fix(ingestion): confine /ingest-path and brain_ingest paths to brain/raw/

Both read a caller-chosen server path with extract.Text, so any file the
pod could read (the ServiceAccount token, /etc/passwd) could be ingested
into the brain and read back with brain_query.

ResolveIngestPath resolves relative paths against brain/raw/ (the inbox
the watcher already owns), evaluates symlinks, and refuses anything
that lands outside. A directory ingest re-resolves every walked file,
so a symlinked file inside raw/ cannot lead out. Existing ingest-path
tests moved their fixtures under brain/raw/.

Refs #149

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.context/PROJECT.md

@@ -64,11 +64,7 @@ the routing pod; brain tools moved to the brain MCP.
 
 The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
 `/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
-for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
-(`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
-(infra#517): use the tailnet (`koala:8443`) or in-cluster
-`ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
-accept only paths inside `brain/raw/`.
+for shell scripts and non-MCP clients.
 
 `brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
 gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,

.context/system-prompt.txt

@@ -304,7 +304,7 @@ entries that age well are about *why*, *how to avoid*, and *what to do when*.
 |---------|-------|-------|
 | **Claude Code, Claude Desktop** | `brain_query` (BM25), `brain_answer` (LLM-synth + sources) MCP tools | `brain_write` MCP tool |
 | **Crush, Pi, Antigravity, other MCP-capable** | same MCP server: `ingestion-brain` (via the `mcp__*_brain__*` namespace once authenticated) | same |
-| **Anything HTTP-only (curl, scripts)** | Tailnet only: `POST https://koala.tail30472e.ts.net:8443/query` with `{"query":"..."}`, sending `BRAIN_MCP_TOKEN` (not yet enforced on REST, hyperguild#149). The public `brain-mcp.d-ma.be` serves `/mcp` only (infra#517). | `POST .../write` with `{"content":"...","wing":"...","hall":"..."}` |
+| **Anything HTTP-only (curl, scripts)** | `POST https://brain-mcp.d-ma.be/query` with `{"query":"..."}` (auth via `BRAIN_MCP_TOKEN`) | `POST .../write` with `{"content":"...","filename":"..."}` |
 | **Browser / human inspection** | `https://git.d-ma.be/mathias/hyperguild` → `knowledge/` and `wiki/` markdown files |
 
 - **Scoping — the brain holds no confidential client content.** Nothing on the read path
@@ -493,11 +493,7 @@ the routing pod; brain tools moved to the brain MCP.
 
 The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
 `/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
-for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
-(`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
-(infra#517): use the tailnet (`koala:8443`) or in-cluster
-`ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
-accept only paths inside `brain/raw/`.
+for shell scripts and non-MCP clients.
 
 `brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
 gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,

AGENTS.md

@@ -299,7 +299,7 @@ entries that age well are about *why*, *how to avoid*, and *what to do when*.
 |---------|-------|-------|
 | **Claude Code, Claude Desktop** | `brain_query` (BM25), `brain_answer` (LLM-synth + sources) MCP tools | `brain_write` MCP tool |
 | **Crush, Pi, Antigravity, other MCP-capable** | same MCP server: `ingestion-brain` (via the `mcp__*_brain__*` namespace once authenticated) | same |
-| **Anything HTTP-only (curl, scripts)** | Tailnet only: `POST https://koala.tail30472e.ts.net:8443/query` with `{"query":"..."}`, sending `BRAIN_MCP_TOKEN` (not yet enforced on REST, hyperguild#149). The public `brain-mcp.d-ma.be` serves `/mcp` only (infra#517). | `POST .../write` with `{"content":"...","wing":"...","hall":"..."}` |
+| **Anything HTTP-only (curl, scripts)** | `POST https://brain-mcp.d-ma.be/query` with `{"query":"..."}` (auth via `BRAIN_MCP_TOKEN`) | `POST .../write` with `{"content":"...","filename":"..."}` |
 | **Browser / human inspection** | `https://git.d-ma.be/mathias/hyperguild` → `knowledge/` and `wiki/` markdown files |
 
 - **Scoping — the brain holds no confidential client content.** Nothing on the read path
@@ -488,11 +488,7 @@ the routing pod; brain tools moved to the brain MCP.
 
 The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
 `/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
-for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
-(`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
-(infra#517): use the tailnet (`koala:8443`) or in-cluster
-`ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
-accept only paths inside `brain/raw/`.
+for shell scripts and non-MCP clients.
 
 `brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
 gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,

CLAUDE.md

@@ -64,11 +64,7 @@ the routing pod; brain tools moved to the brain MCP.
 
 The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
 `/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
-for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
-(`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
-(infra#517): use the tailnet (`koala:8443`) or in-cluster
-`ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
-accept only paths inside `brain/raw/`.
+for shell scripts and non-MCP clients.
 
 `brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
 gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,

cmd/hyperguild/http.go

@@ -64,7 +64,9 @@ func (c *brainClient) Query(ctx context.Context, topic string, limit int) (*Quer
 		return nil, fmt.Errorf("build request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")
-	resp, err := c.do(req)
+	c.authorize(req)
+
+	resp, err := c.http.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("brain POST /query: %w", err)
 	}
@@ -106,7 +108,9 @@ func (c *brainClient) Write(ctx context.Context, wing, hall, filename string, co
 		return nil, fmt.Errorf("build request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")
-	resp, err := c.do(req)
+	c.authorize(req)
+
+	resp, err := c.http.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("brain POST /write: %w", err)
 	}
@@ -143,7 +147,7 @@ func (c *brainClient) PassRate(ctx context.Context, skill, window string) (*Pass
 	if err != nil {
 		return nil, fmt.Errorf("build request: %w", err)
 	}
-	resp, err := c.do(req)
+	resp, err := c.http.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("brain GET /pass-rate: %w", err)
 	}
@@ -159,12 +163,9 @@ func (c *brainClient) PassRate(ctx context.Context, skill, window string) (*Pass
 	return &out, nil
 }
 
-// do sends every brain request, adding the bearer token when one is
-// configured. All methods go through here so none can forget it (PassRate
-// did, PR #152 review).
-func (c *brainClient) do(req *http.Request) (*http.Response, error) {
+// authorize adds the bearer token when one is configured.
+func (c *brainClient) authorize(req *http.Request) {
 	if c.token != "" {
 		req.Header.Set("Authorization", "Bearer "+c.token)
 	}
-	return c.http.Do(req)
 }

cmd/hyperguild/http_auth_test.go

@@ -13,17 +13,13 @@ import (
 
 // hyperguild#149: the ingestion REST API now requires a bearer token; the CLI
 // sends BRAIN_MCP_TOKEN, or it gets 401 on every brain call.
-func TestBrainClientSendsBrainMCPTokenOnQueryWriteAndPassRate(t *testing.T) {
+func TestBrainClientSendsBrainMCPToken(t *testing.T) {
 	var got []string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		got = append(got, r.URL.Path+" "+r.Header.Get("Authorization"))
-		switch r.URL.Path {
-		case "/write":
+		if r.URL.Path == "/write" {
 			_, _ = w.Write([]byte(`{"path":"wiki/x/facts/y.md"}`))
 			return
-		case "/pass-rate":
-			_, _ = w.Write([]byte(`{}`))
-			return
 		}
 		_, _ = w.Write([]byte(`{"results":[]}`))
 	}))
@@ -36,10 +32,7 @@ func TestBrainClientSendsBrainMCPTokenOnQueryWriteAndPassRate(t *testing.T) {
 	require.NoError(t, err)
 	_, err = c.Write(context.Background(), "x", "facts", "y", strings.NewReader("# y"))
 	require.NoError(t, err)
-	// PR #152 review: PassRate sent no token and would 401 in production.
-	_, _ = c.PassRate(context.Background(), "tdd", "7d")
-	assert.Equal(t, []string{"/query Bearer cli-test-token", "/write Bearer cli-test-token",
-		"/pass-rate Bearer cli-test-token"}, got)
+	assert.Equal(t, []string{"/query Bearer cli-test-token", "/write Bearer cli-test-token"}, got)
 }
 
 func TestBrainClientSendsNoAuthorizationWhenTokenUnset(t *testing.T) {

docs/runbooks/exercising-pass-rate-traffic.md

@@ -24,7 +24,7 @@ Only a `tools/call` to the routing pod records a pass/fail.
 |---------|-----|------|
 | Routing MCP (local, Tailscale) | `http://koala:30310/mcp` | Bearer `ROUTING_MCP_TOKEN` |
 | Routing MCP (remote) | `https://routing-mcp.d-ma.be/mcp` | OAuth via `auth.d-ma.be` (audience `claude-ai`) |
-| Pass-rate readout | `http://koala:30330/pass-rate?skill=<name>` | Bearer `BRAIN_MCP_TOKEN` (since hyperguild#149) |
+| Pass-rate readout | `http://koala:30330/pass-rate?skill=<name>` | none (read-only) |
 
 Tools advertised: **`review`**, **`debug`** (the two the #35 gate measures),
 plus `session_log`, `retrospective`, `trainer`.

ingestion/cmd/server/main.go

@@ -33,7 +33,6 @@ import (
 	"github.com/mathiasbq/hyperguild/ingestion/internal/reranker"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/search"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/symlinkguard"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/vectorstore"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/watcher"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/webhook"
@@ -174,8 +173,7 @@ func alertingWarnings(getenv func(string) string) []string {
 	var out []string
 	if getenv("BRAIN_NTFY_URL") == "" {
 		out = append(out, "alerting DISABLED: BRAIN_NTFY_URL unset — "+
-			"brain_edit_root governance rewrites, capture audit degradation and the "+
-			"brain symlink tripwire (hyperguild#157) will not notify")
+			"brain_edit_root governance rewrites and capture audit degradation will not notify")
 	}
 	return out
 }
@@ -241,10 +239,6 @@ func main() {
 	}
 
 	brainDir := envOr("INGEST_BRAIN_DIR", "../brain")
-	if err := startupSymlinkCheck(brainDir); err != nil {
-		logger.Error("brain symlink tripwire", "err", err)
-		os.Exit(1)
-	}
 	port := envOr("INGEST_PORT", "3300")
 
 	llmURL := envOr("INGEST_LLM_URL", "http://iguana:4000/v1")
@@ -366,8 +360,6 @@ func main() {
 	}
 
 	ctx := context.Background()
-	// hyperguild#157: report a symlink that appears in the brain while running.
-	go symlinkguard.Watch(ctx, brainDir, symlinkScanInterval(os.Getenv), buildNotifier())
 
 	// Built before the watcher, the graph backfill and session ingestion, and
 	// retried rather than fatal (#83). Two separate reasons:
@@ -511,10 +503,9 @@ func main() {
 		logger.Info("embed sync started", "interval_s", embedSyncInterval)
 	}
 
-	// Public routes only; buildMux mounts the authenticated REST API (#149).
-	public := map[string]http.Handler{}
+	mux := http.NewServeMux()
 	if webhookHandler != nil {
-		public["POST /webhooks/brain-sync"] = webhookHandler
+		mux.Handle("POST /webhooks/brain-sync", webhookHandler)
 	}
 	// Resource-metadata URL is only emitted on 401 when Dex OAuth is
 	// configured. Static-Bearer-only deployments leave this empty so
@@ -522,14 +513,21 @@ func main() {
 	var resourceMetadataURL string
 	if dexURL := os.Getenv("DEX_ISSUER_URL"); dexURL != "" {
 		resourceURL := os.Getenv("MCP_RESOURCE_URL")
-		public["GET /.well-known/oauth-protected-resource"] = http.HandlerFunc(
+		mux.HandleFunc("GET /.well-known/oauth-protected-resource",
 			chassisauth.ProtectedResourceHandler(resourceURL, dexURL))
 		if resourceURL != "" {
 			resourceMetadataURL = strings.TrimRight(resourceURL, "/") + "/.well-known/oauth-protected-resource"
 		}
 	}
 
-	public["/mcp"] = chassisauth.BearerMiddleware(mcpToken, jwtValidator, "brain", resourceMetadataURL, mcpSrv)
+	mux.Handle("/mcp", chassisauth.BearerMiddleware(mcpToken, jwtValidator, "brain", resourceMetadataURL, mcpSrv))
+	// The REST API, authenticated as a whole (hyperguild#149). Same credential
+	// as /mcp: callers (brain-ui, brain-ingest-ntfy, the hyperguild CLI) send
+	// BRAIN_MCP_TOKEN. Registered after the public routes on purpose only for
+	// reading order; ServeMux precedence is by pattern specificity.
+	mountREST(mux, h, func(next http.Handler) http.Handler {
+		return chassisauth.BearerMiddleware(mcpToken, jwtValidator, "brain", resourceMetadataURL, next)
+	})
 
 	// POST /capture (#53/#54): the uniform capture REST door. Needs a ticket
 	// tracker to file action items, so it only mounts when Gitea is
@@ -551,7 +549,7 @@ func main() {
 		sovereign := splitList(os.Getenv("BRAIN_CAPTURE_SOVEREIGN_PRINCIPALS"))
 		resolver := capturehttp.NewOriginResolver(sovereign)
 		captureH := capturehttp.New(captureSvc, jwtValidator, mcpToken, "local-cli", resolver)
-		public["POST /capture"] = captureH
+		mux.Handle("POST /capture", captureH)
 		// Same use-case behind the MCP `capture` tool (#55 relay) so MCP-native
 		// harnesses (claude.ai, Crush, Pi, LLM Council) reach capture through
 		// the existing /mcp OAuth connector. mcpSrv is already wrapped above;
@@ -581,9 +579,9 @@ func main() {
 			logger.Error("OAUTH_CLIENT_ID/SECRET set but MCP_RESOURCE_URL is empty; cannot derive issuer")
 			os.Exit(1)
 		}
-		public["GET /.well-known/oauth-authorization-server"] = http.HandlerFunc(
+		mux.HandleFunc("GET /.well-known/oauth-authorization-server",
 			oauth.MetadataHandler(issuer))
-		public["POST /oauth/token"] = http.HandlerFunc(oauth.TokenHandler(oauth.TokenConfig{
+		mux.HandleFunc("POST /oauth/token", oauth.TokenHandler(oauth.TokenConfig{
 			ClientID:     oauthID,
 			ClientSecret: oauthSecret,
 			AccessToken:  mcpToken,
@@ -602,17 +600,7 @@ func main() {
 	// real request latency. /metrics itself is excluded from its own
 	// observation by registering it on the outer mux (post-wrap).
 	reg := metrics.New()
-	public["GET /metrics"] = http.HandlerFunc(reg.Handler())
-
-	// The whole router, built in one place so the test of buildMux is a test
-	// of production wiring (PR #152 review). The REST API's credential is the
-	// same as /mcp's.
-	mux, err := buildMux(restAuth{token: mcpToken, validator: jwtValidator, realm: "brain",
-		resourceMetadataURL: resourceMetadataURL}, h, public)
-	if err != nil {
-		logger.Error("build router", "err", err)
-		os.Exit(1)
-	}
+	mux.HandleFunc("GET /metrics", reg.Handler())
 	logger.Info("metrics endpoint registered", "path", "/metrics")
 
 	addr := ":" + port

ingestion/cmd/server/routes.go

@@ -1,65 +1,18 @@
 package main
 
 import (
-	"errors"
-	"fmt"
 	"net/http"
 
-	chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
-
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 )
 
-// publicRoutes is the complete set of patterns allowed on the outer mux,
-// outside the REST API's auth (hyperguild#149). Each authenticates itself or is
-// meant to be open: /mcp (bearer/JWT), /capture (bearer/JWT), the webhook
-// (HMAC), /oauth/token (client secret), OAuth metadata and /metrics (open).
-// A REST pattern added here would beat the authenticated catch-all by
-// specificity and ship open, which is why buildMux refuses anything else.
-var publicRoutes = map[string]bool{
-	"/mcp":                      true,
-	"POST /capture":             true,
-	"POST /webhooks/brain-sync": true,
-	"GET /.well-known/oauth-protected-resource":   true,
-	"GET /.well-known/oauth-authorization-server": true,
-	"POST /oauth/token":                           true,
-	"GET /metrics":                                true,
-}
-
-// restAuth is the credential the REST API checks: the same as /mcp's.
-type restAuth struct {
-	token               string
-	validator           *chassisauth.JWTValidator
-	realm               string
-	resourceMetadataURL string
-}
-
-// buildMux is the server's whole router. The REST API is mounted at "/"
-// behind bearer auth that buildMux constructs itself, so a caller cannot pass
-// a no-op; public handlers are registered as given, and only for patterns on
-// the publicRoutes allowlist. It returns an http.Handler, not the
-// *ServeMux, so nothing can register a route on the result afterwards and
-// bypass the allowlist.
-func buildMux(auth restAuth, h *api.Handler, public map[string]http.Handler) (http.Handler, error) {
-	if auth.token == "" {
-		return nil, errors.New("buildMux: REST auth needs a token")
-	}
-	mux := http.NewServeMux()
-	for pattern, handler := range public {
-		if !publicRoutes[pattern] {
-			return nil, fmt.Errorf("buildMux: %q is not an allowed public route", pattern)
-		}
-		mux.Handle(pattern, handler)
-	}
-	mountREST(mux, h, func(next http.Handler) http.Handler {
-		return chassisauth.BearerMiddleware(auth.token, auth.validator, auth.realm, auth.resourceMetadataURL, next)
-	})
-	return mux, nil
-}
-
 // mountREST registers the REST API on its own mux and mounts it at "/" behind
-// auth: anything not registered as public lands here and is authenticated,
-// including routes added later.
+// auth (hyperguild#149). Authentication is a property of the mux, not of each
+// route: anything not registered on the outer mux as explicitly public (/mcp,
+// /capture, the HMAC webhook, OAuth metadata, /metrics) lands here and is
+// authenticated, including routes added later. Before this, only /mcp was
+// wrapped, and the REST routes beside it were open; infra#517 found them on
+// the internet.
 func mountREST(mux *http.ServeMux, h *api.Handler, auth func(http.Handler) http.Handler) {
 	rest := http.NewServeMux()
 	rest.HandleFunc("POST /query", h.Query)

ingestion/cmd/server/routes_test.go

@@ -9,7 +9,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
+
+	chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
 
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
@@ -17,27 +18,22 @@ import (
 
 const routesTok = "routes-test-token"
 
-func okHandler(body string) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { _, _ = w.Write([]byte(body)) })
-}
-
-// testMux builds the router exactly as main does: buildMux with the full
-// public set main registers (stub handlers) and real bearer config.
-// hyperguild#149: the REST API is authenticated as a whole; the PR #152
-// review showed a test of a COPY of the router let main.go regress unseen.
-func testMux(t *testing.T) http.Handler {
+// hyperguild#149: only /mcp was authenticated; every REST route on the same
+// mux was open, and infra#517 found them on the internet. The REST API is now
+// mounted at "/" behind the bearer middleware, so any route not registered
+// as explicitly public is authenticated, including routes added later.
+func testRouter(t *testing.T) http.Handler {
 	t.Helper()
 	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
-	public := map[string]http.Handler{}
-	for p := range publicRoutes {
-		public[p] = okHandler("public " + p)
-	}
-	mux, err := buildMux(restAuth{token: routesTok, realm: "brain"}, h, public)
-	require.NoError(t, err)
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /metrics", func(w http.ResponseWriter, _ *http.Request) { _, _ = w.Write([]byte("ok")) })
+	mountREST(mux, h, func(next http.Handler) http.Handler {
+		return chassisauth.BearerMiddleware(routesTok, nil, "brain", "", next)
+	})
 	return mux
 }
 
-func do(t *testing.T, h http.Handler, method, path, authz string) (int, string) {
+func do(t *testing.T, h http.Handler, method, path, authz string) int {
 	t.Helper()
 	req := httptest.NewRequest(method, path, strings.NewReader(`{"query":"x"}`))
 	if authz != "" {
@@ -45,62 +41,34 @@ func do(t *testing.T, h http.Handler, method, path, authz string) (int, string)
 	}
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
-	return rec.Code, rec.Body.String()
+	return rec.Code
 }
 
-func TestBuildMuxRefusesRESTRoutesWithoutAValidToken(t *testing.T) {
-	r := testMux(t)
+func TestRESTRoutesRefuseRequestsWithoutAToken(t *testing.T) {
+	r := testRouter(t)
 	for _, rt := range []struct{ method, path string }{
 		{"POST", "/query"}, {"POST", "/write"}, {"POST", "/index"}, {"POST", "/ingest"},
 		{"POST", "/ingest-path"}, {"POST", "/ingest-raw"}, {"POST", "/backfill-refs"},
 		{"GET", "/pending"}, {"POST", "/promote"}, {"POST", "/backfill-embeddings"}, {"GET", "/pass-rate"},
 	} {
-		code, _ := do(t, r, rt.method, rt.path, "")
-		assert.Equal(t, http.StatusUnauthorized, code, "%s %s without a token", rt.method, rt.path)
-		code, _ = do(t, r, rt.method, rt.path, "Bearer wrong")
-		assert.Equal(t, http.StatusUnauthorized, code, "%s %s with a wrong token", rt.method, rt.path)
+		assert.Equal(t, http.StatusUnauthorized, do(t, r, rt.method, rt.path, ""), "%s %s without a token", rt.method, rt.path)
+		assert.Equal(t, http.StatusUnauthorized, do(t, r, rt.method, rt.path, "Bearer wrong"), "%s %s with a wrong token", rt.method, rt.path)
 	}
 }
 
-func TestBuildMuxServesRESTRoutesToAValidToken(t *testing.T) {
-	r := testMux(t)
-	code, _ := do(t, r, "GET", "/pending", "Bearer "+routesTok)
-	assert.Equal(t, http.StatusOK, code)
+func TestRESTRoutesServeAValidToken(t *testing.T) {
+	r := testRouter(t)
+	assert.NotEqual(t, http.StatusUnauthorized, do(t, r, "POST", "/query", "Bearer "+routesTok))
+	assert.Equal(t, http.StatusOK, do(t, r, "GET", "/pending", "Bearer "+routesTok))
 }
 
-func TestBuildMuxAuthenticatesAnUnregisteredPath(t *testing.T) {
-	code, _ := do(t, testMux(t), "POST", "/some-future-route", "")
-	assert.Equal(t, http.StatusUnauthorized, code)
+// Default-deny: a path nobody registered is still behind auth, so a route
+// added to the REST mux later cannot ship open by omission.
+func TestUnregisteredPathIsAuthenticatedByDefault(t *testing.T) {
+	assert.Equal(t, http.StatusUnauthorized, do(t, testRouter(t), "POST", "/some-future-route", ""))
 }
 
-// buildMux registers public handlers as given, without adding auth: each
-// public route owns its own (bearer on /mcp, HMAC on the webhook, client
-// secret on /oauth/token) or is meant to be open (/metrics, OAuth metadata).
-func TestBuildMuxDoesNotWrapPublicRoutes(t *testing.T) {
-	r := testMux(t)
-	for p := range publicRoutes {
-		method, path, ok := strings.Cut(p, " ")
-		if !ok {
-			method, path = "GET", p
-		}
-		code, body := do(t, r, method, path, "")
-		assert.Equal(t, http.StatusOK, code, p)
-		assert.Equal(t, "public "+p, body, p)
-	}
-}
-
-// The allowlist is the control: a REST pattern registered as public would win
-// over the authenticated catch-all (more specific pattern), so it is refused.
-func TestBuildMuxRefusesAPublicPatternOffTheAllowlist(t *testing.T) {
-	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
-	for _, p := range []string{"POST /query", "GET /pending", "/", "POST /metrics"} {
-		_, err := buildMux(restAuth{token: routesTok, realm: "brain"}, h, map[string]http.Handler{p: okHandler("x")})
-		assert.Error(t, err, "public pattern %q must be refused", p)
-	}
-}
-
-func TestBuildMuxRefusesAnEmptyToken(t *testing.T) {
-	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
-	_, err := buildMux(restAuth{token: "", realm: "brain"}, h, nil)
-	assert.Error(t, err)
+// Explicitly public routes registered on the outer mux keep working.
+func TestMetricsStaysOpenForPrometheus(t *testing.T) {
+	assert.Equal(t, http.StatusOK, do(t, testRouter(t), "GET", "/metrics", ""))
 }

ingestion/cmd/server/symlink_check.go

@@ -1,39 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-	"time"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/symlinkguard"
-)
-
-// startupSymlinkCheck is the hyperguild#157 tripwire at boot: a symlink in the
-// brain dir would let brain readers serve a file from outside the brain, so
-// the server does not start until it is removed. A directory the scan cannot
-// read could hide one, so it refuses on that too. A missing brain dir (first
-// boot) is the only case it lets pass.
-func startupSymlinkCheck(brainDir string) error {
-	r, err := symlinkguard.Scan(brainDir)
-	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			return nil
-		}
-		return fmt.Errorf("refusing to start: cannot scan the brain dir %s (hyperguild#157): %w", brainDir, err)
-	}
-	if !r.Clean() {
-		return fmt.Errorf("refusing to start: brain dir %s has %s (hyperguild#157); fix them first", brainDir, r)
-	}
-	return nil
-}
-
-// symlinkScanInterval reads BRAIN_SYMLINK_SCAN_INTERVAL (seconds), falling
-// back to the default on an unset, non-numeric or non-positive value.
-func symlinkScanInterval(getenv func(string) string) time.Duration {
-	if s, err := strconv.Atoi(getenv("BRAIN_SYMLINK_SCAN_INTERVAL")); err == nil && s > 0 {
-		return time.Duration(s) * time.Second
-	}
-	return symlinkguard.DefaultInterval
-}

ingestion/cmd/server/symlink_check_test.go

@@ -1,65 +0,0 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// hyperguild#157: the server refuses to start while a symlink exists in the
-// brain dir, or while any part of it cannot be scanned (which could hide
-// one); a missing brain dir is the only thing it lets pass.
-func TestStartupSymlinkCheckRefusesABrainWithASymlink(t *testing.T) {
-	brain := t.TempDir()
-	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "planted")))
-	err := startupSymlinkCheck(brain)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "planted")
-}
-
-func TestStartupSymlinkCheckRefusesABrainWithAnUnreadableDir(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root reads mode-000 directories")
-	}
-	brain := t.TempDir()
-	locked := filepath.Join(brain, "aaa")
-	require.NoError(t, os.MkdirAll(locked, 0o755))
-	require.NoError(t, os.Chmod(locked, 0o000))
-	t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
-	err := startupSymlinkCheck(brain)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "aaa")
-}
-
-func TestStartupSymlinkCheckPassesACleanOrMissingBrain(t *testing.T) {
-	brain := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "n.md"), []byte("x"), 0o644))
-	assert.NoError(t, startupSymlinkCheck(brain))
-	assert.NoError(t, startupSymlinkCheck(filepath.Join(brain, "missing")))
-}
-
-func TestSymlinkScanIntervalFallsBackOnNonPositive(t *testing.T) {
-	for _, v := range []string{"0", "-5", "", "junk"} {
-		got := symlinkScanInterval(func(string) string { return v })
-		assert.Positive(t, got, "env %q", v)
-	}
-}
-
-func TestAlertingWarningsNamesTheSymlinkTripwire(t *testing.T) {
-	w := strings.Join(alertingWarnings(func(string) string { return "" }), " ")
-	assert.Contains(t, w, "symlink tripwire")
-}
-
-func TestStartupSymlinkCheckRefusesAnUnlistableBrainRoot(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root lists mode-0100 directories")
-	}
-	brain := t.TempDir()
-	require.NoError(t, os.Chmod(brain, 0o100))
-	t.Cleanup(func() { _ = os.Chmod(brain, 0o755) })
-	assert.Error(t, startupSymlinkCheck(brain))
-}

ingestion/internal/api/ingestpath_root.go

@@ -2,14 +2,13 @@ package api
 
 import (
 	"errors"
+	"fmt"
 	"path/filepath"
 	"strings"
 )
 
-// ErrOutsideIngestRoot is the one refusal for every bad ingest path. It never
-// carries the underlying error: "no such file" versus "permission denied"
-// would let a caller probe which server files exist (PR #152 review).
-var ErrOutsideIngestRoot = errors.New("ingest path must be an existing file or directory inside brain/raw/")
+// ErrOutsideIngestRoot means an ingest path does not resolve inside brain/raw/.
+var ErrOutsideIngestRoot = errors.New("ingest path must be inside brain/raw/")
 
 // ResolveIngestPath confines a caller-supplied ingest path to brain/raw/, the
 // inbox the watcher already owns (hyperguild#149). Relative paths resolve
@@ -17,18 +16,18 @@ var ErrOutsideIngestRoot = errors.New("ingest path must be an existing file or d
 // a link inside raw/ that points elsewhere is refused. The path must exist.
 func ResolveIngestPath(brainDir, p string) (string, error) {
 	if strings.TrimSpace(p) == "" {
-		return "", ErrOutsideIngestRoot
+		return "", fmt.Errorf("%w: path is empty", ErrOutsideIngestRoot)
 	}
 	root, err := filepath.EvalSymlinks(filepath.Join(brainDir, "raw"))
 	if err != nil {
-		return "", ErrOutsideIngestRoot
+		return "", fmt.Errorf("%w: inbox unavailable: %v", ErrOutsideIngestRoot, err)
 	}
 	if !filepath.IsAbs(p) {
 		p = filepath.Join(root, p)
 	}
 	real, err := filepath.EvalSymlinks(filepath.Clean(p))
 	if err != nil {
-		return "", ErrOutsideIngestRoot
+		return "", fmt.Errorf("%w: %v", ErrOutsideIngestRoot, err)
 	}
 	rel, err := filepath.Rel(root, real)
 	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {

ingestion/internal/api/ingestpath_root_test.go

@@ -67,22 +67,3 @@ func TestIngestPathDirectoryWalkSkipsSymlinksLeavingTheInbox(t *testing.T) {
 	assert.Contains(t, rec.Body.String(), "skipped")
 	assert.NotContains(t, rec.Body.String(), "SENTINEL-149-OUTSIDE")
 }
-
-// PR #152 review: the raw EvalSymlinks error told an authenticated caller
-// whether any server file existed ("no such file") or was unreadable
-// ("permission denied"), and leaked the brain directory. Every refusal now
-// reads the same.
-func TestResolveIngestPathRefusalsAreIndistinguishable(t *testing.T) {
-	brain := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw"), 0o755))
-	var msgs []string
-	for _, p := range []string{"/etc/hostname", "/etc/definitely-not-here-149", "../x", "nope/missing.md", ""} {
-		_, err := api.ResolveIngestPath(brain, p)
-		require.Error(t, err, p)
-		msgs = append(msgs, err.Error())
-		assert.NotContains(t, err.Error(), brain, "refusal for %q leaks the brain dir", p)
-	}
-	for _, m := range msgs[1:] {
-		assert.Equal(t, msgs[0], m)
-	}
-}

ingestion/internal/symlinkguard/symlinkguard.go

@@ -1,153 +0,0 @@
-// Package symlinkguard is the hyperguild#157 tripwire. The brain directory is
-// a Syncthing sendreceive folder and Syncthing syncs symlinks; several brain
-// readers (search, vectorstore, context, graph) follow a symlink out of the
-// brain and would index or return whatever it points to. Until every reader
-// reads through an os.Root, a symlink inside the brain, or a directory the
-// scan cannot read (which could hide one), is an incident: the server refuses
-// to start on one (main), and Watch reports one that appears while it runs.
-package symlinkguard
-
-import (
-	"context"
-	"fmt"
-	"io/fs"
-	"log/slog"
-	"os"
-	"path/filepath"
-	"sort"
-	"strconv"
-	"strings"
-	"time"
-)
-
-// DefaultInterval is used when Watch is given a non-positive interval.
-const DefaultInterval = 5 * time.Minute
-
-// Notifier is the out-of-band alert sink (audit.Notifier satisfies it).
-type Notifier interface {
-	Notify(ctx context.Context, msg string) error
-}
-
-// Result is what a scan found: symlinks, and directories it could not read
-// (each of which could hide a symlink). Paths are brain-relative.
-type Result struct {
-	Symlinks   []string
-	Unreadable []string
-}
-
-// Clean reports whether the scan found nothing to act on.
-func (r Result) Clean() bool { return len(r.Symlinks) == 0 && len(r.Unreadable) == 0 }
-
-// String describes the findings for a log line or alert. Paths are quoted, so
-// a name containing a newline cannot blur two findings together.
-func (r Result) String() string {
-	q := func(xs []string) string {
-		out := make([]string, len(xs))
-		for i, x := range xs {
-			out[i] = strconv.Quote(x)
-		}
-		return strings.Join(out, ", ")
-	}
-	var parts []string
-	if len(r.Symlinks) > 0 {
-		parts = append(parts, fmt.Sprintf("%d symlink(s): %s", len(r.Symlinks), q(r.Symlinks)))
-	}
-	if len(r.Unreadable) > 0 {
-		parts = append(parts, fmt.Sprintf("%d unreadable dir(s): %s", len(r.Unreadable), q(r.Unreadable)))
-	}
-	return strings.Join(parts, "; ")
-}
-
-// Scan walks the brain dir and reports every symlink in it and every
-// directory it could not read, continuing past both. Only the ROOT .git is
-// skipped (it is brain-sync's, and no reader walks it); a nested .git is
-// scanned like any other directory. brainDir itself may be a symlink (a
-// volume mount); it is resolved first. The error is non-nil when the root
-// cannot be resolved (wrapping os.ErrNotExist when it is missing) or cannot be
-// listed.
-func Scan(brainDir string) (Result, error) {
-	root, err := filepath.EvalSymlinks(brainDir)
-	if err != nil {
-		return Result{}, fmt.Errorf("resolve brain dir: %w", err)
-	}
-	var r Result
-	rootGit := filepath.Join(root, ".git")
-	walkErr := filepath.WalkDir(root, func(p string, d fs.DirEntry, err error) error {
-		rel, _ := filepath.Rel(root, p)
-		rel = filepath.ToSlash(rel)
-		if err != nil {
-			if p == root {
-				return err
-			}
-			r.Unreadable = append(r.Unreadable, rel)
-			if d != nil && d.IsDir() {
-				return filepath.SkipDir
-			}
-			return nil
-		}
-		if d.IsDir() && p == rootGit {
-			return filepath.SkipDir
-		}
-		if d.Type()&os.ModeSymlink != 0 {
-			r.Symlinks = append(r.Symlinks, rel)
-		}
-		return nil
-	})
-	sort.Strings(r.Symlinks)
-	sort.Strings(r.Unreadable)
-	if walkErr != nil {
-		// Only the root's own error reaches here (deeper errors are recorded
-		// as Unreadable). A root that cannot be listed cannot be shown clean
-		// (PR #159 round 2: discarding this reported clean while search
-		// served a planted symlink).
-		return r, fmt.Errorf("scan brain dir: %w", walkErr)
-	}
-	return r, nil
-}
-
-// Watch rescans every interval (DefaultInterval if non-positive) until ctx
-// ends, and notifies once per distinct non-clean result. A result counts as
-// reported only after Notify succeeds, so an alert lost to a notifier outage
-// is retried on the next tick.
-func Watch(ctx context.Context, brainDir string, interval time.Duration, n Notifier) {
-	if interval <= 0 {
-		interval = DefaultInterval
-	}
-	t := time.NewTicker(interval)
-	defer t.Stop()
-	reported := ""
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-t.C:
-		}
-		r, err := Scan(brainDir)
-		var key, msg string
-		switch {
-		case err != nil:
-			key = "error: " + err.Error()
-			msg = "brain symlink tripwire (hyperguild#157): cannot scan the brain dir: " + err.Error()
-		case r.Clean():
-			reported = ""
-			continue
-		default:
-			key = r.String()
-			msg = "brain symlink tripwire (hyperguild#157): " + key +
-				". Readers may follow symlinks out of the brain; remove them."
-		}
-		if key == reported {
-			continue
-		}
-		slog.Error("brain symlink tripwire", "finding", key)
-		if n == nil {
-			reported = key
-			continue
-		}
-		if err := n.Notify(ctx, msg); err != nil {
-			slog.Warn("symlink tripwire notify failed; will retry", "err", err)
-			continue
-		}
-		reported = key
-	}
-}

ingestion/internal/symlinkguard/symlinkguard_test.go

@@ -1,189 +0,0 @@
-package symlinkguard
-
-import (
-	"context"
-	"errors"
-	"os"
-	"path/filepath"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// hyperguild#157: the brain dir is a Syncthing sendreceive folder and
-// Syncthing syncs symlinks; several readers follow them out of the brain.
-// Until every reader goes through an os.Root, a symlink anywhere in the brain,
-// or a directory the scan cannot read (which could hide one), is an incident.
-
-func TestScanReportsSymlinksAtEveryDepthIncludingNestedGit(t *testing.T) {
-	brain := t.TempDir()
-	outside := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki", "w", "facts", ".git"), 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, ".git", "objects"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join(outside, "f"), filepath.Join(brain, "wiki", "w", "facts", "leak.md")))
-	require.NoError(t, os.Symlink(outside, filepath.Join(brain, "wiki", "dirlink")))
-	// PR #159 review: only the ROOT .git is skipped; a nested .git is not
-	// special to the brain readers, which walk into it.
-	require.NoError(t, os.Symlink(filepath.Join(outside, "g"), filepath.Join(brain, "wiki", "w", "facts", ".git", "leak.md")))
-	require.NoError(t, os.Symlink(outside, filepath.Join(brain, ".git", "objects", "alt")))
-
-	r, err := Scan(brain)
-	require.NoError(t, err)
-	assert.ElementsMatch(t, []string{"wiki/w/facts/leak.md", "wiki/dirlink", "wiki/w/facts/.git/leak.md"}, r.Symlinks)
-	assert.Empty(t, r.Unreadable)
-}
-
-// PR #159 review: WalkDir stopped at the first unreadable directory and the
-// startup check passed, while search (which keeps walking) served a planted
-// symlink. Scan now records the unreadable dir and keeps going.
-func TestScanReportsUnreadableDirsAndKeepsWalkingPastThem(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root reads mode-000 directories")
-	}
-	brain := t.TempDir()
-	locked := filepath.Join(brain, "aaa")
-	require.NoError(t, os.MkdirAll(locked, 0o755))
-	require.NoError(t, os.Chmod(locked, 0o000))
-	t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
-	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "zzz-planted")))
-
-	r, err := Scan(brain)
-	require.NoError(t, err)
-	assert.Equal(t, []string{"aaa"}, r.Unreadable)
-	assert.Equal(t, []string{"zzz-planted"}, r.Symlinks, "the walk continues past the unreadable dir")
-}
-
-func TestScanResolvesASymlinkedRootAndReportsSymlinkedEntriesInsideIt(t *testing.T) {
-	real := t.TempDir()
-	link := filepath.Join(t.TempDir(), "brain")
-	require.NoError(t, os.Symlink(real, link))
-	require.NoError(t, os.WriteFile(filepath.Join(real, "n.md"), []byte("x"), 0o644))
-	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(real, "inner")))
-	r, err := Scan(link)
-	require.NoError(t, err)
-	assert.Equal(t, []string{"inner"}, r.Symlinks)
-}
-
-func TestScanOfAMissingRootIsErrNotExist(t *testing.T) {
-	_, err := Scan(filepath.Join(t.TempDir(), "nope"))
-	assert.True(t, errors.Is(err, os.ErrNotExist), "got %v", err)
-}
-
-type recNotifier struct {
-	mu   sync.Mutex
-	msgs []string
-	fail int // fail the first N calls
-}
-
-func (r *recNotifier) Notify(_ context.Context, m string) error {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.msgs = append(r.msgs, m)
-	if r.fail > 0 {
-		r.fail--
-		return errors.New("ntfy down")
-	}
-	return nil
-}
-
-func (r *recNotifier) count() int { r.mu.Lock(); defer r.mu.Unlock(); return len(r.msgs) }
-
-func TestWatchNotifiesOncePerDistinctSetAndAgainForANewSet(t *testing.T) {
-	brain := t.TempDir()
-	n := &recNotifier{}
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go Watch(ctx, brain, 10*time.Millisecond, n)
-
-	time.Sleep(50 * time.Millisecond)
-	assert.Zero(t, n.count(), "a clean brain raises nothing")
-	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "first")))
-	require.Eventually(t, func() bool { return n.count() == 1 }, 2*time.Second, 10*time.Millisecond)
-	time.Sleep(60 * time.Millisecond)
-	assert.Equal(t, 1, n.count(), "the same set is reported once, not every tick")
-	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "second")))
-	require.Eventually(t, func() bool { return n.count() == 2 }, 2*time.Second, 10*time.Millisecond)
-}
-
-// PR #159 review: last was recorded before Notify, so an alert lost to an
-// ntfy outage was never retried while the symlink stayed.
-func TestWatchRetriesAnAlertThatFailedToSend(t *testing.T) {
-	brain := t.TempDir()
-	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "planted")))
-	n := &recNotifier{fail: 2}
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go Watch(ctx, brain, 10*time.Millisecond, n)
-	require.Eventually(t, func() bool { return n.count() == 3 }, 2*time.Second, 10*time.Millisecond)
-	time.Sleep(60 * time.Millisecond)
-	assert.Equal(t, 3, n.count(), "after one successful send, no more")
-}
-
-func TestWatchAlertsOnAnUnreadableDir(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root reads mode-000 directories")
-	}
-	brain := t.TempDir()
-	locked := filepath.Join(brain, "locked")
-	require.NoError(t, os.MkdirAll(locked, 0o755))
-	require.NoError(t, os.Chmod(locked, 0o000))
-	t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
-	n := &recNotifier{}
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go Watch(ctx, brain, 10*time.Millisecond, n)
-	require.Eventually(t, func() bool { return n.count() == 1 }, 2*time.Second, 10*time.Millisecond)
-	assert.Contains(t, n.msgs[0], "locked")
-}
-
-// PR #159 review: a non-positive interval panicked time.NewTicker inside the
-// goroutine and crashlooped the server.
-func TestWatchToleratesANonPositiveInterval(t *testing.T) {
-	brain := t.TempDir()
-	ctx, cancel := context.WithCancel(context.Background())
-	done := make(chan struct{})
-	go func() { Watch(ctx, brain, 0, nil); close(done) }()
-	cancel()
-	select {
-	case <-done:
-	case <-time.After(2 * time.Second):
-		t.Fatal("Watch did not return on cancel")
-	}
-}
-
-// PR #159 round 2: a brain root that can be entered but not listed (mode
-// 0100) made WalkDir fail at the root; the error was discarded and Scan
-// reported clean, while search (which goes straight into wiki/) still served
-// a planted symlink. A root that cannot be listed is now an error.
-func TestScanOfAnUnlistableRootIsAnError(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root lists mode-0100 directories")
-	}
-	brain := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki"), 0o755))
-	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "wiki", "leak.md")))
-	require.NoError(t, os.Chmod(brain, 0o100))
-	t.Cleanup(func() { _ = os.Chmod(brain, 0o755) })
-	_, err := Scan(brain)
-	require.Error(t, err)
-	assert.False(t, errors.Is(err, os.ErrNotExist), "an unlistable root is not a missing root")
-}
-
-// The same set that disappears and comes back is reported again.
-func TestWatchReportsASetAgainAfterItWasCleared(t *testing.T) {
-	brain := t.TempDir()
-	link := filepath.Join(brain, "planted")
-	n := &recNotifier{}
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go Watch(ctx, brain, 10*time.Millisecond, n)
-	require.NoError(t, os.Symlink(t.TempDir(), link))
-	require.Eventually(t, func() bool { return n.count() == 1 }, 2*time.Second, 10*time.Millisecond)
-	require.NoError(t, os.Remove(link))
-	time.Sleep(60 * time.Millisecond)
-	require.NoError(t, os.Symlink(t.TempDir(), link))
-	require.Eventually(t, func() bool { return n.count() == 2 }, 2*time.Second, 10*time.Millisecond)
-}