dan-claude-bot 7d48822cc0 test(cli): drive the #80 guard, the BOX_SUBNET plumb-through, and the signature ... The two pure functions are extracted and driven, the same seam as box_tier and load_template: a shim ip serves canned route tables (the poisoned guest verbatim from #80's capture, the remapped-bridge workaround, a healthy stack host), and each signature line is proven to fire alone and to stay silent on the clean states. Then the WHOLE setup-host is driven end to end under shims (fake incus and sudo log every call; fake id keeps it unprivileged): the three refusals (gateway-in-subnet, foreign interface, garbage/wrong-shape BOX_SUBNET) exit 1 having made NO incus and NO sudo call — refuse-before-mutation is asserted on the logs' absence, not assumed — the existing-bridge mismatch refuses, the legitimate converge (boxnet's own prior claim) still reaches 'Host ready', and a fresh BOX_SUBNET=10.89.0.0/24 build lands ipv4.address=10.89.0.1/24 on the bridge and destination: 10.89.0.1/32 in the ACL, proving every derived value follows the one input. Line-order guards pin the wiring: the subnet guard precedes the first mutation in setup-host, the machine-local signature precedes the doctor's daemon checks, probe_sig runs on both tiers, box-firewall reads the gateway off the live bridge, and the drill/multiuser/migrate probes derive their prefix from the network. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-18 19:47:20 +00:00
..
cli.sh	test(cli): drive the #80 guard, the BOX_SUBNET plumb-through, and the signature	2026-07-18 19:47:20 +00:00