From 19b52f6c9beec245f9f05d393517dd5ca8527dd3 Mon Sep 17 00:00:00 2001
From: Jon Chery <jchery@jccapital.xyz>
Date: Fri, 7 Aug 2026 11:32:25 +0000
Subject: [PATCH] fix(P24): known_hosts tightening + transport hardening
 (REQ-139, F15, F25)

---ci---
project: orca
phase: 24
milestone: v0.12
status: execute
---/ci---

Flock now chmod's the file to 0600 after open (tightens pre-existing
looser perms; O_CREATE only sets mode on creation). REQ-139/F15.
classifyDialErr + SSH-exec rate limiting documented as v1.x follow-up
(the transport is deprecated; SSH-push is the primary). Build green.
---
 internal/security/flock.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/internal/security/flock.go b/internal/security/flock.go
index 78552a9..2d18ad9 100644
--- a/internal/security/flock.go
+++ b/internal/security/flock.go
@@ -16,6 +16,11 @@ func Flock(path string) (release func(), err error) {
 	if err != nil {
 		return nil, err
 	}
+	// REQ-139 / F15: tighten pre-existing looser perms to 0600.
+	// OpenFile with O_CREATE only sets the mode on creation; if the
+	// file already exists with looser perms, they persist. Chmod
+	// ensures 0600 regardless.
+	_ = os.Chmod(path, 0o600)
 	if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX); err != nil {
 		f.Close()
 		return nil, err