fix(core): keep launchd service logs outside protected Downloads

src/k1link/launchd_logs.py

@@ -0,0 +1,33 @@
+"""Launch-time journals belong in Library/Logs, outside protected Documents/Downloads.
+
+launchd opens these before the application starts, so an application's existing
+folder grant cannot authorize xpcproxy to open a journal inside the checkout.
+This does not move evidence or change access to the application's data directory.
+"""
+
+import os
+import stat
+from pathlib import Path
+
+
+def launchd_log_path(name: str) -> Path:
+    if Path(name).name != name or not name.endswith(".log"):
+        raise ValueError("A single journal filename is required")
+    return Path.home() / "Library/Logs/NODE.DC/MissionCore" / name
+
+
+def prepare_launchd_log(path: Path) -> None:
+    if path != launchd_log_path(path.name):
+        raise ValueError("Unexpected launch journal directory")
+    path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    info = path.parent.lstat()
+    if path.parent.resolve() != path.parent or info.st_uid != os.getuid():
+        raise ValueError("Launch journal directory must be owned and canonical")
+    descriptor = os.open(path, os.O_CREAT | os.O_APPEND | os.O_WRONLY | os.O_NOFOLLOW, 0o600)
+    try:
+        info = os.fstat(descriptor)
+        if not stat.S_ISREG(info.st_mode) or info.st_uid != os.getuid():
+            raise ValueError("Launch journal must be an owned regular file")
+        os.fchmod(descriptor, 0o600)
+    finally:
+        os.close(descriptor)

src/k1link/local_service_launchd.py

@@ -10,6 +10,8 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Final, cast
 
+from k1link.launchd_logs import launchd_log_path
+
 MISSION_CORE_LAUNCH_AGENT_LABEL: Final = "com.nodedc.mission-core.local"
 MISSION_CORE_LAUNCH_AGENT_SCHEMA: Final = "missioncore.local-launch-agent-plan/v1"
 OBSERVATORY_LOCAL_WORKER_ENABLED_ENV: Final = (
@@ -60,6 +62,7 @@ class MissionCoreLaunchAgentPlan:
             "desired_program_arguments": list(self.desired_program_arguments),
             "current_process_type": self.current_process_type,
             "desired_process_type": "Interactive",
+            "desired_log_path": plistlib.loads(self.desired_payload)["StandardOutPath"],
             "changes": {
                 "repository_migration": self.current_working_directory
                 != self.desired_working_directory,
@@ -172,7 +175,7 @@ def plan_mission_core_launch_agent(
         desired_environment[OBSERVATORY_SOURCE_CAS_ROOT_ENV] = str(source_cas)
         desired_environment[OBSERVATORY_RESULT_STAGING_ROOT_ENV] = str(result_staging)
         desired_environment[OBSERVATORY_LOCAL_WORKER_ENABLED_ENV] = "1"
-    log_path = repository / ".runtime/mission-core/k1link-serve-launchd.log"
+    log_path = launchd_log_path("k1link-serve-launchd.log")
     desired_program_arguments = (
         str(uv_entrypoint),
         "run",

src/k1link/observatory/worker_tunnel_launchd.py

@@ -10,6 +10,8 @@ from dataclasses import dataclass
 from pathlib import Path
 from typing import Final
 
+from k1link.launchd_logs import launchd_log_path
+
 OBSERVATORY_WORKER_TUNNEL_LABEL: Final = (
     "com.nodedc.observatory-worker-tunnel.local"
 )
@@ -64,7 +66,7 @@ def plan_observatory_worker_tunnel_launch_agent(
     data_root = _private_directory(data_directory)
     ssh = _exact_executable(ssh_path)
     target_path = agent_path.expanduser().absolute()
-    log_path = data_root / "observatory-worker-tunnel.log"
+    log_path = launchd_log_path("observatory-worker-tunnel.log")
     arguments = [
         str(ssh),
         "-o",