bridgebench 3.1.0-alpha.0 → 3.1.0-alpha.2

package/tasks/security/public/supply-secrets-leak-forensics.yaml

@@ -0,0 +1,205 @@
+id: supply-secrets-leak-forensics
+version: 1.0.0
+category: security
+cluster: supply-chain
+difficulty: expert
+title: Beacon Secret-Exposure Forensics — What Actually Leaked and Is It Still Live
+summary: >-
+  An automated scanner flagged six candidate secret exposures in the private "beacon"
+  monorepo. Using the complete git history, a CI build log, both published Dockerfiles,
+  a committed config file, and the authoritative rotation ledger, decide for each what
+  (if anything) actually leaked, where it is retrievable, and whether it is still
+  exploitable today. Two of the six are real, still-live leaks; the rest are masked,
+  build-secret-mounted, public-by-design, or already rotated.
+prompt: |
+  You are the incident responder for the PRIVATE `beacon` monorepo. An automated scanner
+  flagged six candidate secret exposures (E1-E6). For each one, determine WHAT (if
+  anything) actually leaked, WHERE it is (or is not) retrievable, and whether it is STILL
+  exploitable today.
+
+  Answer each deliverable using ONLY the supplied artifacts (git-history, ci-log,
+  dockerfile-api, dockerfile-jobs, committed-config, rotation-log, forensics-note). Cite
+  the artifact id(s) you rely on for every claim. If something is not retrievable or not
+  exploitable in the artifacts, say so explicitly and explain why. This is a forensic
+  analysis: refer to every secret by its artifact location and label — do NOT reproduce
+  or reconstruct any secret value, and do not describe how to use one.
+
+  For deliverables 1-6, classify each exposure as EXACTLY ONE of:
+    - LEAKED-AND-EXPLOITABLE — the value is retrievable from a persisted location AND is
+      still valid today (not rotated).
+    - LEAKED-BUT-ROTATED — the value was exposed in a retrievable location, but the value
+      is now dead (rotated), so it is not exploitable today.
+    - NEVER-LEAKED — no confidential value ever reached a persisted, retrievable
+      location (masked, held only in a build-secret mount, or public-by-design).
+  Justify each with where the value is or is not retrievable (rotation-log for validity).
+
+  1. E1 - BEACON_STAGING_API_KEY in config/.env.staging (git-history).
+  2. E2 - REGISTRY_PULL_TOKEN handling in Dockerfile.api (dockerfile-api).
+  3. E3 - SENTINEL_WEBHOOK_SIGNING_SECRET as it appears in the CI build log (ci-log).
+  4. E4 - JOBS_DB_PASSWORD handling in Dockerfile.jobs (dockerfile-jobs).
+  5. E5 - BEACON_PUBLIC_MAP_KEY in committed-config.
+  6. E6 - ANALYTICS_INGEST_KEY in services/analytics/config.ts (git-history).
+  7. Of everything you classified as LEAKED-AND-EXPLOITABLE, name the SINGLE most severe
+     exposure and justify the ranking strictly from the blast-radius and publication
+     facts stated in the artifacts.
+  8. Give the remediation ORDER for the still-exploitable exposures only. State what must
+     happen first, what happens after, and why the order matters. Note which exposures
+     need no action.
+artifacts:
+  - id: git-history
+    type: log
+    label: Complete commit history for the private beacon monorepo
+    content: |
+      Complete commit history for the PRIVATE `beacon` monorepo — every branch merged to
+      `main`, listed oldest-first. No `git filter-repo`, BFG, or force-rewrite has ever
+      run on this repo, so every blob introduced below is STILL reachable from its
+      introducing commit (`git show <commit>:<path>` returns the original bytes even
+      after a later delete). This is the entire history: there are no other commits,
+      branches, tags, or stashes.
+
+      commit 9f01aa1  2026-03-01 09:12  "add staging env for beacon-api"
+        A  config/.env.staging
+           + BEACON_STAGING_API_KEY=<48-char live key; value elided for this report>
+           (blob 9f01aa1:config/.env.staging — a real credential, committed in plaintext)
+
+      commit 3b22cd7  2026-03-04 14:52  "wire analytics ingest client"
+        A  services/analytics/config.ts
+           + const ANALYTICS_INGEST_KEY = "<key literal; value elided for this report>";
+           (blob 3b22cd7:services/analytics/config.ts)
+
+      commit 7c44ef2  2026-03-04 17:14  "move analytics key to secret manager"
+        M  services/analytics/config.ts
+           - const ANALYTICS_INGEST_KEY = "<literal removed>";
+           + const ANALYTICS_INGEST_KEY = process.env.ANALYTICS_INGEST_KEY;
+           (the literal is gone from the working tree at HEAD, but blob 3b22cd7 is still
+            reachable — this removal is an ordinary commit, not a history rewrite)
+
+      commit c81900d  2026-03-18 11:40  "stop committing staging env files"
+        D  config/.env.staging
+           (file deleted at HEAD; blob 9f01aa1:config/.env.staging is STILL reachable —
+            the delete is an ordinary follow-up commit, not a history rewrite)
+
+      HEAD = c81900d. No secrets remain in the working tree at HEAD. The open question is
+      which values are still recoverable from history, and — via rotation-log — whether
+      each recovered value is still valid.
+  - id: ci-log
+    type: log
+    label: beacon-api CI build log (build #4471), persisted verbatim except masked secrets
+    content: |
+      beacon-api CI — build #4471. Pipeline logs are persisted to disk VERBATIM, EXCEPT
+      that every value registered as a CI secret is replaced with `***` by the runner's
+      secret filter BEFORE the line is ever written. The raw value never reaches this log
+      file; there is no un-masked copy anywhere.
+
+      [00:03] loaded 3 masked secrets: SENTINEL_WEBHOOK_SIGNING_SECRET, DEPLOY_KEY, NPM_TOKEN
+      [00:07] $ echo "webhook signer configured: ${SENTINEL_WEBHOOK_SIGNING_SECRET}"
+      [00:07] webhook signer configured: ***
+      [00:09] $ curl -sS -H "X-Sig: ${SENTINEL_WEBHOOK_SIGNING_SECRET}" https://hooks.internal/ping
+      [00:09] > X-Sig: ***
+      [00:11] webhook signer OK
+      [00:12] build succeeded
+
+      Note: masking is applied to stdout/stderr at the byte level before persistence. A
+      `***` in this log means the underlying value was registered as a secret and was
+      never written to the log in plaintext.
+  - id: dockerfile-api
+    type: config
+    label: Dockerfile.api — builds the PUBLISHED beacon-api image
+    content: |
+      # Dockerfile.api — builds the beacon-api image that is PUBLISHED to a PUBLIC mirror
+      # registry (see forensics-note). Every layer of this image is world-readable to
+      # anyone who pulls it.
+      # syntax=docker/dockerfile:1.7
+      FROM node:20-slim
+
+      # Build-time credential for pulling private npm deps, passed via --build-arg.
+      ARG REGISTRY_PULL_TOKEN
+
+      # The token is written into a PERSISTENT file in THIS layer and never removed.
+      RUN printf '//registry.internal/:_authToken=%s\n' "${REGISTRY_PULL_TOKEN}" > /root/.npmrc \
+       && npm ci --registry=https://registry.internal
+      # ^ /root/.npmrc (containing the token in plaintext) is committed into the image
+      #   filesystem. It is NOT deleted in this layer or any later layer, so it ships
+      #   inside the published image.
+
+      COPY . /app
+      WORKDIR /app
+      CMD ["node", "server.js"]
+  - id: dockerfile-jobs
+    type: config
+    label: Dockerfile.jobs — builds the PUBLISHED beacon-jobs image (BuildKit secret mount)
+    content: |
+      # Dockerfile.jobs — builds the beacon-jobs image (also PUBLISHED to the public
+      # mirror). Uses a BuildKit secret mount instead of an ARG.
+      # syntax=docker/dockerfile:1.7
+      FROM node:20-slim
+      COPY . /app
+      WORKDIR /app
+
+      # BuildKit secret mount: the password is exposed ONLY at /run/secrets during this
+      # single RUN, on a tmpfs that BuildKit never commits to any image layer. Nothing is
+      # written to the image filesystem, and the value does not appear in `docker history`.
+      RUN --mount=type=secret,id=jobs_db_password \
+          JOBS_DB_PASSWORD="$(cat /run/secrets/jobs_db_password)" node scripts/migrate.js
+
+      CMD ["node", "worker.js"]
+  - id: committed-config
+    type: config
+    label: beacon-web public client config (bundled into the browser)
+    content: |
+      // beacon-web/src/public-config.json
+      // This file is bundled into the browser client and served to EVERY visitor. Values
+      // here are PUBLIC by design (see forensics-note E5). Confidential values must never
+      // be placed here.
+      {
+        "BEACON_PUBLIC_MAP_KEY": "<public, domain-restricted client identifier; value elided>",
+        "PUBLIC_API_BASE_URL": "https://api.beacon.example",
+        "SENTRY_DSN_PUBLIC": "https://public-dsn@sentry.beacon.example/42"
+      }
+      // BEACON_PUBLIC_MAP_KEY is a public map-tile client id, locked to the beacon.example
+      // domains at the map provider. It is meant to be visible in shipped client code.
+  - id: rotation-log
+    type: table
+    label: beacon credential rotation ledger (authoritative, complete)
+    content: |
+      This rotation ledger is the AUTHORITATIVE and COMPLETE record of every credential
+      rotation for beacon. If a credential is not listed here as rotated, it has NOT been
+      rotated and its issued value is still live. There are no rotations beyond this table.
+
+      credential                       | first issued | rotated? | rotated at        | notes
+      ---------------------------------|--------------|----------|-------------------|--------------------------------------------
+      BEACON_STAGING_API_KEY           | 2026-03-01   | NO       | -                 | still the live staging key; never rotated
+      REGISTRY_PULL_TOKEN              | 2026-02-10   | NO       | -                 | same token still valid for registry.internal
+      ANALYTICS_INGEST_KEY             | 2026-03-04   | YES      | 2026-03-04 17:10  | rotated ~2h after it was committed; old value dead
+      SENTINEL_WEBHOOK_SIGNING_SECRET  | 2026-01-05   | n/a      | -                 | never exposed in plaintext; no rotation needed
+      JOBS_DB_PASSWORD                 | 2026-02-22   | NO       | -                 | only ever in a build-secret mount; never in a layer
+      BEACON_PUBLIC_MAP_KEY            | 2026-01-20   | n/a      | -                 | public client id; not a secret, nothing to rotate
+  - id: forensics-note
+    type: note
+    label: Forensics scoping note — authoritative blast-radius and publication facts
+    content: |
+      Forensics note — beacon secret-exposure review. This note is the authoritative
+      scoping for the incident: it states each candidate's nature and blast radius, and
+      the publication facts you need to rank severity. The scanner flagged EXACTLY SIX
+      candidates (E1-E6); this is the complete set — no other credential appears in the
+      repo history, the published images, the CI logs, or the committed config. Use
+      rotation-log to decide whether each value is still live.
+
+      E1  BEACON_STAGING_API_KEY  - a real secret. Grants read/write to the beacon
+          STAGING data plane. Lives in the private repo's git history. Scope: staging only.
+      E2  REGISTRY_PULL_TOKEN     - a real secret. Scope: pull AND push to registry.internal
+          (a write scope with supply-chain reach). Handled in Dockerfile.api.
+      E3  SENTINEL_WEBHOOK_SIGNING_SECRET - a real secret, referenced during CI (ci-log).
+      E4  JOBS_DB_PASSWORD        - a real secret, consumed by Dockerfile.jobs at build time.
+      E5  BEACON_PUBLIC_MAP_KEY   - NOT a secret. A public, domain-restricted client
+          identifier intentionally shipped to browsers (committed-config). Disclosing it
+          reveals nothing confidential; there is no secret to leak.
+      E6  ANALYTICS_INGEST_KEY    - a real secret, write-only ingest scope for the
+          analytics pipeline. Appeared briefly in the repo (git-history).
+
+      Publication facts (load-bearing for severity):
+        - The git repository is PRIVATE. Reading its history requires an authorized clone.
+        - The beacon-api and beacon-jobs images are PUBLISHED to a PUBLIC mirror: anyone
+          on the internet can pull them and inspect every layer's filesystem.
+        - rotation-log is the authoritative record of which values are still valid.
+tags: [supply-chain, secrets, forensics, security]

package/tasks/security/public/taint-export-template-render.yaml

@@ -0,0 +1,207 @@
+id: taint-export-template-render
+version: 1.0.0
+category: security
+cluster: taint-flow
+difficulty: expert
+title: Ledgerline HTML Export Template Taint Flow
+summary: >-
+  Trace five account-profile fields through the Ledgerline HTML exporter and
+  classify each source-to-sink path. Auto-escaped slots, an allowlist-sanitized
+  raw slot, a flag-gated raw slot, and a telemetry-only field surround one field
+  that reaches a raw template slot unescaped. Identify the single reachable,
+  unsafe path with evidence — reachability reasoning only, no payloads.
+prompt: |
+  You are reviewing the "Ledgerline" account HTML exporter. It reads an account's
+  profile record and renders it through a single Vellum template. Vellum escaping:
+  a {{ x }} slot is HTML-escaped by the engine; a {{{ x }}} slot emits the model
+  value verbatim (raw, unescaped). The rendered document is served as text/html and
+  opened directly in a viewer's browser, so markup that survives into the output
+  executes in that viewer's context (a stored/reflected cross-site-scripting shape).
+
+  Five profile fields are account-owner-controlled and are read by the exporter:
+  title, description, notes, ownerLabel, legacyBanner. For each numbered deliverable,
+  answer using ONLY the supplied artifacts (export-controller, report-service,
+  sanitizers, export-template, render-config, field-map, service-note). Cite the
+  artifact id(s) you rely on for every claim. If a field is not rendered, not
+  reachable, or not a sink in the artifacts, say so explicitly and cite why.
+
+  This is an analysis task: give reachability reasoning only. Do NOT write an XSS
+  payload, an attack string, or step-by-step exploitation. The verdict is the
+  traced source-to-sink path and its classification, not an exploit.
+
+  Classify each field's source-to-sink path as exactly one of: reachable-unsafe /
+  escaped / sanitized / not-a-sink / unreachable — and give the file-to-file chain
+  (which artifact carries the field from input to its slot, and what neutralizes it,
+  if anything).
+
+  1. Classify the path for `title`.
+  2. Classify the path for `description`.
+  3. Classify the path for `notes`.
+  4. Classify the path for `ownerLabel`.
+  5. Classify the path for `legacyBanner`.
+  6. Name the ONE field whose path is reachable AND unsafe, and state the precondition
+     under which its markup reaches a viewer's browser. Justify from the artifacts.
+  7. Give the minimal fix that closes exactly that one path (escape or sanitize the
+     offending value at its raw slot) without changing the other four classifications.
+artifacts:
+  - id: export-controller
+    type: code
+    label: Ledgerline export HTTP controller
+    content: |
+      // ledgerline/export.controller.ts — HTTP surface for account HTML exports.
+      import { renderExport } from './report-service';
+      import { loadExportRecord } from './records';
+
+      // GET /accounts/:id/export.html
+      // Renders a shareable HTML statement. The response is served with
+      // Content-Type: text/html and opened directly in the recipient's browser
+      // (an ops reviewer, or anyone with the shared link), so any markup that
+      // reaches the response body executes in that viewer's context.
+      export async function handleExport(req, res) {
+        const record = await loadExportRecord(req.params.id);
+        // record fields (title, description, notes, ownerLabel, legacyBanner) are
+        // profile values the account owner supplies through the profile editor.
+        // None are re-validated or stripped here; they are passed through as-is.
+        const html = renderExport(record);
+        res.set('Content-Type', 'text/html; charset=utf-8');
+        res.status(200).send(html);
+      }
+  - id: report-service
+    type: code
+    label: Ledgerline render-model builder (the only path that feeds the template)
+    content: |
+      // ledgerline/report-service.ts — assembles the Vellum render model and renders.
+      // This is the ONLY code path that binds values into the export template.
+      import { vellum } from './vellum';                  // {{ }} escapes; {{{ }}} raw
+      import { sanitizeRichText } from './sanitizers';
+      import { telemetry } from './telemetry';
+      import { exportConfig } from './render-config';
+      import template from './export-template';
+
+      export function renderExport(record) {
+        // ownerLabel is attribution metadata only: emitted to telemetry, and never
+        // bound into `model`, so it never reaches the template.
+        telemetry.record('export.rendered', {
+          ownerLabel: record.ownerLabel,
+          accountId: record.accountId,
+        });
+
+        const model = {
+          title: record.title,                         // -> {{ title }} (engine-escaped)
+          description: record.description,             // -> {{{ description }}} (raw slot)
+          notesHtml: sanitizeRichText(record.notes),   // -> {{{ notesHtml }}} (allowlisted)
+          accountId: record.accountId,                 // -> {{ accountId }} (engine-escaped)
+          legacyBanner: record.legacyBanner,           // -> {{{ legacyBanner }}} (gated slot)
+          showLegacyBanner: exportConfig.flags.exportLegacyBanner, // gate for the banner
+        };
+
+        return vellum.render(template, model);
+      }
+  - id: sanitizers
+    type: code
+    label: Ledgerline sanitizer helpers
+    content: |
+      // ledgerline/sanitizers.ts
+
+      // sanitizeRichText: allowlist HTML sanitizer used for rich note bodies. It
+      // keeps a fixed tag/attribute allowlist and DROPS everything else — <script>,
+      // <style>, <iframe>, any on* event-handler attribute, javascript: URLs, and any
+      // tag not on ALLOWED_TAGS. Its output is safe to place into a {{{ }}} raw slot.
+      export const ALLOWED_TAGS = ['b', 'i', 'em', 'strong', 'p', 'br', 'ul', 'ol', 'li', 'a'];
+      export const ALLOWED_ATTRS = { a: ['href'] }; // href re-checked: http/https/mailto only
+
+      export function sanitizeRichText(html: string): string {
+        // Parse, walk the tree, delete disallowed nodes/attributes, re-serialize.
+        // Only the allowlist above survives; scripts and handlers are removed.
+        return allowlistWalk(html, ALLOWED_TAGS, ALLOWED_ATTRS);
+      }
+
+      // escapeHtml: the primitive the Vellum engine calls internally for every {{ }}
+      // slot. Replaces & < > " ' with entity references. Exposed here only for
+      // completeness. NOTE: {{{ }}} raw slots bypass this entirely — the engine does
+      // not call escapeHtml for them, and report-service does not call it either.
+      export function escapeHtml(s: string): string {
+        return s.replace(/[&<>"']/g, (c) => ENTITIES[c]);
+      }
+  - id: export-template
+    type: spec
+    label: Ledgerline export template (Vellum source — the only template used)
+    content: |
+      {{! Ledgerline account export — Vellum template v4. }}
+      {{! Escaping: {{ x }} is HTML-escaped by the engine; {{{ x }}} is emitted raw. }}
+      {{! This is the whole template. There are no partials and no second template. }}
+      <article class="ledgerline-export">
+        <header>
+          <h1 class="acct-title">{{ title }}</h1>
+          <p class="acct-id">Account {{ accountId }}</p>
+        </header>
+
+        {{#showLegacyBanner}}
+        <aside class="legacy-banner">{{{ legacyBanner }}}</aside>
+        {{/showLegacyBanner}}
+
+        <section class="summary">
+          {{{ description }}}
+        </section>
+
+        <section class="notes">
+          {{{ notesHtml }}}
+        </section>
+      </article>
+  - id: render-config
+    type: config
+    label: Ledgerline exporter feature flags (production)
+    content: |
+      # ledgerline/render-config — export feature flags (production).
+      # COMPLETE: these are all flags the exporter reads. No other flag affects
+      # rendering, and no environment overrides these values.
+      export:
+        flags:
+          exportLegacyBanner: false   # legacy promo banner slot; OFF in every environment
+          includeNotesSection: true   # notes section is rendered
+          embedAccountId: true        # account id header is rendered
+        templateVersion: 4            # selects export-template above; no other template exists
+  - id: field-map
+    type: table
+    label: Ledgerline export field map (COMPLETE — every field the exporter reads)
+    content: |
+      Ledgerline export field map — COMPLETE. Every field on the profile record that
+      report-service reads is listed here, with the render-model key it becomes, the
+      template slot it lands in, whether that slot is escaped or raw, and whether the
+      value is sanitized on the way in. A field NOT in this table is not read by the
+      exporter and reaches no slot.
+
+      record field | model key    | template slot        | slot mode | sanitized en route?
+      -------------|--------------|----------------------|-----------|--------------------------
+      title        | title        | {{ title }}          | escaped   | n/a (engine escapes {{ }})
+      description  | description  | {{{ description }}}  | raw       | NO
+      notes        | notesHtml    | {{{ notesHtml }}}    | raw       | YES — sanitizeRichText()
+      legacyBanner | legacyBanner | {{{ legacyBanner }}} | raw       | NO (slot gated by showLegacyBanner)
+      ownerLabel   | (none)       | (not rendered)       | —         | — telemetry only, no slot
+      accountId    | accountId    | {{ accountId }}      | escaped   | n/a (system value, engine escapes)
+  - id: service-note
+    type: note
+    label: Ledgerline export design note (current 2.x)
+    content: |
+      Ledgerline HTML export — design note (current, 2.x line).
+
+      Templating: we render with Vellum. {{ x }} slots are HTML-escaped by the engine;
+      {{{ x }}} slots emit the model value verbatim. The account export uses exactly
+      one template, export-template; there are no partials and no second template.
+
+      Invariant we hold ourselves to: any value bound to a {{{ }}} raw slot MUST be
+      sanitizer output (sanitizeRichText), because the engine does not escape raw
+      slots. Values bound to {{ }} slots need no pre-processing — the engine escapes
+      them. (This note states the intended invariant; it does not certify that every
+      binding currently obeys it.)
+
+      The render model is assembled in exactly one place — report-service.renderExport.
+      No other code path feeds the template. The complete list of record fields the
+      exporter reads, and the slot each maps to, is in field-map; that table is
+      exhaustive, so a field absent from it is not read.
+
+      Slot gating: the legacy banner section is wrapped in {{#showLegacyBanner}}, and
+      showLegacyBanner is driven solely by the exportLegacyBanner flag in render-config.
+      ownerLabel is attribution metadata: it is emitted to telemetry and never bound
+      into the model.
+tags: [security, taint-flow, xss, template-injection, reachability]

package/tasks/security/public/taint-webhook-outbound-fetch.yaml

@@ -0,0 +1,214 @@
+id: taint-webhook-outbound-fetch
+version: 1.0.0
+category: security
+cluster: taint-flow
+difficulty: expert
+title: Relaypoint Webhook Outbound-Fetch Taint Flow
+summary: >-
+  Relaypoint delivers webhooks to tenant-supplied callback URLs behind an
+  allowlist plus private-range guard. Trace every tenant URL to its outbound
+  fetch and classify each path. The primary delivery and icon fetch are guarded,
+  metadataUrl is never fetched, and an unguarded internal preview is loopback-only
+  — but the retry worker re-fetches the callback URL without re-running the guard.
+  Find the single reachable unvalidated fetch. Reachability reasoning only.
+prompt: |
+  You are reviewing "Relaypoint", a webhook delivery service. Tenants register hooks
+  with URLs; the service makes outbound HTTP requests to them. The only SSRF control is
+  url-guard's ensureDeliverableUrl(url), which enforces a callback host allowlist and
+  blocks private / loopback / link-local / metadata address ranges. Every outbound
+  request built from a tenant-supplied URL is supposed to pass that guard first.
+
+  Three tenant-supplied URL fields exist: callbackUrl (delivered to), iconUrl (fetched
+  for the dashboard), metadataUrl (stored for display). Answer each deliverable using
+  ONLY the supplied artifacts (delivery-controller, retry-worker, url-guard, icon-service,
+  deploy-config, route-map, service-note). Cite the artifact id(s) you rely on for every
+  claim. If a path is guarded, not a fetch sink, or not reachable from tenant input, say
+  so explicitly and cite why.
+
+  This is an analysis task: give reachability reasoning only. Do NOT write an SSRF payload,
+  a private-range target list, a working bypass, or step-by-step exploitation. The verdict
+  is the traced reachable path and its precondition, not an exploit.
+
+  Classify each source path as exactly one of: validated / unvalidated-reachable /
+  not-a-sink / unreachable — and give the file-to-file chain.
+
+  1. Classify the PRIMARY delivery path's use of `callbackUrl` (POST /hooks/:id/deliver).
+  2. Classify `iconUrl` (the dashboard icon fetch).
+  3. Classify `metadataUrl`.
+  4. Classify the RETRY worker's use of the callback URL.
+  5. The internal preview route fetches its URL without the guard. Rule on whether it is
+     reachable from tenant input, with evidence.
+  6. Name the ONE outbound fetch that is reachable from tenant input AND unvalidated, and
+     state the precondition under which a tenant steers it to a blocked target. Justify.
+  7. Give the fix that closes exactly that path so the retry cannot bypass the guard
+     (validate inside a shared fetch wrapper every path already calls).
+artifacts:
+  - id: delivery-controller
+    type: code
+    label: Relaypoint inbound trigger + primary delivery
+    content: |
+      // relaypoint/delivery.controller.ts — public API: hook CRUD + first delivery.
+      import { ensureDeliverableUrl } from './url-guard';
+      import { fetchOutbound } from './http';
+      import { enqueueRetry } from './retry-worker';
+      import { store } from './store';
+
+      // PATCH /hooks/:id — tenant edits their hook, including callbackUrl.
+      export async function updateHook(req, res) {
+        const hook = await store.updateHook(req.params.id, req.body); // callbackUrl editable
+        res.json({ id: hook.id });
+      }
+
+      // POST /hooks/:id/deliver — public: a tenant triggers delivery of their own hook.
+      export async function deliver(req, res) {
+        const hook = await store.getHook(req.params.id); // hook.callbackUrl is tenant-supplied
+        // PRIMARY PATH: validate before the first outbound request.
+        ensureDeliverableUrl(hook.callbackUrl);          // allowlist + private-range block
+        const result = await fetchOutbound(hook.callbackUrl, buildPayload(hook));
+        if (!result.ok) {
+          // Delivery failed: schedule a retry by hook id (no URL snapshot is stored).
+          await store.savePendingDelivery({ hookId: hook.id, attempts: 1 });
+          await enqueueRetry(hook.id);
+        }
+        res.json({ delivered: result.ok });
+      }
+
+      // GET /hooks/:id — dashboard detail. metadataUrl is echoed back as a plain
+      // string for display; it is never passed to fetchOutbound.
+      export async function getHookDetails(req, res) {
+        const hook = await store.getHook(req.params.id);
+        res.json({ id: hook.id, callbackUrl: hook.callbackUrl, metadataUrl: hook.metadataUrl });
+      }
+
+      // INTERNAL ONLY — mounted on the internal loopback listener (see deploy-config),
+      // not on the public router. Takes its URL from an ops query param, not tenant input.
+      export async function internalPreview(req, res) {
+        const result = await fetchOutbound(req.query.url, { method: 'GET' }); // no guard
+        res.send(result.body);
+      }
+  - id: retry-worker
+    type: code
+    label: Relaypoint retry worker (drains failed deliveries)
+    content: |
+      // relaypoint/retry-worker.ts — background worker; re-sends failed deliveries.
+      // Runs out-of-band on a timer (not on any HTTP listener). It is triggered only
+      // by enqueueRetry(hookId), which the primary deliver() path calls on failure.
+      import { fetchOutbound } from './http';
+      import { store } from './store';
+
+      export async function runRetry(hookId) {
+        const pending = await store.getPendingDelivery(hookId);   // { attempts }
+        const hook = await store.getHook(hookId);                 // reloads the CURRENT hook
+        // The callback URL was validated when the hook first fired. We re-send to the
+        // hook's current callbackUrl here and do NOT re-run ensureDeliverableUrl.
+        const result = await fetchOutbound(hook.callbackUrl, buildPayload(hook));
+        await store.updateAttempts(hookId, pending.attempts + 1);
+        if (!result.ok && pending.attempts + 1 < MAX_ATTEMPTS) {
+          await enqueueRetry(hookId); // reschedule
+        }
+        return result;
+      }
+  - id: url-guard
+    type: code
+    label: Relaypoint SSRF guard (the only outbound-URL validator)
+    content: |
+      // relaypoint/url-guard.ts — the ONLY SSRF control. Callers MUST invoke
+      // ensureDeliverableUrl(url) before any outbound request built from tenant input.
+      import { GuardError } from './errors';
+
+      export const CALLBACK_ALLOWLIST = [
+        'hooks.acme-tenant.example',
+        '*.callbacks.partner.example',
+      ];
+
+      export function ensureDeliverableUrl(raw: string): void {
+        const u = new URL(raw);
+        if (u.protocol !== 'https:') throw new GuardError('scheme');
+        if (!hostMatchesAllowlist(u.hostname, CALLBACK_ALLOWLIST)) throw new GuardError('host');
+        // Resolve and reject private, loopback, link-local, and metadata ranges.
+        for (const addr of resolveAll(u.hostname)) {
+          if (isPrivate(addr) || isLoopback(addr) || isLinkLocal(addr) || isMetadata(addr)) {
+            throw new GuardError('range');
+          }
+        }
+        // Returns normally only for an allowlisted host that resolves to public space.
+      }
+  - id: icon-service
+    type: code
+    label: Relaypoint dashboard icon fetcher
+    content: |
+      // relaypoint/icon-service.ts — fetches a hook's display icon for the dashboard.
+      import { ensureDeliverableUrl } from './url-guard';
+      import { fetchOutbound } from './http';
+
+      // Called when rendering the dashboard for a hook. iconUrl is tenant-supplied.
+      export async function fetchIcon(hook) {
+        ensureDeliverableUrl(hook.iconUrl);   // SAME guard as primary delivery
+        return fetchOutbound(hook.iconUrl, { method: 'GET' });
+      }
+  - id: deploy-config
+    type: config
+    label: Relaypoint network + worker bindings (production)
+    content: |
+      # relaypoint/deploy-config — listeners, workers, egress (production).
+      # COMPLETE: these are all listeners and workers the service runs. A route or
+      # worker not listed here is not mounted.
+      listeners:
+        public:                         # tenant-facing API, exposed to the internet
+          bind: 0.0.0.0:8443
+          routes: [POST /hooks, PATCH /hooks/:id, POST /hooks/:id/deliver, GET /hooks/:id]
+        internal:                       # ops-only; NOT routable from the internet
+          bind: 127.0.0.1:9090          # loopback; reachable only from the host / ops VPN
+          routes: [GET /internal/preview]
+      workers:
+        retry:
+          concurrency: 8
+          trigger: enqueueRetry         # enqueued only by the primary deliver() path
+          handler: runRetry             # relaypoint/retry-worker.ts
+      egress:
+        # The retry worker and primary delivery share one egress path. There is NO
+        # network-layer policy that re-blocks a callback URL at retry time; the guard
+        # in url-guard is the only control. If a code path skips it, nothing else stops it.
+        policy: none
+  - id: route-map
+    type: table
+    label: Relaypoint route/fetch map (COMPLETE — every path that can fetch a tenant URL)
+    content: |
+      Relaypoint outbound-fetch map — COMPLETE. Every mounted route and background worker
+      is listed, with its listener, handler, whether it makes an outbound request built
+      from a tenant URL, and whether that request is guarded by ensureDeliverableUrl. A
+      path not in this table is not served and makes no tenant-URL fetch.
+
+      path                    | listener | handler                     | outbound fetch?          | guarded?
+      ------------------------|----------|-----------------------------|--------------------------|----------------------------
+      POST /hooks             | public   | createHook                  | no                       | n/a
+      PATCH /hooks/:id        | public   | updateHook (edits callbackUrl) | no                    | n/a
+      POST /hooks/:id/deliver | public   | deliver (primary)           | yes (callbackUrl)        | YES — ensureDeliverableUrl
+      GET  /hooks/:id         | public   | getHookDetails              | no (echoes metadataUrl as text) | n/a
+      GET  /internal/preview  | internal | internalPreview             | yes (ops query url)      | NO — internal loopback listener only
+      (worker) retry          | —        | runRetry (retry-worker)     | yes (callbackUrl)        | NO
+      (dashboard) icon fetch  | —        | fetchIcon (icon-service)    | yes (iconUrl)            | YES — ensureDeliverableUrl
+  - id: service-note
+    type: note
+    label: Relaypoint outbound-fetch policy note
+    content: |
+      Relaypoint outbound-fetch policy — design note.
+
+      Rule: every outbound request built from a tenant-supplied URL MUST pass
+      ensureDeliverableUrl (url-guard) first. It enforces the callback host allowlist and
+      blocks private / loopback / link-local / metadata address ranges. This is the ONLY
+      SSRF control — deploy-config confirms egress policy is "none", so there is no
+      network-layer backstop if a code path forgets the guard.
+
+      Tenant-supplied URL fields are exactly three: callbackUrl (delivered to), iconUrl
+      (fetched for the dashboard), metadataUrl (stored, shown as text, never fetched).
+      route-map is the complete list of served paths and marks, for each, whether it makes
+      an outbound tenant-URL fetch and whether that fetch is guarded.
+
+      callbackUrl is editable after creation via PATCH /hooks/:id. A hook's callback URL at
+      the time the primary attempt runs may differ from its value when a later attempt runs.
+
+      The internal preview route is mounted only on the internal loopback listener
+      (deploy-config listeners.internal, bind 127.0.0.1:9090) and takes its URL from an ops
+      query param, not from tenant input; it is not reachable from the public API.
+tags: [security, taint-flow, ssrf, outbound-fetch, reachability]