Summary

Rotating the shared gateway auth secret (via config.set / config.patch) does not disconnect existing WebSocket sessions that authenticated against the old secret. Those sessions remain connected and authorized until the next gateway restart.

Impact

HIGH. Credential revocation is ineffective for live connections. If the shared secret is compromised, rotating it does not evict already-connected clients — the revoked credential keeps working on existing sockets until a restart.

Expected behavior

Rotating the active shared secret immediately disconnects every WS client that authenticated with the prior secret. Newly rotated-in credentials continue to work.

Fix sketch

Wire shared-core disconnection on rotation:

• disconnectClientsUsingSharedGatewayAuth in src/gateway/server.impl.ts (plus the supporting gateway context type that exposes the connected-client set keyed by the auth secret they used).
• Call it from the config.set / config.patch rotation path.

Note: fixing only the config.ts caller is insufficient — the integration path that holds the live connections lives in the cross-cutting core server.impl.ts, so the unit-level caller and the integration path must land together.

Why this was deferred

Requires shared-core edits to server.impl.ts (outside any single test-cluster fix) and is a security-semantics change. The two covering tests are it.skip-ped with documented TODOs:

• src/gateway/server.shared-token-session-rotation.test.ts (~line 84)
• src/gateway/server-methods/config.shared-auth.test.ts (~line 100)

They should be un-skipped together.

Acceptance criteria

• Both skipped tests pass.
• After a shared-secret rotation, WS sessions authed against the prior secret are disconnected without requiring a restart.