feat(security): harden gateway boundaries and usage policies

Consolidate subscription usage policy enforcement, privacy-safe persistence, and gateway security hardening into one reviewable change.

Includes bounded HTTP and execution envelopes, header and protocol guards, DNS and relay validation, authentication and secret projection hardening, secure backup/install paths, and regression coverage.

crates/aether-runtime/base/src/admission.rs

@@ -2,6 +2,7 @@ use async_stream::stream;
 use axum::body::Body;
 use axum::http::Response;
 use futures_util::StreamExt;
+use std::sync::Arc;
 use std::time::Duration;
 
 use crate::concurrency::ConcurrencyPermit;
@@ -10,24 +11,31 @@ const ADMISSION_HEALTH_POLL_INTERVAL: Duration = Duration::from_secs(1);
 
 pub trait AdmissionPermitHealth: Send + Sync {
     fn is_healthy(&self) -> bool;
+
+    fn requires_health_poll(&self) -> bool {
+        true
+    }
 }
 
 impl AdmissionPermitHealth for ConcurrencyPermit {
     fn is_healthy(&self) -> bool {
         true
     }
+
+    fn requires_health_poll(&self) -> bool {
+        false
+    }
 }
 
+#[derive(Clone)]
 pub struct AdmissionPermit {
-    _local: Option<ConcurrencyPermit>,
-    _distributed: Option<Box<dyn AdmissionPermitHealth>>,
+    _permits: Vec<Arc<dyn AdmissionPermitHealth>>,
 }
 
 impl std::fmt::Debug for AdmissionPermit {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.debug_struct("AdmissionPermit")
-            .field("has_local", &self._local.is_some())
-            .field("has_distributed", &self._distributed.is_some())
+            .field("permit_count", &self._permits.len())
             .finish()
     }
 }
@@ -37,34 +45,39 @@ impl AdmissionPermit {
         local: Option<ConcurrencyPermit>,
         distributed: Option<D>,
     ) -> Option<Self> {
-        if local.is_none() && distributed.is_none() {
-            None
-        } else {
-            Some(Self {
-                _local: local,
-                _distributed: distributed
-                    .map(|permit| Box::new(permit) as Box<dyn AdmissionPermitHealth>),
-            })
+        let mut permits = Vec::<Arc<dyn AdmissionPermitHealth>>::new();
+        if let Some(local) = local {
+            permits.push(Arc::new(local));
         }
+        if let Some(distributed) = distributed {
+            permits.push(Arc::new(distributed));
+        }
+        (!permits.is_empty()).then_some(Self { _permits: permits })
+    }
+
+    pub fn combine(permits: impl IntoIterator<Item = AdmissionPermit>) -> Option<Self> {
+        let permits = permits
+            .into_iter()
+            .flat_map(|permit| permit._permits)
+            .collect::<Vec<_>>();
+        (!permits.is_empty()).then_some(Self { _permits: permits })
     }
 
     pub fn is_healthy(&self) -> bool {
-        self._distributed
-            .as_ref()
-            .map(|permit| permit.is_healthy())
-            .unwrap_or(true)
+        self._permits.iter().all(|permit| permit.is_healthy())
     }
 
     fn requires_health_poll(&self) -> bool {
-        self._distributed.is_some()
+        self._permits
+            .iter()
+            .any(|permit| permit.requires_health_poll())
     }
 }
 
 impl From<ConcurrencyPermit> for AdmissionPermit {
     fn from(value: ConcurrencyPermit) -> Self {
         Self {
-            _local: Some(value),
-            _distributed: None,
+            _permits: vec![Arc::new(value)],
         }
     }
 }
@@ -210,6 +223,27 @@ mod tests {
         assert_eq!(gate.snapshot().in_flight, 0);
     }
 
+    #[test]
+    fn cloned_permit_releases_capacity_only_after_last_clone_drops() {
+        let gate = ConcurrencyGate::new("test", 1);
+        let permit = AdmissionPermit::from(gate.try_acquire().expect("first permit"));
+        let cloned = permit.clone();
+
+        drop(permit);
+        assert_eq!(gate.snapshot().in_flight, 1);
+        assert!(
+            gate.try_acquire().is_err(),
+            "capacity should remain held by the clone"
+        );
+
+        drop(cloned);
+        assert_eq!(gate.snapshot().in_flight, 0);
+        assert!(
+            gate.try_acquire().is_ok(),
+            "last clone should release capacity"
+        );
+    }
+
     #[tokio::test]
     async fn holds_combined_local_and_distributed_permit_until_future_finishes() {
         let local_gate = ConcurrencyGate::new("local", 1);

crates/aether-runtime/base/src/tracing.rs

@@ -716,10 +716,68 @@ impl RollingFileSink {
 }
 
 fn open_bucketed_log_file(dir: &Path, service_name: &str, bucket: &str) -> io::Result<File> {
-    OpenOptions::new()
-        .create(true)
-        .append(true)
-        .open(bucketed_log_path(dir, service_name, bucket))
+    let path = bucketed_log_path(dir, service_name, bucket);
+    let mut options = OpenOptions::new();
+    options.create(true).append(true);
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::OpenOptionsExt as _;
+        options
+            .mode(0o600)
+            .custom_flags(libc::O_CLOEXEC | libc::O_NOFOLLOW);
+    }
+
+    let file = options.open(&path)?;
+    validate_open_log_file(&file, &path)?;
+    Ok(file)
+}
+
+#[cfg(unix)]
+fn validate_open_log_file(file: &File, path: &Path) -> io::Result<()> {
+    use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
+
+    let metadata = file.metadata()?;
+    if !metadata.file_type().is_file() {
+        return Err(io::Error::new(
+            io::ErrorKind::PermissionDenied,
+            format!("log destination is not a regular file: {}", path.display()),
+        ));
+    }
+    if metadata.uid() != unsafe { libc::geteuid() } {
+        return Err(io::Error::new(
+            io::ErrorKind::PermissionDenied,
+            format!(
+                "log destination is owned by another user: {}",
+                path.display()
+            ),
+        ));
+    }
+    if metadata.nlink() != 1 {
+        return Err(io::Error::new(
+            io::ErrorKind::PermissionDenied,
+            format!(
+                "log destination has multiple hard links: {}",
+                path.display()
+            ),
+        ));
+    }
+    // `mode(0o600)` only affects newly-created files. Tighten an existing
+    // bucket as well so a historical permissive umask cannot keep exposing
+    // request and operational data after an upgrade.
+    file.set_permissions(fs::Permissions::from_mode(0o600))?;
+    Ok(())
+}
+
+#[cfg(not(unix))]
+fn validate_open_log_file(file: &File, path: &Path) -> io::Result<()> {
+    let metadata = file.metadata()?;
+    if !metadata.file_type().is_file() {
+        return Err(io::Error::new(
+            io::ErrorKind::PermissionDenied,
+            format!("log destination is not a regular file: {}", path.display()),
+        ));
+    }
+    Ok(())
 }
 
 fn bucketed_log_path(dir: &Path, service_name: &str, bucket: &str) -> PathBuf {
@@ -838,9 +896,9 @@ fn select_log_files_for_cleanup(
 mod tests {
     use super::{
         bucketed_log_path, cleanup_log_files, format_target_cell, log_bucket_key,
-        select_log_files_for_cleanup, FileLoggingConfig, JsonRuntimeEventFormatter,
-        LogFileCandidate, LogRotation, PrettyRuntimeEventFormatter, RollingFileSink,
-        RuntimeLogIdentity,
+        open_bucketed_log_file, select_log_files_for_cleanup, FileLoggingConfig,
+        JsonRuntimeEventFormatter, LogFileCandidate, LogRotation, PrettyRuntimeEventFormatter,
+        RollingFileSink, RuntimeLogIdentity,
     };
     use chrono::{Local, TimeZone};
     use std::fs;
@@ -962,6 +1020,43 @@ mod tests {
         fs::remove_dir_all(&dir).expect("temp dir should be removable");
     }
 
+    #[cfg(unix)]
+    #[test]
+    fn rolling_log_file_is_private_and_rejects_symlink_destination() {
+        use std::os::unix::fs::{symlink, PermissionsExt as _};
+
+        let dir = std::env::temp_dir().join(format!("aether-runtime-logs-{}", Uuid::new_v4()));
+        fs::create_dir_all(&dir).expect("temp dir should exist");
+
+        let private = open_bucketed_log_file(&dir, "runtime-test", "private")
+            .expect("private log should open");
+        assert_eq!(
+            private
+                .metadata()
+                .expect("log metadata")
+                .permissions()
+                .mode()
+                & 0o777,
+            0o600
+        );
+        drop(private);
+
+        let victim = dir.join("victim.txt");
+        fs::write(&victim, b"unchanged").expect("victim should exist");
+        let symlink_path = bucketed_log_path(&dir, "runtime-test", "symlink");
+        symlink(&victim, &symlink_path).expect("symlink should exist");
+        assert!(
+            open_bucketed_log_file(&dir, "runtime-test", "symlink").is_err(),
+            "rolling logs must not follow a pre-created symlink"
+        );
+        assert_eq!(
+            fs::read(&victim).expect("victim should remain readable"),
+            b"unchanged"
+        );
+
+        fs::remove_dir_all(&dir).expect("temp dir should be removable");
+    }
+
     #[test]
     fn rolling_file_sink_treats_startup_cleanup_failure_as_non_fatal() {
         fn fail_cleanup(_: &str, _: &FileLoggingConfig) -> std::io::Result<usize> {