internal/ipc is unix-socket only, so no module can live off-box #92

2026-08-02T14:51:28+02:00

claude commented

2026-08-02 14:51:28 +02:00

Closes Vikunja #483.

Acceptance criteria and quality gate are in TASK.md on this branch.
Review the review, not the diff — leave comments and the agent will apply them via task start 483.

Closes Vikunja #483. Acceptance criteria and quality gate are in `TASK.md` on this branch. Review the review, not the diff — leave comments and the agent will apply them via `task start 483`.

claude changed target branch from task/459-docs-refresh-the-qa-plan-against-the-liv to master

2026-08-02 14:52:55 +02:00

kami added 4 commits 2026-08-02 15:08:08 +02:00

ipc: a seam address that can name a transport (V-484) 1a704d704d

internal/netaddr parses a daemon seam address and dials or binds it. A
scheme-less address is unix and behaves exactly as it does today: same
0700 parent dir, same 0600 socket, same bytes on the wire. tcp://host:port
is the new option, and it is what lets a module live on another host.

Over tcp the filesystem permission that authenticated the unix socket is
gone, and what crosses this seam is audio of the owner speaking. So a tcp
listener requires a shared token, checked in constant time before the
first protocol frame is read, and a peer that fails is dropped without
taking the listener down with it.

ipc: pin that a scheme-less address still dials unix (V-484) 3e534340bf

Six cases. The load-bearing one is the first: every deploy in the tree
writes a bare path, and it must keep meaning a unix socket with no
handshake in front of the payload.

The rest cover the tcp seam: a good token round-trips, a wrong one comes
back ErrUnauthorized, a stranger that speaks HTTP at the port is dropped
while the listener stays up for the next peer, and a tokenless tcp bind
fails rather than serving his turns to anyone who connects.

ipc, worker: dial and bind through netaddr (V-484) c0de473382

Five hardcoded transports, three in internal/ipc and two in
internal/worker, all now go through the seam address. The unix perms
logic moved into netaddr, so the two copies of parentDir and the umask
dance are gone.

peerCaller already returned ok=false for a non-unix conn, so the
SO_PEERCRED path degrades correctly on tcp with no change.

gitignore the root .env, it holds a live token (V-484) a3af10a830

It was untracked but not ignored, so one git add -A would have committed
MAVEN_AMBIENT_TOKEN. Same class as deploy/telegram.env, which is already
ignored.

kami force-pushed task/483-design-offload-ml-to-the-workstation-kee from 87bc30204c to a3af10a830

2026-08-02 15:08:08 +02:00

Compare

kami merged commit 1c786b7156 into master

2026-08-02 15:08:17 +02:00

claude changed title from ~~Docs: refresh the QA plan against the live task list~~ to internal/ipc is unix-socket only, so no module can live off-box

2026-08-02 15:10:18 +02:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: kami/Maven#92