mirror of https://github.com/garrytan/gstack.git
3126363c2c
On-demand daemon spawns when /ios-qa needs it (single-instance flock + readiness protocol). Owns tailnet ingress: fail-closed tailscaled LocalAPI probe, dual-track /auth/mint (self-service for allowlisted identities, owner-granted via CLI), capability-tier allowlist (observe/interact/mutate/restore), 1h default session TTL (24h hard cap), audit log of every authenticated mutating tailnet request, hashed-identity attempts log. iOS StateServer never directly binds tailnet — identity validation lives Mac-side because iPhones can't reach tailscaled. 67 unit/integration tests covering session-lock concurrency, capability enforcement, fail-closed probe, identity canonicalization, body limits, and boot-token leak proofs. |
||
|---|---|---|
| .. | ||
| allowlist.test.ts | ||
| audit.test.ts | ||
| auth-mint.test.ts | ||
| daemon-integration.test.ts | ||
| proxy-classify.test.ts | ||
| session-tokens.test.ts | ||
| single-instance.test.ts | ||
| tailscale-localapi.test.ts | ||