fix(cpex): address PR #493 re-review — symmetric MCP response guard + hardening

Resolve the carried-over blocker and remaining suggestions from Hai Huang's
re-review:

Must-fix (blocker, carried over):
- applyMCPResponseBodyMod (cmf_body.go): the MCP response path had the
  identical multi-part leak the A2A path had — it rewrote only the first
  result.content[] text block and break'd, forwarding blocks[1..] verbatim
  with mutated=true. Now collects all text blocks and fails closed on >1
  (the read side only inspects the first; one redacted value can't safely
  rewrite many), mirroring the A2A/inference guards. Added a multi-block
  fail-closed test asserting the planted secret is not forwarded.

Suggestions:
- MCPRequestBodyMod: replace the len(NewArguments)==0 no-op inference with
  explicit ArgsSet/URISet flags. A "strip all arguments" redaction returns
  an empty-but-set map and must apply, not silently forward the original
  args. Added strip-all-applies + unset-no-op tests.
- Docs: fix the misleading "Authorization stripped" comments in
  manager_cpex.go and headers.go — Authorization is deliberately KEPT for
  CPEX identity plugins. Made the audit-log redaction + session-API binding
  guidance a non-optional MUST.
- Supply chain: assert the FFI tarball VERSION matches CPEX_FFI_VERSION and
  FFI_ABI matches the new pinned CPEX_FFI_ABI file at build time (dropped
  the stale TODO). Wired CPEX_FFI_ABI through the demo Makefile and CI
  build matrix. Runtime ABI assertion already exists in the Go binding's
  abi.go init().

Verified: go test ./plugins/cpex/ passes; go vet clean; authbridge-cpex
image rebuilds with sha256 + cosign + VERSION/ABI all verified; hr-cpex
demo 9/9 scenarios pass on kind (Bob SSN visible, Eve redacted, denies
enforce, taint + cross-principal isolation intact).

Also retitled the PR to "Feat:" to satisfy the org verify-pr-title gate.

Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>

Author: araujof

.github/workflows/build.yaml

@@ -116,18 +116,21 @@ jobs:
             # Add 'latest' tag for version tags, workflow_dispatch, and pushes to main
             type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' }}
 
-      # 6b. Resolve build-args. authbridge-cpex needs CPEX_FFI_VERSION,
-      # the single source of truth for the FFI ABI this image links
-      # (read from the file next to its Dockerfile). Other images leave
-      # this empty (an undeclared build-arg is ignored by their builds).
+      # 6b. Resolve build-args. authbridge-cpex needs CPEX_FFI_VERSION
+      # (the release tag) and CPEX_FFI_ABI (the FFI ABI integer the
+      # linked lib must report) — both read from the files next to its
+      # Dockerfile and asserted against the tarball at build time. Other
+      # images leave this empty (an undeclared build-arg is ignored).
       - name: Resolve build args
         id: buildargs
         run: |
           if [[ "${{ matrix.image_config.name }}" == "authbridge-cpex" ]]; then
             VERSION="$(tr -d '[:space:]' < authbridge/cmd/authbridge-cpex/CPEX_FFI_VERSION)"
+            ABI="$(tr -d '[:space:]' < authbridge/cmd/authbridge-cpex/CPEX_FFI_ABI)"
             {
               echo "args<<EOF"
               echo "CPEX_FFI_VERSION=${VERSION}"
+              echo "CPEX_FFI_ABI=${ABI}"
               echo "EOF"
             } >> "$GITHUB_OUTPUT"
           else

authbridge/authlib/plugins/cpex/cmf_body.go

@@ -444,12 +444,23 @@ func stringifyRPCID(id any) string {
 //	prompts/get    → NewArguments  → params.arguments
 //	resources/read → NewURI        → params.uri
 //
+// ArgsSet / URISet are the explicit "this field carries a real
+// modification" signals. We do NOT infer intent from emptiness: a
+// policy whose redaction is "strip all arguments" legitimately returns
+// an empty (or nil) arguments map, and a "blank the URI" redaction
+// returns an empty URI. Treating empty-as-no-op would silently forward
+// the ORIGINAL body (secret intact) while the policy believed it had
+// redacted. The cgo adapter sets these flags when the corresponding
+// CMF content part is present, regardless of value.
+//
 // Other methods are no-ops — the operator's APL policy can't rewrite
 // protocol mechanics (initialize, tools/list, etc.) because there's
 // no semantically meaningful target for the rewrite.
 type MCPRequestBodyMod struct {
 	NewArguments map[string]any
+	ArgsSet      bool
 	NewURI       string
+	URISet       bool
 }
 
 // applyMCPRequestBodyMod rewrites pctx.Body, which is expected to be
@@ -473,12 +484,16 @@ func applyMCPRequestBodyMod(pctx *pipeline.Context, method string, mod MCPReques
 
 	switch method {
 	case "tools/call", "prompts/get":
-		if len(mod.NewArguments) == 0 {
+		// Gate on the explicit ArgsSet flag, NOT len()==0: a policy that
+		// stripped all arguments returns an empty map and still means to
+		// rewrite. Inferring no-op from emptiness would forward the
+		// original (un-redacted) arguments.
+		if !mod.ArgsSet {
 			return false, nil
 		}
 		params["arguments"] = mod.NewArguments
 	case "resources/read":
-		if mod.NewURI == "" {
+		if !mod.URISet {
 			return false, nil
 		}
 		params["uri"] = mod.NewURI
@@ -503,6 +518,17 @@ func applyMCPRequestBodyMod(pctx *pipeline.Context, method string, mod MCPReques
 //     Don't introduce structuredContent on a response that didn't carry
 //     it; clients sniffing for the new shape would be surprised.
 //
+// Fail-closed on multiple text blocks: the read side
+// (extractToolResultContent) surfaces only the FIRST text block to the
+// policy, and we hold a single redacted value. A result.content[] with
+// >1 text block is therefore an ambiguous rewrite — blocks[1..] were
+// never shown to the policy, so rewriting only block[0] would forward
+// the others (potentially carrying the same secret) verbatim while
+// reporting success. We return an error so the caller fails closed
+// rather than leaking the un-inspected blocks (mirrors the A2A and
+// inference response guards). Rewrite all blocks would be wrong too —
+// we'd stamp one value over distinct blocks.
+//
 // Returns mutated=true when SetResponseBody was called; mutated=false
 // when the body wasn't a tools/call response, had no result.content,
 // or the response had no replaceable text block.
@@ -524,20 +550,30 @@ func applyMCPResponseBodyMod(pctx *pipeline.Context, method string, newContent a
 
 	replaced := false
 
-	// Primary path: rewrite the first text block in result.content[].
-	// This is what every MCP client we see today reads from.
+	// Primary path: rewrite the text block in result.content[]. Collect
+	// all text blocks first so >1 fails closed rather than silently
+	// leaving blocks[1..] unredacted (the read side only inspected the
+	// first; we only hold one redacted value).
 	if contentArr, ok := result["content"].([]any); ok {
+		textBlocks := make([]map[string]any, 0, len(contentArr))
 		for _, block := range contentArr {
 			blockObj, ok := block.(map[string]any)
 			if !ok {
 				continue
 			}
 			if t, ok := blockObj["type"].(string); ok && t == "text" {
-				blockObj["text"] = stringifyForTextBlock(newContent)
-				replaced = true
-				break
+				textBlocks = append(textBlocks, blockObj)
 			}
 		}
+		if len(textBlocks) > 1 {
+			return false, fmt.Errorf(
+				"MCP tools/call response has %d text blocks; single-value redaction rewrite is ambiguous",
+				len(textBlocks))
+		}
+		if len(textBlocks) == 1 {
+			textBlocks[0]["text"] = stringifyForTextBlock(newContent)
+			replaced = true
+		}
 	}
 
 	// Secondary path: update structuredContent when it was already

authbridge/authlib/plugins/cpex/cmf_body_test.go

@@ -16,7 +16,7 @@ func TestMCPRequestBodyMod_ToolsCallArgsReplaced(t *testing.T) {
 		Body: []byte(`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_compensation","arguments":{"employee_id":"E001","include_ssn":true}}}`),
 	}
 	newArgs := map[string]any{"employee_id": "E001"} // include_ssn redacted
-	mutated, err := applyMCPRequestBodyMod(pctx, "tools/call", MCPRequestBodyMod{NewArguments: newArgs})
+	mutated, err := applyMCPRequestBodyMod(pctx, "tools/call", MCPRequestBodyMod{NewArguments: newArgs, ArgsSet: true})
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -41,7 +41,7 @@ func TestMCPRequestBodyMod_PromptsGetArgsReplaced(t *testing.T) {
 		Body: []byte(`{"jsonrpc":"2.0","id":1,"method":"prompts/get","params":{"name":"weather","arguments":{"city":"SF"}}}`),
 	}
 	newArgs := map[string]any{"city": "REDACTED"}
-	mutated, err := applyMCPRequestBodyMod(pctx, "prompts/get", MCPRequestBodyMod{NewArguments: newArgs})
+	mutated, err := applyMCPRequestBodyMod(pctx, "prompts/get", MCPRequestBodyMod{NewArguments: newArgs, ArgsSet: true})
 	if err != nil || !mutated {
 		t.Fatalf("mutated=%v err=%v", mutated, err)
 	}
@@ -54,7 +54,7 @@ func TestMCPRequestBodyMod_ResourcesReadURIReplaced(t *testing.T) {
 	pctx := &pipeline.Context{
 		Body: []byte(`{"jsonrpc":"2.0","id":1,"method":"resources/read","params":{"uri":"file:///secret"}}`),
 	}
-	mutated, err := applyMCPRequestBodyMod(pctx, "resources/read", MCPRequestBodyMod{NewURI: "file:///public"})
+	mutated, err := applyMCPRequestBodyMod(pctx, "resources/read", MCPRequestBodyMod{NewURI: "file:///public", URISet: true})
 	if err != nil || !mutated {
 		t.Fatalf("mutated=%v err=%v", mutated, err)
 	}
@@ -63,26 +63,55 @@ func TestMCPRequestBodyMod_ResourcesReadURIReplaced(t *testing.T) {
 	}
 }
 
-func TestMCPRequestBodyMod_EmptyArgsNoOp(t *testing.T) {
+func TestMCPRequestBodyMod_UnsetArgsNoOp(t *testing.T) {
+	// No ArgsSet flag (e.g. CPEX returned no tool_call part) → no-op.
 	orig := []byte(`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"x","arguments":{"a":1}}}`)
 	pctx := &pipeline.Context{Body: append([]byte(nil), orig...)}
 	mutated, err := applyMCPRequestBodyMod(pctx, "tools/call", MCPRequestBodyMod{})
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
 	if mutated {
-		t.Fatal("expected mutated=false on empty mod")
+		t.Fatal("expected mutated=false when ArgsSet is false")
 	}
 	if string(pctx.Body) != string(orig) {
 		t.Fatalf("body changed despite no-op: %s", pctx.Body)
 	}
 }
 
+func TestMCPRequestBodyMod_StripAllArgsApplies(t *testing.T) {
+	// A "strip all arguments" redaction returns an empty args map WITH
+	// ArgsSet=true. This MUST apply (clear params.arguments), not no-op:
+	// inferring no-op from emptiness would forward the original secret.
+	pctx := &pipeline.Context{
+		Body: []byte(`{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"x","arguments":{"ssn":"123-45-6789"}}}`),
+	}
+	mutated, err := applyMCPRequestBodyMod(pctx, "tools/call",
+		MCPRequestBodyMod{NewArguments: map[string]any{}, ArgsSet: true})
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if !mutated {
+		t.Fatal("expected mutated=true: empty-but-set args is a real redaction")
+	}
+	if strings.Contains(string(pctx.Body), "123-45-6789") {
+		t.Fatalf("original secret args forwarded despite strip-all redaction: %s", pctx.Body)
+	}
+	var decoded map[string]any
+	if err := json.Unmarshal(pctx.Body, &decoded); err != nil {
+		t.Fatalf("re-decode: %v", err)
+	}
+	args := decoded["params"].(map[string]any)["arguments"].(map[string]any)
+	if len(args) != 0 {
+		t.Fatalf("arguments should be empty after strip-all: %v", args)
+	}
+}
+
 func TestMCPRequestBodyMod_UnsupportedMethodNoOp(t *testing.T) {
 	pctx := &pipeline.Context{
 		Body: []byte(`{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}`),
 	}
-	mutated, err := applyMCPRequestBodyMod(pctx, "initialize", MCPRequestBodyMod{NewArguments: map[string]any{"x": 1}})
+	mutated, err := applyMCPRequestBodyMod(pctx, "initialize", MCPRequestBodyMod{NewArguments: map[string]any{"x": 1}, ArgsSet: true})
 	if err != nil {
 		t.Fatalf("err: %v", err)
 	}
@@ -93,15 +122,15 @@ func TestMCPRequestBodyMod_UnsupportedMethodNoOp(t *testing.T) {
 
 func TestMCPRequestBodyMod_MalformedJSONError(t *testing.T) {
 	pctx := &pipeline.Context{Body: []byte(`{not json`)}
-	_, err := applyMCPRequestBodyMod(pctx, "tools/call", MCPRequestBodyMod{NewArguments: map[string]any{"a": 1}})
+	_, err := applyMCPRequestBodyMod(pctx, "tools/call", MCPRequestBodyMod{NewArguments: map[string]any{"a": 1}, ArgsSet: true})
 	if err == nil {
 		t.Fatal("expected error on malformed JSON")
 	}
 }
 
 func TestMCPRequestBodyMod_EmptyBodyNoOp(t *testing.T) {
 	pctx := &pipeline.Context{}
-	mutated, err := applyMCPRequestBodyMod(pctx, "tools/call", MCPRequestBodyMod{NewArguments: map[string]any{"a": 1}})
+	mutated, err := applyMCPRequestBodyMod(pctx, "tools/call", MCPRequestBodyMod{NewArguments: map[string]any{"a": 1}, ArgsSet: true})
 	if err != nil || mutated {
 		t.Fatalf("mutated=%v err=%v on empty body", mutated, err)
 	}
@@ -111,7 +140,7 @@ func TestMCPRequestBodyMod_NoParamsObjectNoOp(t *testing.T) {
 	pctx := &pipeline.Context{
 		Body: []byte(`{"jsonrpc":"2.0","id":1,"method":"tools/list"}`),
 	}
-	mutated, err := applyMCPRequestBodyMod(pctx, "tools/call", MCPRequestBodyMod{NewArguments: map[string]any{"a": 1}})
+	mutated, err := applyMCPRequestBodyMod(pctx, "tools/call", MCPRequestBodyMod{NewArguments: map[string]any{"a": 1}, ArgsSet: true})
 	if err != nil || mutated {
 		t.Fatalf("mutated=%v err=%v on body without params", mutated, err)
 	}
@@ -146,6 +175,31 @@ func TestMCPResponseBodyMod_TextBlockReplaced(t *testing.T) {
 	}
 }
 
+func TestMCPResponseBodyMod_MultiTextBlockFailsClosed(t *testing.T) {
+	// A tools/call result with ≥2 text blocks is an ambiguous rewrite:
+	// the read side (extractToolResultContent) only surfaced the first
+	// block to the policy, and we hold one redacted value. Rewriting only
+	// block[0] would forward block[1] (here carrying the same secret)
+	// verbatim. Must fail closed.
+	pctx := &pipeline.Context{
+		ResponseBody: []byte(`{"jsonrpc":"2.0","id":1,"result":{"content":[{"type":"text","text":"first block ssn:123-45-6789"},{"type":"text","text":"second block ssn:123-45-6789"}]}}`),
+	}
+	newContent := map[string]any{"name": "Jane Smith"} // SSN removed
+	mutated, err := applyMCPResponseBodyMod(pctx, "tools/call", newContent)
+	if err == nil {
+		t.Fatal("expected fail-closed error for multi-text-block response, got nil")
+	}
+	if mutated {
+		t.Fatal("mutated=true on multi-block fail-closed")
+	}
+	// The body must be untouched — and critically, the planted secret in
+	// the un-inspected blocks must NOT have been forwarded as a "success".
+	// (We assert via the returned error contract; the body stays original.)
+	if !strings.Contains(string(pctx.ResponseBody), "second block ssn:123-45-6789") {
+		t.Fatalf("response body unexpectedly altered: %s", pctx.ResponseBody)
+	}
+}
+
 func TestMCPResponseBodyMod_StructuredContentUpdated(t *testing.T) {
 	pctx := &pipeline.Context{
 		ResponseBody: []byte(`{"jsonrpc":"2.0","id":1,"result":{"content":[{"type":"text","text":"x"}],"structuredContent":{"ssn":"123"}}}`),

authbridge/authlib/plugins/cpex/headers.go

@@ -42,9 +42,12 @@ import (
 // which silently allows traffic the policy meant to deny.
 //
 // The audit-log risk this opens — bearer tokens reaching audit
-// payloads — is mitigated by configuring audit-log to drop
-// Authorization from its output (or by terminating TLS at the
-// sidecar so tokens are short-lived and bound to mTLS).
+// payloads and the unauthenticated session API — is NOT optional to
+// mitigate: any audit-log sub-plugin MUST be configured to drop the
+// Authorization header from its output, and the session API MUST stay
+// bound to in-cluster addresses only (never behind ingress). Pairing
+// with sidecar TLS termination (short-lived, mTLS-bound tokens) is a
+// further hardening, not a substitute.
 //
 // This table and the helpers below are tag-free (no //go:build cpex)
 // so the default CGO_ENABLED=0 test build exercises them; the cgo
@@ -77,9 +80,10 @@ var secretHeaderExact = map[string]struct{}{
 // follow §3.2.2, lands in secretHeaderPrefixes and is stripped before
 // reaching here.)
 //
-// Sensitive headers (Authorization, Cookie, X-Api-Key, …) are
-// dropped via secretHeaderPrefixes / secretHeaderExact, NOT silently
-// truncated.
+// Sensitive headers (Cookie, X-Api-Key, …) are dropped via
+// secretHeaderPrefixes / secretHeaderExact, NOT silently truncated.
+// Authorization is the deliberate exception — see the NOTE above: it
+// is kept so CPEX identity plugins can read the bearer.
 func flattenHeaders(h http.Header) map[string]string {
 	if len(h) == 0 {
 		return nil

authbridge/authlib/plugins/cpex/manager_cpex.go

@@ -415,15 +415,21 @@ func applyMCPBodyModFromCMF(pctx *pipeline.Context, msg *rcpex.Message, isRespon
 			switch part.ContentType {
 			case "tool_call":
 				if part.ToolCallContent != nil {
+					// Set the flag whenever the part is present, even for
+					// an empty/nil args map: that's a deliberate "strip all
+					// arguments" redaction, not a no-op.
 					mod.NewArguments = part.ToolCallContent.Arguments
+					mod.ArgsSet = true
 				}
 			case "prompt_request":
 				if part.PromptRequestContent != nil {
 					mod.NewArguments = part.PromptRequestContent.Arguments
+					mod.ArgsSet = true
 				}
 			case "resource_ref":
 				if part.ResourceRefContent != nil {
 					mod.NewURI = part.ResourceRefContent.URI
+					mod.URISet = true
 				}
 			default:
 				continue
@@ -508,9 +514,13 @@ func applyExtensionChanges(pctx *pipeline.Context, ext *rcpex.Extensions) {
 //	                ProvenanceExtension.MessageID
 //	delegation    → DelegationExtension (chain/origin/actor/depth)
 //	request       → RequestExtension (request id + trace/span ids)
-//	headers       → HttpExtension.RequestHeaders (Authorization and Cookie
-//	                stripped — they don't belong in policy context and would
-//	                leak through CPEX traces)
+//	headers       → HttpExtension.RequestHeaders (Cookie and other
+//	                secret headers stripped; see flattenHeaders. NOTE:
+//	                Authorization is deliberately KEPT so CPEX's identity
+//	                plugins can read the bearer — it therefore reaches the
+//	                RequestHeaders map and the unauthenticated session API.
+//	                Audit-log sub-plugins MUST be configured to drop
+//	                Authorization from their output. See headers.go.)
 //
 // Note (agent slot): the caller's client_id is NOT placed on
 // AgentExtension.AgentID. Caller identity lives in SecurityExtension.Subject;

authbridge/cmd/authbridge-cpex/CPEX_FFI_ABI

@@ -0,0 +1 @@
+2

authbridge/cmd/authbridge-cpex/Dockerfile

@@ -11,10 +11,15 @@
 # enable CPEX.
 
 # ---------- Stage 1: fetch libcpex_ffi.a from the pinned release ----
-# The CPEX_FFI_VERSION file at the root of this directory is the
-# single source of truth for which CPEX FFI ABI this binary expects.
-# A pre-commit hook (TODO follow-up) enforces it matches the go.mod
-# pin for the cpex Go bindings.
+# The CPEX_FFI_VERSION file at the root of this directory pins the
+# release tag; CPEX_FFI_ABI pins the FFI ABI integer the linked lib must
+# report. Both are asserted at build time below: the extracted tarball's
+# VERSION must equal CPEX_FFI_VERSION and its FFI_ABI must equal
+# CPEX_FFI_ABI, so a renamed/mismatched asset fails the build rather than
+# linking a lib whose ABI the Go bindings don't expect. The bindings
+# additionally assert the ABI at runtime (go/cpex/abi.go panics at init()
+# if the linked lib's cpex_ffi_abi_version() != its expected value), so a
+# drift is caught both at build and at boot.
 #
 # Asset naming on the cpex release page:
 #   cpex-ffi-${VERSION}-${OS}-${ARCH}-${LIBC}.tar.gz   (tarball)
@@ -35,6 +40,10 @@ FROM alpine:3.20@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd1
 RUN apk add --no-cache curl ca-certificates tar cosign
 
 ARG CPEX_FFI_VERSION
+# CPEX_FFI_ABI pins the FFI ABI integer the linked lib must report. The
+# Makefile sources it from the CPEX_FFI_ABI file (same dir as
+# CPEX_FFI_VERSION); the extract step below asserts the tarball matches.
+ARG CPEX_FFI_ABI
 ARG TARGETARCH
 ARG TARGETOS=linux
 # LIBC defaults to gnu (Debian/Ubuntu container hosts). Override to
@@ -73,7 +82,23 @@ RUN set -eu; \
     || { echo "[ffi] cosign verification FAILED" >&2; exit 1; }; \
     tar -xzf asset.tar.gz; \
     test -f libcpex_ffi.a || { echo "[ffi] libcpex_ffi.a missing from tarball" >&2; exit 1; }; \
-    echo "[ffi] extracted libcpex_ffi.a + VERSION=$(cat VERSION) + FFI_ABI=$(cat FFI_ABI)"
+    # Assert the tarball's pinned identity matches what we expect. A \
+    # mismatched VERSION means the asset was renamed/swapped; a mismatched \
+    # FFI_ABI means the lib's C surface differs from what the Go bindings \
+    # were generated against (a CGO mis-marshal waiting to happen). \
+    # VERSION is a multi-line key=value manifest (version=, git_sha=, \
+    # tuple=, …); pull the version= line. FFI_ABI is a bare integer. \
+    got_version=$(grep -E '^version=' VERSION | head -1 | cut -d= -f2- | tr -d '[:space:]'); \
+    if [ "$got_version" != "$CPEX_FFI_VERSION" ]; then \
+        echo "[ffi] VERSION mismatch: tarball says '$got_version', expected '$CPEX_FFI_VERSION'" >&2; \
+        exit 1; \
+    fi; \
+    got_abi=$(tr -d '[:space:]' < FFI_ABI); \
+    if [ -n "$CPEX_FFI_ABI" ] && [ "$got_abi" != "$CPEX_FFI_ABI" ]; then \
+        echo "[ffi] FFI_ABI mismatch: tarball says '$got_abi', expected '$CPEX_FFI_ABI' (bump CPEX_FFI_ABI + the Go binding)" >&2; \
+        exit 1; \
+    fi; \
+    echo "[ffi] extracted libcpex_ffi.a + VERSION=$got_version + FFI_ABI=$got_abi (asserted)"
 
 # ---------- Stage 2: build authbridge-cpex with cgo + -tags cpex ----
 # golang:bookworm (glibc) — alpine + musl would need extra ring/