verify #1842 local issue-create fix actually resolves AUTH_REQUIRED on the encryption-on path

[markmhendrickson]

Follow-up from the v0.18.4 security review of #1842 (local-loopback auth fallback for /issues/submit + /issues/add_message).

The adversarial review (docs/releases/in_progress/v0.18.4/security_review.md, finding F5) noted a possible efficacy gap, not a security issue:

• With encryption off, the global auth gate already stamps the local user for any local no-Bearer request before the handler runs, making the new routeAllowsLocalIssueWriteFallback branch effectively redundant.
• With encryption on, a no-credential local request may be gated earlier, so it's unverified end-to-end that the new branch actually closes the original AUTH_REQUIRED symptom Jacob hit.

The change is safe in all configurations (it never loosens auth beyond the global gate, and the remote-no-bearer 401 regression test passes). This issue is only to confirm the fix is effective for the encryption-on local/offline configuration that the reporter runs, and add an integration test for that exact path if a gap is found.

Acceptance: an integration test that reproduces the reporter's encryption-on offline config and asserts issues create succeeds without a bearer (or, if the global gate already handles it, document that and close).

[neotoma-agent]

🤖 Pavo — Ateles swarm, pm gate owner
SIGNED_OFF

Scope & Acceptance Spec

Problem: Issue #1842 added local-loopback auth fallback for /issues/submit and /issues/add_message (no-bearer requests from localhost). The v0.18.4 security review (F5) identified a possible efficacy gap: with encryption on, it's unverified end-to-end that the new branch actually closes the reported AUTH_REQUIRED symptom Jacob hit when offline.

In scope:

• Integration test reproducing the encryption-on offline configuration
• Assert that issues create (or /issues/submit) succeeds without a Authorization: Bearer header when encryption is enabled and the request is local
• Document or test whether the global auth gate already handles this scenario (if so, can close with documentation)

Out of scope:

• Changes to the auth fallback logic itself (that was issues create fails with AUTH_REQUIRED despite gh_cli auth configured #1842)
• New auth mechanisms or trust boundaries
• Encryption implementation changes
• Broader offline CLI workflows

Acceptance criteria:

• Integration test exists that reproduces encryption-enabled + local-offline config (environment or fixture setup)
• Test calls issues create or POSTs to /issues/submit with no Authorization header
• Test asserts the request succeeds (status 2xx, issue created) OR documents that the global gate already handles it
• No regression: existing auth tests pass (bearer-required for remote, oauth-backcompat for local without encryption)
• Test is CI-gated and reproducible in both local and CI environments

Priority & Sequencing: This is a v0.18.4 validation task. Unblocked; can merge independently. Ships in 0.18.4 release.

Verdict: SIGNED_OFF — scope is clear, acceptance criteria are concrete and verifiable, no blockers. PM gate satisfied.

---

📎 Neotoma: neotoma#1856

[neotoma-agent]

🤖 Accipiter — Ateles swarm, ux reviewer

review_expectation (ux) — what accipiter will verify when a PR addresses this issue:

• Error messaging is clear when local offline mode lacks credentials, distinguishing encryption-on vs encryption-off paths
• CLI output explicitly documents the encryption-on local configuration requirement for the new fallback to work
• Integration test reproduces encryption-on offline config and verifies issues create succeeds without a bearer token
• If the global auth gate already handles encryption-on paths, this is explicitly documented in test/code comments to prevent future confusion
• API surface (if any new endpoints/flags exposed) is discoverable via --help or equivalent
• Discoverability: the local-offline workflow is mentioned in README or setup docs so users know it exists

[neotoma-agent]

🤖 Buteo — Ateles swarm, legal reviewer

review_expectation (legal) — what buteo will verify when a PR addresses this issue:

• No new dependencies introduced without licence compatibility audit (encryption, auth libs, test harnesses)
• Credentials (local bearer tokens, encryption keys) not logged or exposed in test output/error messages
• Integration test setup does not require storing unencrypted credentials or auth tokens in test fixtures
• Guest-accessible surfaces (local loopback issue API) do not emit sensitive metadata in error responses or diagnostics
• Test coverage confirms encryption-on config path passes auth gate without regression on remote (Bearer-required) path

[neotoma-agent]

🤖 Phoenicurus — Ateles swarm, qa gate owner
COMMENT

review_expectation (qa) — what phoenicurus will verify when a PR addresses this issue:

• Integration test reproduces encryption-on local/offline config (no Bearer token, succeeds)
• Test asserts issue creation succeeds without Bearer in encryption-on path
• Test confirms global auth gate vs route-level fallback behavior is end-to-end validated
• Regression test confirms remote no-Bearer request still gets 401 (existing test still passes)
• If global gate already handles encryption-on path, test documents this finding and closes as no-functional-gap
• Security review findings (F5) are satisfied: fix efficacy verified for the exact reporter configuration