Reproduce the FULL dependency topology (Kafka + coordinators + partition ring) before declaring an impact dead (Loki ingest-limits cycle277 live-PoC)

Banked from confirming Finding 1 (Loki cross-tenant ingest-limits) Medium impact. The single-binary PoC proved the MISSING-AUTH but the IMPACT did not fire (ReasonFailed + partitions_missing, read=0). That was a WIRING gap, not a mitigation.

The rule

When a vuln's IMPACT depends on a multi-component / experimental feature (Kafka-backed, ring/partition-sharded, async), a naive single-process deploy often leaves the backend un-ready (empty partition->consumer map, no committed offsets) so the impact silently no-ops. Do NOT re-scope to "lower sev / can't fire" until you reproduce the FULL dependency topology using the PROJECT'S OWN dev/integration blueprint (tools/dev/, integration/, the example configs that enable the feature). For Loki ingest-limits: Apache Kafka (KRaft) + the tools/dev/kafka ingest_limits config (kafka_config, ingest_limits.enabled, num_partitions, ingest_limits_frontend, ingester.kafka_ingestion) + PRE-ELECT the consumer-group coordinators (run a console-consumer per group) before launch to dodge COORDINATOR_NOT_AVAILABLE on strict startup. Then the backend becomes partitionReady and the frontend routes to it -> the impact fires.

PoC-config knobs that flip "no-op" -> "fires"

• auth_enabled: true so the PUSH path respects X-Scope-OrgID (else everything is tenant "fake" and the cross-tenant DoS mis-attributes). The BUGGY endpoints still take tenant from path/body regardless = the bypass.
• *_dry_run_enabled: false so the limit ENFORCES (discards) instead of metering.
• a LOW cap (max_global_streams_per_user: 5) so a small fabricated write crosses it.
• a CONTROL tenant push (clean quota -> 204) to prove the impact is victim-SPECIFIC, not global.

Harness note (banked ops)

In this agent harness, long-lived processes survive ONLY as a FOREGROUND run_in_background:true task; nohup CMD & inside a normal Bash call gets reaped. Do NOT prefix every command with pkill (it kills the running PoC). Build a binary once (go build) for fast restarts vs go run. Related: [[multitenant-handler-tenant-from-request-not-context]].