Home devices: declare the LAN printer once; an app with a grant prints through the forge #10413

Home devices: an app can print to the owner's LAN printer, and nothing more.

The owner's new app, trevato/morning-paper (#4 there), prints a newspaper each morning on his home printer: a Brother at 192.168.1.161, IPP on port 631 at /ipp/print. The forge's machine, the vxrail at 192.168.1.21, sits on the same LAN.

His phone only saw the printer with Tailscale off, so the forge has to own this path. Nothing may depend on how his phone is set up.

Done when:

• Declaring a device. The owner declares a device on the forge (name, kind printer, the IPP URL) and grants it to an app. The forge probes it with IPP Get-Printer-Attributes and shows its model, state and supplies on a device page, following the P9 Calm rules: one line when fine.
• Printing. An app with the grant calls a forge print endpoint with a PDF (at most 10 MB and 20 pages). The forge relays it as an IPP Print-Job and returns the job state.

- Apps get no other LAN reach: the relay accepts only declared devices, and a test proves an app can't reach other addresses.

• Limits. Per-app daily caps, set by the owner; the default is 10 jobs a day. Every job is logged with the app, page count and outcome.
• Tests. The relay runs against a fake IPP server, covering the grant check, the caps and a refused LAN address.

Parked by the crew: the check stayed red through 2 automatic tries (pull #10419 closed; its branch mason/10413-home-devices-declare-the-lan-printer-onc at 73036c7a2100 keeps the work so far). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check stayed red through 2 automatic tries (pull #10481 closed; its branch scout/10413-home-devices-declare-the-lan-printer-onc at 997103cc790c keeps the work so far).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #10419 closed; its branch mason/10413-home-devices-declare-the-lan-printer-onc at 73036c7a2100 keeps the work so far)
2. the check stayed red through 2 automatic tries (pull #10481 closed; its branch scout/10413-home-devices-declare-the-lan-printer-onc at 997103cc790c keeps the work so far)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split: two runs went red trying to land declaring, relaying and capping in one pull. Now three steps, each waiting for the one before: #10567 declare the printer and probe it over IPP (device page), #10568 an app with a grant prints a PDF and can reach nothing else on the LAN, #10569 per-app daily caps (default 10) and a job log.

Printer facts from a real test print (11-10 03:55Z): the owner's printer is a Brother HL-L2370DW at 192.168.1.161, IPP at /ipp/print. document-format-supported is only image/pwg-raster, image/urf and application/octet-stream. PDF is refused (IPP status 0x040A). PostScript sent as application/octet-stream is accepted (status 0x0000), since the printer speaks BR-Script3. So the relay must convert PDF to PostScript or PWG raster before Print-Job, with no new dependency: render to PWG raster in-process, or carry a small PS writer.

Correction to my last comment: the PostScript test did not work. The HL-L2370DW took application/octet-stream and printed the PostScript as a stack of garbage text pages, then asked to switch the paper tray (T1, a size mismatch). The relay must send image/pwg-raster at US Letter, 300 dpi, mono, with media set to na_letter, never PS or PDF as octet-stream. It must also check media-ready and the page count before sending, refuse anything over the job's declared pages, and cancel the job if the printer reports a media mismatch.