fix: first-run drill defects — pipefail false FAILs, exec-pty hang, DHCP race #19

Merged

dan-claude-bot merged 1 commit from drill/first-run-fixes into main

2026-07-13 22:07:32 +00:00

dan-claude-bot commented

2026-07-13 22:05:34 +00:00

(Migrated from github.com)

The first live drill run (on the throwaway server, per #15) surfaced three defects in the drill itself. All three are fixed; none require re-provisioning.

~9 false FAILs from set -o pipefail. Every check shaped claudebox <refusal> 2>&1 | grep -q 'text' failed even when the text matched: the refusals exit 1/2 by design, and grep -q SIGPIPEs the left side when it matches early (this is why info | grep -q authed "failed" while the --from drill/authed check — matching the last line — passed, and why the boundary trio "failed" while payroll is still running, untouched passed: the refusals were actually working). The pipeline's verdict must be grep's alone; pipefail is removed with a comment so it doesn't come back.
The 10-minute hang at C7. The in-box background listener (nohup python3 -m http.server … &) inherited the exec session's pty, so incus exec waited on it forever. Now a box_listen helper: </dev/null on the child (load-bearing) plus timeout 20 on the client.
The sibling probe never ran (could not read peer's eth0 address): wait_box proves the agent answers, but DHCP hands out the address a few seconds later. eth0_ip now retries for up to 30s.

Also, the one FAIL that may be a real claudebox bug — 'claude --version' failed inside the box while gh passed — now self-diagnoses: the check distinguishes installed but not on exec's PATH (a repo bug; the help promises claudebox exec work -- claude --version verbatim) from not installed (cloud-init issue), and prints cloud-init status + the ~/.local/bin listing in the latter case.

Confirmed-good from the interrupted run, no re-verification needed: all of phase A (both #15 mechanism checks included), the VM trust boundary, egress, box→host and RFC1918 drops, IPv6-off — and the DNS-enumeration leak is live-confirmed exactly as #12 predicted (peer resolves from a sibling box).

Re-run after merge, on the same server, no cleanup needed — the drill resets its own leftovers:

cd claudebox && git pull && bash drill/drill.sh --yes

🤖 Generated with Claude Code

The first live drill run (on the throwaway server, per #15) surfaced three defects in the drill itself. All three are fixed; none require re-provisioning. 1. **~9 false FAILs from `set -o pipefail`.** Every check shaped `claudebox <refusal> 2>&1 | grep -q 'text'` failed even when the text matched: the refusals exit 1/2 **by design**, and `grep -q` SIGPIPEs the left side when it matches early (this is why `info | grep -q authed` "failed" while the `--from drill/authed` check — matching the last line — passed, and why the boundary trio "failed" while *payroll is still running, untouched* passed: the refusals were actually working). The pipeline's verdict must be grep's alone; pipefail is removed with a comment so it doesn't come back. 2. **The 10-minute hang at C7.** The in-box background listener (`nohup python3 -m http.server … &`) inherited the exec session's pty, so `incus exec` waited on it forever. Now a `box_listen` helper: `</dev/null` on the child (load-bearing) plus `timeout 20` on the client. 3. **The sibling probe never ran** (`could not read peer's eth0 address`): `wait_box` proves the agent answers, but DHCP hands out the address a few seconds later. `eth0_ip` now retries for up to 30s. Also, the one FAIL that may be a **real claudebox bug** — `'claude --version' failed inside the box` while `gh` passed — now self-diagnoses: the check distinguishes *installed but not on exec's PATH* (a repo bug; the help promises `claudebox exec work -- claude --version` verbatim) from *not installed* (cloud-init issue), and prints `cloud-init status` + the `~/.local/bin` listing in the latter case. Confirmed-good from the interrupted run, no re-verification needed: all of phase A (both #15 mechanism checks included), the VM trust boundary, egress, box→host and RFC1918 drops, IPv6-off — and the **DNS-enumeration leak is live-confirmed exactly as #12 predicted** (`peer` resolves from a sibling box). Re-run after merge, on the same server, no cleanup needed — the drill resets its own leftovers: ```sh cd claudebox && git pull && bash drill/drill.sh --yes ``` 🤖 Generated with [Claude Code](https://claude.com/claude-code)

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/box#19

No description provided.