# The root instance-control channel's socket (isolated-exec design §5.2).
# In /run/carlos-control, a root-owned directory beside /run/carlos, never
# under it: an instance's namespace replaces /run/carlos with an empty
# tmpfs, and nothing an instance can reach must resolve to this path. Owned
# by carlos so the agent can connect; the service authenticates the peer
# process itself (§5.4).
[Unit]
Description=carlos instance control socket (agent to root)

[Socket]
ListenStream=/run/carlos-control/control.sock
SocketUser=carlos
SocketGroup=carlos
SocketMode=0600
Accept=no

[Install]
WantedBy=sockets.target