rig bootstrap roles for box tenants — claude, codex, grok, staging #31

New issue

Closed

opened 2026-07-18 16:54:53 +00:00 by dan-claude-bot · 0 comments

dan-claude-bot commented

2026-07-18 16:54:53 +00:00

(Migrated from github.com)

The layering decision

box templates are collapsing to thin, creds-free seeds (base image, user, rig preinstalled — see the companion box issue). Everything a tenant machine becomes moves here, as bootstrap roles:

rig bootstrap claude / codex / grok — the agent CLI, gh, tmux (the box#65 contract), the agent-context file. One shared mechanism, parameterized per agent, instead of three hand-maintained cloud-init YAMLs.
rig bootstrap staging — the server posture from box#69: docker, sshd hardening, the tailnet workload join (the creds-holding step stays operator-run, exactly as #69 designed).

Why rig and not cloud-init

cloud-init is a first-boot one-shot: not convergent, not re-runnable, and only parse-and-grep testable (box#69's test suite is the proof by exhaustion).
rig roles are idempotent scripts with effective-state asserts, driven end-to-end by test/cli.sh and the rehearsals — and re-runnable on an existing box to converge it to a new spec.
Single convergence engine: rig already owns "every box is rig-made, reproducibly"; the guests were the hole.

Design notes

Creds-free roles can be auto-run by box at mint (box exec … rig bootstrap claude); creds-holding roles (staging's tailnet join) stay operator-run through box shell.
The dependency edge inverts and needs a pin point: rig installs box on host-class machines (#28), and box guests will now install rig — both track main unpinned. #29 documented box's unpinned install honestly; this edge needs the same treatment (RIG_REPO/RIG_REF).
The box#80 agent-context guard ("never run setup-host inside a box") should live once, in the agent roles' context file — not per-template.

Companion: the box-side issue (thin templates) links back here.

## The layering decision box templates are collapsing to **thin, creds-free seeds** (base image, user, rig preinstalled — see the companion box issue). Everything a tenant machine *becomes* moves here, as bootstrap roles: - `rig bootstrap claude` / `codex` / `grok` — the agent CLI, gh, tmux (the box#65 contract), the agent-context file. One shared mechanism, parameterized per agent, instead of three hand-maintained cloud-init YAMLs. - `rig bootstrap staging` — the server posture from box#69: docker, sshd hardening, the tailnet workload join (the creds-holding step stays operator-run, exactly as #69 designed). ## Why rig and not cloud-init - cloud-init is a first-boot one-shot: not convergent, not re-runnable, and only parse-and-grep testable (box#69's test suite is the proof by exhaustion). - rig roles are idempotent scripts with effective-state asserts, driven end-to-end by `test/cli.sh` and the rehearsals — and re-runnable on an *existing* box to converge it to a new spec. - Single convergence engine: rig already owns "every box is rig-made, reproducibly"; the guests were the hole. ## Design notes - **Creds-free roles can be auto-run by box at mint** (`box exec … rig bootstrap claude`); creds-holding roles (staging's tailnet join) stay operator-run through `box shell`. - **The dependency edge inverts and needs a pin point**: rig installs box on host-class machines (#28), and box guests will now install rig — both track main unpinned. #29 documented box's unpinned install honestly; this edge needs the same treatment (`RIG_REPO`/`RIG_REF`). - The box#80 agent-context guard ("never run setup-host inside a box") should live once, in the agent roles' context file — not per-template. Companion: the box-side issue (thin templates) links back here.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/rig#31

No description provided.