fix(stage-1b): auth-first proxy ACLs, stale pid cleanup, script modes

Squid denies unauthenticated requests before the destination rules so every audit line carries the expert name. Entrypoint removes the stale pid file (pid 1 in containers makes restarts see ghosts). All scripts executable. Renderer emits lowercase proxy mirrors.

egress/entrypoint.sh

@@ -49,6 +49,11 @@ if ! squid -k parse -f "$conf" 2>&1; then
   exit 64
 fi
 
+# A pre-existing pid file at this point is always stale (fresh container
+# start, or a restart where the old Squid never cleaned up; Squid writes
+# its own pid, which is 1 here, so a stale file even looks live). Remove it
+# before starting.
+rm -f /var/log/squid/squid.pid
 # Mirror the request log to the container's stdout so `docker logs` shows
 # one line per proxied request; the file itself stays authoritative for
 # audits. The tail dies with the container.

egress/squid.conf

@@ -29,8 +29,11 @@ acl to_localhost dst 127.0.0.0/8
 logformat agency %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %un
 access_log stdio:/var/log/squid/access.log agency
 
-# Deny first: private, loopback, link-local, and metadata destinations are
-# denied whatever the allowlist says. Only then the allowlist, then deny.
+# Deny first: authentication is required before anything else so every
+# logged line carries the expert's name; then private, loopback,
+# link-local, and metadata destinations are denied whatever the allowlist
+# says. Only then the allowlist, then deny.
+http_access deny !authed
 http_access deny to_private
 http_access deny to_localhost
 http_access deny CONNECT !SSL_ports

scripts/accept-helpers/compose-hardening.ts

@@ -40,6 +40,7 @@ for (const name of enabled) {
   }
   if ("ports" in svc) errors.push(`${name}: publishes ports`);
   if (svc["privileged"] === true) errors.push(`${name}: privileged`);
+  if ("cap_add" in svc) errors.push(`${name}: adds capabilities`);
   const vols = Array.isArray(svc["volumes"]) ? svc["volumes"] : [];
   for (const vol of vols) {
     if (typeof vol !== "string") continue;
@@ -73,6 +74,8 @@ if (egress === undefined) {
     errors.push("egress: networks != [fleet, outside]");
   }
   if ("ports" in egress) errors.push("egress: publishes ports");
+  if (egress["privileged"] === true) errors.push("egress: privileged");
+  if ("cap_add" in egress) errors.push("egress: adds capabilities");
 }
 
 if (errors.length > 0) {

shared/templates/squid.conf.tmpl

@@ -29,8 +29,11 @@ acl to_localhost dst 127.0.0.0/8
 logformat agency %ts.%03tu %6tr %>a %Ss/%03>Hs %<st %rm %ru %un
 access_log stdio:/var/log/squid/access.log agency
 
-# Deny first: private, loopback, link-local, and metadata destinations are
-# denied whatever the allowlist says. Only then the allowlist, then deny.
+# Deny first: authentication is required before anything else so every
+# logged line carries the expert's name; then private, loopback,
+# link-local, and metadata destinations are denied whatever the allowlist
+# says. Only then the allowlist, then deny.
+http_access deny !authed
 http_access deny to_private
 http_access deny to_localhost
 http_access deny CONNECT !SSL_ports