# 3.4 — Flag-gated auth rollout (GREEN)

Phase: 3 — Authentication
Stage: GREEN
Depends on: [3.2](3.2-bearer-validation.md)

- [ ] Authentication is controlled by an explicit flag in configuration, and its default is OFF
- [ ] With the flag off, every route answers exactly as it did before Phase 3 existed — no 401s, no `WWW-Authenticate`, no behaviour change
- [ ] With the flag on, protected routes require `Authorization: Bearer` and reject anything else with 401
- [ ] `GET /healthz` and `GET /readyz` never require authentication in either state
- [ ] Which routes are protected is per-route configuration, so auth can be turned on for one surface at a time
- [ ] Turning the flag on is a git change synced by Argo; it is never toggled by hand against the cluster
- [ ] The flag's current state is visible in logs at startup and in metrics, so nobody has to guess whether auth is on
- [ ] Turning the flag off again fully restores unauthenticated access, making the rollout reversible

The model API is unauthenticated today — verified live, a request with no credentials
returns 200. Enabling this flag breaks every current caller until they hold a token,
pi included. That is why it defaults off and is enabled deliberately, after
[3.6](3.6-pi-client-migration.md).

## Verify

```bash
# flag off
curl -s -o /dev/null -w '%{http_code}\n' localhost:8080/v1/models              # expected: 200
curl -s -o /dev/null -w '%{http_code}\n' localhost:8080/v1/chat/completions \
  -H 'content-type: application/json' -d '{"model":"reasoning","messages":[]}' # expected: 200

# flag on, no credentials
curl -s -o /dev/null -w '%{http_code}\n' localhost:8080/v1/chat/completions \
  -H 'content-type: application/json' -d '{"model":"reasoning","messages":[]}' # expected: 401
curl -s -o /dev/null -w '%{http_code}\n' localhost:8080/healthz                # expected: 200
```