[vvoland]

host: Require a runtime dir for dependency callbacks

Without a runtime dir, the callback socket ended up as callback.sock in the working directory, and New removed any existing file with that name first. If the runtime dir did not exist and no binary was launched, New failed because only the launcher created it.

Reject dependency providers without a runtime dir, and create the dir with 0o700 before listening, same as the launcher.

internal/launcher: Refuse symlinked extension binaries

Skip anything that is not a regular file with a warning.

internal/launcher: Fail discovery on untrusted extension binaries

Discovery skipped world-writable or foreign-owned dirs and binaries, and non-regular files, with just a warning. Loading is supposed to be all-or-nothing, and a skipped extension just disappears. If nothing depends on it, the daemon starts without it, which for an authz or veto extension means failing open.

Return an error instead, so host.New fails. Directories, non-executable files, and files without a valid extension id are still ignored.

[Copilot]

🟢 Approval recommended

Static review found no unresolved blocking issues in these focused changes; automated tests were not executed.

No open issues 🎉

What changed in this PR

This PR hardens extension startup and service declarations, and fixes dependency callback setup when the runtime directory is missing.

Changes:

• Require a runtime directory for dependency providers and create it before opening the callback socket.
• Fail discovery for untrusted binaries and qualifying non-regular files instead of silently skipping them.
• Restrict process-reported service names to their declared point’s namespace, with updated tests and documentation.

File	Description
internal/​launcher/​launcher_test.go	Expect discovery errors for unsafe permissions and ownership; update service fixtures.
internal/​launcher/​discovery.go	Reject non-regular extension binaries and make trust failures fatal.
internal/​launcher/​discovery_unix_test.go	Test rejection of symlinks and executable FIFOs.
internal/​launcher/​declarations.go	Update the validation comment to describe namespace checks.
internal/​extensiondecl/​declaration.go	Validate service names against their declared point.
internal/​extensiondecl/​declaration_test.go	Test invalid service namespaces and update valid fixtures.
host/​options_test.go	Test that dependency providers require a runtime directory.
host/​host.go	Require and create the dependency callback runtime directory.
docs/​DESIGN.md	Document startup failures for unsafe extension files and directories.
docs/​AUTHORING.md	Clarify that installed extension binaries must not be symlinks.

_{Review effort: Balanced}