fix(daemon,brokerclient): final review fix wave for remote transport

Blocking:
- plans: replace the internal-service-name/deployment-name grep pattern in
  the pre-PR leak-audit step with a neutral IP-shaped pattern plus a manual
  scan instruction, and strip the absolute developer path from the same file
- pkg/brokerclient: fix the package doc and Client doc to say the client
  reaches openbloxd over a Unix socket or a mutual-TLS network connection
- specs: correct the design doc's callback name from VerifyPeerCertificate to
  VerifyConnection and explain why (VerifyPeerCertificate is skipped on
  TLS 1.3 PSK resumption)
- CHANGELOG: add the Unreleased entries for the listen block, NewRemote/
  TLSFiles, and caller identity; stop describing brokerclient as socket-only

Also fixed:
- assert MinVersion == tls.VersionTLS13 in
  TestTLSConfigWiresAllowlistIntoVerifyConnection
- drop the dangling "fix report" reference in listener_tls_test.go
- correct newPKI's ServerName comment: the test certificate's IPAddresses SAN
  already covers 127.0.0.1, so ServerName is set to exercise the documented
  override, not because verification would otherwise fail
- main.go: log socket="off" (was socket="") for consistency with network="off"
- rename serveOnce to serveHTTP (it serves until t.Cleanup, not once)
- TestRemoteAcceptedRequestGetsExactlyTheProfilePolicy now also compares
  Lifetime, DefaultTimeout and MaxTimeout
- config_test.go: add the "listen without tls" refusal case to the existing
  incomplete-listen-block table

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Lutherwaves

CHANGELOG.md

@@ -29,13 +29,22 @@ Releases are cut automatically from [Conventional Commits](https://www.conventio
   need `/var/run/docker.sock`, with per-profile isolation policy resolved
   server-side from configuration alone.
 - `pkg/brokerclient`: a drop-in `sandbox.Backend` that talks to `openbloxd`
-  over its Unix socket, satisfying the same contract the Docker backend does.
+  over a Unix socket, satisfying the same contract the Docker backend does.
 - `openbloxd`: `max_sandboxes` per profile, bounding how many sandboxes exist
   at once — the one resource dimension a profile did not otherwise cover.
   Exceeding it returns `429` with the new `at_capacity` error kind
   (`brokerapi.ErrAtCapacity`), distinct from a malformed request because the
   request is valid and may succeed once the reaper frees a slot. Unset means
   unlimited, so existing deployments are unchanged.
+- `openbloxd`: an optional `listen` block for a mutual-TLS network listener,
+  alongside (or instead of) the Unix socket — `socket` is now optional once
+  `listen` is set. Every caller presents a client certificate; only Common
+  Names on the configured allowlist are accepted, so a shared or mis-issued
+  CA cannot silently grant access. The caller's verified CN is recorded on
+  every request the daemon handles.
+- `pkg/brokerclient`: `NewRemote` and `TLSFiles`, so a caller can reach
+  `openbloxd` over the network with the same `sandbox.Backend` contract the
+  Unix-socket client satisfies.
 
 ### Changed
 

cmd/openbloxd/main.go

@@ -130,12 +130,16 @@ func run(configPath string) error {
 	// connection, even though that peer is local.
 	httpSrv := &http.Server{Handler: daemon.WithCaller(srv.Handler()), ReadHeaderTimeout: 10 * time.Second}
 
+	socket := "off"
+	if cfg.Socket != "" {
+		socket = cfg.Socket
+	}
 	network := "off"
 	if cfg.Listen != nil {
 		network = cfg.Listen.Address
 	}
 	slog.Info("openbloxd listening",
-		slog.String("socket", cfg.Socket),
+		slog.String("socket", socket),
 		slog.String("network", network),
 		slog.Int("profiles", len(cfg.Profiles)))
 	return serve(ctx, httpSrv, lns...)

internal/daemon/config_test.go

@@ -285,6 +285,10 @@ listen:
     client_ca_file: /ca
     allowed_client_cns: ["sandbox-caller"]
 `, "address"},
+		"no tls block": {`
+listen:
+  address: "127.0.0.1:9443"
+`, "cert_file"},
 		"address is not host:port": {`
 listen:
   address: "127.0.0.1"

internal/daemon/listener_tls_test.go

@@ -80,9 +80,9 @@ func clientTLS(t *testing.T, p *testpki.PKI, cn string) *tls.Config {
 	return cfg
 }
 
-// serveOnce accepts on ln and answers every request with 200 "ok", so a test
+// serveHTTP accepts on ln and answers every request with 200 "ok", so a test
 // can assert whether a client got through the handshake at all.
-func serveOnce(t *testing.T, ln net.Listener) {
+func serveHTTP(t *testing.T, ln net.Listener) {
 	t.Helper()
 	srv := &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, "ok")
@@ -116,7 +116,7 @@ func TestListenTLSAcceptsAnAllowedCommonName(t *testing.T) {
 		t.Fatalf("ListenTLS: %v", err)
 	}
 	defer func() { _ = ln.Close() }()
-	serveOnce(t, ln)
+	serveHTTP(t, ln)
 
 	got, err := get(t, ln.Addr().String(), clientTLS(t, pki, "sandbox-caller"))
 	if err != nil {
@@ -137,7 +137,7 @@ func TestListenTLSRejectsUnlistedCommonName(t *testing.T) {
 		t.Fatalf("ListenTLS: %v", err)
 	}
 	defer func() { _ = ln.Close() }()
-	serveOnce(t, ln)
+	serveHTTP(t, ln)
 
 	if _, err := get(t, ln.Addr().String(), clientTLS(t, pki, "someone-else")); err == nil {
 		t.Fatal("a certificate with an unlisted common name was accepted")
@@ -152,7 +152,7 @@ func TestListenTLSRejectsForeignCA(t *testing.T) {
 		t.Fatalf("ListenTLS: %v", err)
 	}
 	defer func() { _ = ln.Close() }()
-	serveOnce(t, ln)
+	serveHTTP(t, ln)
 
 	// Right name, wrong CA. Trust our real CA for the server leg so the only
 	// thing under test is the client certificate.
@@ -170,7 +170,7 @@ func TestListenTLSRejectsNoClientCertificate(t *testing.T) {
 		t.Fatalf("ListenTLS: %v", err)
 	}
 	defer func() { _ = ln.Close() }()
-	serveOnce(t, ln)
+	serveHTTP(t, ln)
 
 	cfg := &tls.Config{MinVersion: tls.VersionTLS13, RootCAs: pki.Pool(), ServerName: "openbloxd"}
 	if _, err := get(t, ln.Addr().String(), cfg); err == nil {
@@ -252,8 +252,9 @@ func TestCheckAllowedClientCN(t *testing.T) {
 //
 // Confirmed by reverting to VerifyPeerCertificate in a scratch copy of
 // tlsConfigFor and re-running: this test goes red (VerifyConnection == nil),
-// while every other test in the package still passes. See the fix report
-// for the transcript.
+// while every other test in the package still passes — because
+// VerifyPeerCertificate is simply never invoked on a resumed session, so a
+// resumed connection sailed through with no allowlist check running at all.
 func TestTLSConfigWiresAllowlistIntoVerifyConnection(t *testing.T) {
 	pki := newPKI(t)
 	tlsCfg, err := tlsConfigFor(listenConfigFor(pki, "127.0.0.1:0", "sandbox-caller"))
@@ -266,6 +267,9 @@ func TestTLSConfigWiresAllowlistIntoVerifyConnection(t *testing.T) {
 	if tlsCfg.VerifyPeerCertificate != nil {
 		t.Error("VerifyPeerCertificate is set — Go skips this callback on a resumed session, so the allowlist must not depend on it")
 	}
+	if tlsCfg.MinVersion != tls.VersionTLS13 {
+		t.Errorf("MinVersion = %v, want tls.VersionTLS13", tlsCfg.MinVersion)
+	}
 }
 
 // TestListenTLSResumedConnectionStillReachesTheGate proves the wiring is
@@ -286,7 +290,7 @@ func TestListenTLSResumedConnectionStillReachesTheGate(t *testing.T) {
 		t.Fatalf("ListenTLS: %v", err)
 	}
 	defer func() { _ = ln.Close() }()
-	serveOnce(t, ln)
+	serveHTTP(t, ln)
 
 	clientCfg := clientTLS(t, pki, "sandbox-caller")
 	clientCfg.ClientSessionCache = tls.NewLRUClientSessionCache(4)
@@ -371,7 +375,7 @@ func TestVerifyConnectionRejectsAResumedSessionOnceItsCNIsRevoked(t *testing.T)
 	}
 	tlsLn := tls.NewListener(ln, serverCfg)
 	defer func() { _ = tlsLn.Close() }()
-	serveOnce(t, tlsLn)
+	serveHTTP(t, tlsLn)
 
 	clientCfg := clientTLS(t, pki, "sandbox-caller")
 	clientCfg.ClientSessionCache = tls.NewLRUClientSessionCache(4)

internal/daemon/policy_test.go

@@ -180,7 +180,9 @@ func TestRemoteAcceptedRequestGetsExactlyTheProfilePolicy(t *testing.T) {
 	got := fake.created["a"]
 	want := sandbox.NewSpec(srv.cfg.Profiles["code-exec"].Options()...)
 	if got.Runtime != want.Runtime || got.Egress != want.Egress ||
-		got.User != want.User || got.Resources != want.Resources || got.Image != want.Image {
+		got.User != want.User || got.Resources != want.Resources || got.Image != want.Image ||
+		got.Lifetime != want.Lifetime || got.DefaultTimeout != want.DefaultTimeout ||
+		got.MaxTimeout != want.MaxTimeout {
 		t.Errorf("spec = %+v, want the profile's %+v", got, want)
 	}
 }

pkg/brokerclient/client.go

@@ -22,9 +22,9 @@ import (
 // a well-formed URL to build a request from.
 const baseURL = "http://openbloxd"
 
-// Client reaches openbloxd over its Unix socket. It satisfies sandbox.Backend
-// so it can stand in for a Docker-backed one without the caller changing any
-// other code.
+// Client reaches openbloxd over a Unix socket or a mutual-TLS network
+// connection. It satisfies sandbox.Backend so it can stand in for a
+// Docker-backed one without the caller changing any other code.
 type Client struct {
 	http *http.Client
 

pkg/brokerclient/options.go

@@ -1,4 +1,5 @@
-// Package brokerclient reaches openbloxd over its Unix socket.
+// Package brokerclient reaches openbloxd over a Unix socket or a mutual-TLS
+// network connection.
 //
 // Its Client satisfies sandbox.Backend and its handle satisfies
 // sandbox.Sandbox, so a caller swaps one constructor and stops needing

pkg/brokerclient/remote_test.go

@@ -81,9 +81,11 @@ func newPKI(t *testing.T) (*testpki.PKI, TLSFiles) {
 		CertFile: certFile,
 		KeyFile:  keyFile,
 		CAFile:   p.CAFile,
-		// The daemon's certificate names "openbloxd", but the test dials
-		// 127.0.0.1 — so the name to verify has to be given explicitly. This
-		// is exactly the case ServerName exists for.
+		// Set explicitly, not because it's required here — the test
+		// certificate's IPAddresses SAN covers 127.0.0.1, so an empty
+		// ServerName would verify fine too. This exercises the override
+		// documented on TLSFiles.ServerName, for deployments that dial the
+		// daemon by an address its certificate doesn't name.
 		ServerName: "openbloxd",
 	}
 }

plans/2026-08-18-openbloxd-remote-transport.md

@@ -196,7 +196,7 @@ func TestIsWildcardHost(t *testing.T) {
 
 - [ ] **Step 2: Run the tests to verify they fail**
 
-Run: `cd /home/blox-master/dev/openblox-32-remote-transport && go test ./internal/daemon/ -run 'TestLoadAcceptsListen|TestLoadRejects|TestIsWildcardHost' -v`
+Run: `go test ./internal/daemon/ -run 'TestLoadAcceptsListen|TestLoadRejects|TestIsWildcardHost' -v`
 Expected: FAIL — compile error, `cfg.Listen` undefined and `ListenConfig` undefined.
 
 - [ ] **Step 3: Add the types**
@@ -1849,8 +1849,8 @@ Expected: no diff. This work is stdlib-only.
 
 - [ ] **Step 4: Audit the diff for anything deployment-specific**
 
-Run: `git diff origin/main -- . | grep -inE 'mcpblox|tekom|prod|tailscale|tailnet|[0-9]{1,3}(\.[0-9]{1,3}){3}'`
-Expected: only `127.0.0.1` from the neutral examples. Anything else is a leak of a specific deployment into a public repository and must be replaced with a neutral placeholder.
+Run: `git diff origin/main -- . | grep -inE '[0-9]{1,3}(\.[0-9]{1,3}){3}'`
+Expected: only `127.0.0.1` (and a documented `0.0.0.0` example). Also manually scan the diff against your own organisation's internal service names, deployment names, hostnames, and VPN/overlay-network products — none belong in this public repository. Anything found is a leak of deployment-specific detail and must be replaced with a neutral placeholder.
 
 - [ ] **Step 5: Open the PR**
 

specs/2026-08-18-openbloxd-remote-transport-design.md

@@ -94,10 +94,18 @@ issued. That is the common way an mTLS deployment ends up weaker than the token
 it replaced. The allowlist makes a CA mis-issuance survivable, and it makes the
 set of permitted callers something an operator can read in one place.
 
-Both gates run during the TLS handshake, via `VerifyPeerCertificate`, so a
+Both gates run during the TLS handshake, via `VerifyConnection`, so a
 rejected caller never reaches the request router at all. The daemon logs the
 rejected CN; the client sees a TLS alert.
 
+`VerifyConnection` is used rather than `VerifyPeerCertificate` deliberately:
+Go does not invoke `VerifyPeerCertificate` on a resumed TLS session — the
+peer's certificates come back from cached session state and that callback is
+skipped — so an allowlist check living there would stop being enforced for a
+resumed caller even after its CN was removed from the allowlist.
+`VerifyConnection` runs on every connection, fresh or resumed, so the check
+applies without exception.
+
 ## Configuration
 
 `listen` is a new optional block. Absent, nothing about an existing deployment