fix(quorum): make health receipts group-readable

automation/health_probe_common.py

@@ -129,7 +129,12 @@ def atomic_receipt(path: Path, value: dict[str, Any]) -> None:
         raise ProbeError("unsafe_receipt_directory_metadata")
     fd, temporary = tempfile.mkstemp(prefix=f".{path.name}.", dir=parent)
     try:
-        os.fchmod(fd, 0o600)
+        # Receipts contain availability metadata only. Give the dedicated
+        # aios-quorum group read access so its unprivileged controller can
+        # consume them, while retaining root ownership and no public access.
+        if os.name == "posix":
+            os.fchown(fd, 0, info.st_gid)
+        os.fchmod(fd, 0o640)
         with os.fdopen(fd, "w", encoding="utf-8") as handle:
             json.dump(value, handle, sort_keys=True, separators=(",", ":"))
             handle.write("\n")

tests/test_aios_health_probes.py

@@ -15,6 +15,12 @@ SPEC.loader.exec_module(common)
 
 
 class HealthProbeSecurityTests(unittest.TestCase):
+    def test_availability_receipts_are_readable_only_by_quorum_group(self):
+        source = MODULE.read_text(encoding="utf-8")
+        self.assertIn("os.fchown(fd, 0, info.st_gid)", source)
+        self.assertIn("os.fchmod(fd, 0o640)", source)
+        self.assertNotIn("os.fchmod(fd, 0o644)", source)
+
     def test_codex_probe_commands_are_group_readable_by_watcher(self):
         unit = (
             Path(__file__).resolve().parents[1]