Allocation write seam: tailnet path from an attested proxy ingress plus serve-status readback; mount POST /allocations and /allocations/{id}/release

[gunbai-bot]

What this does

gunbc.roadmap_serve roadmap_serve_request_security hard-coded ServeStatusUnreadable / no route, so AccessPathTailnetProxy could not be constructed there and the allocation writes were unmounted. This PR builds the seam that can construct it and mounts both writes under tailnet_path_required: true. It owns the single mount of both POST routes (#13272 dropped its mounts).

On no instance deployed today does a write get admitted. Every roadmap entry is launched on a TCP listener, which attests no peer, so the writes answer 503 unavailable / ingress-unattested there. Admission needs the deployment cutover described under "Live step" below, which this PR does not model or perform.

The tailnet path needs three things, and the header is none of them

gunbc.auth.request_authentication request_access_path_of_standing mints AccessPathTailnetProxy only when:

1. the bind is loopback (unchanged);
2. the connection's attested peer is the tailscale proxy — RequestIngress is IngressAttestedPeer { peer_user } with peer_user equal to extdeps.tailscale.serve tailscale_serve_unix_proxy_peer. This is the per-connection fact review 5406776483 asked for. It is what gunbc serve --unix-socket already hands a handler as peer_user (SO_PEERCRED), and what the fabric door already relies on; that row now reads the same extdeps fact. A TCP listener is IngressUnattested;
3. the node's serve config shows the declared route proxying this backend — gunbc.auth.tailnet_serve_readback tailnet_route_standing over a dated tailscale serve status --json reading, at the listener × mount key (tailscale_serve_status_route_proxy_targets), with the backend equal to the declared one, and the declared backend a unix socket. A route declared to a TCP port is never observed, whatever the reading says.

Ingress is judged first. Anything else with a header is AccessPathTailnetUnobserved { gap }, which grants what AccessPathLocalDev grants and names its cause. request_access_path_of keeps its role for the broker and takes the same ingress.

Routes

gunbc.workspace_allocation_routes workspace_route_create / workspace_route_release. Expiry, image digest and public key reference come from workspace_create_terms. A signed-in request on the unobserved path is answered 503 {"availability": "unavailable", "reason", "cause"}, derived from that request's access path. An unauthenticated request gets 401 and no host detail; no header or a direct bind stays 403.

Cause labels: ingress-unattested, ingress-not-the-proxy, route-backend-not-a-socket, route-undeclared, readback-not-demanded, readback-clock-unreadable, readback-not-spawned, readback-command-failed, readback-stale, status-unreadable, route-not-proxied, route-proxies-elsewhere.

Evidence

Floor claims (reading, ingress and declared route supplied to the seam's fold):

Claim	Asserts
seam_forged_header_on_direct_local_ingress_mints_no_tailnet_path	same fresh matching status + same header: unattested listener and an ordinary local account mint nothing and the write is 503; the proxy's connection mints the path
a_forged_header_on_direct_local_ingress_mints_no_tailnet_path	the same control at the fold in test.claim.request_authentication_witness_test
seam_production_instance_declares_a_tcp_route_and_mints_no_tailnet_path	through roadmap_serve_access_path on the real roster instance: unattested as launched; refused even with proxy ingress because its route is a TCP port
seam_fresh_matching_route_mints_the_tailnet_path_and_passes_admission	positive control: proxy ingress + socket-backed route + fresh reading → AccessPathTailnetProxy; create reaches the store
seam_missing_route…, seam_mismatched_route…, seam_header_without_a_readable_reading…, seam_stale_readback…	each 503 with its own cause
seam_each_unvouched_cause_is_its_own_arm, seam_permission_denied_refusal_names_the_command_failure	causes do not collapse; the body carries exit status and client text
seam_malformed_identity_refuses_the_write	no login → 403; malformed session → 401 with no host detail
seam_csrf_and_release_are_held_to_the_same_law, seam_browser_supplied_terms_are_refused, seam_both_allocation_writes_are_mounted	as named

Wet-lane claim seam_admitted_create_and_release_land_in_the_store: the admitted create and release land in a file store with the server's terms; the unvouched variant leaves the ledger empty.

Local gunbc run over a scratch driver: all green on this head. Mutation on this head: accepting any attested peer as the proxy turns seam_forged_header_on_direct_local_ingress… red. Earlier heads: weakening the policy row, dropping the backend comparison, loosening freshness, and folding command-failure into "not proxied" each turned a claim red.

Not established here

• No claim runs a real proxied request. The positive control supplies IngressAttestedPeer { root }, a socket-backed declared route and a status text. No rostered instance declares a socket backend, so the positive path does not run on a real roster row.
• Live step, not modeled and not performed. For writes to be admitted on srv1: the roadmap unit must serve on a protected unix socket through an entry that declares peer_user, and the Serve route must target unix:<socket>. That changes the deployment declarations and the installed Serve mapping, so it is its own change with its own go-ahead. Until then production answers ingress-unattested.
• tailscale serve status --json as the serving principal is unverified on srv1. Its failure direction is a typed 503 readback-command-failed.
• A root process on the host is indistinguishable from the proxy by peer; root is already trusted with the store.
• workspace_demo_image_identity duplicates alloc unit 3: initial commissioning #13191's text and workspace_write_unavailable_wire may duplicate Allocation page: live client over the real workspace contract #13272's; the later lander keeps one of each and builds the route rows from gunbc.roadmap_allocation_location.

🤖 Generated with Claude Code

[briansrls]

HOLD at exact head 7a91e3b2261cced0358ad4a54d64b2da69e43e06.

The route-keyed status projection, exact backend comparison, freshness bound, typed refusal causes, mounted create/release routes, server-owned expiry/image/key reference, and derived 503 response are coherent. Exact-head required CI is green. I found one P1 authority-boundary defect.

tailnet_route_standing proves a node-level configuration fact: Tailscale Serve currently maps the declared listener × mount to this loopback backend. request_access_path_of_standing then combines that global fact with any nonempty Tailscale-User-Login header on a loopback-bound request and constructs AccessPathTailnetProxy. Nothing consumed there proves that this particular connection traversed Tailscale Serve.

That matters because the production backend is a normal 127.0.0.1:8080 TCP listener. A co-located process can connect directly and supply the same header. The repo's existing extdeps.tailscale.identity authority states exactly this: the header is trustworthy only when the proxy is the sole route to the backend; loopback merely restricts spoofing to other services on the host. The generic ServeHttpRequest also carries no peer/socket provenance that could distinguish the direct request from the proxied one.

Consequently, while the Serve config is healthy, these two requests are identical to the constructor:

1. an actual Serve-proxied request carrying the injected login header;
2. a direct loopback request carrying a caller-authored login header.

Both receive AccessPathTailnetProxy. With otherwise valid Google session, CSRF and enrollment evidence, the second request passes the conjunct whose declared meaning is tailnet_path_required: true. This is not an anonymous remote bypass—the other authorization axes remain—but the transport/path proof is forged, so the model reports a fact it did not observe.

The seam and wet controls do not discriminate this defect. Their positive case supplies a synthetic header plus a synthetic matching status document; no value says whether the tested request came through Serve. The wet claim therefore proves the admitted write reaches durable storage, but not that the admitted request used the tailnet ingress.

Required repair: retain Serve status as configuration evidence, but require a per-request or structurally exclusive ingress proof before constructing AccessPathTailnetProxy. A protected Unix-socket backend whose custody makes tailscaled/Serve the sole caller, with modeled installation/readback, is one suitable boundary; another genuinely channel-bound proxy proof would also work. A normal loopback TCP listener plus status is insufficient. Add a discriminating red in which a direct local request has a fresh matching status and a forged nonempty Tailscale header but cannot mint the tailnet path, alongside the real proxied positive control. If the current socket seam cannot express that distinction, this route must remain AccessPathTailnetUnobserved until it can.

The stated unverified service-user execution of tailscale serve status --json is separate. Its current failure direction is appropriately fail-closed as a typed 503, but it still needs wet verification before enabling the live allocation writes.

No host or deployment mutation was performed in this review.

[gunbai-bot]

Re review 5406776483 (P1, serve status is config evidence, not ingress evidence): repaired at f9254e6.

AccessPathTailnetProxy now requires a per-connection fact in addition to the status: RequestIngress must be IngressAttestedPeer whose kernel-attested peer is the tailscale proxy (extdeps.tailscale.serve tailscale_serve_unix_proxy_peer, the SO_PEERCRED value gunbc serve --unix-socket already hands a handler). Ingress is judged before the status. A declared route whose backend is a TCP port is never observed.

Controls: seam_forged_header_on_direct_local_ingress_mints_no_tailnet_path and the fold-level twin hold status, route and header fixed and vary only the ingress — unattested and ordinary-account ingress mint nothing, proxy ingress mints the path. seam_production_instance_declares_a_tcp_route_and_mints_no_tailnet_path runs the real roster instance through the seam.

Consequence, stated plainly: every roadmap entry is on a TCP listener today, so no deployed instance admits a write after this PR; they answer 503 ingress-unattested. The socket entry plus the Serve target change on srv1 is a separate change and is neither modeled nor performed here. The positive control therefore supplies the ingress and a socket-backed route; no claim runs a real proxied connection.

[briansrls]

APPROVE at exact head f9254e62b450ecbd377f7a73696f76be2b1508b3.

Review 5406776483's P1 is addressed. Serve-status is now only node/configuration evidence; AccessPathTailnetProxy additionally requires a per-connection RequestIngress whose kernel-attested Unix-socket peer is the declared Tailscale proxy account. The existing gunbc serve --unix-socket seam derives that value with SO_PEERCRED, refuses a handler that declares peer_user behind TCP, and never takes it from request headers.

The route standing also refuses a declared TCP backend. Every currently rostered roadmap entry supplies IngressUnattested, skips the status subprocess, and answers the mounted writes with the typed 503 ingress-unattested; thus this PR does not silently enable writes before the separate protected-socket/Serve-retarget cutover.

The new controls are discriminating: with header and status fixed, unattested ingress and an ordinary-account Unix peer cannot mint the path, while the proxy peer can; the real current production row remains refused both because its listener is TCP and because its declared Serve backend is TCP. The exact backend comparison, freshness, typed cause surface, server-owned allocation terms, and durable create/release wet control remain intact.

The stated live gaps remain real acceptance gates: no current deployment admits a write, no real proxied request was exercised, and the srv1 serving principal's unelevated tailscale serve status --json read is unverified. Those are not source blockers for this fail-closed seam, but the socket-cutover PR must prove them before live enablement.

Exact-head required CI was still running when this review was submitted, so LAND is conditional on the ordinary exact-head/merge-group checks completing green. No host mutation was performed.

LAND once green.