p2.4: restricted workspace for permitted callers

guardian-star context is allowed only when the authenticated caller is in
permit_restricted and mapped to that workspace. Fleet callers remapped to it
still refuse. CLI client.toml: SIFT_CLIENT, then $HERMES_HOME/sift, then ~/.config.

cmd/sift/fetchcmd.go

@@ -19,12 +19,29 @@ type clientCfg struct {
 	KeyFile string `toml:"key_file"`
 }
 
+func clientConfigPath() string {
+	if p := os.Getenv("SIFT_CLIENT"); p != "" {
+		return p
+	}
+	if h := os.Getenv("HERMES_HOME"); h != "" {
+		p := filepath.Join(h, "sift", "client.toml")
+		if _, err := os.Stat(p); err == nil {
+			return p
+		}
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return filepath.Join(".config", "sift", "client.toml")
+	}
+	return filepath.Join(home, ".config", "sift", "client.toml")
+}
+
 func loadClient() (base, key string, err error) {
 	home, err := os.UserHomeDir()
 	if err != nil {
 		return "", "", err
 	}
-	path := filepath.Join(home, ".config", "sift", "client.toml")
+	path := clientConfigPath()
 	b, err := os.ReadFile(path)
 	if err != nil {
 		return "", "", fmt.Errorf("read %s: %w", path, err)
@@ -132,8 +149,8 @@ func fetchMain() {
 		}
 	}
 	if ctx, ok := env["context"].([]any); ok && len(ctx) > 0 {
-		fmt.Println("--- fleet context ---")
-		fmt.Println("(prior fleet knowledge, not page content)")
+		fmt.Println("--- prior context ---")
+		fmt.Println("(prior knowledge, not page content)")
 		for _, it := range ctx {
 			m, _ := it.(map[string]any)
 			fmt.Printf("- %v: %v\n", m["peer"], m["content"])

cmd/sift/fetchcmd_test.go

@@ -1,6 +1,11 @@
 package main
 
-import "testing"
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
 
 func TestParseFetchFlagsAfterURL(t *testing.T) {
 	url, mode, _, q, noCtx, rec, _, err := parseFetchArgs([]string{"https://example.com/x", "--question", "what", "--mode", "digest", "--recover"})
@@ -28,3 +33,36 @@ func TestParseFetchRejectsExtraPositional(t *testing.T) {
 		t.Fatal("want error")
 	}
 }
+
+func TestClientConfigPathSIFTClient(t *testing.T) {
+	t.Setenv("SIFT_CLIENT", "/tmp/sift-client.toml")
+	if got := clientConfigPath(); got != "/tmp/sift-client.toml" {
+		t.Fatalf("got %q", got)
+	}
+}
+
+func TestClientConfigPathHermesHome(t *testing.T) {
+	dir := t.TempDir()
+	p := filepath.Join(dir, "sift")
+	if err := os.Mkdir(p, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	cfg := filepath.Join(p, "client.toml")
+	if err := os.WriteFile(cfg, []byte("x"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("SIFT_CLIENT", "")
+	t.Setenv("HERMES_HOME", dir)
+	if got := clientConfigPath(); got != cfg {
+		t.Fatalf("got %q want %q", got, cfg)
+	}
+}
+
+func TestClientConfigPathHermesHomeMissingFallsThrough(t *testing.T) {
+	t.Setenv("SIFT_CLIENT", "")
+	t.Setenv("HERMES_HOME", t.TempDir())
+	got := clientConfigPath()
+	if !strings.HasSuffix(got, filepath.Join(".config", "sift", "client.toml")) {
+		t.Fatalf("got %q", got)
+	}
+}

cmd/sift/serve.go

@@ -121,7 +121,7 @@ func serveMain() {
 		if len(allow) == 0 {
 			allow = []string{"hermes-fleet"}
 		}
-		srv.Ctx = &fleetctx.Client{Base: cfg.Context.Honcho, Allow: allow, Log: log}
+		srv.Ctx = &fleetctx.Client{Base: cfg.Context.Honcho, Allow: allow, Permit: cfg.Context.PermitRestricted, Log: log}
 	}
 	if len(cfg.SelfIP.Sources) > 0 {
 		disc := &selfip.Discoverer{