POST /api/v1/registry/register currently accepts service registration when CAPI_REGISTRY_TOKEN is unset and records authenticated: false. That behavior is explicitly described as a local/dev posture, but there is no production guard preventing the same fail-open state under NODE_ENV=production.
The canonical routing matrix identifies CAPI_REGISTRY_TOKEN as the registration auth mechanism. In production, missing auth configuration must not silently turn the service registry into an unauthenticated write surface.
Required remediation:
- preserve unauthenticated registration only for explicit local/dev/test posture;
- under production runtime, if
CAPI_REGISTRY_TOKEN is absent/blank, fail closed before parsing or mutating registry state (503 configuration error is appropriate); - keep invalid/missing presented credentials as 401 when the token is configured;
- add negative tests proving production-without-token cannot register a service and does not create registry state;
- do not log or return token material;
- deployment must supply/rotate the registry token independently; merging source is not runtime verification.
This does not change cAPI's canonical Interlink role or port 3003.
POST /api/v1/registry/registercurrently accepts service registration whenCAPI_REGISTRY_TOKENis unset and recordsauthenticated: false. That behavior is explicitly described as a local/dev posture, but there is no production guard preventing the same fail-open state underNODE_ENV=production.The canonical routing matrix identifies
CAPI_REGISTRY_TOKENas the registration auth mechanism. In production, missing auth configuration must not silently turn the service registry into an unauthenticated write surface.Required remediation:
CAPI_REGISTRY_TOKENis absent/blank, fail closed before parsing or mutating registry state (503 configuration error is appropriate);This does not change cAPI's canonical Interlink role or port 3003.