Function host_caller_allowed 

pub(super) fn host_caller_allowed(known: Option<&str>, supplied: &str) -> bool

Some(error) when the caller failed to prove it’s the paired host — checked for EVERY method before dispatch, so a new method added later is gated by construction rather than by remembering to gate it.

Fails closed when srv has no secret configured: with nothing to verify against, “allow” would silently restore the exact bypass this exists to close. Mirrors host_ipc::handle_register’s None arm. The whole security decision, as a pure function of the two secrets — extracted so it can be tested directly (constructing an AppState in a unit test isn’t practical, and this gate is far too load-bearing to leave to integration coverage alone).

known == None → always false: fail closed. See the caller.

An EMPTY configured secret is treated the same as an absent one. Without that, secret_matches("", "") compares equal and a caller supplying nothing — precisely what an agent without the secret sends — would be admitted, turning the misconfiguration into a skeleton key. Config already .filter(|s| !s.is_empty())s this value (host_reg_secret in config.rs’s Config::from_env_and_args), so today the case is unreachable; the check is here so the gate stays correct on its own terms rather than depending on a filter two modules away that a future refactor could drop.