[P2][security] config_admin policy freeze (#2115) should be deny-by-default, not a fixed key list #2118

Finding (class of problem; details withheld until the fix is merged)

The policy freeze added by #2115 (_restore_policy_subtrees and _POLICY_API_KEYS in api/routes.py) is a deny-by-list: a fixed set of api.* subtrees is restored when a non-admin principal saves the config, and every other api key is taken from the submitted YAML. Some of the unlisted keys are policy-like. The set is not enumerated in this public thread.

Two related hardening points:

• A new policy key added later is editable by config_admin until someone remembers to add it to the list.
• _merge_and_save_config_yaml(submitted_yaml, request=None) skips the freeze when request is omitted. There is one caller today and it passes request, so this is a default that fails open, not a live defect.

Acceptance (executor's choice)

• Invert it: classify every api.* key as editable or admin-only, and treat an unclassified key as admin-only.
• A test that loads the default config, lists every api key the code reads, and fails when a key has no classification.
• Make request required, so no caller can skip the freeze by omission.
• Regression tests that a config_admin cannot change any key classified admin-only.

Note for contributors and LLM agents: do not describe attack vectors, exploit recipes, concrete key or variable names, or reachable paths in public issues or comments before the fix is merged. Class of problem and acceptance criteria only. Detail belongs in the private tracker or in the fix PR.

Provenance: git 6bdb4ad, read only, nothing run. Triage before fix.

Generated by Claude Code