]}"
+            done
+        fi
         printf 'ENV_COUNT=%s\n' "${#D_ENV_KEYS[@]}"
         for index in "${!D_ENV_KEYS[@]}"; do
             key_b64="${D_ENV_KEYS[$index]}"
@@ -271,6 +418,13 @@ start_desired_container() {
         value="$(b64d "${D_ENV_VALUES[$index]}")"
         docker_args+=(--env "$key=$value")
     done
+    for index in "${!D_MATERIAL_NAMES[@]}"; do
+        local source target name
+        name="$(b64d "${D_MATERIAL_NAMES[$index]}")"
+        target="$(b64d "${D_MATERIAL_TARGETS[$index]}")"
+        source="$(material_source "$name")"
+        docker_args+=(--mount "type=bind,src=$source,dst=$target,readonly")
+    done
     docker_args+=("$D_IMAGE")
     "${docker_args[@]}" >/dev/null
 }
@@ -339,6 +493,7 @@ deploy() {
     release_file="$release_dir/release.env"
 
     acquire_deployment_lock "$lock_file"
+    material_probe true || { echo "Read-only material preflight failed." >&2; exit 40; }
 
     for path in "$root" "$releases" "$state" "$root/data" "$root/deployment-evidence.jsonl"; do
         [[ ! -L "$path" ]] || { echo "Managed application path must not be a symbolic link: $path" >&2; exit 35; }
@@ -397,11 +552,22 @@ deploy() {
             echo "Release directory collision with different runtime metadata." >&2
             exit 35
         }
+        if (( ${#D_MATERIAL_NAMES[@]} > 0 )); then
+            [[ "$(release_value "$release_file" MATERIAL_COUNT || true)" == "${#D_MATERIAL_NAMES[@]}" ]] || {
+                echo "Existing release material metadata mismatch." >&2; exit 35;
+            }
+            for index in "${!D_MATERIAL_NAMES[@]}"; do
+                [[ "$(release_value "$release_file" MATERIAL_ID_"$index" || true)" == "${D_MATERIAL_EXPECTED[$index]}" ]] || {
+                    echo "Existing release material directory identity changed." >&2; exit 35;
+                }
+            done
+        fi
     else
         write_release_metadata "$release_file"
     fi
 
     docker pull "$D_IMAGE" >/dev/null
+    material_probe true || { echo "Read-only material source changed before runtime replacement." >&2; exit 40; }
 
     if [[ -n "$current_container" ]]; then
         docker rm -f "$current_container" >/dev/null
@@ -442,6 +608,10 @@ case "$ACTION" in
     deploy)
         deploy
         ;;
+    material-inspect)
+        decode_desired
+        material_probe false || exit 40
+        ;;
     *)
         echo "Unsupported application-runtime action: $ACTION" >&2
         exit 2

package/assets/generated/deployment/src/project_forge_deployment/cloudflare_ingress.py

@@ -43,12 +43,12 @@ CLOUDFLARE_API_TOKEN_ENV = "PROJECT_FORGE_CLOUDFLARE_API_TOKEN"
 _SLUG_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$")
 _REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
 _LABEL_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$")
-_BOOL_STATUS_KEYS = {"markerPresent", "platformReady", "tokenPresent", "containerRunning", "networkAttached"}
+_BOOL_STATUS_KEYS = {"markerPresent", "platformReady", "tokenPresent", "containerRunning", "networkAttached", "authenticatedOrigin"}
 _STATUS_KEYS = {
     "state", "scope", "markerPresent", "markerSchemaVersion", "markerIngressVersion",
     "markerDistribution", "platformReady", "tokenPresent", "containerRunning",
     "networkAttached", "containerName", "cloudflaredImage", "accountId", "zoneId",
-    "zoneName", "tunnelId", "tunnelName",
+    "zoneName", "tunnelId", "tunnelName", "authenticatedOrigin",
 }
 
 
@@ -199,6 +199,7 @@ def _run_remote(
     spec: dict[str, Any] | None = None,
     expected: dict[str, Any] | None = None,
     tunnel_token: str | None = None,
+    authenticated_origin: bool = False,
 ) -> str:
     if action not in {
         "status", "install", "upgrade", "route-inventory",
@@ -212,6 +213,7 @@ def _run_remote(
         args.append(_route_tsv(expected) if expected is not None else "NONE")
     elif action in {"route-remove", "route-remove-locked"}:
         args.append("")
+    args.append("true" if authenticated_origin else "false")
     remote_command = "sudo -n bash -s -- " + " ".join(shlex.quote(item) for item in args)
     completed = subprocess.run(
         ssh_args(profile, address, command=remote_command),
@@ -424,9 +426,12 @@ def plan_cloudflare_ingress(
     zone_name: str,
     api_token: str,
     tunnel_name: str | None = None,
+    authenticated_origin: bool = False,
 ) -> dict[str, Any]:
     """Plan creation/adoption of one shared remotely managed Cloudflare tunnel."""
     scope = _slug(scope, "scope")
+    if type(authenticated_origin) is not bool:
+        raise DeploymentKitError("Authenticated origin must be an explicit boolean opt-in.")
     zone = cloudflare_api.resolve_zone(api_token, zone_name)
     expected_tunnel_name = tunnel_name or tunnel_name_for_scope(scope)
     if not isinstance(expected_tunnel_name, str) or not expected_tunnel_name.strip():
@@ -452,6 +457,8 @@ def plan_cloudflare_ingress(
         tunnel_config = cloudflare_api.get_tunnel_configuration(api_token, zone["accountId"], str(tunnel["id"]))
 
     if host["state"] in {"ready", "upgrade-required"}:
+        if bool(host["authenticatedOrigin"]) != authenticated_origin:
+            raise DeploymentKitError("Origin authentication mode cannot change on an existing scope; use a new isolated scope.")
         expected = {
             "accountId": zone["accountId"],
             "zoneId": zone["zoneId"],
@@ -485,6 +492,7 @@ def plan_cloudflare_ingress(
         "hostState": host["state"],
         "hostStatusSnapshot": _status_snapshot(host),
         "cloudflaredImage": CLOUDFLARED_IMAGE,
+        "authenticatedOrigin": authenticated_origin,
         "requiredAuthorization": HOST_PUBLIC_INGRESS_WRITE_PHRASE,
         "secrets": {
             "apiToken": "workstation-only; not persisted by Deployment Kit",
@@ -506,10 +514,12 @@ def apply_cloudflare_ingress(plan: dict[str, Any], *, api_token: str) -> dict[st
     required = {
         "targetName", "scope", "action", "zone", "tunnelName", "existingTunnel",
         "existingTunnelConfigSha256", "hostState", "hostStatusSnapshot", "cloudflaredImage",
-        "requiredAuthorization", "secrets",
+        "requiredAuthorization", "secrets", "authenticatedOrigin",
     }
     if not isinstance(plan, dict) or set(plan) != required:
         raise DeploymentKitError("Malformed Cloudflare ingress plan.")
+    if type(plan["authenticatedOrigin"]) is not bool:
+        raise DeploymentKitError("Malformed authenticated-origin plan mode.")
     if plan["cloudflaredImage"] != CLOUDFLARED_IMAGE:
         raise DeploymentKitError("Cloudflare ingress plan uses a different cloudflared image; re-plan with the current package.")
 
@@ -561,6 +571,7 @@ def apply_cloudflare_ingress(plan: dict[str, Any], *, api_token: str) -> dict[st
             scope=scope,
             metadata=metadata,
             tunnel_token=token,
+            authenticated_origin=plan["authenticatedOrigin"],
         )
         final = cloudflare_ingress_status(name, scope)
         if final["state"] != "ready":
@@ -659,7 +670,13 @@ def _lan_route(name: str, spec: dict[str, Any]) -> dict[str, Any]:
     return route
 
 
-def _cloudflare_rule(spec: dict[str, Any]) -> dict[str, Any]:
+def _cloudflare_rule(spec: dict[str, Any], *, authenticated_origin: bool = False) -> dict[str, Any]:
+    if authenticated_origin:
+        return {
+            "hostname": spec["publicHostname"],
+            "service": "unix:/run/project-forge-origin/origin.sock",
+            "originRequest": {"httpHostHeader": spec["publicHostname"]},
+        }
     return {
         "hostname": spec["publicHostname"],
         "service": f"http://{CADDY_CONTAINER}:80",
@@ -800,7 +817,7 @@ def plan_public_route(
 
     config = cloudflare_api.get_tunnel_configuration(api_token, host["accountId"], host["tunnelId"])
     rules, final_rule = _split_ingress(config)
-    desired_rule = _cloudflare_rule(spec)
+    desired_rule = _cloudflare_rule(spec, authenticated_origin=host["authenticatedOrigin"])
     conflicting = [item for item in rules if item.get("hostname") == spec["publicHostname"] and item != desired_rule]
     if conflicting:
         raise DeploymentKitError("Cloudflare tunnel already has a conflicting ingress rule for this hostname.")
@@ -984,7 +1001,7 @@ def plan_public_route_removal(
         raise DeploymentKitError("Cloudflare public-route removal ownership does not match.")
     config = cloudflare_api.get_tunnel_configuration(api_token, host["accountId"], host["tunnelId"])
     rules, final_rule = _split_ingress(config)
-    expected_rule = _cloudflare_rule(route)
+    expected_rule = _cloudflare_rule(route, authenticated_origin=host["authenticatedOrigin"])
     matches = [item for item in rules if item == expected_rule]
     if len(matches) != 1:
         raise DeploymentKitError("Cloudflare tunnel does not contain exactly one expected managed rule for this route.")

package/assets/generated/deployment/src/project_forge_deployment/cloudflare_ingress_remote.py

@@ -8,6 +8,7 @@ SCOPE="$2"
 META="${3:-}"
 SPEC="${4:-}"
 EXPECTED="${5:-}"
+AUTHENTICATED_ORIGIN="${6:-false}"
 
 PLATFORM_ROOT="__PLATFORM_ROOT__"
 NETWORK_NAME="__NETWORK_NAME__"
@@ -38,6 +39,10 @@ MARKER="$ROOT/ingress.env"
 TOKEN_FILE="$ROOT/tunnel-token"
 COMPOSE_FILE="$ROOT/compose.yaml"
 ROUTE_ROOT="$ROOT/routes"
+AUTH_ROOT="$PLATFORM_ROOT/proxy/data/authenticated/$SCOPE"
+AUTH_ROUTES="$AUTH_ROOT/routes"
+AUTH_CADDY="$PLATFORM_ROOT/proxy/conf.d/90-project-forge-auth-$SCOPE.caddy"
+AUTH_SOCKET="$AUTH_ROOT/origin.sock"
 CONTAINER="project-forge-cloudflared-$SCOPE"
 LOCK_FILE="/run/lock/project-forge-cloudflare-$SCOPE.lock"
 
@@ -73,7 +78,9 @@ status() {
     network_attached && attached=true || true
     platform_ready && platform=true || true
 
-    local state marker_schema marker_version marker_distribution marker_image runtime_image
+    local state marker_schema marker_version marker_distribution marker_image runtime_image mode
+    mode="$(marker_value AUTHENTICATED_ORIGIN 2>/dev/null || true)"
+    [[ "$mode" == true ]] || mode=false
     marker_schema="$(marker_value SCHEMA_VERSION 2>/dev/null || true)"
     marker_version="$(marker_value INGRESS_VERSION 2>/dev/null || true)"
     marker_distribution="$(marker_value DISTRIBUTION 2>/dev/null || true)"
@@ -90,6 +97,8 @@ status() {
         state="upgrade-required"
     elif [[ "$running" == true && "$runtime_image" != "$CLOUDFLARED_IMAGE" ]]; then
         state="drifted"
+    elif [[ "$mode" == true && ( ! -S "$AUTH_SOCKET" || ! -f "$AUTH_CADDY" ) ]]; then
+        state="drifted"
     elif [[ "$token" == true && "$running" == true && "$attached" == true && -f "$COMPOSE_FILE" && -d "$ROUTE_ROOT" ]]; then
         state="ready"
     else
@@ -113,6 +122,7 @@ status() {
     printf 'zoneName=%s\n' "$(marker_value ZONE_NAME 2>/dev/null || true)"
     printf 'tunnelId=%s\n' "$(marker_value TUNNEL_ID 2>/dev/null || true)"
     printf 'tunnelName=%s\n' "$(marker_value TUNNEL_NAME 2>/dev/null || true)"
+    printf 'authenticatedOrigin=%s\n' "$mode"
 }
 
 parse_meta() {
@@ -136,6 +146,7 @@ ZONE_NAME=$M_ZONE_NAME
 TUNNEL_ID=$M_TUNNEL_ID
 TUNNEL_NAME=$M_TUNNEL_NAME
 CLOUDFLARED_IMAGE=$CLOUDFLARED_IMAGE
+AUTHENTICATED_ORIGIN=$AUTHENTICATED_ORIGIN
 EOF
     chmod 0600 "$tmp"
     mv -f "$tmp" "$MARKER"
@@ -152,6 +163,11 @@ services:
     command: tunnel --no-autoupdate run --token-file /run/secrets/tunnel-token
     volumes:
       - $TOKEN_FILE:/run/secrets/tunnel-token:ro
+EOF
+    if [[ "$AUTHENTICATED_ORIGIN" == true ]]; then
+        printf '      - %s:/run/project-forge-origin:ro\n' "$AUTH_ROOT" >> "$tmp"
+    fi
+    cat >> "$tmp" <<EOF
     networks:
       - $NETWORK_NAME
     logging:
@@ -169,6 +185,112 @@ EOF
     mv -f "$tmp" "$COMPOSE_FILE"
 }
 
+
+setup_authenticated_origin() {
+    [[ "$AUTHENTICATED_ORIGIN" == true ]] || return 0
+    [[ ! -L "$AUTH_ROOT" && ! -L "$AUTH_CADDY" ]] || {
+        echo "Authenticated origin path is a symbolic link." >&2; exit 27;
+    }
+    install -d -m 0700 "$AUTH_ROOT" "$AUTH_ROUTES"
+    chown 65532:65532 "$AUTH_ROOT"
+    chmod 0700 "$AUTH_ROOT"
+    local tmp="$AUTH_CADDY.tmp.$BASHPID"
+    cat > "$tmp" <<EOF
+http://:19078 {
+    bind unix//data/authenticated/$SCOPE/origin.sock|0222
+    import /data/authenticated/$SCOPE/routes/*.caddy
+    respond "Not Found" 404
+}
+EOF
+    chmod 0644 "$tmp"
+    mv -f "$tmp" "$AUTH_CADDY"
+    docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null
+    [[ -S "$AUTH_SOCKET" ]] || {
+        echo "Authenticated private origin socket did not appear." >&2; exit 27;
+    }
+}
+
+# Public-only Caddy handler: the LAN listener never receives this virtual host.
+# All routing metadata comes from the existing, owned LAN route on this host.
+auth_route_path() { printf '%s/%s.caddy' "$AUTH_ROUTES" "$1"; }
+auth_route_verify_lan() {
+    local lan="$PLATFORM_ROOT/routes/$R_ROUTE.route" hosts
+    [[ -f "$lan" && ! -L "$lan" ]] || { echo "Owned LAN route missing." >&2; exit 35; }
+    [[ "$(route_value "$lan" OWNER_REPO)" == "$R_OWNER" &&
+       "$(route_value "$lan" ENVIRONMENT)" == "$R_ENV" &&
+       "$(route_value "$lan" APP_SLUG)" == "$R_APP" &&
+       "$(route_value "$lan" ROUTE_ID)" == "$R_ROUTE" ]] || {
+        echo "LAN route ownership changed." >&2; exit 35;
+    }
+    hosts="$(route_value "$lan" HOSTNAMES)"
+    [[ ",$hosts," == *",$R_ORIGIN,"* ]] || {
+        echo "LAN origin hostname is no longer owned." >&2; exit 35;
+    }
+    AUTH_UPSTREAM="$(route_value "$lan" UPSTREAM_CONTAINER)"
+    AUTH_PORT="$(route_value "$lan" UPSTREAM_PORT)"
+    [[ "$AUTH_UPSTREAM" =~ ^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$ &&
+       "$AUTH_PORT" =~ ^[0-9]+$ ]] || {
+        echo "LAN upstream is malformed." >&2; exit 35;
+    }
+    (( 10#$AUTH_PORT >= 1 && 10#$AUTH_PORT <= 65535 )) || {
+        echo "LAN port out of range." >&2; exit 35;
+    }
+}
+auth_route_write() {
+    [[ "$(marker_value AUTHENTICATED_ORIGIN)" == true ]] || return 0
+    auth_route_verify_lan
+    local file tmp backup
+    file="$(auth_route_path "$R_ROUTE")"
+    [[ ! -L "$file" ]] || { echo "Unsafe authenticated route symlink." >&2; exit 35; }
+    tmp="$file.tmp.$BASHPID"
+    backup="$file.backup.$BASHPID"
+    [[ ! -f "$file" ]] || cp -a "$file" "$backup"
+    cat > "$tmp" <<EOF
+@pf_$R_ROUTE host $R_PUBLIC
+handle @pf_$R_ROUTE {
+    reverse_proxy $AUTH_UPSTREAM:$AUTH_PORT {
+        header_up Host $R_PUBLIC
+        header_up -Forwarded
+        header_up -X-Forwarded-*
+        header_up -X-Real-IP
+        header_up -True-Client-IP
+        header_up -CF-Visitor
+        header_up -CF-Connecting-IP
+        header_up X-Forwarded-Proto https
+        header_up X-Forwarded-Host $R_PUBLIC
+        header_up X-Forwarded-For {http.request.header.Cf-Connecting-Ip}
+        header_up X-Real-IP {http.request.header.Cf-Connecting-Ip}
+    }
+}
+EOF
+    chmod 0644 "$tmp"
+    mv -f "$tmp" "$file"
+    if ! docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null; then
+        if [[ -f "$backup" ]]; then mv -f "$backup" "$file"; else rm -f "$file"; fi
+        docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null 2>&1 || true
+        echo "Authenticated Caddy route failed validation; restored previous state." >&2
+        exit 35
+    fi
+    rm -f "$backup"
+}
+auth_route_remove() {
+    [[ "$(marker_value AUTHENTICATED_ORIGIN)" == true ]] || return 0
+    local file backup
+    file="$(auth_route_path "$R_ROUTE")"
+    [[ -f "$file" && ! -L "$file" ]] || {
+        echo "Expected authenticated Caddy route is missing." >&2; exit 35;
+    }
+    backup="$file.backup.$BASHPID"
+    mv -f "$file" "$backup"
+    if ! docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null; then
+        mv -f "$backup" "$file"
+        docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null 2>&1 || true
+        echo "Authenticated Caddy removal failed; restored previous route." >&2
+        exit 35
+    fi
+    rm -f "$backup"
+}
+
 write_token() {
     [[ -n "$TOKEN_B64" ]] || { echo "Tunnel token was not supplied." >&2; exit 20; }
     local tmp="$TOKEN_FILE.tmp.$$"
@@ -190,6 +312,9 @@ install_or_upgrade() {
         exit 22
     fi
     install -d -m 0700 "$ROOT" "$ROUTE_ROOT"
+    if [[ "$AUTHENTICATED_ORIGIN" == true ]]; then
+        setup_authenticated_origin
+    fi
     write_token
     write_compose
     write_marker
@@ -289,6 +414,9 @@ PUBLIC_HOSTNAME=$R_PUBLIC
 ORIGIN_HOSTNAME=$R_ORIGIN
 EOF
     chmod 0600 "$tmp"
+    if [[ "$(marker_value AUTHENTICATED_ORIGIN 2>/dev/null || true)" == true ]]; then
+        auth_route_write
+    fi
     mv -f "$tmp" "$path"
 }
 
@@ -298,6 +426,7 @@ route_remove() {
     path="$(route_path "$R_ROUTE")"
     [[ -f "$path" && ! -L "$path" ]] || { echo "Managed public-ingress route does not exist." >&2; exit 34; }
     metadata_matches "$path" "$SPEC" || { echo "Public-ingress route ownership/state mismatch." >&2; exit 34; }
+    auth_route_remove
     rm -f "$path"
 }
 

package/assets/generated/deployment/src/project_forge_deployment/ingress_cli.py

@@ -77,6 +77,7 @@ def build_parser() -> argparse.ArgumentParser:
     configure.add_argument("--scope", required=True)
     configure.add_argument("--zone", required=True, help="Existing active Cloudflare zone, for example example.com")
     configure.add_argument("--tunnel-name", help="Optional explicit tunnel name; default is project-forge-<scope>")
+    configure.add_argument("--authenticated-origin", action="store_true", help="Experimental: isolate the public connector origin on a private Unix socket; only new scopes")
     configure.add_argument("--json", action="store_true")
     configure.add_argument("--yes", action="store_true")
 
@@ -132,6 +133,7 @@ def main(argv: list[str] | None = None) -> int:
                 zone_name=args.zone,
                 api_token=token,
                 tunnel_name=args.tunnel_name,
+                authenticated_origin=args.authenticated_origin,
             )
             _print(plan, as_json=False)
             _confirm(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.19.1",
+  "version": "4.21.0",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {