Add Remote session foundations and feasibility checks

Add opt-in Tentacle protocol 1.1, explicit remote grants, lifecycle IPC and expiring core leases in both SDKs. Revoke access before update preparation, including failed updates.

Add transient secret entries, shared Braille cell export and isolated Xorg recovery experiments with focused tests and documented limitations. Production consent, desktop services and live interoperability remain pending.

internal/tentacle/manager.go

@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"git.stormux.org/storm/cthulhu/internal/input"
+	"git.stormux.org/storm/cthulhu/internal/tentaclewire"
 )
 
 type Limits struct {
@@ -35,6 +36,8 @@ func DefaultLimits() Limits {
 // Spec is a validated launch description, independent of package metadata.
 // Program[0] must be absolute; arguments are never interpreted by a shell.
 type Spec struct {
+	SessionEvents  bool     // Opt in to protocol 1.1 lifecycle calls and events.
+	RemoteGrants   []string // Install grants only; do not authorize desktop access.
 	ID             string
 	Program        []string
 	Directory      string
@@ -60,6 +63,8 @@ type Manager struct {
 	containment       *containment
 	supervisorProgram []string
 	cleanupError      error
+	remoteMutex       sync.Mutex
+	remoteOwner       *Session
 }
 
 // NewSupervisedManager launches a private lifetime helper for each Tentacle.
@@ -144,12 +149,17 @@ func (manager *Manager) Start(ctx context.Context, spec Spec) (*Session, error)
 		return nil, err
 	}
 	spec.Program = append([]string{}, spec.Program...)
+	spec.RemoteGrants = append([]string(nil), spec.RemoteGrants...)
+	queueSize := manager.limits.PendingPerProcess + 2
+	if spec.SessionEvents {
+		queueSize = tentaclewire.SessionQueueSize
+	}
 	sessionContext, cancel := context.WithCancel(ctx)
 	outputContext, revokeOutput := context.WithCancel(sessionContext)
 	session := &Session{manager: manager, spec: spec, identity: hex.EncodeToString(identity[:]),
 		outputContext: outputContext, revokeOutput: revokeOutput,
 		ctx: sessionContext, cancel: cancel, state: Starting, ready: make(chan struct{}), done: make(chan struct{}),
-		stop: make(chan struct{}), revoked: make(chan struct{}), outbound: make(chan outgoing, manager.limits.PendingPerProcess+2),
+		stop: make(chan struct{}), revoked: make(chan struct{}), outbound: make(chan outgoing, queueSize),
 		pending: make(map[string]*pendingCall)}
 	manager.sessions[spec.ID] = session
 	go session.run()
@@ -196,6 +206,9 @@ func (manager *Manager) Shutdown(ctx context.Context) error {
 }
 
 func validate_spec(spec Spec) error {
+	if !tentaclewire.ValidRemoteGrants(spec.RemoteGrants) || len(spec.RemoteGrants) > 0 && !spec.SessionEvents {
+		return errors.New("invalid remote grants")
+	}
 	if spec.ReaderSettings && !spec.Interaction || spec.Interaction && !spec.Presentation || !valid_id(spec.ID) || len(spec.Program) == 0 || len(spec.Program) > 32 ||
 		!filepath.IsAbs(spec.Program[0]) || (spec.Directory != "" && !filepath.IsAbs(spec.Directory)) {
 		return errors.New("invalid local tentacle launch")