test(827): capture Gate0 runtime evidence

docs/compaction-refresh/probes/p1_sibling_attacker.py

@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+"""Same-UID sibling that attempts to claim the anchor's broker-minted id."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import socket
+import time
+from pathlib import Path
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--socket", required=True)
+    parser.add_argument("--state", required=True)
+    ns = parser.parse_args()
+    state_path = Path(ns.state)
+    for _ in range(200):
+        if state_path.exists():
+            break
+        time.sleep(0.025)
+    state = json.loads(state_path.read_text())
+    conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    conn.connect(ns.socket)
+    conn.sendall(
+        (
+            json.dumps(
+                {"action": "claim-session", "session_id": state["session_id"]},
+                sort_keys=True,
+            )
+            + "\n"
+        ).encode()
+    )
+    response = json.loads(conn.makefile("r", encoding="utf-8").readline())
+    conn.close()
+    print(
+        json.dumps(
+            {
+                "attacker_pid": os.getpid(),
+                "attacker_uid": os.getuid(),
+                "victim_session_id_known": True,
+                "broker_decision": response.get("decision"),
+                "broker_reason": response.get("reason"),
+            },
+            sort_keys=True,
+        )
+    )
+    raise SystemExit(0 if response.get("decision") == "REJECT" else 1)
+
+
+if __name__ == "__main__":
+    main()