fix(doctor): a fresh host is not a dirty one #62

Merged

dan-claude-bot merged 1 commit from fix/doctor-fresh-host into main

2026-07-15 00:57:48 +00:00

dan-claude-bot commented

2026-07-15 00:55:26 +00:00

(Migrated from github.com)

Missing from a stack and never set up are different findings. The network/profile/ACL sections already knew this ("does not exist — a fresh host"); the firewall and resolver sections now do too:

FRESH (no boxnet) downgrades both to information. The VPN resolver is still named — it's a real fact about the host — but as "noted, not a fault: setup-host pins around it", not a DIRTY.
The clean verdict on a fresh host now says what to do: fresh — run box setup-host (or the drill — it sets the host up itself) instead of implying the host is ready to mint.
A partial stack (boxnet exists, drop or pin missing) still DIRTYs exactly as before — that's the case the severity belongs to.

Verified both paths live on a real stack: standing stack → clean, post-teardown → fresh with zero DIRTYs.

Rider: the measured drill count is 84 — README said 83 (the box-info exposure check was a NOTE when last counted, and is a PASS now); README and CHANGELOG updated to match the green run.

🤖 Generated with Claude Code

From the green run's preamble: the doctor gave a bare host two DIRTYs (box-to-box drop "MISSING — boxes can reach each other", the host's Tailscale resolver) and declared it "NOT fit to mint boxes (or to drill)" — then the drill went **84/84 green** from that exact state. **Missing from a stack** and **never set up** are different findings. The network/profile/ACL sections already knew this ("does not exist — a fresh host"); the firewall and resolver sections now do too: - `FRESH` (no boxnet) downgrades both to information. The VPN resolver is still *named* — it's a real fact about the host — but as "noted, not a fault: setup-host pins around it", not a DIRTY. - The clean verdict on a fresh host now says what to do: `fresh — run box setup-host (or the drill — it sets the host up itself)` instead of implying the host is ready to mint. - A *partial* stack (boxnet exists, drop or pin missing) still DIRTYs exactly as before — that's the case the severity belongs to. Verified both paths live on a real stack: standing stack → `clean`, post-teardown → `fresh` with zero DIRTYs. Rider: the measured drill count is **84** — README said 83 (the box-info exposure check was a NOTE when last counted, and is a PASS now); README and CHANGELOG updated to match the green run. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/box#62

No description provided.