feat(dioptron): serve the capability contract over a Unix socket

[forkwright]

What changed

crates/dioptron gains the daemon's Unix-socket server. The custody store and the invocation lifecycle attach later through two seams:

• TenantDirectory looks up a tenant's verifying key and bound uids. It must be a short point read.
• Dispatcher takes ConnIdentity, Request, a CancelSignal and a deadline, and returns a Response. It uses a return-position impl Future, since async-trait is banned.

How the server behaves:

• Socket. The socket file is 0600, inside a directory that must be 0700 and owned by the daemon.
  • An exclusive lock on the directory allows one daemon per socket directory, so two daemons can never race to replace each other's socket.
  • A stale socket is replaced only if it belongs to the directory owner and refuses connections. A regular file, a symlink, a foreign-owned socket, or a live listener all refuse startup.
• Connections. A global connection semaphore caps concurrent connections. peer_cred() reads the peer's uid and pid at accept time.
• Framing. The 12-byte header is read under a timeout, and magic, flags, reserved bits, kind and length are all checked before any allocation. The 4 KiB pre-auth cap covers every frame in both directions until Admitted; after that the negotiated max_frame applies. Bodies go through syntheke's validated, canonical decode.
• Handshake (≤5 s total).
  • Version negotiation always picks a version inside the client's offered range. Incompatible still carries a valid max_frame.
  • The server sends a fresh 16-byte nonce.
  • Auth checks Ed25519 verify_strict over the shared transcript, then the peer uid against the tenant's bound uids.
  • Every failure takes the same three steps, and an unknown tenant is verified against a dummy key. They all end in one byte-identical Fault(AuthFailed).
• After admission.
  • An in-flight cap per connection, with duplicate in-flight ids rejected.
  • Cancel reaches the dispatcher.
  • The deadline is clamped to the server's maximum and measured on its monotonic clock. A backstop answers DeadlineExceeded at the deadline plus a grace period.
  • Idle timeout.
  • A panicking dispatcher produces UnknownEffect.
  • Any protocol error sends one Fault(ProtocolError) and then closes the connection.
• Memory. Limits::worst_case_bytes() = connections × (in-flight + 7) × max_frame. The defaults (16 connections, 9 in flight, the contract's 1 MiB frame) come to exactly 256 MiB, and a test checks that bound.
• Shutdown. On a signal it stops accepting, cancels in-flight work, delivers any finished responses, removes the socket, and aborts whatever is left after the grace period.
• Logs. They carry fixed reason strings plus uid, pid, tenant id, request id and capability name, never frame contents.

capability-contract.md states the pre-auth cap rule and the version-choice rule.

Why

S2 requires the Rust contract to be exposed through the accepted local Unix-socket boundary. That includes version negotiation, binding to the peer's identity, bounded frames, and propagation of cancellation and deadlines. Unknown versions, malformed frames and partial connections must fail closed, with no unbounded allocation.

Dependencies

Crate	Why
tokio 1.53 (net, rt, io-util, time, sync, macros, signal)	Async socket server; peer_cred() is safe
ed25519-dalek 3 (zeroize)	Tenant authentication (same RustCrypto generation as phylake)
getrandom 0.4	Server nonces and the dummy-key seed
tracing 0.1	Structured logs without frame contents
tempfile, rustix (process) (dev)	Socket directories; sending a real SIGTERM in the shutdown test

Stage and acceptance

Phase 01 S2, the wire boundary. This PR proves these acceptance clauses: forged peer identity; frame corruption, oversize and incompatible-version rejection; unknown versions, malformed frames and partial connections failing closed with no unbounded allocation.

The independent-client clause is covered by xenos (#83). The process-level tests against the real binary arrive with the lifecycle slice, which wires this server into main.

Proof (toolchain 1.97.1)

• dioptron suite. It covers:
  • The handshake: success, incompatible version, and the chosen version staying inside the offered range.
  • Seven auth failures producing byte-identical faults: wrong key, a signature replayed from an earlier connection, a uid bound to the tenant that isn't the caller's, an unknown tenant, and three frames sent before auth. The dummy-key path is counted.
  • The pre-auth cap on Auth, Admitted and Fault.
  • Every header defect, corrupt and truncated bodies, and oversize lengths refused from the header alone.
  • Partial headers and bodies timing out.
  • The in-flight cap and duplicate ids, cancel propagation, deadline clamping and the backstop, and the idle timeout.
  • A panicking dispatcher, the connection semaphore, the socket mode, the directory lock, and stale-socket handling.
  • Shutdown on a real SIGTERM, and every error variant.
• Workspace: 182 tests pass. The dioptron suite passed 30 stress runs: 10 at a time with 64 threads, while 16 CPU-hog processes loaded 4 cores.
• clippy -D warnings, cargo deny check, cargo tree -d (only the documented syn skip), and the doc checks are clean.
• An independent adversarial review:
  • made auth-failure work equivalent across paths;
  • bounded memory;
  • fixed a real race in stale-socket replacement;
  • removed peer-controlled bytes from the logs.