fix(minvmd): replace raw-PID gvproxy signalling with pidfd - #555

…sh proof

Restore main's crates/minvmd/src/net.rs: this branch had reverted #555's
pidfd-based gvproxy signalling (a stale-base content-revert unrelated to
the WireGuard mesh task), re-introducing the PID-recycle bug. WireGuard
lives in minimald; minvmd net.rs is out of scope here.

Wire the UC7 two-namespace mesh proof into ci-netns.yml: it was covered
by no gate (mesh_uc7.rs is networking-wg-gated, the netns name filter did
not match remote_ptask_packet_crosses_the_mesh_tunnel, and the test read
MINIMAL_NETNS_TESTS while the lane sets MINIMALD_NETNS_TEST). Add a
dedicated --features networking-wg --test mesh_uc7 step and fix the env
var name in the test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0143kv2BRrRqGxmVwwHskQtS

…sh proof

Restore main's crates/minvmd/src/net.rs: this branch had reverted #555's
pidfd-based gvproxy signalling (a stale-base content-revert unrelated to
the WireGuard mesh task), re-introducing the PID-recycle bug. WireGuard
lives in minimald; minvmd net.rs is out of scope here.

Wire the UC7 two-namespace mesh proof into ci-netns.yml: it was covered
by no gate (mesh_uc7.rs is networking-wg-gated, the netns name filter did
not match remote_ptask_packet_crosses_the_mesh_tunnel, and the test read
MINIMAL_NETNS_TESTS while the lane sets MINIMALD_NETNS_TEST). Add a
dedicated --features networking-wg --test mesh_uc7 step and fix the env
var name in the test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0143kv2BRrRqGxmVwwHskQtS

… advertisement, and minimal mesh CLI (#561)

* feat(minimald,minimal2): boringtun WireGuard mesh peer and mesh CLI

* ci: gate the networking-wg WireGuard mesh proofs

The WireGuard mesh peer is behind the non-default networking-wg feature,
so the workspace test job never compiled or ran its proof artifacts
(two_meshes_handshake_and_relay_a_packet, rpc get_mesh_status). Add an
explicit step so the mesh proofs run in CI (sdd-validate Gate 1).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0143kv2BRrRqGxmVwwHskQtS

* fix(minimald): restore pidfd net.rs revert + wire up the UC7 netns mesh proof

Restore main's crates/minvmd/src/net.rs: this branch had reverted #555's
pidfd-based gvproxy signalling (a stale-base content-revert unrelated to
the WireGuard mesh task), re-introducing the PID-recycle bug. WireGuard
lives in minimald; minvmd net.rs is out of scope here.

Wire the UC7 two-namespace mesh proof into ci-netns.yml: it was covered
by no gate (mesh_uc7.rs is networking-wg-gated, the netns name filter did
not match remote_ptask_packet_crosses_the_mesh_tunnel, and the test read
MINIMAL_NETNS_TESTS while the lane sets MINIMALD_NETNS_TEST). Add a
dedicated --features networking-wg --test mesh_uc7 step and fix the env
var name in the test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0143kv2BRrRqGxmVwwHskQtS

* ci(netns): run the UC7 mesh proof binary as root

mesh_uc7 binds sockets inside the namespaces via in-process setns, so the
test binary itself needs root (the sudo-per-command model the UC6 netns
tests use does not cover an in-process setns). Build unprivileged, then
run the test binary under the netns runner's passwordless sudo, fixing the
'mkdir /run/netns: Permission denied' / 'ip netns add' failures.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0143kv2BRrRqGxmVwwHskQtS

* fix(minimald,minimal2): address mesh review threads

- mesh join: validate host:port at entry before persisting the enrolment
  so a typo never lands a bad address on disk (CR/bot R4.3 input check).
- wg route_inbound: probe every candidate peer (exact-endpoint match
  first, then each endpoint-less peer) until one authenticates, instead
  of stopping at the first endpoint-less peer — handles roaming source
  addresses and multiple endpoint-less peers. Still exactly one
  decapsulate for the owning peer.
- wg mesh_status: treat a finished pump as unconfigured (MeshHandle::
  is_alive) so GetMeshStatus never serves frozen, stale peer state after
  the pump exits on a socket error.
- wg loopback test: pre-bind ephemeral sockets via start_with_socket
  instead of hard-coding 51820/51821, removing CI port-collision flakes.
- mesh_uc7: RAII Drop guard tears down namespaces on every exit path
  (success, panic, timeout); fix stale env-var name in the doc comment.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(minvmd): always SIGKILL gvproxy on stop() timeout

When a PtaskAttachment drop already claimed teardown (SIGTERM sent) and
gvproxy ignores SIGTERM, stop() would hit its grace timeout but skip
SIGKILL under the `!already_claimed` guard, then block forever on
`supervisor.await` and hang daemon shutdown. Escalate to SIGKILL on
timeout unconditionally; on Linux the fd-based signal targets the exact
process instance (ESRCH after exit is benign), so it never lands on a
recycled PID.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(minimal2): reject port 0 in mesh-join enrolment address

port.parse::<u16>() accepts 0, but a WireGuard endpoint on port zero is
unusable; was still written as a successful enrolment. Require non-zero.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0143kv2BRrRqGxmVwwHskQtS

---------

Co-authored-by: gominimal-aw-bot[bot] <281738952+gominimal-aw-bot[bot]@users.noreply.github.com>
Co-authored-by: Norrie Taylor <norrie@minimal.dev>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>