fix(auth): exempt machine endpoints from global API-key and identity middlewares

app/api/security.py

@@ -26,6 +26,14 @@ from starlette.types import ASGIApp
 
 EXEMPT_PATHS: tuple[str, ...] = ("/", "/docs", "/redoc", "/openapi.json")
 EXEMPT_SUFFIXES: tuple[str, ...] = ("/health",)
+# Machine (service-to-service) endpoints authenticate through the mandatory
+# ``require_service_api_key`` route dependency, which accepts INGEST_API_KEY or
+# API_KEY. The global middlewares must not swallow them: the API_KEY middleware
+# only knows the global key (the ingest key would be rejected), and the
+# trusted-identity middleware expects user headers machine callers never have.
+# Exempting them here does NOT open the endpoints — their own dependency stays
+# mandatory (see tests/test_ingest_auth.py).
+MACHINE_PATH_SUFFIXES: tuple[str, ...] = ("/knowledge-ingest", "/dispatch/inbox")
 
 
 def _extract_token(request: Request) -> str | None:
@@ -97,6 +105,8 @@ def install_api_key_auth(app: FastAPI) -> None:
             return await call_next(request)
         if any(path.endswith(s) for s in EXEMPT_SUFFIXES):
             return await call_next(request)
+        if any(path.endswith(s) for s in MACHINE_PATH_SUFFIXES):
+            return await call_next(request)
         if not path.startswith(settings.app_api_prefix):
             return await call_next(request)
 
@@ -136,6 +146,8 @@ def install_trusted_headers_auth(app: FastAPI) -> None:
             return await call_next(request)
         if path in EXEMPT_PATHS or any(path.endswith(s) for s in EXEMPT_SUFFIXES):
             return await call_next(request)
+        if any(path.endswith(s) for s in MACHINE_PATH_SUFFIXES):
+            return await call_next(request)
         if not path.startswith(fresh_settings.app_api_prefix):
             return await call_next(request)