P0: broker attest exact Mac control-plane and ACL readiness

[100yenadmin]

Problem

The Mac can prove that a Tailscale-compatible client is installed, running, enrolled, and locally online. It cannot authoritatively prove that the client is connected to the evaOS customer’s assigned control plane or that the required customer-scoped ACL route is allowed.

The bridge therefore omits correct_control_plane and acl_allowed, and Workbench #664 correctly keeps readiness blocked. Those facts need a broker/control-plane authority contract; they must never be guessed from a 100.x address, interface, local client output, or stale connector row.

Required authority contract

• For the exact authenticated customer/device/grant scope, return redacted booleans for:
  • correct_control_plane;
  • acl_allowed;
  • freshness/expiry sufficient to reject stale proof.
• Bind proof to the active device identity and current enrollment/grant, not a display label or pending row.
• Revoke/demote immediately on wrong network, ACL denial, grant expiry, stop/revoke, kill switch, device replacement, or offline transition.
• Do not expose control-plane URLs, ACL contents, private addresses, connector endpoints, tokens, customer data, or raw logs.
• Keep local Workbench evidence and authoritative broker evidence separate in diagnostics and audit proof.

Acceptance proof

• exact customer/device/grant, stale row, wrong control plane, ACL denial, offline, revoke, and replay tests;
• renderer receives booleans and safe reason codes only;
• P0: add typed Mac onboarding prerequisites #664 classification reaches online only when all six network booleans are true;
• P0: Mac & iPhone readiness can appear ready before end-to-end broker runtime control works #655 canonical customer_mac_status, desktop_control_status, and desktop_see remain the end-to-end exit gate.

Dependencies

• Parent P0: P0: Workbench fresh-Mac onboarding depends on unbundled Python and manual private-network setup #662
• Typed Workbench consumer: P0: add typed Mac onboarding prerequisites #664
• Local bridge producer: P0: expose redacted Workbench readiness evidence electricsheephq/evaos-desktop-bridge#313
• Existing Mac-control tracker: Sprint: Mac Control Contract Unification + Matt-Style Reconciler #480

Proof boundary

Local Tailscale status, a private address, or a connector health response does not prove the assigned control plane, ACL authorization, or customer readiness.

[coderabbitai]

🔗 Related PRs

#391 - Restore beta3 Mac pairing baseline [merged]
#403 - fix: recover Mac control installed app states [merged]
#415 - Fix Mac control permission proof reconciliation [merged]
#416 - Fix Mac control connector-service ready reconciliation [merged]
#465 - Fix Mac connector readiness probe [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[100yenadmin]

Dependency boundary now explicit: draft dashboard PR #658 mints and tracks one-use private-network material but deliberately cannot mark it consumed/ready. Enrollment remains pending until this issue provides authoritative Headscale node presence and exact customer ACL proof. Client possession or submission of the key is not readiness evidence.