# Critical-only leads (2026-11-14)

## Guidewire Germany cloud migration
- DNS identifies the Baloise Germany Guidewire tenant as `baloisede-balde.stars.guidewire.net`.
- Live dev aliases: `{pc,bc,cc,cm,ab}.dev.baloisede-balde.stars.guidewire.net` -> Guidewire AWS ELB.
- Canonical dev route: `pc-dev-baldedev.baloisede.alpha1-pinwheel.guidewire.net` (and bc/cc/cm equivalents).
- `*.gwupdate.baloisede-balde.stars.guidewire.net` DNS exists but no application route.
- Direct dev application routes are source-IP allowlisted (`403 IP address not allowed`). A 325-name canonical ingress-host sweep found only dev; no production cloud route on the same cluster. Production `gwde.baloise.de` appears to remain behind the on-prem Airlock boundary.
- Next step if a production cloud hostname appears: establish direct linkage from `gwde.baloise.de`, then check stock `su:gw` read-only identity and SystemTools API.

## GWDE auth boundary
- HTTP Basic `su:gw`, IAM password `su:gw`, fixed ESP SSO tickets, plain/base64/gzip/none JWT tickets, forged request-side `AL_CONTROL`, and `portal-redirect` flow activation/goto did not grant a session.
- Remaining critical angles: a legitimate low-priv Baloise session for cross-application role confusion; distinct gateway/backend parser desync; production backend hostname/origin discovery.

## Layer7 API gateway
- Production RESTMAN/Graphman stock `admin:7layer` denied.
- CVE-2026-1180 OTK DCR default `/openid/connect/register` returned generic not-found and made no managed callback. Only custom-mounted DCR paths remain open.