Fabric door on a group-restricted unix socket with kernel-attested peers; placed host writes through it; retire fabric_storage_append_principal_unrefused

[gunbai-bot]

Depends on #12451. This branch contains #12451. Until that lands, the diff against main includes it; review the commits after 5fa60e86a9.

This PR retires gunbc.rung_drop fabric_storage_append_principal_unrefused by its trigger. The retirement is carried in the row's standing: Retired { trigger_fired } receipt, the same way every other retired drop records it. It implements the operator ruling relayed by proud-deer-538 on 2026-09-27: the fabric backend moves to a group-restricted unix socket, and FabricStorageLocalFiles is retired for the placed host, so the placed host also writes through the door.

The door

• Seed. gunbc serve --unix-socket <path> is added to the modeled CLI surface (gunbc.cli_dispatch_surface) and to the seed.
  • It binds the socket and replaces a stale socket, but refuses to replace any other kind of file.
  • It opens the socket's mode, because the socket's directory is the filesystem wall.
  • For each connection it reads the peer from the kernel (SO_PEERCRED → account name) and passes it to the handler as peer_user. TCP attests nothing, so peer_user is "" there.
  • An unresolvable peer drops the connection.
  • Seed tests: cli_run serve_unix_socket_door_tests, 3 tests passing.
• Placement. The door is fabric_storage_door_socket inside fabric_storage_door_directory: owner is the service account, group is ghrunner, and the group can only traverse.
  • That directory's dependents are the local writer roster, so the kernel and the handler read one declaration.
  • The store areas are now service-only (0700, entries 0400). The ghrunner group and the entry repair are removed.
• Admission. In gunbc.fabric_writer_roster, fabric_door_principal_of sorts every connection into one of three cases:
  • peer root is the tailscale proxy, so the request's login is checked against the served roster;
  • any other peer is judged as itself against the local roster, and any header it sends is ignored;
  • no peer at all is unattested.
  • Refusals are typed FabricWriterRefusal arms: WriterLoginAbsent, WriterLoginUnrostered, WriterPeerUnrostered, WriterPeerUnattested.
• Client. fabric_storage_binding_for binds the placed host to FabricStorageDoorSocket, which uses curl --unix-socket through the new extdeps.http.client PostStdinWithinUnixSocket. No placement derives FabricStorageLocalFiles any more; it remains only for the door's own realization and for fixtures and instruments over their own roots.
• Deploy. The unit runs --unix-socket and binds no --host/--port. The tailscale route targets unix:<socket>. That target form is in upstream ipn/serve.go (ExpandProxyTargetValue), and since v1.98.9 only root may configure it (TS-2026-005); our apply already runs it privileged.
• Identity reading. On srv1, the observe mode now reads local <user> through the socket (FabricIdentityLocalPeer).

Evidence (executed locally, all true)

• Wet claims over the real handler and real files:
  • the outsider-login and absent-login REDs;
  • a_put_or_advance_from_an_unrostered_local_account_is_refused_even_with_a_rostered_login_by_real_execution (forged header from a local account);
  • a_put_or_advance_on_an_unattested_connection_is_refused_by_real_execution;
  • positive controls for a rostered login and a rostered local account.
• The Fabric served door refuses unrostered writers (roster derived from writer-identity readings) #12451 mutation (admission forced to admitted) reds the refusal claims through the same binding.
• The roster witness: header believed only from the proxy peer; the local roster equals the door directory's dependents; store areas admit no writer but the service.
• The wire witness, including every writer-refusal arm.
• test.claim.live_deploy.emit: the unit binds the socket, the route proxies to it, the areas and the door directory have the expected modes, the entry mode is 0400, and no entry repair is emitted.
• pair_serving_d0_witness the_wet_door_refuses_while_the_fabric_storage_write_wall_drop_stands: with the row Retired, D0 still refuses, now on d0_store_operation_wall.

Not walled, stated

• Root, and the service account itself, can still write the files directly (fabric_storage_directory).
• The served roster is empty: no fleet host has resolved the door (srv3 and srv4 hit curl exit 6).
• This takes effect on srv1 only once dashboard_deploy applies this revision. After deploy, check:
  • tailscale version is recent enough for unix targets;
  • entries ghrunner wrote before the cutover are still readable by the service.
• The per-operation D0 wall remains d0_store_operation_wall (lively-dove-256).

🤖 Generated with Claude Code

[gunbai-bot]

Review 72010: added a SeedGrowthJustification receipt, gunbc.fabric_door_socket_seed_growth, registered in gunbc.seed_growth_admission. It lists the five citable hand items (ServeConnection, ServeListener, ServeBoundAddress, serve_bind, serve_peer_user) and names what isn't citable (the impl blocks, the listener methods and the test module). Its reason is that a bind and an SO_PEERCRED read on an accepted connection are host facts, and the seed decides nothing: the peer reaches .dag as a value. Owning lane v1-hand-queue-drain. Trigger: serve becomes a v2-native CLI verb with an attested-peer socket effect the rendered main realizes. — sent from jolly-owl-158