feat(skillfs): allow skill meta passthrough

[kongche-jbw]

Why

SkillFS currently hides and protects .skill-meta even when no Skill Ledger
integration is configured. That prevents an independently deployed Ledger from
managing metadata through the SkillFS FUSE view in zero-integration coexistence
mode.

What changed

• Derive one mount-scoped metadata policy from the presence of an active
  resolver or enabled trusted writer.
• Treat .skill-meta as ordinary passthrough content when both integration
  signals are absent, consistently across reads, listings, mutations, links,
  xattrs, and both rename endpoints.
• Preserve protected Current, Snapshot, Hidden, trusted-writer, and explicitly
  injected policy behavior for flat and Hermes layouts.
• Keep Hermes in-place link classification on the fd-bypass path and revalidate
  Hidden state at both link endpoints.
• Enable kernel permission checks for allow_other mounts so backing POSIX
  permissions remain authoritative across UIDs.
• Add FUSE regression coverage for all configuration combinations, metadata
  lifecycle operations, links, xattrs, resolver state changes, and real
  source-equals-mountpoint Hermes topology.

Related issue

closes #2042

User / Agent impact

Without an active resolver or enabled trusted writer, agents and independently
deployed Ledger processes now see .skill-meta as ordinary filesystem content
through SkillFS. Integrated deployments retain the existing hidden and
protected metadata view.

Risk and compatibility

• Public CLI, API, configuration, or documented behavior changed
• Privileged or security-sensitive behavior changed
• Cross-component contract changed
• Migration or rollback guidance is needed

This intentionally changes the default metadata behavior when neither
integration capability is configured. Deployments relying on implicit
.skill-meta protection must enable an active resolver or trusted writer.
--security-mode selects in-place topology only and does not enable metadata
protection by itself. The selected policy is fixed for the mount lifetime.

Validation

• cargo +1.86.0 fmt --all -- --check
• cargo +1.86.0 clippy --workspace --all-targets -- -D warnings
• cargo +1.86.0 test --workspace
• scripts/test.sh with real FUSE and managed-mount smoke coverage
• focused link/FIFO tests: 23/23 passed
• metadata view and lifecycle tests: 23/23 passed
• xattr tests: 11/11 passed
• security-mode runtime tests: 8/8 passed
• cargo +1.86.0 doc --workspace --no-deps
• git diff --check

The root-only multi-UID allow_other regression is included; it skips when
the local test runner is not root.

Documentation and rollback

The bilingual README and user guide, CLI help/runtime diagnostics, and
capability record now document the passthrough/protected mode matrix and
migration requirement. Operators can retain the former protected behavior by
configuring an active resolver or trusted writer. Reverting this commit
restores unconditional metadata protection.

[kongche-jbw]

Relationship to the related issues and PR

This PR is the direct implementation of #2042.

• [skillfs] feat: support .skill-meta passthrough without Ledger integration #2042 — zero-integration coexistence: this PR closes the filesystem
  compatibility gap. When neither an active resolver nor an enabled trusted
  writer is configured, SkillFS treats .skill-meta as ordinary passthrough
  content so an independently deployed Skill Ledger can manage its complete
  metadata lifecycle through the FUSE path.
• [skillfs] SkillFS: restrict .skill-meta access to trusted processes and expose live metadata for trusted access #1115 — protected trusted-process access: this behavior is preserved.
  Configuring a trusted writer keeps the mount in protected mode; trusted and
  untrusted callers continue to follow the existing live-metadata access rules.
• [skillfs] Provide a read-only SkillFS resolver for Skill Ledger live source lookup #1233 / [sec-core] Align Skill Ledger around canonical skill paths and SkillFS live source resolution #1235 — resolver-based integrated mode: these issues define the
  integrated SkillFS/Ledger contract. Configuring the active resolver keeps
  .skill-meta hidden and protected in the FUSE view while Ledger resolves and
  operates on the live backing path.
• [skillfs] feat: Run SkillFS as a sidecar on ACS #2028 / feat(skillfs): support container sidecars #2057 — ACS and Kubernetes sidecar deployment: feat(skillfs): support container sidecars #2057 provides the
  privileged SkillFS FUSE sidecar, shared-volume mount propagation, workload
  visibility, and lifecycle tooling tracked by [skillfs] feat: Run SkillFS as a sidecar on ACS #2028. This PR does not duplicate
  that deployment work. It supplies the missing .skill-meta semantics when
  SkillFS and Ledger/sec-core coexist without cross-container resolver or
  trusted-writer integration.

In short, #2057 makes the SkillFS view available across containers; this PR
makes that view usable by an independent Ledger in zero-integration mode.

How this PR satisfies #2042

1. It derives one mount-scoped decision:
   protect_skill_meta = active_resolver || trusted_writer_enabled.
2. The decision is fixed for the mount lifetime and is not changed by runtime
   resolver state.
3. Read, lookup, listing, mutation, access, setattr, xattr, link, symlink, and
   both rename endpoints use the same effective policy.
4. Both flat and Hermes layouts support ordinary metadata creation, discovery,
   updates, renames, links, xattrs, and deletion in passthrough mode.
5. Current, Snapshot, Hidden, resolver, and trusted-writer behavior remains
   protected and regression-tested.

This PR intentionally does not add cross-container control-socket
authentication, raw-path translation, reverse notifications, or dynamic policy
switching; those remain outside #2042 and separate from the #2028/#2057 sidecar
baseline.

[qoderai]

[P2] Hermes symlink classification now derives nested known skills by scanning source_root rather than the skill store when PathType::NestedPassthrough, which can mis-classify targets for skills that exist in the store but lack backing directories or for non-skill directories. This may weaken cross-skill link safeguards for nested layouts.

[P2] Passthrough .skill-meta mounts allow full user.* xattr mutation while resolver-enabled protected mode continues to deny user.* xattrs on .skill-meta, creating a policy difference on the same metadata tree that may surprise operators expecting consistent semantics.

[P2] Hermes protected metadata symlink/hardlink denials now consistently surface EACCES only instead of EACCES or EROFS, which may change error-driven behavior or monitoring expectations that previously relied on distinguishing EROFS from EACCES for nested metadata link attempts.

---

🤖 Generated by Qoder • View workflow run

[kongche-jbw]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3711a04fc7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[1570005763]

The no-integration passthrough direction matches #2042, but the six inline findings below should be addressed before merge. Findings 1 and 3 are pre-existing gaps newly exposed or extended by this PR; finding 5 is an unfulfilled acceptance criterion; findings 2 and 4 are newly introduced regressions; finding 6 is a security-sensitive documentation and migration contract mismatch.