chore: sync bug-1508/1868/1869 to Gitea (#287-#289), refresh STATUS.md

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

.wolf/STATUS.md

@@ -7,17 +7,22 @@
 
 ## ✅ Done
 
+- **Worker security fixes** (2026-09-26, pushed, all TDD RED→GREEN, worker suite 12/12, sequential HA soaks PASS on xcecd_virtual):
+  - **bug-1508** (`7723a4f4`): worker `fetchfile` (root) opened any path. Now only `<dir>/job_<jobid>_task<N>.out` for the request's jobid (exact match, `xcecd_is_job_output_path()` in `worker/include/job_output_path.h`), O_NOFOLLOW|O_NONBLOCK, regular single-link file. Also closed the REST route (submit with `out_file=/etc/shadow`, then GET output).
+  - **bug-1868** (`7864a3da`): job output file created as root in /tmp followed planted links. `xcecd_create_job_output()` unlinks + O_EXCL|O_NOFOLLOW.
+  - **bug-1869** (`5df33e69`): `xcecd_worker.log` (was chmod 0666 by path), `/tmp/xcecd_worker.log` append, and the restart flag. `worker/include/xcecd_tmpfile.h`: `xcecd_open_owned_file()` / `xcecd_owned_file_exists()`, fchmod instead of chmod(path).
+  - Live gap: the sandbox only runs `xcecd_virtual`, so the real root worker's output/log creation is covered by unit tests only.
 - **bug-1754** (2026-09-26, `6876e4f6`, pushed): a failed job's exit code is now persisted. A worker reports every nonzero exit as a FAIL (not FINISH), and WAL_JOB_FAIL had no code slot, so `job.exit_info` was NULL for every failed job. WAL_JOB_FAIL now carries an int32 code trailer (`persist_submit_job_fail_fact`); both apply seams adopt it via `apply_job_fail_exit_code()` (non-POST_EXEC stages only). `apply_wal_entry` also no longer assigns wire state 0 for STAGE_FLAG FAIL entries. New `test_wal_job_fail_fact.c`; controller suite 1228/0. Soaks: sequential 6 rounds PASS (SIMVERIFY 7 files, 0 mismatches) + factstream 2 rounds PASS.
 - **HA stability fixes** (2026-09-25, pushed, soak-verified): bug-1864 (per-endpoint FIFO in vtask dispatcher), bug-1865 (primary control endpoint refcounted, no double-close), bug-1850 (NOT_READY retries in place, no failover rotate), bug-1854 (re-pushed resource defs are idempotent).
 - **bug-1714 / bug-1840** marked cannot-reproduce (0 crashes across 2,400-element burst on old + current builds).
-- **Gitea sync** (2026-09-26): issues #264-#286 created (recent bugs + bug-1798..1804, 1714, 1754, 1850, 1854), #74 closed. Only a subset of the buglog is mirrored by design; `scripts/gitea-sync.py` gained `--ids` because bulk triage bumped the date fields `--since` relies on.
+- **Gitea sync** (2026-09-26): issues #264-#289 created (#287-#289 = bug-1508/1868/1869) (recent bugs + bug-1798..1804, 1714, 1754, 1850, 1854, 1508, 1868, 1869), #74 closed. Only a subset of the buglog is mirrored by design; `scripts/gitea-sync.py` gained `--ids` because bulk triage bumped the date fields `--since` relies on.
 - Logged: **bug-1866** (worker `launch_type` leak), **bug-1867** (controller snapshot drops `exit_info` — capnp `Job` has no exit field).
 
 ---
 
 ## 🚀 Next phase
 
-**Goal:** _None active._ Suggested order: bug-1508 (fetchfile path check, security) → bug-1747 FAIL half (add finish_time to the new WAL_JOB_FAIL trailer) → bug-1867 → `xce_test` harness batch + bug-1866 → a tasks-ready spec.
+**Goal:** _None active._ Suggested order: bug-1747 FAIL half (add finish_time to the WAL_JOB_FAIL trailer) → bug-1867 (snapshot exit_info, capnp schema) → `xce_test` harness batch + bug-1866 → a tasks-ready spec.
 
 ### Open items (not yet actioned)
 - _none pending_
@@ -26,14 +31,14 @@
 - _none pending_
 
 ### Open decisions
-- _none pending_
+- **REST job output for jobs with a custom `out_file`/`err_file`**: the worker never writes those paths (always `/tmp/job_<id>_task<N>.out`), so since bug-1508 `GET /jobs/:id/output` for such a job returns a permission error from the worker. Either the apiserver's `resolveOutputPath()` (controllers/output.go) always targets the worker's own output file, or the worker starts honouring `out_file`. Waiting on the user.
 
 ---
 
 ## 📁 Active architecture
 
 - **Stack:** Go API/CLI tier (`src/frontend/apiserver`) fronting C daemons (`src/controller`, `src/worker`, `src/scheduler`); Meson-based build via `src/tools/xce-build.sh`, hermetic nix dev shell.
-- **Current focus area:** `src/controller` persistence — WAL fact payloads and apply seams (`persist.c` `apply_committed_entry` / `apply_wal_entry`, `job.c` `record_job_*_fact`).
+- **Current focus area:** `src/controller` persistence (WAL fact payloads/apply seams in `persist.c`, `job.c`) and worker root-privilege file handling (`src/worker/include/job_output_path.h`, `xcecd_tmpfile.h`).
 
 ---
 

.wolf/buglog.json

@@ -18082,6 +18082,8 @@
     },
     {
       "id": "bug-1508",
+      "gitea_synced_status": "fixed",
+      "gitea_issue": 287,
       "status": "fixed",
       "status_updated": "2026-09-26",
       "status_note": "7723a4f4: worker fetchfile accepts only <dir>/job_<jobid>_task<N>.out for the request's jobid (exact match), O_NOFOLLOW|O_NONBLOCK, regular single-link file. Also closed the REST route (user out_file=/etc/shadow).",
@@ -28111,6 +28113,8 @@
     },
     {
       "id": "bug-1868",
+      "gitea_synced_status": "fixed",
+      "gitea_issue": 288,
       "status": "fixed",
       "status_updated": "2026-09-26",
       "status_note": "7864a3da: xcecd_create_job_output() unlinks then creates with O_EXCL|O_NOFOLLOW|O_CLOEXEC.",
@@ -28134,6 +28138,8 @@
     },
     {
       "id": "bug-1869",
+      "gitea_synced_status": "fixed",
+      "gitea_issue": 289,
       "status": "fixed",
       "status_updated": "2026-09-26",
       "status_note": "5df33e69: xcecd_open_owned_file()/xcecd_owned_file_exists() (xcecd_tmpfile.h) for the worker log, xcecd_worker.log and restart flag; fchmod instead of chmod(path).",