feat(jail): provision disposable Oxy testbed with ZFS workload metadata #25

Closed

clawdie wants to merge 0 commits from clawdie/feat/oxy-testbed-jail into main AGit

clawdie commented

2026-10-29 14:28:30 +01:00

Owner

Summary

Adds scripts/jail-testbed.sh, a repeatable disposable Bastille testbed provisioner, and extends the jail-run.sh destroy guard so jails whose exact root dataset carries clawdie:lifecycle=temp can be destroyed without a -test suffix.

The provisioner supports provision|verify|destroy|status, refuses protected production names such as cms, records disposability in metadata, writes the three-layer lineage stamp, makes the jail root readable for unprivileged Colibri probes, and stages the host Oxigraph 0.4.9 binary inside the jail.

Safety

cms is never targeted; BUILTIN_PROTECTED_NAMES is enforced before any mutation.
Provision/destroy require root; the helper prints the exact root-tmux command if run unprivileged.
Destroy requires the exact-name confirmation and either a disposable name or local clawdie:lifecycle=temp; --allow-production remains the explicit override.
Hermetic tests use only PATH shims and temporary directories.

Tests

sh scripts/tests/jail-run-test.sh
sh scripts/tests/test-jail-testbed.sh
./scripts/ci-checks.sh

## Summary Adds `scripts/jail-testbed.sh`, a repeatable disposable Bastille testbed provisioner, and extends the `jail-run.sh` destroy guard so jails whose exact root dataset carries `clawdie:lifecycle=temp` can be destroyed without a `-test` suffix. The provisioner supports `provision|verify|destroy|status`, refuses protected production names such as `cms`, records disposability in metadata, writes the three-layer lineage stamp, makes the jail root readable for unprivileged Colibri probes, and stages the host Oxigraph 0.4.9 binary inside the jail. ## Safety - `cms` is never targeted; `BUILTIN_PROTECTED_NAMES` is enforced before any mutation. - Provision/destroy require root; the helper prints the exact root-tmux command if run unprivileged. - Destroy requires the exact-name confirmation and either a disposable name or local `clawdie:lifecycle=temp`; `--allow-production` remains the explicit override. - Hermetic tests use only PATH shims and temporary directories. ## Tests ```sh sh scripts/tests/jail-run-test.sh sh scripts/tests/test-jail-testbed.sh ./scripts/ci-checks.sh ```

clawdie added 14 commits

2026-10-29 14:28:30 +01:00

feat(jail): add disposable testbed provisioner and lifecycle destroy guard

format-check / gates (pull_request) Successful in 6s

Details

b9466d1373

Add scripts/jail-testbed.sh (provision|verify|destroy|status) for a metadata-disposable Bastille jail. It writes a local clawdie:lifecycle tag, root-base lineage stamp, 0755 probe-readable directories, and stages the host oxigraph binary into the jail. Provisioning is idempotent and refuses protected names such as cms.

Extend jail-run.sh destroy authorization to accept a non-name-disposable jail when its exact root dataset carries local clawdie:lifecycle=temp, while retaining --allow-production as the explicit override. Add hermetic coverage for the provisioner and the new destroy path, and wire both tests into ci-checks.sh.