Release v0.1.13 bind safety

Author: Liu

CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to Genome Forge are documented in this file.
 
 ## [Unreleased]
 
+## [0.1.13] - 2026-05-15
+
+### Changed
+
+- The local web server now refuses non-loopback bind addresses by default and requires explicit `--allow-remote` opt-in before accepting network-facing hosts.
+- Installation, security, architecture, API, developer, and README docs now describe the loopback-only default and remote-bind opt-in path.
+
+### Added
+
+- Added regression coverage for loopback bind validation, blocked remote binds, and explicit remote-bind opt-in.
+
+### Fixed
+
+- Stabilized browser workflow tests so repeated actions cannot pass against stale output from a prior API response.
+
+### Validation
+
+- `python3 docs/validate_docs.py`
+- `python3 -m py_compile web_ui.py tests/test_web_ui_security.py docs/validate_docs.py`
+- `python3 -m unittest tests.test_web_ui_security -v`
+- `python3 -m unittest discover -s tests -p 'test_*.py'`
+- `./.venv-docs/bin/python -m pytest`
+- `python3 smoke_test.py`
+- `python3 real_world_functional_test.py`
+- `npm run test:e2e`
+
 ## [0.1.12] - 2026-05-15
 
 ### Added

HANDOFF_ZERO_MEMORY.md

@@ -33,7 +33,7 @@ What matters operationally:
 - The product already has broad feature coverage.
 - Backend decomposition has started: record I/O/core workflows, design-assist workflows, trace, BLAST-like search, reference-library, siRNA, project/share/history, cloning/assembly, analysis/alignment, and biology-support workflows now live in `backend/`.
 - Current known local regression baseline is:
-  - `python3 -m unittest discover -s tests -p 'test_*.py'`: `41` passing tests
+  - `python3 -m unittest discover -s tests -p 'test_*.py'`: `44` passing tests
   - `smoke_test.py`: `115` passing checks
   - `real_world_functional_test.py`: `104` passing steps
   - `npm run test:e2e`: `15` passing browser tests

README.md

@@ -20,7 +20,7 @@ It combines:
 
 Latest release:
 
-- [Genome Forge v0.1.12](https://github.com/felizvida/genomeforge/releases/tag/v0.1.12)
+- [Genome Forge v0.1.13](https://github.com/felizvida/genomeforge/releases/tag/v0.1.13)
 
 ## Why Genome Forge
 
@@ -92,6 +92,8 @@ Open:
 http://127.0.0.1:8080
 ```
 
+The local server refuses non-loopback bind addresses unless you explicitly pass `--allow-remote`; see [Security Model](docs/SECURITY_MODEL.md).
+
 Recommended editable install:
 
 ```bash
@@ -112,7 +114,7 @@ genomeforge input.fasta info
 
 Current shipped baseline:
 
-- `python3 -m unittest discover -s tests -p 'test_*.py'` -> `41/41` passed
+- `python3 -m unittest discover -s tests -p 'test_*.py'` -> `44/44` passed
 - `python3 smoke_test.py` -> `115/115` passed
 - `python3 real_world_functional_test.py` -> `104/104` passed
 - `npm run test:e2e` -> `15/15` passed

VERSION

@@ -1 +1 @@
-v0.1.12
+v0.1.13

docs/API.md

@@ -156,6 +156,7 @@ This file is also used as a machine-checked inventory surface by `docs/validate_
 ## Notes
 
 - The API is intentionally local-first and currently served by Python stdlib HTTP infrastructure.
+- The server binds to loopback by default and requires `--allow-remote` before accepting non-loopback hosts.
 - The local server emits security headers and a CSP for browser defense in depth; see [Security Model](SECURITY_MODEL.md).
 - Many endpoints return JSON plus embedded SVG payloads for visualization.
 - Some biological algorithms are heuristic by design and should be interpreted alongside validation evidence.

docs/ARCHITECTURE.md

@@ -73,6 +73,7 @@ Strength:
 Security boundary:
 
 - binds to `127.0.0.1` by default
+- refuses non-loopback bind addresses unless started with `--allow-remote`
 - emits CSP, frame-denial, referrer, content-type, opener, and permissions-policy headers on every response
 - is intended for trusted local workstation use, not untrusted network exposure
 

docs/DEVELOPER_GUIDE.md

@@ -23,6 +23,8 @@ Runtime:
 python3 web_ui.py --port 8080
 ```
 
+Remote binding is blocked unless you pass `--allow-remote`; keep the default loopback mode for normal development.
+
 Editable install:
 
 ```bash

docs/INSTALL.md

@@ -24,6 +24,14 @@ Then open:
 http://127.0.0.1:8080
 ```
 
+The web UI is loopback-only by default. If you intentionally expose it to a trusted network, you must opt in:
+
+```bash
+python3 web_ui.py --host 0.0.0.0 --port 8080 --allow-remote
+```
+
+Do not use remote binding on an untrusted network; the current server is a local-first workbench, not a hosted multi-user service.
+
 ## Recommended Path: Editable Local Install
 
 Create an environment and install the project in editable mode:

docs/SECURITY_MODEL.md

@@ -15,7 +15,13 @@ The default command is intentionally loopback-only:
 python3 web_ui.py --host 127.0.0.1 --port 8080
 ```
 
-Avoid binding to `0.0.0.0` unless the machine is behind an appropriate trusted network boundary and you understand that Genome Forge does not yet provide production-grade authentication, session management, rate limiting, or multi-user isolation.
+The server refuses non-loopback bind addresses unless you make that choice explicit:
+
+```bash
+python3 web_ui.py --host 0.0.0.0 --port 8080 --allow-remote
+```
+
+Avoid `--allow-remote` unless the machine is behind an appropriate trusted network boundary and you understand that Genome Forge does not yet provide production-grade authentication, session management, rate limiting, or multi-user isolation.
 
 ## Browser Boundary
 

docs/releases/v0.1.13.md

@@ -0,0 +1,45 @@
+# Genome Forge v0.1.13
+
+Release date: 2026-05-15
+
+## Highlights
+
+- Added an explicit safety gate for non-loopback web UI binding.
+- Kept normal workstation use unchanged: `python3 web_ui.py --port 8080` still binds to `127.0.0.1`.
+- Required `--allow-remote` before accepting hosts such as `0.0.0.0`.
+- Updated security, install, architecture, API, developer, and README docs to explain the local-first bind model.
+- Stabilized browser workflow tests so repeated UI actions wait for fresh output instead of accepting stale responses.
+
+## Bind Safety
+
+Genome Forge is a local-first workstation app. Starting the server on a network-facing address now requires an explicit acknowledgement:
+
+```bash
+python3 web_ui.py --host 0.0.0.0 --port 8080 --allow-remote
+```
+
+Without `--allow-remote`, non-loopback hosts fail fast with a clear error. This reduces accidental exposure on lab or public networks while preserving an intentional opt-in path for trusted environments.
+
+## Validation
+
+- `python3 docs/validate_docs.py`
+- `python3 -m py_compile web_ui.py tests/test_web_ui_security.py docs/validate_docs.py`
+- `python3 -m unittest tests.test_web_ui_security -v`
+- `python3 -m unittest discover -s tests -p 'test_*.py'`
+- `./.venv-docs/bin/python -m pytest`
+- `python3 smoke_test.py`
+- `python3 real_world_functional_test.py`
+- `npm run test:e2e`
+- `git diff --check`
+
+## Validation Snapshot
+
+- Unit tests: `44/44`
+- Smoke checks: `115/115`
+- Real-world functional checks: `104/104`
+- Browser E2E tests: `15/15`
+
+## Notes
+
+- This is a focused local-server safety release following `v0.1.12`.
+- Genome Forge still does not claim hosted SaaS isolation, authenticated browser sessions, or regulated electronic-records compliance.