feat(tls): TLS-root owner gate + leaf-rotation hardening + self-heal timeout

[MichaelTaylor3d]

Summary

Batches four cohesive follow-ups from the #624 (v0.33.0 HTTPS/TLS) and #42 (v0.34.0 CORS/self-heal) arcs, all in crates/dig-node-service (tls.rs + self_heal.rs + a new shared security.rs + SPEC).

Closes #661
Closes #660
Closes #659
Closes #693

Fixes + tests

• #661 — TLS-root owner gate (feat, defence-in-depth). Before load_https_material reads the leaf (and, on the rotation path, ca.key), it verifies the TLS root dir is owned by a privileged principal (Windows: well-known SYSTEM S-1-5-18 / Administrators S-1-5-32-544 SID by exact equality; unix: root + not group/world-writable) and fails closed to plaintext otherwise. A user-writable root could hold an attacker-swapped ca.key this privileged service would sign with.
  • DRY (§2.5): extracted PR feat(serve): desktop-app CORS + self-heal beacon re-arm and forcelist reconcile #42's spawn-free Win32 owner-SID reader (read_owner_sid_string / windows_owner_is_privileged / owner_sid_is_privileged via GetNamedSecurityInfoW + ConvertSidToStringSidW) from self_heal.rs into a new shared crates/dig-node-service/src/security.rs (dir_is_privileged), reused by BOTH the self-heal LPE spawn gate (#565) and this new TLS-root gate. The Win32 tests moved with it.
  • Test: tls::tests::load_refuses_when_the_tls_root_is_not_privileged_owned (a provisioned-but-user-owned tempdir → None).
• #660 — missed-tick Delay. spawn_leaf_rotation's daily interval now uses MissedTickBehavior::Delay (via new_renewal_ticker), so a host sleep/suspend across intervals coalesces into ONE catch-up pass instead of a redundant burst.
  • Test: tls::tests::renewal_ticker_uses_delay_missed_tick_behavior (paused-clock; counts exactly 1 immediate catch-up tick after a 3-interval stall vs Burst's 3).
• #659 — rotation-loop coverage. Factored the pass body into run_rotation_pass(manager, now) (behaviour-preserving) so the rotation action is testable without a day's wait.
  • Tests: rotation_pass_leaves_a_fresh_leaf_untouched and rotation_pass_reissues_a_leaf_inside_its_renewal_window (clock +61d past the 90d−30d window → leaf re-issued on disk).
• #693 — self-heal non-gating hardening.
  • (a) Bounded per-child timeout (CHILD_TIMEOUT = 120s) via with_child_timeout, applied to both the kick spawns and the channel get read, so a hung dig-updater/dig-installer child can never stall future 6h passes. Test: self_heal::tests::kick_times_out_a_hung_child_so_the_pass_never_blocks (paused-clock hung child → SpawnFailed).
  • (b) Documented the Tauri app-origin wallet-read CORS exposure in SPEC §4.3 (same-machine trust; custody + signing stay token-gated; /ws never reflects desktop-app origins). A route/method-scoped CORS gate is not currently cheap (one router-wide CorsLayer; POST / multiplexes content + wallet reads by method), so it is documented rather than enforced, with the future split noted.

Version

minor: 0.34.0 → 0.35.0 — the #661 owner gate is a new backwards-compatible capability (feat); the rest are hardening + tests. Root [workspace.package].version bumped (the released dig-node binary tracks it).

Verification

• cargo test -p dig-node-service --lib → 189 passed; 0 failed (incl. the 5 new tests).
• cargo fmt --all -- --check clean; cargo clippy -p dig-node-service --all-targets --all-features -- -D warnings clean.
• Added tokio test-util dev-dependency for the paused-clock tests.

gitnexus blast radius

• spawn_leaf_rotation / load_https_material — sole caller server::bring_up_local_https; signatures unchanged. Owner gate returns None (fail-soft), same type the caller already handles.
• dir_is_privileged extraction — call sites: self_heal::resolve_privileged_sibling_in (unchanged behaviour) + new tls::load_https_material. Win32 FFI unchanged (byte-moved).
• spawn_process — now wrapped by with_child_timeout at both call sites; return type unchanged.

Do NOT merge — orchestrator re-gates (#661 + #693 security-adjacent → adversarial + loop-security) then squash-merges + releases (nightlies manual stable dispatch) + bumps the pointer.

🤖 Generated with Claude Code