heavy-duty/box

Fork 1

refactor(templates): the tenant seeds carry rig's -box family suffix #125

Merged

dan-claude-bot merged 2 commits from feat/template-family-suffix into main

2026-07-20 13:09:30 +00:00

dan-claude-bot commented

2026-07-20 00:02:07 +00:00

(Migrated from github.com)

Closes #123.

rig is growing a second family of roles, and once a staging role can mean either a fleet machine or a box tenant, the bare name stops naming anything. rig's answer is a suffix on the role itself (rig#76) — -server for fleet machines, -box for box tenants. box's answer is that a template keeps being named for the role it converges, so the tenant seeds move with it:

was	is
`templates/claude`	`templates/claude-box`
`templates/codex`	`templates/codex-box`
`templates/grok`	`templates/grok-box`
`templates/staging`	`templates/staging-box`

Each seed's BOX_BOOTSTRAP_ROLE moves with its directory. Renamed with git mv, so each seed's history follows it.

blank keeps its name. It seeds no tenant role and sets no BOX_BOOTSTRAP_ROLE, so it has nothing to agree with — renaming it would only churn the default template's name for symmetry's sake.

⚠️ Merge ordering: this goes in AFTER rig's rename

Labeled blocked on purpose. Do not merge this before rig#76 lands.

The seeds install rig from RIG_REPO/RIG_REF, which default to heavy-duty/rig@main and stay unpinned until rig#32's releases. So a box minted from these templates asks whatever main happens to be for rig bootstrap claude-box. Against a pre-rename rig that role does not exist, cmd_new refuses to call the box ready, and the operator gets a failed mint — roughly 15 minutes in, on a cold claude-box mint — for a change neither repo has finished making.

Merged in the other order the window closes instead of opening. rig's cut is hard, with no aliases, so the day rig's rename lands, every unmerged box seed naming a bare role is the broken one. There is no ordering where both repos are simultaneously correct; there is only the one where the broken interval is zero-length on box's side.

Two namespaces, and only one of them moved

The template name and the rig role are now claude-box. The seed user stays claude — that is the user rig's role converges, and the one box shell lands in. test/cli.sh now pins the pair per tenant rather than each half alone:

check "$u-box: role is '$u-box', seed user is '$u' (rig's tenant mapping)" \
  0 "USER=$u REQUIRE_VM= AUTOSTART= ROLE=$u-box" tpl "$ROOT" "$u-box"

A later rename that moves one and forgets the other mints a box whose role dies looking for a user nobody created. Pinning them together is what makes that fail here instead of on a host.

The one deliberate asymmetry — please read this arm

The mint-time hints in cmd_new match both spellings of user.box.template:

if [ "$eff" = claude-box ] || [ "$eff" = claude ]; then

This is not an alias for the role. rig bootstrap claude is gone and nothing in this PR softens that. What these arms read is user.box.template, a stamp left on an instance at its own mint time: every box minted before this change carries the bare name forever, and a clone carries it forward. Refusing the old spelling here would not cut anything over — it would only drop the login hint on boxes that predate the rename, which is the same reason user.claudebox is honored everywhere else, and what the README's "boxes minted by any earlier version keep working under every verb" already promises. Happy to drop the legacy arms if reviewers read that promise more narrowly.

Relatedly, migrate-host.sh now stamps re-homed legacy boxes user.box.template=claude-box — the name the template has today — so a re-homed box looks like a fresh mint rather than a fossil.

What was left alone, on purpose

Grepping the bare names is mostly false positives, so every hit was read in context. Deliberately untouched:

The agent CLI binaries and their config dirs — claude then /login, box exec work -- claude --version, ~/.claude/CLAUDE.md / ~/.codex/AGENTS.md / ~/.grok/AGENTS.md. These name the agent, not the template.
The legacy host stack — claude-dev, claudenet, claude-isolate, user.claudebox. Pre-0.4.0 names, honored forever.
drill/RUNS.md — a record of what past runs proved, claudebox-era names included. History does not get retconned.
README.md's > **0.5.0**: two new templates (\codex`, `grok`)` — a release note recording what shipped under those names at the time. Flagging it in case reviewers prefer it updated.
Drill box NAMES (codex, grok) — announced in the pre-flight banner and deleted by teardown. Only the --template they pass moved.
test/cli.sh's EVILROOT fixtures — synthetic templates with BOX_BOOTSTRAP_ROLE="claude". The suite's own comment says fixtures survive a template rename, and their point is the parser, not the name.
install.sh:159's staging="$DEST.migrating.$$" — a shell variable for a staging directory. The clearest argument against a blind sed.
rig bootstrap workload — still spelled bare. #123 lists only the four tenant roles; if rig#76 also suffixes workload, that is a follow-up here (it appears in staging-box's seed comment, bin/box's operator hint, and the README).

Checks

bash test/cli.sh — 475 passed, 0 failed
bash test/labels-reconcile.sh — 19 passed, 0 failed
bash test/release.sh — 90 passed, 0 failed
shellcheck -x over CI's exact globstar file list (bin/* **/*.sh) — clean
.github/scripts/changelog-armed.sh — passes

Not drilled on real hardware: every mint path in this PR is a name change, and the drill's own mint assertions moved with it, but no cold claude-box mint has actually been run against a post-rename rig — that proof is only available once rig#76 is merged.

Closes #123. rig is growing a second family of roles, and once a `staging` role can mean either a fleet machine or a box tenant, the bare name stops naming anything. rig's answer is a suffix on the role itself ([rig#76](https://github.com/heavy-duty/rig/issues/76)) — `-server` for fleet machines, `-box` for box tenants. box's answer is that a template keeps being named for the role it converges, so the tenant seeds move with it: | was | is | |---|---| | `templates/claude` | `templates/claude-box` | | `templates/codex` | `templates/codex-box` | | `templates/grok` | `templates/grok-box` | | `templates/staging` | `templates/staging-box` | Each seed's `BOX_BOOTSTRAP_ROLE` moves with its directory. Renamed with `git mv`, so each seed's history follows it. `blank` keeps its name. It seeds no tenant role and sets no `BOX_BOOTSTRAP_ROLE`, so it has nothing to agree with — renaming it would only churn the default template's name for symmetry's sake. ## ⚠️ Merge ordering: this goes in AFTER rig's rename Labeled `blocked` on purpose. **Do not merge this before [rig#76](https://github.com/heavy-duty/rig/issues/76) lands.** The seeds install rig from `RIG_REPO`/`RIG_REF`, which default to `heavy-duty/rig@main` and stay unpinned until [rig#32](https://github.com/heavy-duty/rig/issues/32)'s releases. So a box minted from these templates asks *whatever `main` happens to be* for `rig bootstrap claude-box`. Against a pre-rename rig that role does not exist, `cmd_new` refuses to call the box ready, and the operator gets a failed mint — roughly 15 minutes in, on a cold claude-box mint — for a change neither repo has finished making. Merged in the other order the window closes instead of opening. rig's cut is hard, with no aliases, so the day rig's rename lands, every unmerged box seed naming a bare role is the broken one. There is no ordering where both repos are simultaneously correct; there is only the one where the broken interval is zero-length on box's side. ## Two namespaces, and only one of them moved The template name and the rig role are now `claude-box`. The seed **user** stays `claude` — that is the user rig's role converges, and the one `box shell` lands in. `test/cli.sh` now pins the *pair* per tenant rather than each half alone: ``` check "$u-box: role is '$u-box', seed user is '$u' (rig's tenant mapping)" \ 0 "USER=$u REQUIRE_VM= AUTOSTART= ROLE=$u-box" tpl "$ROOT" "$u-box" ``` A later rename that moves one and forgets the other mints a box whose role dies looking for a user nobody created. Pinning them together is what makes that fail here instead of on a host. ## The one deliberate asymmetry — please read this arm The mint-time hints in `cmd_new` match **both** spellings of `user.box.template`: ```sh if [ "$eff" = claude-box ] || [ "$eff" = claude ]; then ``` This is **not** an alias for the role. `rig bootstrap claude` is gone and nothing in this PR softens that. What these arms read is `user.box.template`, a stamp left on an *instance* at its own mint time: every box minted before this change carries the bare name forever, and a clone carries it forward. Refusing the old spelling here would not cut anything over — it would only drop the login hint on boxes that predate the rename, which is the same reason `user.claudebox` is honored everywhere else, and what the README's "boxes minted by any earlier version keep working under every verb" already promises. Happy to drop the legacy arms if reviewers read that promise more narrowly. Relatedly, `migrate-host.sh` now stamps re-homed legacy boxes `user.box.template=claude-box` — the name the template has *today* — so a re-homed box looks like a fresh mint rather than a fossil. ## What was left alone, on purpose Grepping the bare names is mostly false positives, so every hit was read in context. Deliberately untouched: - **The agent CLI binaries and their config dirs** — `claude` then `/login`, `box exec work -- claude --version`, `~/.claude/CLAUDE.md` / `~/.codex/AGENTS.md` / `~/.grok/AGENTS.md`. These name the agent, not the template. - **The legacy host stack** — `claude-dev`, `claudenet`, `claude-isolate`, `user.claudebox`. Pre-0.4.0 names, honored forever. - **`drill/RUNS.md`** — a record of what past runs proved, `claudebox`-era names included. History does not get retconned. - **`README.md`'s `> **0.5.0**: two new templates (\`codex\`, \`grok\`)`** — a release note recording what shipped under those names at the time. Flagging it in case reviewers prefer it updated. - **Drill box NAMES** (`codex`, `grok`) — announced in the pre-flight banner and deleted by teardown. Only the `--template` they pass moved. - **`test/cli.sh`'s `EVILROOT` fixtures** — synthetic templates with `BOX_BOOTSTRAP_ROLE="claude"`. The suite's own comment says fixtures survive a template rename, and their point is the parser, not the name. - **`install.sh:159`'s `staging="$DEST.migrating.$$"`** — a shell variable for a staging *directory*. The clearest argument against a blind sed. - **`rig bootstrap workload`** — still spelled bare. #123 lists only the four tenant roles; if rig#76 also suffixes `workload`, that is a follow-up here (it appears in `staging-box`'s seed comment, `bin/box`'s operator hint, and the README). ## Checks - `bash test/cli.sh` — 475 passed, 0 failed - `bash test/labels-reconcile.sh` — 19 passed, 0 failed - `bash test/release.sh` — 90 passed, 0 failed - `shellcheck -x` over CI's exact globstar file list (`bin/* **/*.sh`) — clean - `.github/scripts/changelog-armed.sh` — passes Not drilled on real hardware: every mint path in this PR is a name change, and the drill's own mint assertions moved with it, but no cold `claude-box` mint has actually been run against a post-rename rig — that proof is only available once rig#76 is merged.

danmt (Migrated from github.com) reviewed 2026-07-20 00:02:07 +00:00

dan-claude-bot commented

2026-07-20 00:07:10 +00:00

(Migrated from github.com)

Pushed a follow-up commit closing a gap I left: the machine-role half of rig#76 reaches box in one place.

The tailnet workload join box prints as the next step for a staging-box guest was rig bootstrap workload, and that role is now workload-server (heavy-duty/rig#79). box never runs it — it holds a pre-auth key, and that it stays operator-run is the absence keeping box creds-free end to end — but box does print it, in three places that had to move together: cmd_new's hint, the staging-box seed's own comment, and the README. A next step an operator copy-pastes is as wrong as a role box executes, and it fails later and further from the cause.

test/cli.sh's assertion moved with it, so it still pins what it was written to pin — that the join is printed and never exec'd.

475 passing, shellcheck clean, changelog still armed.

Merge order is unchanged: heavy-duty/rig#79 → heavy-duty/rig#80 → this.

Pushed a follow-up commit closing a gap I left: the **machine**-role half of rig#76 reaches box in one place. The tailnet workload join box prints as the next step for a `staging-box` guest was `rig bootstrap workload`, and that role is now `workload-server` (heavy-duty/rig#79). box never *runs* it — it holds a pre-auth key, and that it stays operator-run is the absence keeping box creds-free end to end — but box does **print** it, in three places that had to move together: `cmd_new`'s hint, the `staging-box` seed's own comment, and the README. A next step an operator copy-pastes is as wrong as a role box executes, and it fails later and further from the cause. `test/cli.sh`'s assertion moved with it, so it still pins what it was written to pin — that the join is printed and never `exec`'d. 475 passing, shellcheck clean, changelog still armed. Merge order is unchanged: heavy-duty/rig#79 → heavy-duty/rig#80 → this.

grok-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-20 00:11:54 +00:00

grok-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: Approve — I agree with this as-is.

Why

Tenant seeds git mv to templates/{claude,codex,grok,staging}-box with matching BOX_BOOTSTRAP_ROLE. blank unchanged.
Legacy instance template reads still accept bare claude/staging where stamped; user.claudebox maps to claude-box. Workload join next-step uses workload-server.
Follow-up commit fixes the printed join for the machine-role half. CI check/reconcile/scope green.

Land with/after rig#80 so mint auto-bootstrap hits a role the installed rig knows.

No blockers.

**Verdict: Approve** — I agree with this as-is. ### Why - Tenant seeds `git mv` to `templates/{claude,codex,grok,staging}-box` with matching `BOX_BOOTSTRAP_ROLE`. `blank` unchanged. - Legacy instance template reads still accept bare `claude`/`staging` where stamped; `user.claudebox` maps to `claude-box`. Workload join next-step uses `workload-server`. - Follow-up commit fixes the printed join for the machine-role half. CI check/reconcile/scope green. Land with/after rig#80 so mint auto-bootstrap hits a role the installed rig knows. No blockers.

codex-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-20 00:18:32 +00:00

codex-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: I agree with everything and have no additional feedback.

The template and role renames are consistent, legacy instance stamps remain readable, the workload join hint now names workload-server, and the current checks are green. The blocked merge order remains necessary: land rig#79, then rig#80, before this PR.

Verdict: I agree with everything and have no additional feedback. The template and role renames are consistent, legacy instance stamps remain readable, the workload join hint now names workload-server, and the current checks are green. The blocked merge order remains necessary: land rig#79, then rig#80, before this PR.

claude-bot-andresmgsl (Migrated from github.com) approved these changes 2026-07-20 00:23:09 +00:00

claude-bot-andresmgsl (Migrated from github.com) left a comment

Verdict: Approve — the rename is exact on both sides of the rig↔box contract, every in-repo consumer moved, backward compatibility is handled at the right layer, and the one dangerous window (merge ordering) is documented and gated by the blocked label. Verified at head 9c78911.

The cross-repo contract, checked name by name

I diffed rig#80 (and rig#79 for the machine half) against this branch:

rig#80's tenant dispatch accepts exactly claude-box|codex-box|grok-box|staging-box (both entrypoints, hard cut, old names refused) — box's four seeds ask for exactly those: templates/claude-box/box.env:21, templates/codex-box/box.env:21, templates/grok-box/box.env:21, templates/staging-box/box.env:29.
rig#80's role→user table (claude-box→claude, codex-box→codex, grok-box→grok, staging-box→ops) matches each seed's BOX_USER — the "two namespaces, only one moved" asymmetry is the same on both sides, and test/cli.sh:358-361 now pins the pair per tenant, which is the right guard for the failure mode (role converging a user nobody created).
workload-server in the three printed-next-step sites (bin/box:1204, templates/staging-box/box.env:11 + user-data.yaml:7, README.md:274) matches rig#79's machine-role dispatch exactly. test/cli.sh:437-439 moved with it and still asserts printed-never-exec'd.

No spelling drift anywhere. Merge order rig#79 → rig#80 → this is stated in both PR bodies and in this PR's CHANGELOG entry; the blocked label is on. Do not merge until rig#80 is in.

Consumers — all accounted for

Template resolution in bin/box is dynamic (cmd_templates globs templates/*/ at bin/box:1020; cmd_new reads $root/templates/$t at bin/box:938), so nothing hardcodes the list at runtime. Every static spelling moved: help text, README, docs/box-design.md, docs/box-recipe.md, drill/drill.sh (including the codex/grok mint loop, which correctly keeps bare box names while passing --template $t-box), and host/migrate-host.sh. Remaining bare-name greps are all deliberate and correct in context: historical CHANGELOG entries (CHANGELOG.md:406-408 records what 0.2.0 shipped), agent CLI binaries and dotdirs, the legacy host stack, drill/RUNS.md, EVILROOT fixtures, and install.sh:159's unrelated staging variable.

Backward compatibility — handled at the right layer

The dual-spelling arms in cmd_new (bin/box:1199-1202) read user.box.template, an instance stamp, not a role — I agree this is not an alias and does not soften rig's cut. Dropping the bare arms would only lose the hint on pre-rename boxes, contradicting the README's compatibility promise. Keep them.
user.claudebox legacy detection now maps to claude-box (bin/box:1199), and migrate-host.sh:82 stamps re-homed boxes with today's name — consistent with "a re-homed box looks like a fresh mint".
box shell lands via user.box.user, which never changed, so existing boxes are untouched under every verb.
Installs are versioned (install.sh puts each tree under versions/<ver> and atomically flips current), so an upgrade cannot leave templates/claude and templates/claude-box coexisting in one tree. No stale-directory hazard.

Label

refactor is fair for the main commit: no runtime logic changes beyond names, and the follow-up is correctly typed fix. The one operator-visible break — box new --template claude now dies with the generic no such template: claude (see 'box templates') — is inherent to the rename and documented under CHANGELOG Changed.

Checks run locally at `9c78911`

bash test/cli.sh — 475 passed, 0 failed
bash test/release.sh — 90 passed, 0 failed
shellcheck -x bin/* **/*.sh — clean

Non-blocking suggestions

bin/box:939's no such template error could special-case the four old names with a one-line "renamed to -box (rig#76)" hint — cheap insurance for post-upgrade muscle memory and scripts. Fine as a follow-up or not at all.
The README's 0.5.0 release-note line keeping old names: I read it as history and would leave it, matching your drill/RUNS.md reasoning.

— automated review by claude-bot-andresmgsl · heavy-duty-review-bot

**Verdict: Approve** — the rename is exact on both sides of the rig↔box contract, every in-repo consumer moved, backward compatibility is handled at the right layer, and the one dangerous window (merge ordering) is documented and gated by the `blocked` label. Verified at head 9c78911. ## The cross-repo contract, checked name by name I diffed rig#80 (and rig#79 for the machine half) against this branch: - rig#80's tenant dispatch accepts exactly `claude-box|codex-box|grok-box|staging-box` (both entrypoints, hard cut, old names refused) — box's four seeds ask for exactly those: `templates/claude-box/box.env:21`, `templates/codex-box/box.env:21`, `templates/grok-box/box.env:21`, `templates/staging-box/box.env:29`. - rig#80's role→user table (`claude-box`→`claude`, `codex-box`→`codex`, `grok-box`→`grok`, `staging-box`→`ops`) matches each seed's `BOX_USER` — the "two namespaces, only one moved" asymmetry is the same on both sides, and `test/cli.sh:358-361` now pins the pair per tenant, which is the right guard for the failure mode (role converging a user nobody created). - `workload-server` in the three printed-next-step sites (`bin/box:1204`, `templates/staging-box/box.env:11` + `user-data.yaml:7`, `README.md:274`) matches rig#79's machine-role dispatch exactly. `test/cli.sh:437-439` moved with it and still asserts printed-never-exec'd. No spelling drift anywhere. Merge order rig#79 → rig#80 → this is stated in both PR bodies and in this PR's CHANGELOG entry; the `blocked` label is on. Do not merge until rig#80 is in. ## Consumers — all accounted for Template resolution in `bin/box` is dynamic (`cmd_templates` globs `templates/*/` at `bin/box:1020`; `cmd_new` reads `$root/templates/$t` at `bin/box:938`), so nothing hardcodes the list at runtime. Every static spelling moved: help text, README, `docs/box-design.md`, `docs/box-recipe.md`, `drill/drill.sh` (including the codex/grok mint loop, which correctly keeps bare box *names* while passing `--template $t-box`), and `host/migrate-host.sh`. Remaining bare-name greps are all deliberate and correct in context: historical CHANGELOG entries (`CHANGELOG.md:406-408` records what 0.2.0 shipped), agent CLI binaries and dotdirs, the legacy host stack, `drill/RUNS.md`, EVILROOT fixtures, and `install.sh:159`'s unrelated `staging` variable. ## Backward compatibility — handled at the right layer - The dual-spelling arms in `cmd_new` (`bin/box:1199-1202`) read `user.box.template`, an instance stamp, not a role — I agree this is not an alias and does not soften rig's cut. Dropping the bare arms would only lose the hint on pre-rename boxes, contradicting the README's compatibility promise. Keep them. - `user.claudebox` legacy detection now maps to `claude-box` (`bin/box:1199`), and `migrate-host.sh:82` stamps re-homed boxes with today's name — consistent with "a re-homed box looks like a fresh mint". - `box shell` lands via `user.box.user`, which never changed, so existing boxes are untouched under every verb. - Installs are versioned (`install.sh` puts each tree under `versions/<ver>` and atomically flips `current`), so an upgrade cannot leave `templates/claude` and `templates/claude-box` coexisting in one tree. No stale-directory hazard. ## Label `refactor` is fair for the main commit: no runtime logic changes beyond names, and the follow-up is correctly typed `fix`. The one operator-visible break — `box new --template claude` now dies with the generic `no such template: claude (see 'box templates')` — is inherent to the rename and documented under CHANGELOG *Changed*. ## Checks run locally at 9c78911 - `bash test/cli.sh` — 475 passed, 0 failed - `bash test/release.sh` — 90 passed, 0 failed - `shellcheck -x bin/* **/*.sh` — clean ## Non-blocking suggestions 1. `bin/box:939`'s `no such template` error could special-case the four old names with a one-line "renamed to <t>-box (rig#76)" hint — cheap insurance for post-upgrade muscle memory and scripts. Fine as a follow-up or not at all. 2. The README's 0.5.0 release-note line keeping old names: I read it as history and would leave it, matching your `drill/RUNS.md` reasoning. — _automated review by `claude-bot-andresmgsl` · heavy-duty-review-bot_

dan-claude-bot commented

2026-07-20 00:41:44 +00:00

(Migrated from github.com)

Round passed — three bot approvals, head-current. Handing to @danmt.

Still blocked, and the label is accurate: this must merge after heavy-duty/rig#79 and heavy-duty/rig#80. rig hard-cuts the old role names with no aliases, so a seed here naming claude-box fails its own mint-time bootstrap against a rig that predates the rename — and these seeds install rig from RIG_REF, unpinned, defaulting to main. Merge order: rig#79 → rig#80 → this.

One change since the bots approved, pushed as a follow-up commit and called out in-thread: the machine-role half of rig#76 reaches box in one place. The tailnet workload join box prints as the next step for a staging-box guest was rig bootstrap workload, now workload-server, in three places that had to move together (cmd_new's hint, the staging-box seed comment, the README). box never runs it — it holds a pre-auth key, and that it stays operator-run is the absence keeping box creds-free end to end — but a next step an operator copy-pastes is as wrong as a role box executes, and it fails further from the cause.

bash test/cli.sh 475/0 · test/release.sh 90/0 · test/labels-reconcile.sh 19/0 · shellcheck -x clean over CI's globstar list · changelog armed.

Round passed — three bot approvals, head-current. Handing to @danmt. **Still `blocked`, and the label is accurate**: this must merge after heavy-duty/rig#79 and heavy-duty/rig#80. rig hard-cuts the old role names with no aliases, so a seed here naming `claude-box` fails its own mint-time bootstrap against a rig that predates the rename — and these seeds install rig from `RIG_REF`, unpinned, defaulting to `main`. Merge order: rig#79 → rig#80 → this. One change since the bots approved, pushed as a follow-up commit and called out in-thread: the **machine**-role half of rig#76 reaches box in one place. The tailnet workload join box *prints* as the next step for a `staging-box` guest was `rig bootstrap workload`, now `workload-server`, in three places that had to move together (`cmd_new`'s hint, the `staging-box` seed comment, the README). box never runs it — it holds a pre-auth key, and that it stays operator-run is the absence keeping box creds-free end to end — but a next step an operator copy-pastes is as wrong as a role box executes, and it fails further from the cause. `bash test/cli.sh` 475/0 · `test/release.sh` 90/0 · `test/labels-reconcile.sh` 19/0 · `shellcheck -x` clean over CI's globstar list · changelog armed.

dan-claude-bot commented

2026-07-20 12:11:08 +00:00

(Migrated from github.com)

Unblocked — heavy-duty/rig#79 and heavy-duty/rig#80 both merged, so the tenant role names this seed converges (claude-box, codex-box, grok-box, staging-box) now exist on rig main. Removed the blocked label.

Ordering held: rig cut the old names with no aliases, so this had to land second or every mint from these seeds would have died at its own bootstrap. That window is now closed in the right direction — it is the unrebased seeds that are broken, which is what this PR fixes.

Three head-current approvals, CI green, @danmt already requested.

Worth stating plainly for whoever merges: no cold mint has run against a post-rename rig. The suite covers name agreement, the drill assertions moved with the templates, but a real box new --template claude-box against rig main has not happened and could not have before now. That is the first thing to watch after this lands.

Unblocked — heavy-duty/rig#79 and heavy-duty/rig#80 both merged, so the tenant role names this seed converges (`claude-box`, `codex-box`, `grok-box`, `staging-box`) now exist on rig `main`. Removed the `blocked` label. Ordering held: rig cut the old names with no aliases, so this had to land second or every mint from these seeds would have died at its own bootstrap. That window is now closed in the right direction — it is the *unrebased* seeds that are broken, which is what this PR fixes. Three head-current approvals, CI green, @danmt already requested. Worth stating plainly for whoever merges: **no cold mint has run against a post-rename rig.** The suite covers name agreement, the drill assertions moved with the templates, but a real `box new --template claude-box` against rig `main` has not happened and could not have before now. That is the first thing to watch after this lands.