dan-claude-bot a8d0f64e48 test(cli): the seed contract, driven — and the absence, fail-closed (#81) ... - render_userdata extracted and DRIVEN: defaults pin heavy-duty/rig@main on both the installer URL and the installer's env; RIG_REPO/RIG_REF override at mint; a shell-shaped repo, a spaced ref and a newline-smuggled repo all die on the host (bash =~ anchors the whole string — one clean line cannot sneak past it the way a line-oriented grep -q lets it). - BOX_BOOTSTRAP_ROLE through the real parser: round-trips, and a shell-shaped value dies at the gate. - Per-template sweep grows the #81 contract: BOX_USER matches the user the cloud-init actually creates; a role-bearing seed installs rig carrying BOTH pin tokens; and absence greps over EFFECTIVE cloud-init lines (comments may name what they refuse — #69's idiom) prove no agent CLI, no docker, no tailscale/authkey/ssh, no write_files heredocs, in ANY template. Want-exit 1: re-adding tenant content goes red. - cmd_new pinned: user-data reaches Incus through render_userdata; the auto-run orders after the cloud-init wait and sits under the T_BOOTSTRAP_ROLE guard; the failure path names the re-run; the workload join is printed, never exec'd; no template names a creds-holding role. - staging's boot demands pinned to the file; blank proven roleless and rig-less. 283 passed, 0 failed (main: 213); shellcheck -x clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-18 20:51:27 +00:00
..
cli.sh	test(cli): the seed contract, driven — and the absence, fail-closed (#81)	2026-07-18 20:51:27 +00:00
labels-reconcile.sh	fix: base the human auto-request on THIS handoff, not review history	2026-07-18 20:16:55 +00:00