[karauda]

Evidence now leaves a plane only over a unix socket whose peer the plane checks, or over TLS (ADR-0080). Before, the collector's bearer credential went in plaintext to whoever held a loopback port while the collector was down.

• An http:// export.endpoint and export.allow_plaintext: true are refused at load. Each refusal names 0.17 and the two ways that remain: unix:///path with export.collector_uid, or https://. export.allow_plaintext stays a known key that is refused, not an unknown one.
• A unix export socket's path is bounded at 103 bytes, as listener.socket is.
• The OpenTelemetry exporter refuses http even when built directly. otel.Options.AllowPlaintext is gone.
• collect --listen takes unix:///path only, and the collector refuses a TCP listener handed to it.
• dev runs its collector on a socket in a directory of its own under TMPDIR (0700, its own uid), and refuses a TMPDIR too long for one.
• doctor drops the plaintext warning and names an https endpoint as export over TLS.
• Every test rig and example that ran a collector over TCP now uses a unix socket; https keeps its tests.

Pages: ADR-0080 (new), pointers in ADR-0014, 0020 and 0072, the generated configuration reference, cli, dev, five guides, the threat model, privacy, benchmarks (the published run used loopback TCP), status, CHANGELOG (Breaking, with the upgrade step).

Verified:

• Load refusals through the exported loader: http, the old key, a 104-byte path refused and 103 loading, https accepted.
• collect and the collector refuse TCP. The exporter refuses http built directly. The exporter's own client sends nothing to a collector whose certificate the system does not trust.
• Each of these mutants fails a test:
  • http accepted again;
  • the 103 bound dropped;
  • collect binding TCP;
  • the collector's TCP guard off;
  • allow_plaintext accepted;
  • any scheme with a host accepted, at load or in the exporter;
  • dev's collector uid off by one;
  • dev's socket-path estimate set to zero;
  • certificate checks off on the exporter's own client.
• Test binaries for adapters/otel, bench, both commands, both examples with tests, internal/docscheck, configdoc, internal/gateway/e2e, internal/gatewayconfig, internal/metrics, internal/recovery, internal/scenario, internal/trailfile, internal/console, internal/core/approval and internal/core.
• make vet (GOOS=windows included), check-imports, check-brand, check-sizes, golangci-lint.

Not verified or not covered:

• The Python client's end-to-end test, scripts/check-mcp-client.sh and the hook bridge's qualification plane.sh were edited for the unix collector and traced, not run here; CI runs the MCP client check.
• dev and collect build unix:// + path while the plane percent-decodes the URL: a TMPDIR holding %41 binds one path and dials another. That fails closed, since evidence never arrives.
• dev's TMPDIR advice is added to every export.endpoint refusal.
• collect --listen has no 103-byte bound of its own.
• The redirect test does not reach the https own-client path.
• Benchmarks were not re-measured.

docs-impact: 0 uncovered surfaces; the frozen paths are the four ADRs, the ADR index and status. The suspect pages were searched for http export, allow_plaintext, a TCP collect --listen and loopback collectors; only pdp.allow_plaintext (another feature) remains.