claude-bot-andresmgsl ce3a0c5076 Make setup-host privilege-aware; make the drill prove the new contract ... Review found two real problems, both confirmed by reproducing them. setup-host hardcoded 'sudo' for every privileged call, so install.sh's deliberate root branch — the one that proceeds when id -u is 0 even with no sudo installed — handed off to a script that died on 'sudo: command not found' before doing anything (exit 127, reproduced with env -i and a minimal PATH). The root path was nominal, not real. Privilege is now resolved once: nothing at UID 0, sudo otherwise, a clear error if neither is possible. Two things fell out of that. Root does not need incus-admin at all (UID 0 opens the socket regardless), so adding root to the group was a no-op that also missed the human — under 'sudo install.sh' that is SUDO_USER, who is now the one granted the group. And apt must not hang: install.sh runs setup-host with nobody watching, while a fresh cloud image holds the dpkg lock in apt-daily for its first minutes, so the calls are now bounded and non-interactive. The drill did not exercise any of this. It ran setup-host immediately after install.sh, so the stack existed by the drill's own hand and a run passed identically whether or not install.sh had done a thing — a fresh run converged three times while its messages still described the pre-#63 "first pass may only add you to the group" behaviour. It now asserts the post-install stack in-group, before the clean or anything else mutates the host, which is the assertion that actually proves #64. setup-host then runs exactly once more, after the clean — that one is load-bearing, since the clean deliberately unsets dns.mode and something has to converge it back. DRILL_OWNS_SETUP=1 hands sequencing back to the drill. Pre-setup tripwires now read before install.sh, because install.sh is what triggers setup now; read afterwards they said nothing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-07-17 13:16:06 +00:00
..
box-firewall.service	feat!: rename the host stack too, default to blank, drill the templates, add wipe	2026-07-14 14:36:39 +00:00
box-firewall.sh	fix(expose): accept established flows back from boxnet — the input drop was eating the door's replies	2026-07-14 23:13:25 +00:00
migrate-host.sh	fix: run 17's four real findings — migrate retire, expose proxy, wait_box, grok PATH	2026-07-14 19:56:17 +00:00
setup-host.sh	Make setup-host privilege-aware; make the drill prove the new contract	2026-07-17 13:16:06 +00:00
teardown-host.sh	chore: finish the debrand — env vars, install dir, docs are 'box', not 'claudebox'	2026-07-14 17:44:24 +00:00