fix(launcher-standard): move PID/log to XDG dirs (security: symlink-attack hardening)

[hyperpolymath]

Summary

The launcher-standard specified /tmp/{app-name}-server.pid and
/tmp/{app-name}-server.log as the required runtime paths. Predictable
names in a world-writable directory are a symlink-attack target on
any shared host:

• An attacker can pre-create /tmp/<app>-server.pid containing their
  own PID. The launcher's is_running() returns true, and
  stop_server() will kill <attacker-pid> — DoS or signal-handling
  abuse.
• Similar pattern for the log: pre-symlink /tmp/<app>-server.log →
  some target the attacker wants clobbered, then the launcher's
  nohup ... > LOG_FILE does the write.
• The standard already warns "don't log sensitive information"
  (§Best Practices > Security), but the predictable-path defence is
  belt-and-braces.

Fix

Route both to XDG dirs with documented fallback ladders:

• PID → ${XDG_RUNTIME_DIR:-${TMPDIR:-/tmp}}/<app>-server.pid.
  $XDG_RUNTIME_DIR is mode 0700 and user-scoped per the XDG Base
  Directory spec (Linux). $TMPDIR covers macOS / BSDs (typically
  /var/folders/.../T, per-user). /tmp remains only as a last-resort
  fallback for hosts that set neither (rare).
• Log → ${XDG_STATE_HOME:-$HOME/.local/state}/<app>/server.log.
  Per-user, survives reboot, not world-writable. The <app> subdir
  isolates each launcher's logs.

Changes

Both files in the same commit per the lock-step requirement
(and the gate in #172):

• launcher/launcher-standard.a2ml
  • [runtime].pid-file-pattern / log-file-pattern updated with
    fallback ladders + commented rationale
  • [disinteg].preserve updated to reference the new log dir
• docs/UX-standards/launcher-standard.adoc
  • Standard Launcher Template snippet uses XDG paths + mkdir -p
    for the state dir
  • §What --disinteg removes / does not remove: paths updated
  • Desktop File Exec= example log-arg updated
  • Calling Convention daemon-chain example updated
  • Debugging Checklist now uses $LOG_FILE / $PID_FILE variable
    refs rather than literal paths
  • §Best Practices > Logging: lead bullet rewritten with rationale
  • §Best Practices > Security: new lead bullets explaining the
    attack vector and the XDG choice
  • §Compliance Checklist: "Log to predictable location (/tmp/...)"
    replaced with the XDG requirement

Remaining /tmp/ mentions in the prose are in forbidden-patterns
text that explicitly tells readers NOT to use /tmp — intentional.

Compatibility

Bash-expansion syntax (${VAR:-${VAR2:-/literal}}) matches the
shell-expansion style already in the a2ml (e.g.
$HOME/.local/share/applications in [integration.linux]). Any
consumer that already interpolates $HOME here will handle ${...:-...}
without changes.

Existing launchers that hard-coded /tmp/<app>-server.pid continue to
work but become non-compliant; no break for them, just a green-field
contract change for new launchers and a flagged migration for old
ones.

Coordination

• Independent of fix(launcher-standard): resolve 3 cross-doc contradictions #170, fix(launcher-standard): replace hard-coded /var/mnt/eclipse/... with a search-ladder #171, ci: add launcher-standard prose↔a2ml lock-step gate #172, feat(launcher-standard): require --version mode with machine-greppable format #173. No file overlap.
• Lock-step gate (ci: add launcher-standard prose↔a2ml lock-step gate #172) will go green on first push (both files in
  diff).

Notes

• Spec [spec].version intentionally NOT bumped — five PRs (fix(launcher-standard): resolve 3 cross-doc contradictions #170,
  fix(launcher-standard): replace hard-coded /var/mnt/eclipse/... with a search-ladder #171, feat(launcher-standard): require --version mode with machine-greppable format #173, this one, plus any future) all touch the contract; the
  merger sequences them.

Test plan

• a2ml parses (python tomllib): new patterns round-trip cleanly,
  [disinteg].preserve reflects the new log path
• No /tmp/ literals remain in non-forbidden-patterns prose
  (grep verified)
• Live lock-step gate (ci: add launcher-standard prose↔a2ml lock-step gate #172) goes green on first push

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 118 issues detected

Severity	Count
🔴 Critical	64
🟠 High	43
🟡 Medium	11

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "deno-ci-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance-reusable.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Python file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml-templates/state-scm-to-v2.py",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/a2ml/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/lol/test/vitest.config.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/standards/standards/k9-svc/bindings/deno/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "Agda postulate assumes without proof -- potential soundness hole (4 occurrences, CWE-704)",
    "type": "agda_postulate",
    "file": "/home/runner/work/standards/standards/lol/proofs/theories/information_theory.agda",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "believe_me undermines formal verification (1 occurrences, CWE-704)",
    "type": "believe_me",
    "file": "/home/runner/work/standards/standards/lol/src/abi/Locale.idr",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "Wildcard CORS -- restrict to specific origins or use env var (1 occurrences, CWE-942)",
    "type": "js_wildcard_cors",
    "file": "/home/runner/work/standards/standards/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence