xrpl.walker_health.localhost_only_access

Route 404s for any request not originating from 127.0.0.1 / ::1 — on Render behind the proxy this is never reachable from the internet; on the Mac it's available at localhost:PORT/walker_health with no token

yellow Public-infrastructure dependent OR no independent cross-check path yet. Free-tier only until Batch B walker migration lands (post-soak, ~2026-08-31) and/or an independent verification walker is wired for this series.

Machine-readable status: /claims/xrpl.walker_health.localhost_only_access.json or send Accept: application/json on this URL. URI is permanent — safe to cite.

What this claim says

label: Route 404s for any request not originating from 127.0.0.1 / ::1 — on Render behind the proxy this is never reachable from the internet; on the Mac it's available at localhost:PORT/walker_health with no token
page: /walker_health
claim id (yaml): walker_health_localhost_only_access
behavior: MANUAL_CURATION
Layer 3 source: self-attested-only

Risk note

Load-bearing security property. If Render's proxy ever forwards the client IP as remote_addr (e.g., a config change that strips the proxy layer), this page would become publicly reachable. Any change to the request.remote_addr check must be reviewed against the CF proxy config — the same class of concern as CF_shared_secret and CF_Connecting_IP trust.

Evidence — code paths that back this claim

app.py:walker_health_page() — request.remote_addr guard

Verify

CLAIMS.yaml on GitHub walker_health signed snapshot chain methodology · for AI agents

Sovereignty classification derives from the claim's Layer 3 source per /methodology. Last verified 2026-08-05. This surface is documented in docs/PAID_MACHINE_TIER_DESIGN.md § 3.1.