claude-hdb a0400606c2 fix(doctor): read the isolation off the bridge, not off the config ... Two bugs, one in each direction. setup-host's new assertion ran 'nft list table bridge claudebox' without sudo. nft needs root, so it failed with permission denied and printed "the box-to-box drop is NOT active" about a rule that was demonstrably there. A check that cries wolf is worse than no check. And the deeper one: every check so far has asked the CONFIG whether boxes are isolated. The config is a claim. Incus can accept security.port_isolation and the kernel can still leave 'isolated off' on the tap — and then boxes reach each other while every config in sight says they cannot. That is precisely the shape of the original bug: the ACL looked airtight and never saw the traffic. So the doctor now reads the kernel's own view — 'bridge -d link show' on claudenet's ports — and reports the isolated flag as the fact it is. If the profile says true and the kernel says off, we learn that in a second instead of after another ten-minute drill. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-14 02:16:57 +00:00
..
claudebox-firewall.service	Import claudebox: creds-free, trust-less Claude Code VMs	2026-07-10 15:00:36 +00:00
claudebox-firewall.sh	fix: boxes could reach each other — isolate them at the bridge	2026-07-14 01:29:33 +00:00
setup-host.sh	fix(doctor): read the isolation off the bridge, not off the config	2026-07-14 02:16:57 +00:00
teardown-host.sh	feat: drop the claude- instance-name prefix; tag boxes instead	2026-07-10 17:09:45 +00:00