Log what answered when a Gateway reply is not encrypted

[Marketen]

When a reply to an encrypted request has no Ehbp-Response-Nonce, the proxy only logged:

failed to decrypt response: missing Ehbp-Response-Nonce header

The Gateway sets that header on every reply once its EHBP handler has decrypted the request, so a reply without it came from something in front of that step: an edge, a load balancer or an early rejection. The real HTTP status was dropped before anyone could read it.

This happened on a Dappnode on 2026-09-14: six small requests (likely Hermes title generation) failed in two bursts at 11:49 and 11:51 UTC, while large requests sent at the same moment succeeded, with no Gateway redeploy or key change. Small requests reach the encrypted handler normally (verified against the live TEE Gateway), so the cause is outside it, but the logs can't say what.

Change

GuardEHBPResponses now fails an unencrypted reply to an encrypted request itself, describing it:

Gateway replied without EHBP encryption: HTTP 429 (Content-Type=text/plain, Retry-After=5): rate limited at the edge

• Includes Content-Type, Server, Retry-After, Cf-Ray when present and a 512-byte single-line body excerpt.
• The reply was plaintext on the wire, so no prompt or completion can appear in it. The integration test asserts the prompt canary never reaches the log.
• The 422 problem+json key-mismatch reply still passes through, so the EHBP client re-verifies as before (existing key-rotation test passes).
• Requests that were never encrypted are untouched.

The caller-facing behaviour is unchanged: still a 502.

Tests

• Guard unit tests: descriptive error with capped, single-line excerpt and closed body; key mismatch and unencrypted requests pass through. The main test fails with the change disabled.
• Proxy integration test: a plaintext 429 edge gives the caller 502 and a log line with the status, Retry-After and body.
• go vet ./... and go test ./... pass.

🤖 Generated with Claude Code