Record the ProxyHmacFilter rollout and what it does not cover

Shipped

August 15, 2026 at 2:16 PM UTC

Author

kamo

Commit

11a1752

Two ordered steps, the checks that made the second one safe, and the reason the order matters: kamo-internal had to be signing before KamoLOS started validating, or every loan request would have been rejected. Also states plainly that HMAC does not replace the org checks. It raises X-Org-Id from "a header someone sent" to "a header this proxy sent"; LoanService and LoanScope still decide whether that org may see the row.