requestlog: publish collector-readable evidence boundary

Publish the reviewed Gamertan Web Foundations v0.1.0-preview.6 snapshot with a narrow mode-0640 collector boundary, private mode-0600 default, explicit setgid ownership guidance, and native macOS-safe release verification.

Exported from reviewed private source 120d660fa432761f85316ca3dde990e2dd142f19 after trusted Gitea CI run 681 and the complete native Mac verification suite.

Material implementation assistance provided by OpenAI Codex; reviewed and verified through the maintainer workflow.

Signed-off-by: Cole Speelman <crspeelman@gmail.com>

requestlog/jsonl.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"sync"
@@ -20,20 +21,39 @@ type JSONL struct {
 	err    error
 }
 
+// JSONLOptions controls the local file boundary. A zero FileMode preserves the
+// private 0600 default. Mode 0640 may be used when the deployment has assigned
+// the file to one explicit collector group; world-readable or writable modes
+// are never accepted.
+type JSONLOptions struct {
+	FileMode fs.FileMode
+}
+
 func OpenJSONL(path string) (*JSONL, error) {
+	return OpenJSONLWithOptions(path, JSONLOptions{})
+}
+
+func OpenJSONLWithOptions(path string, options JSONLOptions) (*JSONL, error) {
 	if !filepath.IsAbs(path) || filepath.Clean(path) != path {
 		return nil, errors.New("requestlog: JSONL path must be clean and absolute")
 	}
+	mode := options.FileMode
+	if mode == 0 {
+		mode = 0o600
+	}
+	if mode != 0o600 && mode != 0o640 {
+		return nil, errors.New("requestlog: JSONL mode must be 0600 or 0640")
+	}
 	if info, err := os.Lstat(path); err == nil && (info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular()) {
 		return nil, errors.New("requestlog: JSONL destination must be a regular file")
 	} else if err != nil && !errors.Is(err, os.ErrNotExist) {
 		return nil, err
 	}
-	file, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600)
+	file, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, mode)
 	if err != nil {
 		return nil, err
 	}
-	if err = file.Chmod(0o600); err != nil {
+	if err = file.Chmod(mode); err != nil {
 		file.Close()
 		return nil, err
 	}

requestlog/requestlog_test.go

@@ -101,6 +101,33 @@ func TestJSONLRoundTripAndMode(t *testing.T) {
 	}
 }
 
+func TestJSONLAllowsExplicitCollectorGroupRead(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "access.jsonl")
+	sink, err := OpenJSONLWithOptions(path, JSONLOptions{FileMode: 0o640})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = sink.Close(); err != nil {
+		t.Fatal(err)
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if runtime.GOOS != "windows" && info.Mode().Perm() != 0o640 {
+		t.Fatalf("mode=%o", info.Mode().Perm())
+	}
+}
+
+func TestJSONLRejectsOverlyPermissiveMode(t *testing.T) {
+	for _, mode := range []os.FileMode{0o400, 0o620, 0o644, 0o660, 0o666} {
+		path := filepath.Join(t.TempDir(), "access.jsonl")
+		if _, err := OpenJSONLWithOptions(path, JSONLOptions{FileMode: mode}); err == nil {
+			t.Fatalf("accepted mode %o", mode)
+		}
+	}
+}
+
 func TestPanicIsRecordedAndRepanicked(t *testing.T) {
 	sink := &memorySink{}
 	handler := Middleware(sink, Policy{})(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { panic("expected") }))