feat(smolmachines): provision_ca + provision_git + provision_supervise (PRD 0023 chunk 4d)

End-to-end provisioning parity with the docker backend. After this
chunk a smolmachines bottle has a working trust store, git-gate
gitconfig, and supervise MCP registration — same shape as docker,
dispatched via `smolvm machine cp` / `smolvm machine exec` instead
of `docker cp` / `docker exec`.

Adds three new provision modules:
- ca.py:        select egress vs pipelock CA (same logic as
                docker), machine cp + update-ca-certificates,
                log sha256 fingerprint.
- git.py:       copy host .git when --cwd was passed; render
                ~/.gitconfig with insteadOf URLs. URL prefix is
                `git://<bundle_ip>:9418/...` (no DNS in the
                TSI-allowlisted guest) vs docker's
                `git://git-gate/...`.
- supervise.py: `claude mcp add` via machine_exec; URL is
                `http://<bundle_ip>:9100/`. Failure is logged but
                non-fatal (matches docker).

Shared render: `render_git_gate_gitconfig` moves out of
backend/docker/provision/git.py into the platform-neutral
claude_bottle/git_gate.py (renamed to git_gate_render_gitconfig
for consistency with the existing git_gate_render_* helpers),
parameterized on a `gate_host` argument so both backends use the
same logic with different addresses.

Path/user fixups for the post-chunk-4c agent image (real
claude-bottle image, USER node, $HOME=/home/node):
- prompt.py default path moves from /root/... to
  /home/node/.claude-bottle-prompt.txt; chown + chmod after
  machine cp.
- skills.py default skills dir moves from /root/.claude/skills to
  /home/node/.claude/skills; chown -R per skill.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/unit/test_provision_git.py

@@ -1,19 +1,28 @@
-"""Unit: render of ~/.gitconfig pushInsteadOf rules (PRD 0008)."""
+"""Unit: render of ~/.gitconfig insteadOf rules (PRD 0008).
+
+The render moved to `claude_bottle.git_gate` so both backends
+share it; tests live here because docker's provision_git is the
+original consumer."""
 
 import unittest
 
-from claude_bottle.backend.docker.provision.git import render_git_gate_gitconfig
+from claude_bottle.git_gate import (
+    GIT_GATE_HOSTNAME,
+    git_gate_render_gitconfig,
+)
 from tests.fixtures import fixture_minimal, fixture_with_git
 
 
 class TestGitGateGitconfigRender(unittest.TestCase):
     def test_empty_entries_renders_nothing(self):
         bottle = fixture_minimal().bottles["dev"]
-        self.assertEqual("", render_git_gate_gitconfig(bottle.git))
+        self.assertEqual(
+            "", git_gate_render_gitconfig(bottle.git, GIT_GATE_HOSTNAME),
+        )
 
     def test_one_block_per_entry(self):
         bottle = fixture_with_git().bottles["dev"]
-        out = render_git_gate_gitconfig(bottle.git)
+        out = git_gate_render_gitconfig(bottle.git, GIT_GATE_HOSTNAME)
         # Both entries map to a [url ...] block keyed on the gate's
         # short network alias (`git-gate`) inside the sidecar bundle.
         self.assertIn(
@@ -37,10 +46,19 @@ class TestGitGateGitconfigRender(unittest.TestCase):
         # gate push and leave fetch on the original URL — exactly the
         # v1 design we've moved past.
         bottle = fixture_with_git().bottles["dev"]
-        out = render_git_gate_gitconfig(bottle.git)
+        out = git_gate_render_gitconfig(bottle.git, GIT_GATE_HOSTNAME)
         self.assertIn("\tinsteadOf", out)
         self.assertNotIn("pushInsteadOf", out)
 
+    def test_gate_host_can_be_ip_port_form(self):
+        # The smolmachines backend's TSI-allowlisted guest has no
+        # DNS, so it dials git-gate via `<bundle_ip>:<port>`.
+        bottle = fixture_with_git().bottles["dev"]
+        out = git_gate_render_gitconfig(bottle.git, "192.168.20.2:9418")
+        self.assertIn(
+            '[url "git://192.168.20.2:9418/claude-bottle.git"]', out,
+        )
+
 
 if __name__ == "__main__":
     unittest.main()

tests/unit/test_smolmachines_provision.py

@@ -1,4 +1,4 @@
-"""Unit: smolmachines provisioning helpers (PRD 0023 chunk 4a).
+"""Unit: smolmachines provisioning helpers (PRD 0023 chunks 4a + 4d).
 
 Tests mock `smolvm.machine_cp` / `smolvm.machine_exec` and assert
 on the dispatched call shape. The real round-trip lives in the
@@ -6,6 +6,8 @@ chunk-4 integration smoke."""
 
 from __future__ import annotations
 
+import subprocess
+import tempfile
 import unittest
 from pathlib import Path
 from unittest.mock import patch
@@ -15,22 +17,48 @@ from claude_bottle.backend.smolmachines.bottle_plan import (
     SmolmachinesBottlePlan,
 )
 from claude_bottle.backend.smolmachines.provision import (
+    ca as _ca,
+    git as _git,
     prompt as _prompt,
     skills as _skills,
+    supervise as _supervise,
 )
-from claude_bottle.egress import EgressPlan
+from claude_bottle.backend.smolmachines.smolvm import SmolvmRunResult
+from claude_bottle.egress import EgressPlan, EgressRoute
 from claude_bottle.git_gate import GitGatePlan
-from claude_bottle.manifest import Manifest
+from claude_bottle.manifest import GitEntry, Manifest
 from claude_bottle.pipelock import PipelockProxyPlan
+from claude_bottle.supervise import SupervisePlan
 
 
 def _plan(
     *,
     agent_prompt: str = "",
     skills: list[str] | None = None,
+    git: list[GitEntry] = (),
+    copy_cwd: bool = False,
+    user_cwd: str = "/tmp/x",
+    stage_dir: Path | None = None,
+    egress_routes: tuple[EgressRoute, ...] = (),
+    egress_ca_path: Path = Path(),
+    pipelock_ca_path: Path = Path(),
+    supervise: bool = False,
+    bundle_ip: str = "192.168.50.2",
 ) -> SmolmachinesBottlePlan:
+    bottle_json: dict = {}
+    if git:
+        bottle_json["git"] = [
+            {
+                "Name": g.Name,
+                "Upstream": g.Upstream,
+                "IdentityFile": g.IdentityFile,
+            }
+            for g in git
+        ]
+    if supervise:
+        bottle_json["supervise"] = True
     manifest = Manifest.from_json_obj({
-        "bottles": {"dev": {}},
+        "bottles": {"dev": bottle_json},
         "agents": {
             "demo": {
                 "skills": list(skills or []),
@@ -42,16 +70,23 @@ def _plan(
     spec = BottleSpec(
         manifest=manifest,
         agent_name="demo",
-        copy_cwd=False,
-        user_cwd="/tmp/x",
+        copy_cwd=copy_cwd,
+        user_cwd=user_cwd,
     )
+    supervise_plan = None
+    if supervise:
+        supervise_plan = SupervisePlan(
+            slug="demo-abc12",
+            queue_dir=Path("/tmp/queue"),
+            current_config_dir=Path("/tmp/current-config"),
+        )
     return SmolmachinesBottlePlan(
         spec=spec,
-        stage_dir=Path("/tmp/stage"),
+        stage_dir=stage_dir or Path("/tmp/stage"),
         slug="demo-abc12",
         bundle_subnet="192.168.50.0/24",
         bundle_gateway="192.168.50.1",
-        bundle_ip="192.168.50.2",
+        bundle_ip=bundle_ip,
         machine_name="claude-bottle-demo-abc12",
         agent_from_path=Path("/tmp/agent.smolmachine"),
         guest_env={},
@@ -59,6 +94,7 @@ def _plan(
         proxy_plan=PipelockProxyPlan(
             yaml_path=Path("/tmp/pipelock.yaml"),
             slug="demo-abc12",
+            ca_cert_host_path=pipelock_ca_path,
         ),
         git_gate_plan=GitGatePlan(
             slug="demo-abc12",
@@ -70,10 +106,11 @@ def _plan(
         egress_plan=EgressPlan(
             slug="demo-abc12",
             routes_path=Path("/tmp/routes.yaml"),
-            routes=(),
+            routes=egress_routes,
             token_env_map={},
+            mitmproxy_ca_cert_only_host_path=egress_ca_path,
         ),
-        supervise_plan=None,
+        supervise_plan=supervise_plan,
     )
 
 
@@ -81,33 +118,58 @@ class TestProvisionPrompt(unittest.TestCase):
     def test_cp_uses_smolvm_machine_cp_with_machine_path_syntax(self):
         with patch(
             "claude_bottle.backend.smolmachines.provision.prompt._smolvm.machine_cp"
-        ) as cp:
+        ) as cp, patch(
+            "claude_bottle.backend.smolmachines.provision.prompt._smolvm.machine_exec"
+        ):
             _prompt.provision_prompt(_plan(), "claude-bottle-demo-abc12")
         cp.assert_called_once_with(
             "/tmp/state/demo-abc12/agent/prompt.txt",
-            "claude-bottle-demo-abc12:/root/.claude-bottle-prompt.txt",
+            "claude-bottle-demo-abc12:/home/node/.claude-bottle-prompt.txt",
         )
 
     def test_returns_path_when_agent_has_prompt(self):
         with patch(
             "claude_bottle.backend.smolmachines.provision.prompt._smolvm.machine_cp"
+        ), patch(
+            "claude_bottle.backend.smolmachines.provision.prompt._smolvm.machine_exec"
         ):
             r = _prompt.provision_prompt(
                 _plan(agent_prompt="You are a helpful assistant."),
                 "claude-bottle-demo-abc12",
             )
-        self.assertEqual("/root/.claude-bottle-prompt.txt", r)
+        self.assertEqual("/home/node/.claude-bottle-prompt.txt", r)
 
     def test_returns_none_when_agent_has_no_prompt(self):
         # The file is still copied (path-must-exist contract);
         # only the return value differs.
         with patch(
             "claude_bottle.backend.smolmachines.provision.prompt._smolvm.machine_cp"
-        ) as cp:
+        ) as cp, patch(
+            "claude_bottle.backend.smolmachines.provision.prompt._smolvm.machine_exec"
+        ):
             r = _prompt.provision_prompt(_plan(agent_prompt=""), "claude-bottle-demo-abc12")
         self.assertIsNone(r)
         cp.assert_called_once()
 
+    def test_chowns_to_node_after_copy(self):
+        # machine cp lands as root; without the chown, the node user
+        # can't read its own mode-600 prompt.
+        with patch(
+            "claude_bottle.backend.smolmachines.provision.prompt._smolvm.machine_cp"
+        ), patch(
+            "claude_bottle.backend.smolmachines.provision.prompt._smolvm.machine_exec"
+        ) as ex:
+            _prompt.provision_prompt(_plan(), "claude-bottle-demo-abc12")
+        argv_seen = [call.args[1] for call in ex.call_args_list]
+        self.assertIn(
+            ["chown", "node:node", "/home/node/.claude-bottle-prompt.txt"],
+            argv_seen,
+        )
+        self.assertIn(
+            ["chmod", "600", "/home/node/.claude-bottle-prompt.txt"],
+            argv_seen,
+        )
+
 
 class TestProvisionSkills(unittest.TestCase):
     def _patch_host_skill_dir(self, returns: dict[str, str]):
@@ -143,11 +205,11 @@ class TestProvisionSkills(unittest.TestCase):
                 "claude-bottle-demo-abc12",
             )
 
-        # mkdir -p the skills dir once + rm -rf per skill = 3 exec calls.
-        self.assertEqual(3, ex.call_count)
+        # mkdir -p once + (rm -rf + chown) per skill = 5 exec calls.
+        self.assertEqual(5, ex.call_count)
         mkdir_call = ex.call_args_list[0]
         self.assertEqual(
-            ("claude-bottle-demo-abc12", ["mkdir", "-p", "/root/.claude/skills"]),
+            ("claude-bottle-demo-abc12", ["mkdir", "-p", "/home/node/.claude/skills"]),
             mkdir_call.args,
         )
         # Two cp calls, one per skill, into the per-skill subdir.
@@ -155,11 +217,25 @@ class TestProvisionSkills(unittest.TestCase):
         cp_targets = {call.args[1] for call in cp.call_args_list}
         self.assertEqual(
             {
-                "claude-bottle-demo-abc12:/root/.claude/skills/init-prd",
-                "claude-bottle-demo-abc12:/root/.claude/skills/verify",
+                "claude-bottle-demo-abc12:/home/node/.claude/skills/init-prd",
+                "claude-bottle-demo-abc12:/home/node/.claude/skills/verify",
             },
             cp_targets,
         )
+        # Each skill gets a chown -R node:node so claude can read it.
+        chown_argvs = [
+            call.args[1] for call in ex.call_args_list
+            if call.args[1][:1] == ["chown"]
+        ]
+        self.assertEqual(2, len(chown_argvs))
+        chown_targets = {argv[-1] for argv in chown_argvs}
+        self.assertEqual(
+            {
+                "/home/node/.claude/skills/init-prd",
+                "/home/node/.claude/skills/verify",
+            },
+            chown_targets,
+        )
 
     def test_skills_dir_overridable_via_env(self):
         import os
@@ -197,5 +273,218 @@ class TestProvisionSkills(unittest.TestCase):
                 _skills.provision_skills(_plan(skills=["init-prd"]), "claude-bottle-demo-abc12")
 
 
+def _write_self_signed_cert(path: Path) -> None:
+    """Drop a real self-signed PEM at `path` so provision_ca's
+    fingerprint computation (PEM_cert_to_DER_cert + sha256) has
+    actual bytes to chew on. Generated once per test via openssl."""
+    subprocess.run(
+        ["openssl", "req", "-x509", "-newkey", "rsa:2048", "-nodes",
+         "-keyout", "/dev/null",
+         "-out", str(path),
+         "-days", "1",
+         "-subj", "/CN=test"],
+        check=True, capture_output=True,
+    )
+
+
+class TestProvisionCA(unittest.TestCase):
+    """provision_ca selects the right CA cert (egress when the
+    bottle has routes, else pipelock) and dispatches
+    machine_cp + machine_exec in the right order."""
+
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory(prefix="cb-prov-ca.")
+        self.tmp = Path(self._tmp.name)
+        self.pipelock_ca = self.tmp / "pipelock-ca.pem"
+        self.egress_ca = self.tmp / "egress-ca.pem"
+        _write_self_signed_cert(self.pipelock_ca)
+        _write_self_signed_cert(self.egress_ca)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def test_pipelock_path_when_no_routes(self):
+        plan = _plan(pipelock_ca_path=self.pipelock_ca)
+        with patch(
+            "claude_bottle.backend.smolmachines.provision.ca._smolvm.machine_cp"
+        ) as cp, patch(
+            "claude_bottle.backend.smolmachines.provision.ca._smolvm.machine_exec"
+        ) as ex:
+            _ca.provision_ca(plan, "claude-bottle-demo-abc12")
+        cp.assert_called_once_with(
+            str(self.pipelock_ca),
+            "claude-bottle-demo-abc12:" + _ca.AGENT_CA_PATH,
+        )
+        argvs = [c.args[1] for c in ex.call_args_list]
+        self.assertIn(["chmod", "644", _ca.AGENT_CA_PATH], argvs)
+        self.assertIn(["update-ca-certificates"], argvs)
+
+    def test_egress_path_when_routes_declared(self):
+        plan = _plan(
+            egress_routes=(EgressRoute(host="api.anthropic.com"),),
+            egress_ca_path=self.egress_ca,
+            pipelock_ca_path=self.pipelock_ca,
+        )
+        with patch(
+            "claude_bottle.backend.smolmachines.provision.ca._smolvm.machine_cp"
+        ) as cp, patch(
+            "claude_bottle.backend.smolmachines.provision.ca._smolvm.machine_exec"
+        ):
+            _ca.provision_ca(plan, "claude-bottle-demo-abc12")
+        # When routes are declared, egress is the agent's first hop,
+        # so egress's CA is the one that gets installed.
+        cp.assert_called_once_with(
+            str(self.egress_ca),
+            "claude-bottle-demo-abc12:" + _ca.AGENT_CA_PATH,
+        )
+
+    def test_dies_when_selected_cert_missing(self):
+        # Plan claims a pipelock cert at a path that doesn't exist —
+        # something went wrong in launch's pipelock_tls_init.
+        plan = _plan(pipelock_ca_path=self.tmp / "does-not-exist.pem")
+        with patch(
+            "claude_bottle.backend.smolmachines.provision.ca._smolvm.machine_cp"
+        ), patch(
+            "claude_bottle.backend.smolmachines.provision.ca._smolvm.machine_exec"
+        ):
+            with self.assertRaises(SystemExit):
+                _ca.provision_ca(plan, "claude-bottle-demo-abc12")
+
+
+class TestProvisionGit(unittest.TestCase):
+    """provision_git dispatches two independent passes (cwd .git
+    copy + gitconfig insteadOf write); each no-ops on its own
+    when its condition doesn't hold."""
+
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory(prefix="cb-prov-git.")
+        self.stage = Path(self._tmp.name)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def test_noop_when_no_cwd_and_no_git_entries(self):
+        with patch(
+            "claude_bottle.backend.smolmachines.provision.git._smolvm.machine_cp"
+        ) as cp, patch(
+            "claude_bottle.backend.smolmachines.provision.git._smolvm.machine_exec"
+        ) as ex:
+            _git.provision_git(
+                _plan(stage_dir=self.stage), "claude-bottle-demo-abc12",
+            )
+        cp.assert_not_called()
+        ex.assert_not_called()
+
+    def test_copies_cwd_git_when_copy_cwd_and_git_present(self):
+        # Stage a fake host .git dir under user_cwd so the path-
+        # check in _provision_cwd_git fires.
+        cwd = self.stage / "cwd"
+        (cwd / ".git").mkdir(parents=True)
+        plan = _plan(
+            copy_cwd=True, user_cwd=str(cwd), stage_dir=self.stage,
+        )
+        with patch(
+            "claude_bottle.backend.smolmachines.provision.git._smolvm.machine_cp"
+        ) as cp, patch(
+            "claude_bottle.backend.smolmachines.provision.git._smolvm.machine_exec"
+        ) as ex:
+            _git.provision_git(plan, "claude-bottle-demo-abc12")
+        cp.assert_called_once_with(
+            f"{cwd}/.git",
+            "claude-bottle-demo-abc12:/home/node/workspace/.git",
+        )
+        argvs = [c.args[1] for c in ex.call_args_list]
+        self.assertIn(["mkdir", "-p", "/home/node/workspace"], argvs)
+        # chown the workspace tree so the agent (node) owns it.
+        self.assertIn(
+            ["chown", "-R", "node:node", "/home/node/workspace/.git"],
+            argvs,
+        )
+
+    def test_skips_cwd_when_copy_cwd_false(self):
+        plan = _plan(copy_cwd=False, stage_dir=self.stage)
+        with patch(
+            "claude_bottle.backend.smolmachines.provision.git._smolvm.machine_cp"
+        ) as cp, patch(
+            "claude_bottle.backend.smolmachines.provision.git._smolvm.machine_exec"
+        ):
+            _git.provision_git(plan, "claude-bottle-demo-abc12")
+        cp.assert_not_called()
+
+    def test_writes_gitconfig_with_ip_port_form_for_smolmachines(self):
+        # Smolmachines's TSI-allowlisted guest has no DNS resolver,
+        # so the insteadOf URL has to be IP+port rather than the
+        # docker backend's `git-gate` short alias.
+        plan = _plan(
+            git=[GitEntry(
+                Name="claude-bottle",
+                Upstream="ssh://git@host/repo.git",
+                IdentityFile="~/.ssh/id_ed25519",
+            )],
+            stage_dir=self.stage,
+            bundle_ip="192.168.99.2",
+        )
+        with patch(
+            "claude_bottle.backend.smolmachines.provision.git._smolvm.machine_cp"
+        ) as cp, patch(
+            "claude_bottle.backend.smolmachines.provision.git._smolvm.machine_exec"
+        ):
+            _git.provision_git(plan, "claude-bottle-demo-abc12")
+        # The staged gitconfig path is whatever NamedTemporaryFile
+        # picked; we read its contents.
+        cp_call = cp.call_args
+        staged_path = Path(cp_call.args[0])
+        self.assertEqual(self.stage, staged_path.parent)
+        content = staged_path.read_text()
+        self.assertIn(
+            '[url "git://192.168.99.2:9418/claude-bottle.git"]', content,
+        )
+        self.assertIn(
+            "\tinsteadOf = ssh://git@host/repo.git", content,
+        )
+
+
+class TestProvisionSupervise(unittest.TestCase):
+    def test_noop_when_supervise_not_enabled(self):
+        with patch(
+            "claude_bottle.backend.smolmachines.provision.supervise._smolvm.machine_exec"
+        ) as ex:
+            _supervise.provision_supervise(_plan(), "claude-bottle-demo-abc12")
+        ex.assert_not_called()
+
+    def test_calls_claude_mcp_add_when_supervise_enabled(self):
+        plan = _plan(supervise=True, bundle_ip="192.168.50.2")
+        with patch(
+            "claude_bottle.backend.smolmachines.provision.supervise._smolvm.machine_exec",
+            return_value=SmolvmRunResult(returncode=0, stdout="", stderr=""),
+        ) as ex:
+            _supervise.provision_supervise(plan, "claude-bottle-demo-abc12")
+        ex.assert_called_once()
+        argv = ex.call_args.args[1]
+        # claude mcp add --scope user --transport http supervise <url>
+        self.assertEqual(
+            [
+                "claude", "mcp", "add",
+                "--scope", "user",
+                "--transport", "http",
+                "supervise",
+                "http://192.168.50.2:9100/",
+            ],
+            argv,
+        )
+
+    def test_non_zero_exit_logs_warning_but_does_not_raise(self):
+        plan = _plan(supervise=True)
+        with patch(
+            "claude_bottle.backend.smolmachines.provision.supervise._smolvm.machine_exec",
+            return_value=SmolvmRunResult(
+                returncode=1, stdout="", stderr="boom",
+            ),
+        ):
+            # No raise — the bottle still works without the MCP
+            # entry, so we log and move on.
+            _supervise.provision_supervise(plan, "claude-bottle-demo-abc12")
+
+
 if __name__ == "__main__":
     unittest.main()