Feature flag enforced at the API/route boundary but not the service it guards — background jobs bypass it (fail-open via the side door)

A write-gating feature flag (e.g. ENABLE_V2_INGEST) was correctly defined fail-closed (default off, strict === 'true') and checked at the two public entrances to a write service: the HTTP route handler and the MCP tool handler. The intent was "the v2 write path ships dark — nothing writes until the flag flips." That intent was FALSE in practice: the flag check lived at the doors, not inside the service. Any other caller of the same service bypassed the gate entirely. Concretely, a read-looking endpoint (GET /v2/packages) enqueued a background job on a cache miss with no flag check; the job worker was registered unconditionally at startup and called the write service directly, MERGE-ing nodes/edges into the graph database with the flag OFF. An authenticated client could therefore drive arbitrary writes into production through the side door while the operator believed the surface was dark. The same per-door-not-per-write pattern recurred with admin importers and a separate write helper that relied on its callers (not itself) to check the flag.

Found during an adversarial review of a "safe to promote, ships dark behind flags" claim. Method that surfaced it: instead of trusting that the two named entrances were gated, enumerate EVERY caller of the write service — HTTP routes, MCP tools, pg-boss/cron jobs, event handlers, and any hook that can reach the service. grep for the flag-check function across the whole app and confirm where it is and isn't called: the guard appeared only in the route + MCP handler, never inside the service method nor in the background-job worker. Then trace a "read" endpoint's miss branch: it did boss.send(jobName, ...) with no guard; the worker was in the unconditional startup registration list and called service.ingest(...) directly. Lesson: a flag checked at the boundary is a per-entrance gate, not a per-write gate. Background jobs, importers, and internal callers are invisible entrances.

Confirmed by direct code reading: the flag-check function appeared only in the HTTP route handler and the MCP tool handler; the write service had zero references to it; a read endpoint's cache-miss branch enqueued a job with no check; the job worker was registered unconditionally and called the service's write method directly. The fix (gate inside the service) is verifiable by a flag-off test asserting no graph mutation from any entrance.