dan-claude-bot 56eed6250e test+ci: the multi-user rehearsal, and CI that runs it on a real incus (#74) ... drill/multiuser.sh: two throwaway users, real grants, real boxes, and the contract measured from INSIDE them — #74's criteria (a)-(f) plus what the findings added: the cross-user sibling drop, the closed private-bridge escape hatches, incus-user re-sync survival, scoped revoke --purge. Its own first runs are in RUNS.md (MU-1..3): both false FAILs were the instrument, and both lessons (keep the mint's narration; probe a SIBLING's name, never your own — /etc/hosts answers for you) are now comments in the script. test/cli.sh: box_tier() driven against a shim id for all five cases (including both-groups → admin: membership wins at the socket), the two copies diffed byte-identical, the tier scripts' usage contracts driven for real, and grep-guards on every load-bearing line a daemon-free run cannot exercise — the expose guard's position, the boxnet-and-only-boxnet narrowing, the snapshot allow, 'incus:snapshot restore'. ci.yml: a second job stands up the real stack on the runner (setup-host, doctor, then the rehearsal in container mode) — every PR now proves the tier's semantics against a live daemon. The tier's mechanics are instance-type-independent (the drop, the ACL, dns.mode and port_isolation bind to boxnet, not the instance); the VM trust boundary itself stays a real-hardware ritual, like the full drill. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-18 04:09:48 +00:00
..
cli.sh	test+ci: the multi-user rehearsal, and CI that runs it on a real incus (#74)	2026-07-18 04:09:48 +00:00