Bind mavweb to loopback and make the step-up fail-open loud and overridable

The /tools enable action takes name+cmd from form fields and calls
core.EnableTool, so it defines arbitrary argv that internal/tool then executes.
Its step-up gate read `session != nil && !session.IsStepUp()`, and
stepUpSession is nil unless both -webauthn-origin and -webauthn-rpid are set —
so with neither flag the gate was skipped entirely. compose passed neither and
published 9201 on every host interface, while /ptt proxies to the voice server
unauthenticated, so a caller could enable a tool, trigger it, and answer its
own confirm turn. internal/tool's boundary reasoning ("a compromised router
can't grant itself a capability") held; the outer boundary it depends on was an
unwritten deployment assumption.

The fail-open itself stays: gating on a session that can never be asserted
would 403 permanently, and that reasoning is sound. What was missing is the
compensating control.

- compose publishes 127.0.0.1:9201 so reaching the UI requires the wg tunnel by
  construction rather than by convention. Verified no other service reaches
  mavweb by host-published port; mavpoll is host-networked but only dials
  netdata and kuma.
- stepUpOK() replaces the two inline gates in handleTools and handleRevert, so
  one decision point covers both surfaces.
- -require-stepup (default false, behaviour byte-for-byte unchanged) fails those
  actions closed when step-up cannot be asserted.
- A startup warning names both unguarded surfaces when stepUpSession is nil,
  in fail-open and fail-closed variants.

Also repoints one doc comment at DESIGN.md, since it shared a hunk with the
warning block.

The committed kuma key is deliberately left for a separate change: the old
value is in git history forever, so rotation means a genuinely new key, not a
re-commit under a variable.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X5JApcrCRVGmqrxnhynSik

cmd/mavweb/main.go

@@ -314,6 +314,7 @@ func main() {
 	coreSock := flag.String("core", "", "mavend IPC socket path for presence-signal ingest (empty = disabled)")
 	pkOrigin := flag.String("webauthn-origin", "", "WebAuthn origin URL (e.g. https://maven.kvmx.ru)")
 	pkRPID := flag.String("webauthn-rpid", "", "WebAuthn RP ID (e.g. maven.kvmx.ru)")
+	requireStepUp := flag.Bool("require-stepup", false, "fail closed on step-up-gated actions (/tools POST, /api/revert) when WebAuthn step-up cannot be asserted; default false preserves the historical fail-open behaviour")
 	pkFile := flag.String("passkey-file", "./passkeys.json", "path to WebAuthn credential store (JSON)")
 	nexusURL := flag.String("nexus", "", "Nexus base URL for the /ecosystem panel (empty = not configured)")
 	praxisURL := flag.String("praxis", "", "Praxis base URL for the /ecosystem panel (empty = not configured)")
@@ -416,13 +417,21 @@ func main() {
 		mux.HandleFunc("/auth/webauthn/assert/begin", pk.AssertBegin)
 		mux.HandleFunc("/auth/webauthn/assert/finish", pk.AssertFinish)
 	}
+	if stepUpSession == nil {
+		if *requireStepUp {
+			log.Printf("SECURITY: step-up verification is DISABLED (-webauthn-origin/-webauthn-rpid unset) and -require-stepup is set: POST /tools (tool enable/disable/dismiss — defines and executes arbitrary argv) and POST /api/revert will be DENIED (403). Set -webauthn-origin and -webauthn-rpid to enable passkey step-up.")
+		} else {
+			log.Printf("SECURITY WARNING: step-up verification is DISABLED because -webauthn-origin/-webauthn-rpid are unset. UNGUARDED SURFACES: POST /tools (defines arbitrary argv via name+cmd, which internal/tool then EXECUTES) and POST /api/revert (voids the latest fact for a key). These are protected only by whatever transport-level auth sits in front of mavweb (wg+nginx+auth) — do NOT expose -addr on a public interface. Set -webauthn-origin and -webauthn-rpid to require passkey step-up, or pass -require-stepup to fail closed instead.")
+		}
+	}
 
 	// /tools — the authed enable surface. maven proposes acts she can't run;
 	// this page is where a human reviews and enables them (proposed→enabled).
-	// Enabling is the boundary-moving act (maven.md), so it lives ONLY here,
+	// Enabling is the boundary-moving act (DESIGN.md § Tool registration —
+	// drafting is suggest, enabling is act), so it lives ONLY here,
 	// behind wg+nginx+auth — never the voice/chat path.
 	mux.HandleFunc("/tools", func(w http.ResponseWriter, r *http.Request) {
-		handleTools(w, r, core, stepUpSession)
+		handleTools(w, r, core, stepUpSession, *requireStepUp)
 	})
 
 	// /api/revert voids the latest fact for a key — a store mutation, so it
@@ -435,7 +444,7 @@ func main() {
 		handleChatAPI(w, r, core)
 	})
 	mux.HandleFunc("/api/revert", func(w http.ResponseWriter, r *http.Request) {
-		handleRevert(w, r, core, stepUpSession)
+		handleRevert(w, r, core, stepUpSession, *requireStepUp)
 	})
 
 	srv := &http.Server{Addr: *addr, Handler: mux}
@@ -827,7 +836,24 @@ func handleVoice(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-func handleRevert(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession) {
+// stepUpOK is the single decision point for the AuthStepUp gate shared by
+// POST /tools and POST /api/revert.
+//
+// A nil session means WebAuthn is not configured (-webauthn-origin /
+// -webauthn-rpid unset), so step-up can never be asserted — not merely unmet.
+// The default is therefore fail-OPEN: gating on an unassertable session would
+// 403 those surfaces permanently. In that mode the actions rest on the
+// transport-level auth in front of mavweb (wg+nginx+auth), and main logs a
+// startup warning naming them. With -require-stepup the same situation fails
+// CLOSED instead: no assertable step-up ⇒ deny.
+func stepUpOK(session *webauthn.PasskeySession, requireStepUp bool) bool {
+	if session == nil {
+		return !requireStepUp
+	}
+	return session.IsStepUp()
+}
+
+func handleRevert(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
 		http.Error(w, "POST only", http.StatusMethodNotAllowed)
 		return
@@ -836,12 +862,11 @@ func handleRevert(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, sess
 		http.Error(w, "revert disabled (no -core)", http.StatusServiceUnavailable)
 		return
 	}
-	// nil session ⇒ WebAuthn not configured; step-up gate not applicable
-	// (asserting would be impossible, not just unmet) — matches handleTools.
-	if session != nil && !session.IsStepUp() {
+	if !stepUpOK(session, requireStepUp) {
 		http.Error(w, "step-up required: assert a passkey first", http.StatusForbidden)
 		return
 	}
+
 	key := strings.TrimSpace(r.FormValue("key"))
 	if key == "" {
 		http.Error(w, "key required", http.StatusBadRequest)
@@ -868,7 +893,7 @@ func handleRevert(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, sess
 // whitespace-split — argv with embedded spaces isn't supported (ponytail: no
 // shell-word parsing; the box owner controls this input, quote a wrapper script
 // if an arg needs spaces).
-func handleTools(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession) {
+func handleTools(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
 	if core == nil {
 		http.Error(w, "tools disabled (no -core)", http.StatusServiceUnavailable)
 		return