feat(daemon): remote transport with mTLS caller authentication - #34

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Nothing in the block defaults, and allowed_client_cns is mandatory: with
certificate verification alone the CA would be the entire access control
list. The socket becomes optional only when listen replaces it.

Fixes map-literal alignment in TestIsWildcardHost.

Both gates run in the handshake, so a caller failing either never reaches
the router. The common-name allowlist is the gate that keeps a CA
mis-issuance survivable, and it is asserted by a test using a certificate
that verifies perfectly against the configured CA.

Review found two Minors on the TLS listener. VerifyPeerCertificate
indexed chains[0][0] without checking chains was non-empty; that only
holds under RequireAndVerifyClientCert, and net/http's conn.serve
recovers panics silently, so a future downgrade to RequireAnyClientCert
would weaken the boundary with tests staying green. Added an explicit
guard that fails as a readable rejection instead.

testpki.ServerTLS builds a one-gate server config with no common-name
allowlist, for a later task's plain-TLS transport tests. Documented
that it is not a substitute for ListenTLS, so nothing mistakes it for
covering allowlist behaviour.

Nothing consumes it yet. A transport that discards who called has to be
reopened to add per-caller quotas, so the identity is recorded where it is
still available. Remote requests also get an audit log line; the unix path
is unchanged.

Both feed one http.Server with one handler, so no route table can drift
between transports. A wildcard bind is warned about at boot, since the
difference between deliberate and careless is invisible in the config.

A failed ListenTLS left the socket listener open with nothing to close it,
so its fd outlived the process without the unlink-on-close that Close()
would have triggered -- a down daemon then answered ECONNREFUSED instead
of ENOENT. Also fixes serve's doc comment, stale since the signature went
variadic.

Every body in the hostile-field table now runs over a real authenticated
TLS connection as well as against the handler directly, and an accepted
remote request is asserted to land on exactly the profile's policy.

…setup

Review fixes: transport.post now returns the response body alongside the
status so a failing policy assertion still prints what the daemon said,
fix a stale doc comment referencing a nonexistent postSandboxes name,
extract newTLSPoster to share PKI/listener/server/client setup between
the tls transport and TestRemoteAcceptedRequestGetsExactlyTheProfilePolicy,
and drain the accepted-request response body for consistency with the
transport path.

The credential takes file paths rather than a *tls.Config, so an
unverified client is inexpressible rather than refused at runtime. New
keeps its exact signature; both constructors now share one dial seam.

DialPort now goes through the same dial seam as the pooled client, so the
two cannot diverge. CloseWrite is reached by type assertion and a
transport change breaks it silently, so *tls.Conn's is pinned by test.

…wire target into dial/request errors

The TLS CloseWrite test's io.ReadAll could hang instead of fail on a
CloseWrite regression that silently no-ops; run it in a goroutine and
select against a timeout, matching TestDialPortCloseWriteSignalsEndOfInput.

Also wire Client.target into the two error paths that name no address
today (dial failure, pooled request failure), so its "for error messages"
doc comment is honest.

Says plainly that a compromised caller is a valid caller and that the
profile, not the credential, is what bounds it; that a private network is
not a sole control; and that revocation is a restart.

Says which file goes in cert_file/key_file/client_ca_file/allowed_client_cns,
and calls out client.crt/client.key as the one pair that leaves the
daemon's host, per review feedback on the remote threat model section.

Go skips VerifyPeerCertificate entirely on a resumed TLS session (peer
certs are restored from cached session state, and the callback that
carried the CN allowlist never runs), so a caller could keep connecting
after its CN was removed from allowed_client_cns for as long as its
session ticket stayed valid. Move the check into VerifyConnection,
which Go calls on both fresh and resumed connections, and extract it
into checkAllowedClientCN so there's one copy of the security check
used by both paths.

Also fixes the golangci-lint findings that surfaced this: config.go's
non-wrapping %s verb (now %w), and two bodyclose false positives in
policy_test.go where the linter can't trace the response through
newTLSPoster's returned closure (bodies are closed via the deferred
Close two lines below each flagged call) — suppressed with a written
justification matching pkg/brokerclient/dial.go's existing pattern.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The earlier fix moved the allowlist check to VerifyConnection but
nothing asserted ListenTLS actually wires it there instead of back
onto VerifyPeerCertificate — the existing resumption tests pass
identically under either callback, since they only observe accept/
reject outcomes, not which callback ran.

Extract tlsConfigFor(cfg) from ListenTLS so a test can inspect the
built tls.Config directly, and add
TestTLSConfigWiresAllowlistIntoVerifyConnection asserting
VerifyConnection != nil && VerifyPeerCertificate == nil. Confirmed by
reverting to the vulnerable form in a scratch copy: only this new test
goes red, everything else (including the two resumption tests) stays
green.

Also replace the revocation test's bare map + delete() with a
mutex-guarded syncAllowlist — the map was read from the server's
VerifyConnection goroutine and written from the test goroutine with no
synchronization; -race didn't catch it in practice but it was a real
race by the memory model.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Blocking:
- plans: replace the internal-service-name/deployment-name grep pattern in
  the pre-PR leak-audit step with a neutral IP-shaped pattern plus a manual
  scan instruction, and strip the absolute developer path from the same file
- pkg/brokerclient: fix the package doc and Client doc to say the client
  reaches openbloxd over a Unix socket or a mutual-TLS network connection
- specs: correct the design doc's callback name from VerifyPeerCertificate to
  VerifyConnection and explain why (VerifyPeerCertificate is skipped on
  TLS 1.3 PSK resumption)
- CHANGELOG: add the Unreleased entries for the listen block, NewRemote/
  TLSFiles, and caller identity; stop describing brokerclient as socket-only

Also fixed:
- assert MinVersion == tls.VersionTLS13 in
  TestTLSConfigWiresAllowlistIntoVerifyConnection
- drop the dangling "fix report" reference in listener_tls_test.go
- correct newPKI's ServerName comment: the test certificate's IPAddresses SAN
  already covers 127.0.0.1, so ServerName is set to exercise the documented
  override, not because verification would otherwise fail
- main.go: log socket="off" (was socket="") for consistency with network="off"
- rename serveOnce to serveHTTP (it serves until t.Cleanup, not once)
- TestRemoteAcceptedRequestGetsExactlyTheProfilePolicy now also compares
  Lifetime, DefaultTimeout and MaxTimeout
- config_test.go: add the "listen without tls" refusal case to the existing
  incomplete-listen-block table

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>