NA-0670 (D-1297): closeout — constant-time bearer-token comparison shipped (audit C-2)

[Tebbens4832]

Goals: G4

What

Spine governance closeout for NA-0670 (D606). The qsl-server implementation (satellite decision D-0014) merged as 5235c2bf (PR #64, QuantumShieldLabs/qsl-server#64) over base b4f86a3c, replacing auth_ok's short-circuiting provided == token (str::eq, a remote timing oracle on the network-exposed shared bearer token) with ct_eq_secret — SHA-256 both sides to a fixed 32-byte digest, then the client's hs_ct_eq_32 XOR-accumulate fold (ENG-0003) over all 32 bytes, no data-dependent early return. Same idiom the file already uses for its other secret (route_key_for); hashing normalises both inputs to 32 bytes and closes the length leak for free. No dependency change (sha2 already direct; subtle deliberately not added; Cargo.toml/Cargo.lock diff empty); no wire/API/protocol/schema/env change.

The 2026-07-22 independent audit's C-2 — the last unfixed HIGH, and the only one outside the spine — is now closed. No audit HIGHs remain.

Where the evidence is (and where it is NOT)

• The implementation PR suite2: add reason_code to CHAINKEY_UNSET reject #64 changed src/lib.rs, so its required rust check RAN and went green on the exact reviewed commit 82df531 (1m36s). That green is real evidence for the behavioural half (auth still accepts the right token, rejects wrong ones incl. the same-length case). The constant-time property itself is structural, read-verified, not measured — no timing proof run or claimed.
• ⚠ THIS closeout PR is docs_only=true (classify_ci_scope over the diff), so its suites skip and its own green proves nothing about the fix. It ships governance records only — do not read this PR's CI as evidence for C-2; PR suite2: add reason_code to CHAINKEY_UNSET reject #64's is.

Records

DECISIONS.md (D-1297); TRACEABILITY.md; docs/ops/ROLLING_OPERATIONS_JOURNAL.md; NEXT_ACTIONS.md STATE → READY=NONE | HIGHEST_NA=0670 | HIGHEST_D=1297 (NA-0670 flipped DONE); docs/governance/evidence/NA-0670_as_built.md; tests/NA-0670_qsl_server_c2_constant_time_bearer_testplan.md.

Queue helper verified: READY_COUNT 0 / exit 2 (correct at READY=NONE, --allow-nonready-count not passed); LATEST_DECISION_ENTRY D-1297; DUPLICATE_COUNT 0.

Four IMPROVEMENT_LEDGER filings — none fixed (recording, not a second fix)

• ENG-0063 — precompute Sha256::digest(token) at AppState construction (removes the secret from the per-request path; erases the block-count offset). Refinement, rides new_with_auth*.
• ENG-0064 — the two-repo seat leaked qsl-protocol's CARGO_TARGET_DIR into the qsl-server seat, so the satellite built into the spine's target dir and its registered per-repo cache went unused. First real exercise of the NA-0667 two-repo seat path; worked around with an explicit pin, qwork untouched.
• ENG-0065 — a pre-existing flaky log-capture test (tests::logs_do_not_contain_raw_channel) surfaced, not caused, by the required new test: 0/20 pristine vs 8/25 at 6 cores, 0/30 at RUST_TEST_THREADS=2 and =4 so CI's 2-vCPU runner is reliably green. The "always passes where merges are decided" class.
• ENG-0066 — qsl-server TRACEABILITY.md lapsed for three satellite lanes (D-0011/0012/0013 have no rows); only the NA-0670 row was added.

Commit identity GH007 noreply, author and committer, trailers empty, verified on the object (WF-0029 per-commit override). The executor cannot self-promote — stopping at this open PR.

🤖 Generated with Claude Code