Control ID,Area,Recorded implementation,Evidence,Confirmation needed
GW01,Topology,Browser → portal Nginx TLS → Kong proxy 127.0.0.1:8000 → kernel-mediflex HTTPS 127.0.0.1:11440 → authenticated gateway → module runtimes / PostgreSQL.,"T02; DP03, DP06–07","Confirm active host, routes and upstream before UAT freeze."
GW02,Recorded Kong version,3.9.3 in the pre-portal inspection.,T22,Historical version; current installed version not queried by packaging.
GW03,Public portal route,kernel-portal; host portal.kernelhealth.tech; path /; http/https; strip_path=false; preserve_host=true; same existing kernel-mediflex service.,T02; DP06,Portal deployment receipt includes created route ID; check current matching route.
GW04,API compatibility route,kernel-mediflex; host api.kernelhealth.tech; path /; strip_path=false; preserve_host=true. Existing API route preserved by portal deployment.,T22; T02; DP03,Only recognized UI GET/HEAD entry points redirect to portal; API endpoints retain API behavior.
GW05,Upstream,Service kernel-mediflex; HTTPS 127.0.0.1:11440. Initial provision sets tls_verify=false for the loopback upstream.,T22; DP03,Public TLS and upstream TLS are separate. Reconfirm current upstream certificate policy; public certificate verification must stay enabled.
GW06,Timeouts,Initial service settings: connect 10000 ms; read/write 60000 ms.,T22; DP03,Runtime and UI deadlines are separate; current values and retry policy require readback. A timeout does not prove a mutation failed.
GW07,Admin API,http://127.0.0.1:8001 in operator configuration.,DP05,Keep management local/restricted. Verify listening addresses and NSG/firewall; do not publish an Admin API route.
GW08,TLS and headers,"Portal Nginx: TLS 1.2/1.3, HSTS max-age=31536000, route-specific CSP; HTTP redirects to HTTPS except ACME challenge.",DP07; T02,Confirm certificate expiry/renewal owner. Never distribute private-key contents.
GW09,Forwarded request context,"Nginx preserves Host, X-Real-IP, X-Forwarded-For and X-Forwarded-Proto=https; upgrade headers forwarded.",DP07,Verify trusted proxy policy and host/origin validation after any edge change.
GW10,Authentication ownership,"Application gateway/IAM handle native session, selected profile and OIDC flow. Portal origin is canonical; registered API-host callback is relayed with state/nonce/PKCE and host-bound flow validation.",T02,Kong routing does not replace IAM RBAC/ABAC or independent review.
GW11,CORS / mutation origin,Credentialed trusted-origin handling and mutation-origin rejection are in the authenticated web host. Recorded trusted UI CORS 204 and untrusted origin 403.,T01–02; DP04,Do not assume a Kong CORS plugin exists. Reconfirm active allowed origins.
GW12,Plugins,Pre-portal plugin snapshot is empty.,T22,No evidence here of enabled Kong JWT/OIDC/rate-limit/WAF/logging plugins; obtain a sanitized current inventory before making those claims.
GW13,Private service ports,"Deployment firewall rules restrict application ports, including 9090, 8081, 8080, 10040–10051 and 11440/11442, to loopback ingress.",DP03,This is script evidence; current NSG/firewall and Kong exposure need current operations confirmation.
GW14,Observability,"Capture HTTP status, correlation_id, timestamp, selected profile, route/upstream and matching systemd/Nginx/Kong logs.",E01; T02; DP03,No centralized monitoring/SIEM retention or alerts acceptance is asserted by this package.