fix(backend): fix pyright errors in lazy-load implementation

- Rename _BACKENDS → _backends: pyright treats uppercase module-level
  names as constants and flags the reassignment in _get_backends() as
  reportConstantRedefinition; lowercase avoids this.
- Add TYPE_CHECKING guard importing CommitCancelled/Freezer/get_freezer
  from .freeze: pyright cannot see module-level __getattr__ bindings, so
  reportUnsupportedDunderAll fired for those three __all__ entries; the
  guard makes them visible to the type checker without running at import
  time.
- Update test_backend_selection.py to patch _backends (lowercase).

bot_bottle/agent_provider.py

@@ -61,13 +61,6 @@ class AgentProviderRuntime:
     prompt_mode: PromptMode
     bypass_args: tuple[str, ...]
     resume_args: tuple[str, ...]
-    # argv run inside a throwaway container of a freshly built agent
-    # image, right after `build_image()`, to catch a build that
-    # exited 0 but produced a broken CLI (e.g. an npm
-    # optionalDependencies fetch for a platform-native binary that
-    # silently no-ops on a transient failure). Empty tuple skips the
-    # check — not every provider has opted in yet.
-    smoke_test: tuple[str, ...] = ()
 
 
 @dataclass(frozen=True)

bot_bottle/backend/__init__.py

@@ -40,7 +40,7 @@ from abc import ABC, abstractmethod
 from contextlib import AbstractContextManager
 from dataclasses import dataclass
 from pathlib import Path
-from typing import Any, Generic, Sequence, TypeVar
+from typing import TYPE_CHECKING, Any, Generic, Sequence, TypeVar
 
 from ..agent_provider import AgentProvisionPlan, get_provider, build_agent_provision_plan
 from ..egress import EgressPlan
@@ -54,6 +54,9 @@ from ..workspace import WorkspacePlan, workspace_plan
 from .print_util import print_multi, visible_agent_env_names
 from .util import host_skill_dir
 
+if TYPE_CHECKING:
+    from .freeze import CommitCancelled, Freezer, get_freezer
+
 
 @dataclass(frozen=True)
 class BottleSpec:
@@ -572,31 +575,31 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT]):
         Not called by the launch path or the test suite."""
 
 
-# _BACKENDS is None until the first call to _get_backends(), at which
+# _backends is None until the first call to _get_backends(), at which
 # point all three concrete backend classes are imported and instantiated.
 # Keeping the imports out of module scope means that importing any
 # backend sub-module (e.g. `backend.docker.util`) no longer drags the
 # firecracker and macos-container implementations into memory.
 #
-# Tests may replace _BACKENDS with a {name: fake} dict via patch.object;
+# Tests may replace _backends with a {name: fake} dict via patch.object;
 # _get_backends() returns the current module-level value as-is when it
 # is not None, so test fakes take effect without triggering real imports.
-_BACKENDS: dict[str, BottleBackend[Any, Any]] | None = None
+_backends: dict[str, BottleBackend[Any, Any]] | None = None
 
 
 def _get_backends() -> dict[str, BottleBackend[Any, Any]]:
     """Return the registry of all backend instances, loading lazily on first call."""
-    global _BACKENDS  # pylint: disable=global-statement
+    global _backends  # pylint: disable=global-statement
-    if _BACKENDS is None:
+    if _backends is None:
         from .docker import DockerBottleBackend
         from .firecracker import FirecrackerBottleBackend
         from .macos_container import MacosContainerBottleBackend
-        _BACKENDS = {
+        _backends = {
             "docker": DockerBottleBackend(),
             "firecracker": FirecrackerBottleBackend(),
             "macos-container": MacosContainerBottleBackend(),
         }
-    return _BACKENDS
+    return _backends
 
 
 def __getattr__(name: str) -> Any:
@@ -717,12 +720,12 @@ __all__ = [
     "BottleCleanupPlan",
     "BottlePlan",
     "BottleSpec",
-    "CommitCancelled",  # pylint: disable=undefined-all-variable
+    "CommitCancelled",
     "ExecResult",
-    "Freezer",  # pylint: disable=undefined-all-variable
+    "Freezer",
     "enumerate_active_agents",
     "get_bottle_backend",
-    "get_freezer",  # pylint: disable=undefined-all-variable
+    "get_freezer",
     "has_backend",
     "known_backend_names",
 ]

bot_bottle/backend/docker/launch.py

@@ -36,7 +36,6 @@ from contextlib import ExitStack, contextmanager
 from pathlib import Path
 from typing import Callable, Generator
 
-from ...agent_provider import runtime_for
 from ...egress import egress_resolve_token_values
 from ...git_gate import (
     provision_git_gate_dynamic_keys,
@@ -111,9 +110,6 @@ def launch(
                 plan.image, _REPO_DIR,
                 dockerfile=plan.dockerfile_path,
             )
-            docker_mod.verify_agent_image(
-                plan.image, runtime_for(plan.agent_provider_template).smoke_test,
-            )
 
         # Step 2: mint the git-gate dynamic (gitea) deploy keys, if any, before
         # provisioning the bottle's repos into the shared gateway.

bot_bottle/backend/docker/util.py

@@ -4,7 +4,6 @@ existence, and building images."""
 
 from __future__ import annotations
 
-import os
 import re
 import shutil
 import subprocess
@@ -75,29 +74,6 @@ def docker_exec_root(container: str, argv: list[str]) -> None:
     )
 
 
-def docker_exec(container: str, argv: list[str], *, user: str = "") -> None:
-    """Run `docker exec` in the named container, dying with the
-    command's own stderr on failure. Pass `user=\"0\"` to run as root."""
-    cmd = ["docker", "exec"]
-    if user:
-        cmd += ["-u", user]
-    cmd += [container, *argv]
-    result = run_docker(cmd)
-    if result.returncode != 0:
-        die(
-            f"docker exec in {container} failed: "
-            f"{(result.stderr or '').strip() or '<no stderr>'}"
-        )
-
-
-def docker_cp(src: str, dest: str) -> None:
-    """Run `docker cp`, dying with the command's own stderr on failure."""
-    result = run_docker(["docker", "cp", src, dest])
-    if result.returncode != 0:
-        die(f"docker cp {src} -> {dest} failed: "
-            f"{(result.stderr or '').strip() or '<no stderr>'}")
-
-
 _SLUG_RE = re.compile(r"[^a-z0-9]+")
 
 
@@ -118,40 +94,15 @@ def build_image(ref: str, context: str, *, dockerfile: str = "") -> None:
 
     `dockerfile` is an optional path (relative to `context`, or
     absolute) for callers that need to build from a non-default
-    Dockerfile in the same context — e.g. `Dockerfile.git-gate`.
+    Dockerfile in the same context — e.g. `Dockerfile.git-gate`."""
-
-    Set `BOT_BOTTLE_NO_CACHE=1` (the `start --no-cache` flag) to force
-    `--no-cache`. The npm/curl installers some provider Dockerfiles
-    shell out to can silently no-op on a transient network failure —
-    e.g. an `optionalDependencies` fetch for a platform-native binary —
-    and Docker will then cache that broken layer indefinitely."""
     info(f"building image {ref} from {context} (layer cache keeps repeat builds fast)")
     args = ["docker", "build", "-t", ref]
-    if os.environ.get("BOT_BOTTLE_NO_CACHE") == "1":
-        args.append("--no-cache")
     if dockerfile:
         args.extend(["-f", dockerfile])
     args.append(context)
     subprocess.run(args, check=True)
 
 
-def verify_agent_image(image: str, argv: tuple[str, ...]) -> None:
-    """Run `argv` inside a throwaway container of a freshly built agent
-    image and die loudly if it fails, instead of shipping an image
-    whose CLI only breaks at first real use. No-op when the provider
-    hasn't declared a smoke test (`AgentProviderRuntime.smoke_test`)."""
-    if not argv:
-        return
-    result = run_docker(["docker", "run", "--rm", "--entrypoint", argv[0], image, *argv[1:]])
-    if result.returncode != 0:
-        detail = (result.stderr or result.stdout or "").strip()
-        die(
-            f"agent image {image!r} failed its post-build smoke test "
-            f"({' '.join(argv)}): {detail}\n"
-            f"Try rebuilding from scratch: bot-bottle start --no-cache"
-        )
-
-
 # def build_image_with_cwd(
 #     derived: str,
 #     base: str,

bot_bottle/backend/firecracker/consolidated_launch.py

@@ -1,162 +0,0 @@
-"""Consolidated bottle launch sequence for the Firecracker backend (PRD 0070).
-
-Mirrors bot_bottle.backend.docker.consolidated_launch but wired for
-Firecracker's TAP-based network topology instead of a shared Docker bridge.
-
-The per-bottle sidecar bundle (one `docker run` per bottle, published on the
-slot's host-side TAP IP) is replaced by a single persistent gateway that
-every Firecracker VM shares. The gateway runs as a Docker container in the
-dev-harness (a Firecracker VM is stage B per PRD 0070), with its ports
-published on the host (`0.0.0.0:PORT`). VMs reach it at their slot's
-host-side TAP IP because Docker's iptables PREROUTING DNAT redirects
-port 9099/9100/9420 traffic to the gateway container — a path the nft
-isolation table already allows via `ct status dnat accept` in the forward
-chain.
-
-Attribution is by the VM's guest IP, which is unspoofable by construction:
-the /31 point-to-point TAP topology + the `bot_bottle_fc` nft table ensure
-that only the expected VM can source-IP that address.
-
-Sequence:
-  1. ensure the Firecracker-flavoured orchestrator + gateway are up;
-  2. register the bottle by its guest IP (attribution key) → bottle id +
-     identity token;
-  3. provision its git-gate repos/creds into the running gateway;
-  4. fetch the shared gateway CA for the provisioner to install in the rootfs.
-
-The TAP slot allocation, rootfs build, and VM boot are the caller's job.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-
-from ...egress import EgressPlan
-from ...git_gate import GitGatePlan
-from ...orchestrator.client import OrchestratorClient
-from ...orchestrator.gateway import (
-    GATEWAY_NETWORK,
-    DockerGateway,
-)
-from ...orchestrator.lifecycle import (
-    OrchestratorService,
-    OrchestratorStartError,  # re-exported so callers can catch it
-)
-from ...orchestrator.registration import registration_inputs
-from ..docker.egress import EGRESS_PORT
-from ..docker.gateway_provision import deprovision_git_gate, provision_git_gate
-from ...supervise import SUPERVISE_PORT
-
-_GIT_HTTP_PORT = 9420
-
-# Separate names from the Docker gateway so both backends can coexist on one
-# host (and for clarity in `docker ps` output).
-_FC_GATEWAY_NAME = "bot-bottle-fc-gateway"
-_FC_ORCHESTRATOR_NAME = "bot-bottle-fc-orchestrator"
-_FC_ORCHESTRATOR_LABEL = "bot-bottle-fc-orchestrator=1"
-# Ports the gateway publishes on the host so Firecracker VMs can reach it
-# via their TAP link. Docker's PREROUTING DNAT + nft's `ct status dnat
-# accept` in the forward chain route the traffic.
-_FC_GATEWAY_HOST_PORTS = (EGRESS_PORT, SUPERVISE_PORT, _GIT_HTTP_PORT)
-
-
-class ConsolidatedLaunchError(RuntimeError):
-    """The consolidated register/provision sequence could not complete."""
-
-
-@dataclass(frozen=True)
-class LaunchContext:
-    """What the Firecracker launch needs from the consolidated sequence."""
-
-    bottle_id: str
-    identity_token: str
-    source_ip: str          # the VM's guest IP — the attribution key
-    gateway_ca_pem: str     # the shared gateway CA the provisioner installs
-    orchestrator_url: str
-
-
-class _FirecrackerOrchestratorService(OrchestratorService):
-    """Dev-harness orchestrator for the Firecracker backend.
-
-    Uses a gateway that publishes its ports on the host so Firecracker VMs can
-    reach it via their TAP link. The gateway and orchestrator containers use
-    `*-fc-*` names so both backends can run independently on the same host.
-    """
-
-    def __init__(self, **kwargs: object) -> None:
-        super().__init__(
-            orchestrator_name=_FC_ORCHESTRATOR_NAME,
-            orchestrator_label=_FC_ORCHESTRATOR_LABEL,
-            **kwargs,  # type: ignore[arg-type]
-        )
-
-    def _gateway(self) -> DockerGateway:
-        return DockerGateway(
-            self.image,
-            name=_FC_GATEWAY_NAME,
-            network=self.network,
-            orchestrator_url=self.internal_url,
-            host_port_bindings=_FC_GATEWAY_HOST_PORTS,
-        )
-
-
-def launch_consolidated(
-    egress_plan: EgressPlan,
-    git_gate_plan: GitGatePlan,
-    *,
-    guest_ip: str,
-    image_ref: str = "",
-    tokens: dict[str, str] | None = None,
-    service: OrchestratorService | None = None,
-    gateway_name: str = _FC_GATEWAY_NAME,
-) -> LaunchContext:
-    """Ensure the orchestrator + Firecracker gateway are up, register the
-    bottle by its guest IP, and provision its git-gate state. Returns the
-    context the VM launch needs. Raises `ConsolidatedLaunchError` (or the
-    primitives' own errors) on failure — the caller tears down on failure."""
-    service = service or _FirecrackerOrchestratorService()
-    url = service.ensure_running()
-    client = OrchestratorClient(url)
-
-    inputs = registration_inputs(egress_plan)
-    reg = client.register_bottle(
-        guest_ip, image_ref=image_ref, policy=inputs.policy,
-        metadata=inputs.metadata, tokens=tokens,
-    )
-    try:
-        provision_git_gate(gateway_name, reg.bottle_id, git_gate_plan)
-    except Exception:
-        client.teardown_bottle(reg.bottle_id)
-        raise
-
-    # Fetch the shared gateway CA here so the caller can install it in the
-    # rootfs (the same CA every agent on this host trusts for TLS interception).
-    gateway_ca_pem = DockerGateway(
-        name=gateway_name, network=GATEWAY_NETWORK,
-    ).ca_cert_pem()
-
-    return LaunchContext(
-        bottle_id=reg.bottle_id,
-        identity_token=reg.identity_token,
-        source_ip=guest_ip,
-        gateway_ca_pem=gateway_ca_pem,
-        orchestrator_url=url,
-    )
-
-
-def teardown_consolidated(
-    bottle_id: str, *, orchestrator_url: str, gateway_name: str = _FC_GATEWAY_NAME,
-) -> None:
-    """Deregister the bottle and remove its git-gate state from the gateway.
-    Both steps are idempotent so this is safe from a cleanup trap."""
-    OrchestratorClient(orchestrator_url).teardown_bottle(bottle_id)
-    deprovision_git_gate(gateway_name, bottle_id)
-
-
-__all__ = [
-    "LaunchContext",
-    "launch_consolidated",
-    "teardown_consolidated",
-    "ConsolidatedLaunchError",
-    "OrchestratorStartError",
-]

bot_bottle/backend/firecracker/launch.py

@@ -1,64 +1,75 @@
-"""Launch flow for the Firecracker backend (PRD 0070, consolidated).
+"""Launch flow for the Firecracker backend.
 
 Per bottle:
-  1. build the agent image (docker), export it to a cached ext4 rootfs;
+  1. mint the egress CA, build the agent image (docker), export it to a
-  2. ensure the per-host orchestrator + shared gateway are up;
+     cached ext4 rootfs;
-  3. claim a free TAP pool slot (rootless flock);
+  2. claim a free TAP pool slot (rootless flock);
-  4. register the bottle on the orchestrator by the VM's guest IP (the
+  3. bring up the Docker sidecar bundle, publishing egress / git-gate /
-     attribution key) and provision its git-gate state into the gateway;
+     supervise on the slot's host-side TAP IP at fixed ports;
-  5. boot the microVM on that TAP; wait for SSH;
+  4. boot the microVM on that TAP; wait for SSH;
-  6. provision (shared gateway CA, prompt, skills, workspace, git, supervise)
+  5. provision (CA, prompt, skills, workspace, git, supervise) over SSH.
-     over SSH.
-
-The per-bottle Docker sidecar bundle is gone. The shared gateway handles
-egress / git-gate / supervise for every VM; Docker's PREROUTING DNAT routes
-the VMs' traffic to it, and the nft table's `ct status dnat accept` rule
-in the forward chain lets it pass. The VM still sends to `host_tap_ip:PORT`
-— the address its world is, by nft design, limited to.
 
 Isolation is enforced by the operator-provisioned nft table (checked
-fail-closed in preflight): a VM reaches only the sidecar (DNAT'd from
+fail-closed in preflight): a VM reaches only its sidecar (DNAT'd from
-the host TAP IP) and nothing else.
+the host TAP IP) and nothing else. The agent's HTTPS_PROXY therefore
+points at `http://<host_tap_ip>:9099`, its only route to the world.
 """
 
 from __future__ import annotations
 
 import dataclasses
 import os
+import subprocess
 from contextlib import ExitStack, contextmanager
 from pathlib import Path
 from typing import Callable, Generator
 
-from ...agent_provider import runtime_for
 from ...bottle_state import (
     egress_state_dir,
     git_gate_state_dir,
     read_committed_image,
 )
 from ...egress import (
+    EGRESS_ROUTES_IN_CONTAINER,
     egress_agent_env_entries,
     egress_resolve_token_values,
+    egress_sidecar_env_entries,
 )
 from ...git_gate import (
     provision_git_gate_dynamic_keys,
     revoke_git_gate_provisioned_keys,
 )
-from ...log import info, warn
+from ...log import die, info, warn
-from ...supervise import SUPERVISE_PORT
+from ...supervise import DB_PATH_IN_CONTAINER, SUPERVISE_PORT
-from ..docker import util as docker_mod
+from ...util import expand_tilde
-from ..docker.egress import EGRESS_PORT
+from ..docker.egress import (
+    EGRESS_CA_IN_CONTAINER,
+    EGRESS_PORT,
+    egress_tls_init,
+)
+from ..docker.git_gate import (
+    GIT_GATE_ACCESS_HOOK_IN_CONTAINER,
+    GIT_GATE_CREDS_DIR_IN_CONTAINER,
+    GIT_GATE_ENTRYPOINT_IN_CONTAINER,
+    GIT_GATE_HOOK_IN_CONTAINER,
+)
+from ..docker.sidecar_bundle import (
+    SIDECAR_BUNDLE_DOCKERFILE,
+    SIDECAR_BUNDLE_IMAGE,
+)
 from ..util import AGENT_CA_BUNDLE, AGENT_CA_PATH
 from . import firecracker_vm, isolation_probe, netpool, util
 from .bottle import FirecrackerBottle
 from .bottle_plan import FirecrackerBottlePlan
-from .consolidated_launch import (
-    launch_consolidated,
-    teardown_consolidated,
-)
 
 
 _REPO_DIR = str(Path(__file__).resolve().parent.parent.parent.parent)
 _GIT_HTTP_PORT = 9420
+_GIT_GATE_READY_FILE = "/run/git-gate/ready"
+
+
+def sidecar_container_name(slug: str) -> str:
+    return f"bot-bottle-sidecars-{slug}"
 
 
 @contextmanager
@@ -67,8 +78,6 @@ def launch(
     *,
     provision: Callable[[FirecrackerBottlePlan, "FirecrackerBottle"], str | None],
 ) -> Generator[FirecrackerBottle, None, None]:
-    """Build, launch, and provision a Firecracker bottle via the consolidated
-    orchestrator. Teardown on exit."""
     stack = ExitStack()
     bottle_for_revoke = plan.manifest.bottle
     git_gate_dir_for_revoke = git_gate_state_dir(plan.slug)
@@ -85,75 +94,26 @@ def launch(
             raise teardown_exc
 
     try:
-        # Step 1: agent image. The sidecar bundle image is built by the
+        plan = _mint_certs(plan)
-        # orchestrator service (ensure_running → ensure_built); we only
-        # build the agent image here. Use a committed snapshot when available.
         plan = _build_agent_image(plan)
 
-        # Step 2: mint the git-gate dynamic (gitea) deploy keys, if any.
+        # Claim a TAP slot; the flock is held until teardown closes it.
-        git_gate_plan = plan.git_gate_plan
-        if git_gate_plan.upstreams:
-            git_gate_plan = provision_git_gate_dynamic_keys(
-                plan.manifest.bottle, git_gate_plan, git_gate_state_dir(plan.slug),
-            )
-
-        # Step 3: claim a TAP slot; the flock is held until teardown.
         slot, lock = netpool.allocate(plan.slug)
         stack.callback(lock.close)
         info(f"firecracker slot {slot.iface}: host={slot.host_ip} "
              f"guest={slot.guest_ip}")
 
-        # Step 4: register on the orchestrator + provision this bottle's
+        plan = _provision_git_gate_keys(plan)
-        # git-gate state into the shared gateway. The per-bottle egress tokens
-        # are resolved from the host env now and handed to the orchestrator
-        # (in memory) for the gateway to inject — the agent never sees them.
-        # Attribution is by the VM's guest IP (unspoofable via /31 TAP + nft).
-        effective_env = {**os.environ, **plan.agent_provision.provisioned_env}
-        token_values = egress_resolve_token_values(
-            plan.egress_plan.token_env_map, effective_env,
-        )
-        ctx = launch_consolidated(
-            plan.egress_plan, git_gate_plan,
-            guest_ip=slot.guest_ip,
-            image_ref=plan.image,
-            tokens=token_values,
-        )
-        stack.callback(
-            teardown_consolidated, ctx.bottle_id,
-            orchestrator_url=ctx.orchestrator_url,
-        )
 
-        # Step 5: install the SHARED gateway CA (replaces the per-bottle CA).
+        sidecar_name = sidecar_container_name(plan.slug)
-        # Write it to a stable host path so the provisioner can copy it over SSH.
+        _force_remove_container(sidecar_name)
-        ca_dir = egress_state_dir(plan.slug) / "gateway-ca"
+        _start_sidecar_bundle(plan, sidecar_name, slot.host_ip)
-        ca_dir.mkdir(parents=True, exist_ok=True)
+        stack.callback(_force_remove_container, sidecar_name)
-        ca_file = ca_dir / "gateway-ca.pem"
+        _stage_git_gate(plan, sidecar_name)
-        ca_file.write_text(ctx.gateway_ca_pem)
-        egress_plan = dataclasses.replace(
-            plan.egress_plan,
-            mitmproxy_ca_host_path=ca_file,
-            mitmproxy_ca_cert_only_host_path=ca_file,
-        )
-        # Point the agent's git-gate insteadOf rewrites and supervise MCP URL
-        # at the shared gateway (reached at the slot's host TAP IP — the VM
-        # sends there and Docker DNAT routes to the gateway container).
-        git_gate_url = (
-            f"http://{slot.host_ip}:{_GIT_HTTP_PORT}" if git_gate_plan.upstreams else ""
-        )
-        supervise_url = (
-            f"http://{slot.host_ip}:{SUPERVISE_PORT}/"
-            if plan.supervise_plan is not None else ""
-        )
-        plan = dataclasses.replace(
-            plan,
-            git_gate_plan=git_gate_plan,
-            egress_plan=egress_plan,
-            agent_proxy_url=f"http://{slot.host_ip}:{EGRESS_PORT}",
-            agent_git_gate_url=git_gate_url,
-            agent_supervise_url=supervise_url,
-        )
 
-        # Step 6: build the per-bottle rootfs + SSH key, then boot.
+        plan = _stamp_agent_urls(plan, slot.host_ip)
+
+        # Build the per-bottle rootfs + SSH key, then boot.
         base_dir = util.build_base_rootfs_dir(plan.image)
         run_dir = util.cache_dir() / "run" / plan.slug
         run_dir.mkdir(parents=True, exist_ok=True)
@@ -173,8 +133,8 @@ def launch(
         stack.callback(vm.terminate)
         firecracker_vm.wait_for_ssh(vm, private_key)
 
-        # Authoritative fail-closed egress-boundary check, before the agent
+        # Authoritative fail-closed egress-boundary check, before the
-        # runs: prove the VM cannot reach the host directly.
+        # agent runs: prove the VM cannot reach the host directly.
         isolation_probe.verify_isolation(private_key, slot.guest_ip)
 
         bottle = FirecrackerBottle(
@@ -199,21 +159,171 @@ def launch(
         teardown()
 
 
+def _mint_certs(plan: FirecrackerBottlePlan) -> FirecrackerBottlePlan:
+    egress_ca_host, egress_ca_cert_only = egress_tls_init(egress_state_dir(plan.slug))
+    egress_plan = dataclasses.replace(
+        plan.egress_plan,
+        mitmproxy_ca_host_path=egress_ca_host,
+        mitmproxy_ca_cert_only_host_path=egress_ca_cert_only,
+    )
+    return dataclasses.replace(plan, egress_plan=egress_plan)
+
+
 def _build_agent_image(plan: FirecrackerBottlePlan) -> FirecrackerBottlePlan:
+    _docker_build(SIDECAR_BUNDLE_IMAGE, _REPO_DIR, dockerfile=SIDECAR_BUNDLE_DOCKERFILE)
     committed = read_committed_image(plan.slug)
-    if committed and docker_mod.image_exists(committed):
+    if committed and _image_exists(committed):
         info(f"using committed image {committed!r}")
         return dataclasses.replace(
             plan,
             agent_provision=dataclasses.replace(plan.agent_provision, image=committed),
         )
-    docker_mod.build_image(plan.image, _REPO_DIR, dockerfile=plan.dockerfile_path)
+    _docker_build(plan.image, _REPO_DIR, dockerfile=plan.dockerfile_path)
-    docker_mod.verify_agent_image(
-        plan.image, runtime_for(plan.agent_provider_template).smoke_test,
-    )
     return plan
 
 
+def _provision_git_gate_keys(plan: FirecrackerBottlePlan) -> FirecrackerBottlePlan:
+    if not plan.git_gate_plan.upstreams:
+        return plan
+    git_gate_plan = provision_git_gate_dynamic_keys(
+        plan.manifest.bottle, plan.git_gate_plan, git_gate_state_dir(plan.slug),
+    )
+    return dataclasses.replace(plan, git_gate_plan=git_gate_plan)
+
+
+def _stamp_agent_urls(
+    plan: FirecrackerBottlePlan, host_ip: str,
+) -> FirecrackerBottlePlan:
+    proxy_url = f"http://{host_ip}:{EGRESS_PORT}"
+    supervise_url = (
+        f"http://{host_ip}:{SUPERVISE_PORT}/" if plan.supervise_plan is not None else ""
+    )
+    git_gate_url = (
+        f"http://{host_ip}:{_GIT_HTTP_PORT}" if plan.git_gate_plan.upstreams else ""
+    )
+    return dataclasses.replace(
+        plan,
+        agent_proxy_url=proxy_url,
+        agent_git_gate_url=git_gate_url,
+        agent_supervise_url=supervise_url,
+    )
+
+
+# --- sidecar bundle (Docker) ----------------------------------------
+
+def _start_sidecar_bundle(
+    plan: FirecrackerBottlePlan, sidecar_name: str, host_ip: str,
+) -> None:
+    argv = ["docker", "run", "--name", sidecar_name, "--detach", "--rm",
+            "-e", f"BOT_BOTTLE_SIDECAR_DAEMONS={','.join(_sidecar_daemons(plan))}"]
+    for entry in _sidecar_env_entries(plan):
+        argv += ["-e", entry]
+    for host_path, container_path, read_only in _sidecar_mounts(plan):
+        argv += ["-v", f"{host_path}:{container_path}{':ro' if read_only else ''}"]
+    # Publish on the slot's host TAP IP at fixed ports — each bottle
+    # has a distinct host_ip, so fixed ports never collide, and the VM
+    # reaches them at a stable, well-known address (its only route out).
+    for port in _sidecar_ports(plan):
+        argv += ["-p", f"{host_ip}:{port}:{port}"]
+    argv.append(SIDECAR_BUNDLE_IMAGE)
+
+    effective_env = {**dict(os.environ), **plan.agent_provision.provisioned_env}
+    token_values = egress_resolve_token_values(
+        plan.egress_plan.token_env_map, effective_env,
+    )
+    env = {**os.environ, **token_values}
+    info(f"docker run sidecar bundle {sidecar_name} (published on {host_ip})")
+    result = subprocess.run(argv, capture_output=True, text=True, env=env, check=False)
+    if result.returncode != 0:
+        die(f"docker run for sidecar bundle {sidecar_name} failed: "
+            f"{(result.stderr or '').strip() or '<no stderr>'}")
+
+
+def _sidecar_daemons(plan: FirecrackerBottlePlan) -> tuple[str, ...]:
+    daemons = ["egress"]
+    if plan.git_gate_plan.upstreams:
+        daemons += ["git-gate", "git-http"]
+    if plan.supervise_plan is not None:
+        daemons.append("supervise")
+    return tuple(daemons)
+
+
+def _sidecar_ports(plan: FirecrackerBottlePlan) -> tuple[int, ...]:
+    ports = [EGRESS_PORT]
+    if plan.git_gate_plan.upstreams:
+        ports.append(_GIT_HTTP_PORT)
+    if plan.supervise_plan is not None:
+        ports.append(SUPERVISE_PORT)
+    return tuple(ports)
+
+
+def _sidecar_env_entries(plan: FirecrackerBottlePlan) -> tuple[str, ...]:
+    env: list[str] = list(egress_sidecar_env_entries(plan.egress_plan))
+    if plan.git_gate_plan.upstreams:
+        env.append(f"BOT_BOTTLE_GIT_GATE_READY_FILE={_GIT_GATE_READY_FILE}")
+    if plan.supervise_plan is not None:
+        env += [
+            f"SUPERVISE_BOTTLE_SLUG={plan.slug}",
+            f"SUPERVISE_DB_PATH={DB_PATH_IN_CONTAINER}",
+            f"SUPERVISE_PORT={SUPERVISE_PORT}",
+        ]
+    return tuple(env)
+
+
+def _sidecar_mounts(
+    plan: FirecrackerBottlePlan,
+) -> tuple[tuple[str, str, bool], ...]:
+    mounts: list[tuple[str, str, bool]] = []
+    ep = plan.egress_plan
+    mounts.append((str(ep.mitmproxy_ca_host_path.parent),
+                   str(Path(EGRESS_CA_IN_CONTAINER).parent), False))
+    if ep.routes:
+        mounts.append((str(ep.routes_path.parent),
+                       str(Path(EGRESS_ROUTES_IN_CONTAINER).parent), True))
+    sp = plan.supervise_plan
+    if sp is not None:
+        mounts.append((str(sp.db_path.parent),
+                       str(Path(DB_PATH_IN_CONTAINER).parent), False))
+    return tuple(mounts)
+
+
+def _stage_git_gate(plan: FirecrackerBottlePlan, sidecar_name: str) -> None:
+    gp = plan.git_gate_plan
+    if not gp.upstreams:
+        return
+    _docker_exec(sidecar_name, [
+        "mkdir", "-p",
+        str(Path(GIT_GATE_HOOK_IN_CONTAINER).parent),
+        GIT_GATE_CREDS_DIR_IN_CONTAINER, "/git",
+        str(Path(_GIT_GATE_READY_FILE).parent),
+    ])
+    for host_path, container_path in _git_gate_files(plan):
+        _docker_cp(host_path, f"{sidecar_name}:{container_path}")
+    _docker_exec(sidecar_name, [
+        "sh", "-c",
+        f"chmod 755 {GIT_GATE_ENTRYPOINT_IN_CONTAINER} "
+        f"{GIT_GATE_HOOK_IN_CONTAINER} {GIT_GATE_ACCESS_HOOK_IN_CONTAINER} && "
+        f"chmod 600 {GIT_GATE_CREDS_DIR_IN_CONTAINER}/* && "
+        f"touch {_GIT_GATE_READY_FILE}",
+    ])
+
+
+def _git_gate_files(plan: FirecrackerBottlePlan) -> tuple[tuple[str, str], ...]:
+    gp = plan.git_gate_plan
+    files: list[tuple[str, str]] = [
+        (str(gp.entrypoint_script), GIT_GATE_ENTRYPOINT_IN_CONTAINER),
+        (str(gp.hook_script), GIT_GATE_HOOK_IN_CONTAINER),
+        (str(gp.access_hook_script), GIT_GATE_ACCESS_HOOK_IN_CONTAINER),
+    ]
+    for upstream in gp.upstreams:
+        files.append((expand_tilde(upstream.identity_file),
+                      f"{GIT_GATE_CREDS_DIR_IN_CONTAINER}/{upstream.name}-key"))
+        if upstream.known_hosts_file:
+            files.append((str(upstream.known_hosts_file),
+                          f"{GIT_GATE_CREDS_DIR_IN_CONTAINER}/{upstream.name}-known_hosts"))
+    return tuple(files)
+
+
 # --- agent guest env -------------------------------------------------
 
 def _agent_guest_env(plan: FirecrackerBottlePlan, host_ip: str) -> dict[str, str]:
@@ -245,3 +355,50 @@ def _agent_guest_env(plan: FirecrackerBottlePlan, host_ip: str) -> dict[str, str
         if value is not None:
             env[name] = value
     return env
+
+
+# --- docker helpers --------------------------------------------------
+
+def _docker_build(ref: str, context: str, *, dockerfile: str = "") -> None:
+    info(f"docker build {ref}")
+    args = ["docker", "build", "-t", ref]
+    if dockerfile:
+        if not os.path.isabs(dockerfile):
+            dockerfile = os.path.join(context, dockerfile)
+        args += ["-f", dockerfile]
+    args.append(context)
+    result = subprocess.run(args, check=False)
+    if result.returncode != 0:
+        die(f"docker build for {ref!r} failed")
+
+
+def _image_exists(ref: str) -> bool:
+    return subprocess.run(
+        ["docker", "image", "inspect", ref],
+        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False,
+    ).returncode == 0
+
+
+def _force_remove_container(name: str) -> None:
+    subprocess.run(
+        ["docker", "rm", "-f", name],
+        stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False,
+    )
+
+
+def _docker_exec(name: str, argv: list[str]) -> None:
+    result = subprocess.run(
+        ["docker", "exec", name, *argv], capture_output=True, text=True, check=False,
+    )
+    if result.returncode != 0:
+        die(f"docker exec in {name} failed: "
+            f"{(result.stderr or '').strip() or '<no stderr>'}")
+
+
+def _docker_cp(host_path: str, dest: str) -> None:
+    result = subprocess.run(
+        ["docker", "cp", host_path, dest], capture_output=True, text=True, check=False,
+    )
+    if result.returncode != 0:
+        die(f"docker cp {host_path} -> {dest} failed: "
+            f"{(result.stderr or '').strip() or '<no stderr>'}")

bot_bottle/backend/macos_container/launch.py

@@ -17,7 +17,6 @@ from contextlib import ExitStack, contextmanager
 from pathlib import Path
 from typing import Callable, Generator
 
-from ...agent_provider import runtime_for
 from ...bottle_state import (
     egress_state_dir,
     git_gate_state_dir,
@@ -170,9 +169,6 @@ def _build_images(plan: MacosContainerBottlePlan) -> MacosContainerBottlePlan:
         _REPO_DIR,
         dockerfile=plan.dockerfile_path,
     )
-    container_mod.verify_agent_image(
-        plan.image, runtime_for(plan.agent_provider_template).smoke_test,
-    )
     return plan
 
 

bot_bottle/backend/macos_container/util.py

@@ -60,21 +60,13 @@ def dns_server() -> str:
 
 
 def build_image(ref: str, context: str, *, dockerfile: str = "") -> None:
-    """Build an OCI image with Apple's BuildKit-backed `container build`.
+    """Build an OCI image with Apple's BuildKit-backed `container build`."""
-
-    Set `BOT_BOTTLE_NO_CACHE=1` (the `start --no-cache` flag) to force
-    `--no-cache`. The npm/curl installers some provider Dockerfiles
-    shell out to can silently no-op on a transient network failure —
-    e.g. an `optionalDependencies` fetch for a platform-native binary —
-    and the builder will then cache that broken layer indefinitely."""
     info(
         f"building image {ref} from {context} with Apple Container "
         "(layer cache keeps repeat builds fast)"
     )
     _ensure_builder_dns()
     args = [_CONTAINER, "build", "-t", ref, "--dns", dns_server()]
-    if os.environ.get("BOT_BOTTLE_NO_CACHE") == "1":
-        args.append("--no-cache")
     if dockerfile:
         # `container build` resolves -f relative to the current working
         # directory, not the build context. Anchor a relative Dockerfile to
@@ -86,28 +78,6 @@ def build_image(ref: str, context: str, *, dockerfile: str = "") -> None:
     subprocess.run(args, check=True)
 
 
-def verify_agent_image(image: str, argv: tuple[str, ...]) -> None:
-    """Run `argv` inside a throwaway container of a freshly built agent
-    image and die loudly if it fails, instead of shipping an image
-    whose CLI only breaks at first real use. No-op when the provider
-    hasn't declared a smoke test (`AgentProviderRuntime.smoke_test`)."""
-    if not argv:
-        return
-    result = subprocess.run(
-        [_CONTAINER, "run", "--rm", "--entrypoint", argv[0], image, *argv[1:]],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        detail = (result.stderr or result.stdout or "").strip()
-        die(
-            f"agent image {image!r} failed its post-build smoke test "
-            f"({' '.join(argv)}): {detail}\n"
-            f"Try rebuilding from scratch: bot-bottle start --no-cache"
-        )
-
-
 def commit_container(container_name: str, image_tag: str) -> None:
     """Snapshot a running Apple Container as a local image.
 

bot_bottle/cli/start.py

@@ -46,17 +46,6 @@ def cmd_start(argv: list[str]) -> int:
     parser = argparse.ArgumentParser(prog=f"{PROG} start", add_help=True)
     parser.add_argument("--dry-run", action="store_true")
     parser.add_argument("--cwd", action="store_true", help="copy host cwd into the running bottle")
-    parser.add_argument(
-        "--no-cache",
-        action="store_true",
-        help=(
-            "rebuild agent/sidecar images from scratch, bypassing the "
-            "build layer cache. Use when an image looks broken after a "
-            "dependency bump — e.g. an installer's optionalDependencies "
-            "fetch silently no-op'd on a transient failure and got baked "
-            "into a cached layer."
-        ),
-    )
     parser.add_argument(
         "--backend",
         choices=known_backend_names(),
@@ -108,11 +97,6 @@ def cmd_start(argv: list[str]) -> int:
     args = parser.parse_args(argv)
 
     dry_run = args.dry_run or os.environ.get("BOT_BOTTLE_DRY_RUN") == "1"
-    if args.no_cache or os.environ.get("BOT_BOTTLE_NO_CACHE") == "1":
-        # Read by build_image() in each backend's util module — set here
-        # so both the interactive and --headless paths pick it up without
-        # threading a no_cache field through every backend's plan dataclass.
-        os.environ["BOT_BOTTLE_NO_CACHE"] = "1"
 
     manifest = ManifestIndex.resolve(USER_CWD)
     backend_name: str | None = args.backend

bot_bottle/contrib/claude/agent_provider.py

@@ -91,7 +91,6 @@ _RUNTIME = AgentProviderRuntime(
     prompt_mode="append_file",
     bypass_args=("--dangerously-skip-permissions",),
     resume_args=("--continue",),
-    smoke_test=("claude", "--version"),
 )
 
 

bot_bottle/contrib/codex/agent_provider.py

@@ -61,7 +61,6 @@ _RUNTIME = AgentProviderRuntime(
     prompt_mode="read_prompt_file",
     bypass_args=("--dangerously-bypass-approvals-and-sandbox",),
     resume_args=("resume", "--last"),
-    smoke_test=(_CODEX_CLI, "--version"),
 )
 
 

bot_bottle/orchestrator/gateway.py

@@ -100,7 +100,6 @@ class DockerGateway(Gateway):
         orchestrator_url: str = "",
         build_context: Path | None = None,
         dockerfile: str | None = GATEWAY_DOCKERFILE,
-        host_port_bindings: tuple[int, ...] = (),
     ) -> None:
         self.image_ref = image_ref
         self.name = name
@@ -111,10 +110,6 @@ class DockerGateway(Gateway):
         self._orchestrator_url = orchestrator_url
         self._build_context = build_context or _REPO_ROOT
         self._dockerfile = dockerfile
-        # Ports published on the host (0.0.0.0). Used by the Firecracker
-        # backend's dev-harness gateway so VMs can reach it via their TAP link;
-        # Docker's DNAT + the nft `ct status dnat accept` rule handle the rest.
-        self._host_port_bindings = host_port_bindings
 
     def image_exists(self) -> bool:
         return run_docker(["docker", "image", "inspect", self.image_ref]).returncode == 0
@@ -193,8 +188,6 @@ class DockerGateway(Gateway):
             # trust it) — see GATEWAY_CA_VOLUME.
             "--volume", f"{GATEWAY_CA_VOLUME}:{MITMPROXY_HOME}",
         ]
-        for port in self._host_port_bindings:
-            argv += ["--publish", f"0.0.0.0:{port}:{port}"]
         if self._orchestrator_url:
             # Makes the gateway's egress / git / supervise daemons multi-tenant:
             # each request resolves source-IP -> policy against the control plane.

bot_bottle/orchestrator/lifecycle.py

@@ -48,13 +48,7 @@ class OrchestratorStartError(RuntimeError):
 
 class OrchestratorService:
     """Manages the orchestrator control-plane container + the shared gateway.
-    Callers only need `ensure_running()` + `url`.
+    Callers only need `ensure_running()` + `url`."""
-
-    `orchestrator_name` / `orchestrator_label` let backends run independent
-    orchestrators on the same host without name collisions (e.g. the
-    Firecracker backend uses `bot-bottle-fc-orchestrator` alongside the Docker
-    backend's `bot-bottle-orchestrator`). Subclass and override `_gateway()`
-    to supply a backend-specific gateway variant."""
 
     def __init__(
         self,
@@ -64,16 +58,12 @@ class OrchestratorService:
         image: str = GATEWAY_IMAGE,
         repo_root: Path = _REPO_ROOT,
         host_root: Path | None = None,
-        orchestrator_name: str = ORCHESTRATOR_NAME,
-        orchestrator_label: str = ORCHESTRATOR_LABEL,
     ) -> None:
         self.port = port
         self.network = network
         self.image = image
         self._repo_root = repo_root
         self._host_root = host_root or bot_bottle_root()
-        self._orchestrator_name = orchestrator_name
-        self._orchestrator_label = orchestrator_label
 
     @property
     def url(self) -> str:
@@ -85,7 +75,7 @@ class OrchestratorService:
         """Control-plane URL as the gateway container reaches it — by name over
         docker DNS on the shared network. This is the gateway's
         BOT_BOTTLE_ORCHESTRATOR_URL."""
-        return f"http://{self._orchestrator_name}:{self.port}"
+        return f"http://{ORCHESTRATOR_NAME}:{self.port}"
 
     def is_healthy(self, *, timeout: float = _HEALTH_REQUEST_TIMEOUT_SECONDS) -> bool:
         try:
@@ -101,11 +91,11 @@ class OrchestratorService:
     def _run_orchestrator_container(self) -> None:
         """Start the control-plane container (idempotent: clears a stale
         fixed-name container first). Register-only broker → no docker socket."""
-        run_docker(["docker", "rm", "--force", self._orchestrator_name])
+        run_docker(["docker", "rm", "--force", ORCHESTRATOR_NAME])
         proc = run_docker([
             "docker", "run", "--detach",
-            "--name", self._orchestrator_name,
+            "--name", ORCHESTRATOR_NAME,
-            "--label", self._orchestrator_label,
+            "--label", ORCHESTRATOR_LABEL,
             "--network", self.network,
             # Host CLI reaches the control plane here; bound to loopback so it
             # is not exposed on the host's external interfaces.
@@ -147,7 +137,7 @@ class OrchestratorService:
         # (~seconds); the registry DB persists and the current launch
         # re-registers its own in-memory state. (The dedicated orchestrator
         # image follow-up replaces this with image-staleness detection.)
-        log.info("starting orchestrator container", context={"name": self._orchestrator_name})
+        log.info("starting orchestrator container", context={"name": ORCHESTRATOR_NAME})
         self._run_orchestrator_container()
 
         deadline = time.monotonic() + startup_timeout
@@ -162,7 +152,7 @@ class OrchestratorService:
 
     def stop(self) -> None:
         """Remove the orchestrator + gateway containers (idempotent)."""
-        run_docker(["docker", "rm", "--force", self._orchestrator_name])
+        run_docker(["docker", "rm", "--force", ORCHESTRATOR_NAME])
         self._gateway().stop()
 
 

tests/unit/test_backend_selection.py

@@ -40,7 +40,7 @@ class TestGetBottleBackend(unittest.TestCase):
                 return True
 
         with patch.dict(os.environ, {}, clear=True), \
-             patch.object(backend_mod, "_BACKENDS", {
+             patch.object(backend_mod, "_backends", {
                  "macos-container": _FakeBackend(),
                  "docker": _FakeBackend(),
              }):
@@ -61,7 +61,7 @@ class TestGetBottleBackend(unittest.TestCase):
         with patch.dict(os.environ, {}, clear=True), \
              patch.object(backend_mod.FirecrackerBottleBackend,
                           "is_host_capable", classmethod(lambda cls: False)), \
-             patch.object(backend_mod, "_BACKENDS", {
+             patch.object(backend_mod, "_backends", {
                  "macos-container": _FakeBackend("macos-container", False),
                  "docker": _FakeBackend("docker", True),
              }):
@@ -83,7 +83,7 @@ class TestGetBottleBackend(unittest.TestCase):
         with patch.dict(os.environ, {}, clear=True), \
              patch.object(backend_mod.FirecrackerBottleBackend,
                           "is_host_capable", classmethod(lambda cls: True)), \
-             patch.object(backend_mod, "_BACKENDS", {
+             patch.object(backend_mod, "_backends", {
                  "macos-container": _FakeBackend("macos-container", False),
                  "firecracker": _FakeBackend("firecracker", False),
                  "docker": _FakeBackend("docker", True),
@@ -133,7 +133,7 @@ class TestEnumerateActiveAgents(unittest.TestCase):
                 return self._items
 
         with patch.object(
-            backend_mod, "_BACKENDS",
+            backend_mod, "_backends",
             {"docker": _FakeBackend([a]), "firecracker": _FakeBackend([b])},
         ):
             self.assertEqual([a, b], enumerate_active_agents())
@@ -167,7 +167,7 @@ class TestEnumerateActiveAgents(unittest.TestCase):
                 return self._items
 
         with patch.object(
-            backend_mod, "_BACKENDS",
+            backend_mod, "_backends",
             {
                 "docker": _FakeBackend([newer, tie_b]),
                 "firecracker": _FakeBackend([missing_metadata, tie_a]),
@@ -187,7 +187,7 @@ class TestEnumerateActiveAgents(unittest.TestCase):
                 return []
 
         with patch.object(
-            backend_mod, "_BACKENDS",
+            backend_mod, "_backends",
             {"docker": _FakeBackend(), "firecracker": _FakeBackend()},
         ):
             self.assertEqual([], enumerate_active_agents())
@@ -218,7 +218,7 @@ class TestEnumerateActiveAgents(unittest.TestCase):
                 return self._items
 
         with patch.object(
-            backend_mod, "_BACKENDS",
+            backend_mod, "_backends",
             {
                 "docker": _FakeBackend([present], available=True),
                 "firecracker": _FakeBackend([hidden], available=False),
@@ -234,7 +234,7 @@ class TestHasBackend(unittest.TestCase):
                 return False
 
         with patch.object(
-            backend_mod, "_BACKENDS", {"docker": _FakeBackend()},
+            backend_mod, "_backends", {"docker": _FakeBackend()},
         ):
             from bot_bottle.backend import has_backend
             self.assertFalse(has_backend("docker"))

tests/unit/test_docker_launch_committed_image.py

@@ -91,7 +91,6 @@ class TestLaunchCommittedImage(unittest.TestCase):
         with mock.patch.object(launch_mod, "read_committed_image", return_value=committed_tag), \
                 mock.patch.object(launch_mod.docker_mod, "image_exists", return_value=image_present), \
                 mock.patch.object(launch_mod.docker_mod, "build_image", side_effect=_build), \
-                mock.patch.object(launch_mod.docker_mod, "verify_agent_image"), \
                 mock.patch.object(launch_mod, "launch_consolidated", return_value=_CTX), \
                 mock.patch.object(launch_mod, "teardown_consolidated"), \
                 mock.patch.object(launch_mod, "DockerGateway", return_value=gw), \

tests/unit/test_docker_launch_teardown.py

@@ -94,7 +94,6 @@ class TestTeardownWarning(unittest.TestCase):
         )
 
         with mock.patch.object(launch_mod.docker_mod, "build_image"), \
-             mock.patch.object(launch_mod.docker_mod, "verify_agent_image"), \
              mock.patch.object(launch_mod, "launch_consolidated", return_value=ctx), \
              mock.patch.object(launch_mod, "teardown_consolidated"), \
              mock.patch.object(launch_mod, "DockerGateway", return_value=gw), \

tests/unit/test_macos_container_launch.py

@@ -357,17 +357,12 @@ class TestMacosContainerLaunchCommittedImage(unittest.TestCase):
             launch.container_mod, "image_exists", return_value=False,
         ), patch.object(
             launch.container_mod, "build_image", side_effect=fake_build,
-        ), patch.object(
+        ):
-            launch.container_mod, "verify_agent_image",
-        ) as verify:
             updated = launch._build_images(plan)
 
         self.assertEqual("bot-bottle-agent:latest", updated.image)
         self.assertEqual(2, len(calls))
         self.assertEqual("bot-bottle-agent:latest", calls[1][0])
-        verify.assert_called_once_with(
-            "bot-bottle-agent:latest", ("claude", "--version"),
-        )
 
 
 if __name__ == "__main__":