fix(orchestrator): bound streamed request bodies

bot_bottle/backend/docker/cleanup.py

@@ -28,7 +28,6 @@ import subprocess
 
 from ...paths import bot_bottle_root
 from ...log import info, warn
-from .. import EnumerationError
 from . import util as docker_mod
 from .bottle_cleanup_plan import DockerBottleCleanupPlan
 from ...bottle_state import bottle_state_dir, is_preserved
@@ -37,17 +36,15 @@ from .compose import COMPOSE_PROJECT_PREFIX, list_compose_projects
 
 def _list_prefixed_containers() -> list[str]:
     """All bot-bottle-prefixed containers, running or stopped."""
-    try:
-        result = subprocess.run(
-            ["docker", "ps", "-a",
-             "--filter", f"name=^{COMPOSE_PROJECT_PREFIX}",
-             "--format", "{{.Names}}\t{{.Label \"com.docker.compose.project\"}}"],
-            capture_output=True, text=True, check=False,
-        )
-    except OSError as exc:
-        raise EnumerationError(f"docker ps failed: {exc}") from exc
+    result = subprocess.run(
+        ["docker", "ps", "-a",
+         "--filter", f"name=^{COMPOSE_PROJECT_PREFIX}",
+         "--format", "{{.Names}}\t{{.Label \"com.docker.compose.project\"}}"],
+        capture_output=True, text=True, check=False,
+    )
     if result.returncode != 0:
-        raise EnumerationError(f"docker ps failed: {result.stderr.strip()}")
+        warn(f"docker ps failed: {result.stderr.strip()}")
+        return []
     out: list[str] = []
     for line in (result.stdout or "").splitlines():
         if not line:
@@ -66,19 +63,15 @@ def _list_prefixed_networks() -> list[str]:
     to a compose project. Compose-managed networks have a
     `com.docker.compose.project` label; bare ones (from pre-compose
     code paths) don't."""
-    try:
-        result = subprocess.run(
-            ["docker", "network", "ls",
-             "--filter", f"name={COMPOSE_PROJECT_PREFIX}",
-             "--format", "{{.Name}}\t{{.Label \"com.docker.compose.project\"}}"],
-            capture_output=True, text=True, check=False,
-        )
-    except OSError as exc:
-        raise EnumerationError(f"docker network ls failed: {exc}") from exc
+    result = subprocess.run(
+        ["docker", "network", "ls",
+         "--filter", f"name={COMPOSE_PROJECT_PREFIX}",
+         "--format", "{{.Name}}\t{{.Label \"com.docker.compose.project\"}}"],
+        capture_output=True, text=True, check=False,
+    )
     if result.returncode != 0:
-        raise EnumerationError(
-            f"docker network ls failed: {result.stderr.strip()}"
-        )
+        warn(f"docker network ls failed: {result.stderr.strip()}")
+        return []
     out: list[str] = []
     for line in (result.stdout or "").splitlines():
         if not line:
@@ -127,10 +120,7 @@ def prepare_cleanup() -> DockerBottleCleanupPlan:
     `enumerate_active_agents()` so the orphan-state-dir bucket
     doesn't include slugs whose non-docker bottle is still up."""
     docker_mod.require_docker()
-    projects = list_compose_projects(
-        warn_on_error=False,
-        raise_on_error=True,
-    )
+    projects = list_compose_projects()
     project_set = set(projects)
     # Late import to avoid a circular at module-load time —
     # the backend package's __init__ imports this module.

bot_bottle/backend/firecracker/cleanup.py

@@ -11,9 +11,10 @@ Reaps *orphans* only — resources with no live VM behind them:
     — a VMM left lingering after its dir was removed.
 
 A run dir with a *live* firecracker process is a running bottle and is
-left strictly alone: it is neither killed nor removed. Active-agent
-enumeration uses this same process snapshot, so cleanup and generic
-backend consumers agree about which bottles are running.
+left strictly alone: it is neither killed nor removed. (The backend's
+`enumerate_active` registry is still a stub — #354 — so a live process
+is the only reliable "this bottle is in use" signal we have. Once the
+registry lands, registry-orphaned-but-running VMs can be reaped too.)
 
 TAP slots free themselves (the flock drops when the launcher exits), so
 there is nothing to reclaim there.
@@ -21,7 +22,6 @@ there is nothing to reclaim there.
 
 from __future__ import annotations
 
-from collections.abc import Sequence
 import os
 import shutil
 import signal
@@ -30,7 +30,7 @@ from pathlib import Path
 
 from ...log import info
 from .. import EnumerationError
-from . import lifecycle_lock, util
+from . import util
 from .bottle_cleanup_plan import FirecrackerBottleCleanupPlan
 
 
@@ -38,7 +38,7 @@ def _run_root() -> Path:
     return util.cache_dir() / "run"
 
 
-def _run_dir_of(args: Sequence[str], run_root: Path) -> Path | None:
+def _run_dir_of(cmd: str, run_root: Path) -> Path | None:
     """The bottle run dir a firecracker cmdline belongs to, or None.
 
     A bottle VM is launched with `--config-file <run_root>/<slug>/config.json`,
@@ -46,35 +46,15 @@ def _run_dir_of(args: Sequence[str], run_root: Path) -> Path | None:
     the run root. Anything else (a builder VM, the infra VM elsewhere) is
     not ours to reap here.
     """
-    for i, arg in enumerate(args):
-        if arg == "--config-file" and i + 1 < len(args):
-            parent = Path(args[i + 1]).parent
+    toks = cmd.split()
+    for i, tok in enumerate(toks):
+        if tok == "--config-file" and i + 1 < len(toks):
+            parent = Path(toks[i + 1]).parent
             if parent.parent == run_root:
                 return parent
     return None
 
 
-def _decode_cmdline(raw: bytes) -> tuple[str, ...]:
-    """Decode Linux's NUL-delimited argv without losing embedded spaces."""
-    return tuple(
-        value.decode(errors="surrogateescape")
-        for value in raw.split(b"\0") if value
-    )
-
-
-def _process_args(pid: int) -> tuple[str, ...] | None:
-    """Read one process's lossless argv, or None when it exited meanwhile."""
-    try:
-        raw = Path(f"/proc/{pid}/cmdline").read_bytes()
-    except FileNotFoundError:
-        return None
-    except OSError as exc:
-        raise EnumerationError(
-            f"could not inspect Firecracker pid {pid}: {exc}"
-        ) from exc
-    return _decode_cmdline(raw)
-
-
 def _scan_processes(run_root: Path) -> tuple[set[str], list[int]]:
     """Inspect running firecracker VMs under ``run_root``.
 
@@ -85,7 +65,7 @@ def _scan_processes(run_root: Path) -> tuple[set[str], list[int]]:
     """
     try:
         result = subprocess.run(
-            ["pgrep", "firecracker"],
+            ["pgrep", "-a", "firecracker"],
             capture_output=True, text=True, check=False,
         )
     except OSError as exc:
@@ -103,14 +83,14 @@ def _scan_processes(run_root: Path) -> tuple[set[str], list[int]]:
     live: set[str] = set()
     orphan_pids: list[int] = []
     for line in result.stdout.splitlines():
+        parts = line.split(None, 1)
+        if len(parts) != 2:
+            continue
         try:
-            pid = int(line.strip())
+            pid = int(parts[0])
         except ValueError:
             continue
-        args = _process_args(pid)
-        if args is None:
-            continue
-        run_dir = _run_dir_of(args, run_root)
+        run_dir = _run_dir_of(parts[1], run_root)
         if run_dir is None:
             continue
         if run_dir.is_dir():
@@ -146,42 +126,12 @@ def prepare_cleanup() -> FirecrackerBottleCleanupPlan:
 
 
 def cleanup(plan: FirecrackerBottleCleanupPlan) -> None:
-    """Revalidate the preview under the launch lock, then remove its survivors."""
-    with lifecycle_lock.hold():
-        fresh = prepare_cleanup()
-        approved_pids = set(plan.vm_pids).intersection(fresh.vm_pids)
-        approved_dirs = set(plan.run_dirs).intersection(fresh.run_dirs)
-        for pid in sorted(approved_pids):
-            _terminate_orphan(pid, _run_root())
-        for path in sorted(approved_dirs):
-            info(f"rm -rf {path}")
-            shutil.rmtree(path, ignore_errors=True)
-
-
-def _terminate_orphan(pid: int, run_root: Path) -> None:
-    """Signal exactly the process identity that still owns an orphan config."""
-    try:
-        pidfd = os.pidfd_open(pid)
-    except ProcessLookupError:
-        return
-    except OSError as exc:
-        raise EnumerationError(
-            f"could not pin Firecracker pid {pid} for cleanup: {exc}"
-        ) from exc
-    try:
-        try:
-            raw = Path(f"/proc/{pid}/cmdline").read_bytes()
-        except FileNotFoundError:
-            return
-        except OSError as exc:
-            raise EnumerationError(
-                f"could not revalidate Firecracker pid {pid}: {exc}"
-            ) from exc
-        args = _decode_cmdline(raw)
-        run_dir = _run_dir_of(args, run_root)
-        if run_dir is None or run_dir.is_dir():
-            return
+    for pid in plan.vm_pids:
         info(f"kill firecracker VM pid {pid}")
-        signal.pidfd_send_signal(pidfd, signal.SIGTERM)
-    finally:
-        os.close(pidfd)
+        try:
+            os.kill(pid, signal.SIGTERM)
+        except ProcessLookupError:
+            pass
+    for path in plan.run_dirs:
+        info(f"rm -rf {path}")
+        shutil.rmtree(path, ignore_errors=True)

bot_bottle/backend/firecracker/infra_artifact.py

@@ -41,8 +41,6 @@ from ... import resources
 from ...log import die, info
 from . import util
 
-ARTIFACT_HTTP_TIMEOUT_SECONDS = 30.0
-
 # Bump if the on-disk artifact *format* changes (compression, layout) so a new
 # scheme can't collide with a cached/published artifact of the old one.
 _ARTIFACT_FORMAT = "1"
@@ -166,9 +164,7 @@ def _download(url: str, dest: Path) -> None:
     """Stream `url` to `dest` (atomic via a `.part` sibling)."""
     tmp = dest.with_suffix(dest.suffix + ".part")
     try:
-        with urllib.request.urlopen(
-            _open(url), timeout=ARTIFACT_HTTP_TIMEOUT_SECONDS,
-        ) as resp, open(tmp, "wb") as out:
+        with urllib.request.urlopen(_open(url)) as resp, open(tmp, "wb") as out:
             shutil.copyfileobj(resp, out, _CHUNK)
     except urllib.error.HTTPError as e:
         tmp.unlink(missing_ok=True)

bot_bottle/backend/firecracker/launch.py

@@ -46,7 +46,7 @@ from ...log import die, info, warn
 from ...supervisor.types import SUPERVISE_PORT
 from ..docker.egress import EGRESS_PORT
 from ..util import AGENT_CA_BUNDLE, AGENT_CA_PATH
-from . import firecracker_vm, image_builder, isolation_probe, lifecycle_lock, netpool, util
+from . import firecracker_vm, image_builder, isolation_probe, netpool, util
 from .bottle import FirecrackerBottle
 from .bottle_plan import FirecrackerBottlePlan
 from ...orchestrator.store.config_store import resolve_teardown_timeout
@@ -164,29 +164,25 @@ def launch(
         )
 
         # Step 6: build the per-bottle rootfs + SSH key, then boot.
-        # Cleanup takes the same lock while refreshing its process snapshot.
-        # Hold it until the VMM exists so a newly-created run dir can never be
-        # mistaken for an orphan in the build-before-boot window.
-        with lifecycle_lock.hold():
-            run_dir = util.cache_dir() / "run" / plan.slug
-            run_dir.mkdir(parents=True, exist_ok=True)
-            # Remove the run dir on teardown so the per-bottle rootfs.ext4 (~1G)
-            # doesn't leak. Registered before vm.terminate below so it runs
-            # *after* it (ExitStack is LIFO).
-            stack.callback(lambda: shutil.rmtree(run_dir, ignore_errors=True))
-            rootfs = run_dir / "rootfs.ext4"
-            util.build_rootfs_ext4(agent_base, rootfs)
-            private_key, pubkey = util.generate_keypair(run_dir)
+        run_dir = util.cache_dir() / "run" / plan.slug
+        run_dir.mkdir(parents=True, exist_ok=True)
+        # Remove the run dir on teardown so the per-bottle rootfs.ext4 (~1G)
+        # doesn't leak. Registered before vm.terminate below so it runs *after*
+        # it (ExitStack is LIFO): the VM is gone before we rm its rootfs.
+        stack.callback(lambda: shutil.rmtree(run_dir, ignore_errors=True))
+        rootfs = run_dir / "rootfs.ext4"
+        util.build_rootfs_ext4(agent_base, rootfs)
+        private_key, pubkey = util.generate_keypair(run_dir)
 
-            vm = firecracker_vm.boot(
-                name=plan.container_name,
-                rootfs=rootfs,
-                tap=slot.iface,
-                guest_ip=slot.guest_ip,
-                host_ip=slot.host_ip,
-                pubkey=pubkey,
-                run_dir=run_dir,
-            )
+        vm = firecracker_vm.boot(
+            name=plan.container_name,
+            rootfs=rootfs,
+            tap=slot.iface,
+            guest_ip=slot.guest_ip,
+            host_ip=slot.host_ip,
+            pubkey=pubkey,
+            run_dir=run_dir,
+        )
         stack.callback(vm.terminate)
         firecracker_vm.wait_for_ssh(vm, private_key)
         persist_env_var_secret(private_key, slot.guest_ip, ctx.env_var_secret)

bot_bottle/backend/firecracker/lifecycle_lock.py

@@ -1,30 +0,0 @@
-"""Serialize Firecracker run-directory creation with orphan cleanup."""
-
-from __future__ import annotations
-
-import fcntl
-from contextlib import contextmanager
-from pathlib import Path
-from typing import Generator
-
-from . import util
-
-
-def _lock_path() -> Path:
-    return util.cache_dir() / "run.lifecycle.lock"
-
-
-@contextmanager
-def hold() -> Generator[None]:
-    """Exclude cleanup while a launch directory lacks a visible VMM."""
-    path = _lock_path()
-    path.parent.mkdir(parents=True, exist_ok=True)
-    with path.open("a", encoding="utf-8") as handle:
-        fcntl.flock(handle, fcntl.LOCK_EX)
-        try:
-            yield
-        finally:
-            fcntl.flock(handle, fcntl.LOCK_UN)
-
-
-__all__ = ["hold"]

bot_bottle/backend/firecracker/publish_infra.py

@@ -34,7 +34,6 @@ from pathlib import Path
 from . import infra_artifact, infra_vm, util
 
 _CHUNK = 1 << 20
-_REGISTRY_HTTP_TIMEOUT_SECONDS = 30.0
 
 _GZ_NAME = "rootfs.ext4.gz"
 _SHA_NAME = "rootfs.ext4.gz.sha256"
@@ -92,9 +91,7 @@ def _put(url: str, body: "bytes | Path", token: str) -> None:
         req.add_header("Authorization", f"token {token}")
     req.add_header("Content-Type", "application/octet-stream")
     try:
-        with urllib.request.urlopen(
-            req, timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ) as resp:
+        with urllib.request.urlopen(req) as resp:
             print(f"  uploaded {url} (HTTP {resp.status})")
     except urllib.error.HTTPError as e:
         if e.code == 409:
@@ -115,9 +112,7 @@ def _delete(url: str, token: str) -> None:
     if token:
         req.add_header("Authorization", f"token {token}")
     try:
-        with urllib.request.urlopen(
-            req, timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ):
+        with urllib.request.urlopen(req):
             pass
     except urllib.error.HTTPError as e:
         if e.code != 404:
@@ -156,10 +151,7 @@ def _try_download_published(role: str, role_dir: Path) -> str | None:
     version = _role_version(role)
     sha_url = infra_artifact.artifact_url(version, _SHA_NAME, role=role)
     try:
-        with urllib.request.urlopen(
-            infra_artifact._open(sha_url),
-            timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ):
+        with urllib.request.urlopen(infra_artifact._open(sha_url)):
             pass
     except urllib.error.HTTPError as e:
         if e.code == 404:
@@ -203,10 +195,7 @@ def _publish_bundle(role: str, role_dir: Path, token: str) -> str:
     # present, a re-publish is a no-op. Otherwise clear any partial upload left
     # by an interrupted prior attempt and upload the complete set.
     try:
-        with urllib.request.urlopen(
-            infra_artifact._open(sha_url),
-            timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ) as resp:
+        with urllib.request.urlopen(infra_artifact._open(sha_url)) as resp:
             remote_sha = resp.read().decode("utf-8").split()[0].strip().lower()
     except urllib.error.HTTPError as e:
         if e.code != 404:

bot_bottle/backend/macos_container/cleanup.py

@@ -4,8 +4,7 @@ from __future__ import annotations
 
 import subprocess
 
-from .. import EnumerationError
-from ...log import info
+from ...log import info, warn
 from . import util as container_mod
 from .bottle_cleanup_plan import MacosContainerBottleCleanupPlan
 
@@ -20,8 +19,8 @@ def _list_prefixed_containers() -> list[str]:
         check=False,
     )
     if result.returncode != 0:
-        detail = result.stderr.strip() or f"exit {result.returncode}"
-        raise EnumerationError(f"container list failed: {detail}")
+        warn(f"container list failed: {result.stderr.strip()}")
+        return []
     return sorted(
         name for name in (line.strip() for line in result.stdout.splitlines())
         if name.startswith(_PREFIX)
@@ -36,8 +35,7 @@ def _list_prefixed_networks() -> list[str]:
         check=False,
     )
     if result.returncode != 0:
-        detail = result.stderr.strip() or f"exit {result.returncode}"
-        raise EnumerationError(f"container network list failed: {detail}")
+        return []
     return sorted(
         name for name in (line.strip() for line in result.stdout.splitlines())
         if name.startswith(_PREFIX)

bot_bottle/cli/commands/cleanup.py

@@ -52,11 +52,7 @@ def cmd_cleanup(_argv: list[str]) -> int:
         info("cleanup: skipped")
         return 0
 
-    # Confirmation authorizes a fresh authoritative snapshot, not blind use of
-    # identities that may have changed while the operator reviewed the preview.
-    refreshed = [(name, backend, backend.prepare_cleanup())
-                 for name, backend, _plan in prepared]
-    for name, backend, plan in refreshed:
+    for name, backend, plan in prepared:
         if plan.empty:
             continue
         backend.cleanup(plan)

bot_bottle/gateway/bootstrap.py

@@ -136,18 +136,10 @@ def _pump(name: str, stream: IO[bytes]) -> None:
     """Read lines from `stream`, prefix with `[name]`, write to
     stdout. Runs in its own thread per child; daemon=True so a
     blocked read doesn't keep the process alive after main exits."""
-    try:
-        for raw in iter(stream.readline, b""):
-            line = raw.decode("utf-8", errors="replace").rstrip("\n")
-            sys.stdout.write(f"[{name}] {line}\n")
-            sys.stdout.flush()
-    except (OSError, ValueError) as exc:
-        # The manager closes a dead child's pipe after wait() and before a
-        # restart. A pump can be between readline calls at that exact moment;
-        # closed-stream errors are normal completion, not uncaught thread
-        # failures. Preserve genuinely unexpected I/O diagnostics.
-        if not stream.closed:
-            _log(f"{name} output pump stopped: {type(exc).__name__}: {exc}")
+    for raw in iter(stream.readline, b""):
+        line = raw.decode("utf-8", errors="replace").rstrip("\n")
+        sys.stdout.write(f"[{name}] {line}\n")
+        sys.stdout.flush()
 
 
 def _spawn(spec: _DaemonSpec) -> subprocess.Popen[bytes]:

bot_bottle/gateway/bounded_http.py

@@ -1,109 +0,0 @@
-"""Shared resource boundaries for gateway stdlib HTTP services."""
-
-from __future__ import annotations
-
-import http.server
-import socket
-import threading
-import time
-from dataclasses import dataclass
-from typing import Any, Protocol
-
-
-class Readable(Protocol):
-    def read(self, size: int = -1, /) -> bytes: ...
-
-
-@dataclass(frozen=True)
-class BodyReadError(Exception):
-    status: int
-    message: str
-
-
-def read_declared_body(
-    stream: Readable,
-    connection: socket.socket,
-    raw_length: str | None,
-    *,
-    maximum: int,
-    timeout_seconds: float,
-    require_length: bool,
-) -> bytes:
-    """Validate and read exactly one declared body under a read deadline."""
-    if raw_length is None:
-        if require_length:
-            raise BodyReadError(411, "Content-Length required")
-        raw_length = "0"
-    try:
-        length = int(raw_length)
-    except ValueError as exc:
-        raise BodyReadError(400, "invalid Content-Length") from exc
-    if length < 0:
-        raise BodyReadError(400, "invalid Content-Length")
-    if length > maximum:
-        raise BodyReadError(413, "request body too large")
-    previous_timeout = connection.gettimeout()
-    deadline = time.monotonic() + timeout_seconds
-    chunks: list[bytes] = []
-    remaining = length
-    try:
-        while remaining:
-            timeout = deadline - time.monotonic()
-            if timeout <= 0:
-                raise BodyReadError(408, "request body read timed out")
-            connection.settimeout(timeout)
-            chunk = stream.read(min(remaining, 64 * 1024))
-            if not chunk:
-                raise BodyReadError(400, "incomplete request body")
-            chunks.append(chunk)
-            remaining -= len(chunk)
-    except TimeoutError as exc:
-        raise BodyReadError(408, "request body read timed out") from exc
-    finally:
-        connection.settimeout(previous_timeout)
-    return b"".join(chunks)
-
-
-class BoundedThreadingHTTPServer(http.server.ThreadingHTTPServer):
-    """ThreadingHTTPServer with a hard cap on in-flight request threads."""
-
-    daemon_threads = True
-
-    def __init__(  # pylint: disable=consider-using-with
-        self, *args, max_workers: int = 32, **kwargs,  # type: ignore[no-untyped-def]
-    ):
-        if max_workers < 1:
-            raise ValueError("max_workers must be positive")
-        self._request_slots = threading.BoundedSemaphore(max_workers)
-        super().__init__(*args, **kwargs)
-
-    def process_request(
-        self, request: Any, client_address: Any,
-    ) -> None:
-        if not self._request_slots.acquire(  # pylint: disable=consider-using-with
-            blocking=False,
-        ):
-            try:
-                request.sendall(
-                    b"HTTP/1.1 503 Service Unavailable\r\n"
-                    b"Content-Length: 0\r\nConnection: close\r\n\r\n"
-                )
-            finally:
-                self.shutdown_request(request)
-            return
-        try:
-            super().process_request(request, client_address)
-        except BaseException:
-            self._request_slots.release()
-            raise
-
-    def process_request_thread(
-        self, request: Any, client_address: Any,
-    ) -> None:
-        try:
-            super().process_request_thread(request, client_address)
-        finally:
-            self._request_slots.release()
-
-
-__all__ = ["BodyReadError", "BoundedThreadingHTTPServer", "read_declared_body"]

bot_bottle/gateway/egress/addon.py

@@ -16,7 +16,7 @@ import typing
 from mitmproxy import http  # type: ignore[import-not-found]  # pylint: disable=import-error
 
 from bot_bottle.constants import IDENTITY_HEADER
-from bot_bottle.gateway.egress.dlp_detectors import redact_tokens
+from bot_bottle.gateway.egress.dlp_detectors import redact_tokens, strip_crlf
 from bot_bottle.gateway.egress.dlp_config import (
     DEFAULT_OUTBOUND_ON_MATCH,
     ON_MATCH_BLOCK,
@@ -25,19 +25,19 @@ from bot_bottle.gateway.egress.dlp_config import (
 from bot_bottle.gateway.egress.context import resolve_client_context
 from bot_bottle.gateway.egress.dlp import (
     build_inbound_scan_text,
+    build_outbound_scan_text,
     build_token_allow_payload,
+    outbound_scan_headers,
     scan_inbound,
     scan_outbound,
 )
-from bot_bottle.gateway.egress.outbound_pipeline import redact_request, scan_request
 from bot_bottle.gateway.egress.matching import (
     decide,
+    decide_git_fetch,
+    is_git_fetch_request,
+    is_git_push_request,
     match_route,
 )
-from bot_bottle.gateway.egress.request_pipeline import (
-    evaluate_route_policy,
-    git_block_reason,
-)
 from bot_bottle.gateway.egress.schema import route_to_yaml_dict
 from bot_bottle.gateway.egress.types import (
     LOG_BLOCKS,
@@ -435,12 +435,21 @@ class EgressAddon:
         request_path: str, query: str,
     ) -> bool:
         """Apply the HTTPS Git push/fetch boundary before general routing."""
-        reason = git_block_reason(
-            config.routes, flow.request.pretty_host, request_path, query,
-        )
-        if not reason:
+        if is_git_push_request(request_path, query):
+            self._block(
+                flow,
+                "egress: git push over HTTPS is not supported; "
+                "use the bottle.git SSH path (gitleaks-scanned by "
+                "git-gate's pre-receive hook).",
+                ctx=self._req_ctx(flow),
+            )
+            return False
+        if not is_git_fetch_request(request_path, query):
             return True
-        self._block(flow, reason, ctx=self._req_ctx(flow))
+        git_decision = decide_git_fetch(config.routes, flow.request.pretty_host)
+        if git_decision.action != "block":
+            return True
+        self._block(flow, git_decision.reason, ctx=self._req_ctx(flow))
         return False
 
     def _apply_route_policy(
@@ -452,26 +461,30 @@ class EgressAddon:
         # are caught above; the route may inject gateway-owned auth below.
         # Routes with preserve_auth=True pass the header through as-is so the
         # agent's own credentials (e.g. registry bearer tokens) reach the upstream.
-        result = evaluate_route_policy(
-            config,
-            route,
-            host=flow.request.pretty_host,
-            request_path=request_path,
-            method=flow.request.method,
-            headers=dict(flow.request.headers),
-            env=env,
-        )
-        if result.strip_authorization:
+        if route is None or not route.preserve_auth:
             flow.request.headers.pop("authorization", None)
 
-        if result.block_reason:
-            self._block(flow, result.block_reason, ctx=self._req_ctx(flow))
+        # Build headers mapping for match evaluation
+        req_headers = {k.lower(): v for k, v in flow.request.headers.items()}
+
+        decision = decide(
+            config.routes,
+            flow.request.pretty_host,
+            request_path,
+            env,
+            request_method=flow.request.method,
+            request_headers=req_headers,
+            deny_reason=config.deny_reason,
+        )
+
+        if decision.action == "block":
+            self._block(flow, decision.reason, ctx=self._req_ctx(flow))
             return
 
-        if result.inject_authorization is not None:
-            flow.request.headers["authorization"] = result.inject_authorization
+        if decision.inject_authorization is not None:
+            flow.request.headers["authorization"] = decision.inject_authorization
 
-        if result.log_request:
+        if config.log >= LOG_FULL:
             self._log_request(flow, env)
 
     def _block_dlp(self, flow: http.HTTPFlow, result: ScanResult) -> None:
@@ -495,12 +508,20 @@ class EgressAddon:
         Loops so the supervise policy can re-scan after each approval — a
         second, un-approved token in the same request is still caught."""
         while True:
-            request_path, _, _ = flow.request.path.partition("?")
-            result = scan_request(
-                flow.request,
-                route,
-                env,
-                safe_tokens=self._safe_tokens_for(slug),
+            request_path, _, query = flow.request.path.partition("?")
+            body = flow.request.get_text(strict=False) or ""
+            headers = outbound_scan_headers(route, dict(flow.request.headers))
+            scan_text = build_outbound_scan_text(
+                flow.request.pretty_host, request_path, query, headers, body,
+            )
+            # CRLF is scanned only over the request line + headers, never the
+            # body (see scan_outbound) — a body is not an injection vector.
+            crlf_text = build_outbound_scan_text(
+                flow.request.pretty_host, request_path, query, headers, "",
+            )
+            result = scan_outbound(
+                route, scan_text, env,
+                safe_tokens=self._safe_tokens_for(slug), crlf_text=crlf_text,
             )
             if result is None or result.severity != "block":
                 return True
@@ -510,7 +531,7 @@ class EgressAddon:
             # redact scrubs every detection (tokens and structural CRLF) and
             # forwards; it fails closed only if a match survives the scrub.
             if policy == ON_MATCH_REDACT:
-                if redact_request(flow.request, route, env):
+                if self._redact_outbound(flow, route, env):
                     if self._flow_log(flow) >= LOG_BLOCKS:
                         sys.stderr.write(json.dumps({
                             "event": "egress_redacted",
@@ -543,6 +564,41 @@ class EgressAddon:
                 return False  # _supervise_token_block wrote the 403 response
             # loop: the approved value is now in safe_tokens; re-scan.
 
+    def _redact_outbound(
+        self, flow: http.HTTPFlow, route: Route, env: "typing.Mapping[str, str]",
+    ) -> bool:
+        """Scrub detected tokens (and CRLF injection sequences) from the mutable
+        request surfaces (body, headers, path/query) and re-scan. `env` is the
+        per-bottle env overlay. Returns True if the request is now clean; False
+        if a block-severity match remains on a surface redaction cannot rewrite
+        (the hostname) so the caller fails closed."""
+        body = flow.request.get_text(strict=False)
+        if body:
+            redacted_body = redact_tokens(body, env=env)
+            if redacted_body != body:
+                flow.request.text = redacted_body
+        for name, value in list(flow.request.headers.items()):
+            if name.lower() == "host":
+                continue  # routing-critical; never a legitimate token
+            redacted = strip_crlf(redact_tokens(value, env=env))
+            if redacted != value:
+                flow.request.headers[name] = redacted
+        redacted_path = strip_crlf(redact_tokens(flow.request.path, env=env))
+        if redacted_path != flow.request.path:
+            flow.request.path = redacted_path
+
+        request_path, _, query = flow.request.path.partition("?")
+        new_body = flow.request.get_text(strict=False) or ""
+        headers = outbound_scan_headers(route, dict(flow.request.headers))
+        scan_text = build_outbound_scan_text(
+            flow.request.pretty_host, request_path, query, headers, new_body,
+        )
+        crlf_text = build_outbound_scan_text(
+            flow.request.pretty_host, request_path, query, headers, "",
+        )
+        result = scan_outbound(route, scan_text, env, crlf_text=crlf_text)
+        return result is None or result.severity != "block"
+
     async def _supervise_token_block(
         self,
         flow: http.HTTPFlow,

bot_bottle/gateway/egress/outbound_pipeline.py

@@ -1,83 +0,0 @@
-"""Outbound DLP request scanning and redaction for the egress pipeline."""
-
-from __future__ import annotations
-
-from typing import ItemsView, Mapping, Protocol
-
-from .dlp import (
-    build_outbound_scan_text,
-    outbound_scan_headers,
-    scan_outbound,
-)
-from .dlp_detectors import redact_tokens, strip_crlf
-from .types import Route, ScanResult
-
-
-class MutableHeaders(Protocol):
-    def items(self) -> ItemsView[str, str]: ...
-    def __getitem__(self, name: str, /) -> str: ...
-    def __setitem__(self, name: str, value: str, /) -> None: ...
-
-
-class MutableRequest(Protocol):
-    pretty_host: str
-    path: str
-    headers: MutableHeaders
-    text: str
-
-    def get_text(self, strict: bool = False) -> str | None: ...
-
-
-def scan_request(
-    request: MutableRequest,
-    route: Route,
-    env: Mapping[str, str],
-    *,
-    safe_tokens: set[str] | None = None,
-) -> ScanResult | None:
-    """Scan all mutable outbound request surfaces in their canonical order."""
-    request_path, _, query = request.path.partition("?")
-    headers = outbound_scan_headers(route, dict(request.headers.items()))
-    body = request.get_text(strict=False) or ""
-    scan_text = build_outbound_scan_text(
-        request.pretty_host, request_path, query, headers, body,
-    )
-    # Bodies cannot alter HTTP framing, so CRLF detection is deliberately
-    # restricted to the request line and headers.
-    crlf_text = build_outbound_scan_text(
-        request.pretty_host, request_path, query, headers, "",
-    )
-    return scan_outbound(
-        route,
-        scan_text,
-        env,
-        safe_tokens=safe_tokens,
-        crlf_text=crlf_text,
-    )
-
-
-def redact_request(
-    request: MutableRequest,
-    route: Route,
-    env: Mapping[str, str],
-) -> bool:
-    """Redact mutable request surfaces and return whether the result is clean."""
-    body = request.get_text(strict=False)
-    if body:
-        redacted_body = redact_tokens(body, env=env)
-        if redacted_body != body:
-            request.text = redacted_body
-    for name, value in list(request.headers.items()):
-        if name.lower() == "host":
-            continue
-        redacted = strip_crlf(redact_tokens(value, env=env))
-        if redacted != value:
-            request.headers[name] = redacted
-    redacted_path = strip_crlf(redact_tokens(request.path, env=env))
-    if redacted_path != request.path:
-        request.path = redacted_path
-    result = scan_request(request, route, env)
-    return result is None or result.severity != "block"
-
-
-__all__ = ["MutableRequest", "redact_request", "scan_request"]

bot_bottle/gateway/egress/request_pipeline.py

@@ -1,92 +0,0 @@
-"""Framework-neutral request policy stages for the egress adapter.
-
-The mitmproxy addon owns flow mutation and response construction. This module
-owns the ordered Git and route-policy decisions so those rules remain directly
-testable without a live proxy flow.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Mapping, Sequence
-
-from .matching import (
-    decide,
-    decide_git_fetch,
-    is_git_fetch_request,
-    is_git_push_request,
-)
-from .types import LOG_FULL, Config, Route
-
-GIT_PUSH_BLOCK_REASON = (
-    "egress: git push over HTTPS is not supported; "
-    "use the bottle.git SSH path (gitleaks-scanned by "
-    "git-gate's pre-receive hook)."
-)
-
-
-@dataclass(frozen=True)
-class RoutePolicyResult:
-    """The flow mutations and outcome produced by general route policy."""
-
-    block_reason: str = ""
-    strip_authorization: bool = False
-    inject_authorization: str | None = None
-    log_request: bool = False
-
-
-def git_block_reason(
-    routes: Sequence[Route],
-    host: str,
-    request_path: str,
-    query: str,
-) -> str:
-    """Return the HTTPS Git policy denial, or ``""`` when allowed."""
-    if is_git_push_request(request_path, query):
-        return GIT_PUSH_BLOCK_REASON
-    if not is_git_fetch_request(request_path, query):
-        return ""
-    decision = decide_git_fetch(routes, host)
-    return decision.reason if decision.action == "block" else ""
-
-
-def evaluate_route_policy(
-    config: Config,
-    route: Route | None,
-    *,
-    host: str,
-    request_path: str,
-    method: str,
-    headers: Mapping[str, str],
-    env: Mapping[str, str],
-) -> RoutePolicyResult:
-    """Evaluate authorization stripping, matching, injection, and logging."""
-    strip_authorization = route is None or not route.preserve_auth
-    effective_headers = {
-        name.lower(): value
-        for name, value in headers.items()
-        if not (strip_authorization and name.lower() == "authorization")
-    }
-    decision = decide(
-        config.routes,
-        host,
-        request_path,
-        env,
-        request_method=method,
-        request_headers=effective_headers,
-        deny_reason=config.deny_reason,
-    )
-    return RoutePolicyResult(
-        block_reason=decision.reason if decision.action == "block" else "",
-        strip_authorization=strip_authorization,
-        inject_authorization=decision.inject_authorization,
-        log_request=config.log >= LOG_FULL,
-    )
-
-
-__all__ = [
-    "GIT_PUSH_BLOCK_REASON",
-    "RoutePolicyResult",
-    "evaluate_route_policy",
-    "git_block_reason",
-]

bot_bottle/gateway/git_gate/http_backend.py

@@ -22,16 +22,11 @@ import os
 import subprocess
 import sys
 import typing
-from http.server import BaseHTTPRequestHandler
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from urllib.parse import urlsplit
 
 from bot_bottle.constants import GIT_GATE_TIMEOUT_SECS, IDENTITY_HEADER
-from bot_bottle.gateway.bounded_http import (
-    BodyReadError,
-    BoundedThreadingHTTPServer,
-    read_declared_body,
-)
 from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver
 
 
@@ -82,8 +77,6 @@ def resolve_sandbox_root(
 
 # Bound memory use while still allowing ordinary git push packfiles.
 MAX_BODY_BYTES = 100 * 1024 * 1024
-REQUEST_BODY_TIMEOUT_SECONDS = 30.0
-MAX_REQUEST_WORKERS = 16
 
 
 class GitHttpHandler(BaseHTTPRequestHandler):
@@ -191,18 +184,19 @@ class GitHttpHandler(BaseHTTPRequestHandler):
             value = self.headers.get(header)
             if value:
                 env[variable] = value
+        raw_length = self.headers.get("content-length", "0") or "0"
         try:
-            body = read_declared_body(
-                self.rfile,
-                self.connection,
-                self.headers.get("content-length"),
-                maximum=MAX_BODY_BYTES,
-                timeout_seconds=REQUEST_BODY_TIMEOUT_SECONDS,
-                require_length=False,
-            )
-        except BodyReadError as exc:
-            self.send_error(exc.status, exc.message)
+            length = int(raw_length)
+        except ValueError:
+            self.send_error(400, "Bad Content-Length")
             return
+        if length < 0:
+            self.send_error(400, "Negative Content-Length")
+            return
+        if length > MAX_BODY_BYTES:
+            self.send_error(413, "Request body too large")
+            return
+        body = self.rfile.read(length) if length else b""
         proc = subprocess.run(
             ["git", "http-backend"],
             input=body,
@@ -279,9 +273,7 @@ def main() -> int:
             "(no single-tenant flat-root fallback)\n"
         )
         return 1
-    server = BoundedThreadingHTTPServer(
-        ("0.0.0.0", port), GitHttpHandler, max_workers=MAX_REQUEST_WORKERS,
-    )
+    server = ThreadingHTTPServer(("0.0.0.0", port), GitHttpHandler)
     # Resolve each request's sandbox namespace by source IP against the
     # orchestrator control plane.
     server.policy_resolver = PolicyResolver(orch_url)  # type: ignore[attr-defined]

bot_bottle/gateway/supervisor/mcp_dispatch.py

@@ -1,92 +0,0 @@
-"""Framework-neutral MCP method and tool dispatch."""
-
-from __future__ import annotations
-
-import json
-from dataclasses import dataclass
-from typing import Callable, Protocol
-
-from bot_bottle.gateway.egress.schema import load_config, route_to_yaml_dict
-from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver
-from bot_bottle.supervisor import types as _sv
-
-
-class Request(Protocol):
-    @property
-    def method(self) -> str: ...
-
-    @property
-    def params(self) -> dict[str, object]: ...
-
-
-class MethodNotFoundError(Exception):
-    """Raised when a JSON-RPC method has no MCP handler."""
-
-
-class RouteResolutionError(Exception):
-    """The caller's live route table could not be resolved authoritatively."""
-
-
-Handler = Callable[[dict[str, object]], object]
-
-
-@dataclass(frozen=True)
-class Handlers:
-    initialize: Handler
-    tools_list: Handler
-    list_routes: Handler
-    check_proposal: Handler
-    propose: Handler
-
-
-def dispatch(request: Request, handlers: Handlers) -> object:
-    """Route one parsed request without depending on the HTTP server."""
-    if request.method == "initialize":
-        return handlers.initialize(request.params)
-    if request.method == "notifications/initialized":
-        return None
-    if request.method == "tools/list":
-        return handlers.tools_list(request.params)
-    if request.method != "tools/call":
-        raise MethodNotFoundError(request.method)
-
-    tool = request.params.get("name")
-    if tool == _sv.TOOL_LIST_EGRESS_ROUTES:
-        return handlers.list_routes(request.params)
-    if tool == _sv.TOOL_CHECK_PROPOSAL:
-        return handlers.check_proposal(request.params)
-    return handlers.propose(request.params)
-
-
-def resolved_routes_payload(
-    resolver: PolicyResolver,
-    source_ip: str,
-    identity_token: str,
-) -> dict[str, object]:
-    """Render an authoritatively resolved route table for the calling bottle."""
-    try:
-        policy, bottle_id, _tokens = resolver.resolve_policy_and_bottle_id(
-            source_ip, identity_token,
-        )
-    except PolicyResolveError as exc:
-        raise RouteResolutionError("orchestrator unavailable") from exc
-    if not bottle_id:
-        raise RouteResolutionError("request source is not attributed to a bottle")
-    try:
-        config = load_config(policy or "")
-    except ValueError as exc:
-        raise RouteResolutionError("resolved policy is invalid") from exc
-    body = json.dumps(
-        {"routes": [route_to_yaml_dict(route) for route in config.routes]},
-        indent=2,
-    )
-    return {"content": [{"type": "text", "text": body}], "isError": False}
-
-
-__all__ = [
-    "Handlers",
-    "MethodNotFoundError",
-    "RouteResolutionError",
-    "dispatch",
-    "resolved_routes_payload",
-]

bot_bottle/gateway/supervisor/server.py

@@ -51,27 +51,17 @@ from __future__ import annotations
 import http.server
 import json
 import os
+import socketserver
 import sys
 import time
 import typing
 from dataclasses import dataclass
 
 from bot_bottle.constants import IDENTITY_HEADER
-from bot_bottle.gateway.bounded_http import (
-    BodyReadError,
-    BoundedThreadingHTTPServer,
-    read_declared_body,
-)
-from bot_bottle.gateway.egress.schema import load_config
+from bot_bottle.gateway.egress.context import resolve_client_context
+from bot_bottle.gateway.egress.schema import load_config, route_to_yaml_dict
 from bot_bottle.gateway.egress.types import LOG_OFF
 from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver
-from bot_bottle.gateway.supervisor.mcp_dispatch import (
-    Handlers as DispatchHandlers,
-    MethodNotFoundError,
-    RouteResolutionError,
-    dispatch,
-    resolved_routes_payload,
-)
 from bot_bottle.supervisor import types as _sv
 
 
@@ -575,8 +565,6 @@ def format_unknown_proposal_text(proposal_id: str) -> str:
 # Max request body the server accepts. 1 MB is well above any realistic
 # routes.yaml proposal.
 MAX_BODY_BYTES = 1 * 1024 * 1024
-REQUEST_BODY_TIMEOUT_SECONDS = 10.0
-MAX_REQUEST_WORKERS = 32
 
 
 class MCPHandler(http.server.BaseHTTPRequestHandler):
@@ -599,18 +587,19 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
         self._write_text(405, "use POST for MCP requests\n")
 
     def do_POST(self) -> None:
-        try:
-            body = read_declared_body(
-                self.rfile,
-                self.connection,
-                self.headers.get("Content-Length"),
-                maximum=MAX_BODY_BYTES,
-                timeout_seconds=REQUEST_BODY_TIMEOUT_SECONDS,
-                require_length=True,
-            )
-        except BodyReadError as exc:
-            self._write_text(exc.status, exc.message + "\n")
+        length_header = self.headers.get("Content-Length")
+        if length_header is None:
+            self._write_text(411, "Content-Length required\n")
             return
+        try:
+            length = int(length_header)
+        except ValueError:
+            self._write_text(400, "invalid Content-Length\n")
+            return
+        if length < 0 or length > MAX_BODY_BYTES:
+            self._write_text(413, "request body too large\n")
+            return
+        body = self.rfile.read(length)
 
         try:
             req = parse_jsonrpc(body)
@@ -622,11 +611,6 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
 
         try:
             result = self._dispatch(req, config)
-        except MethodNotFoundError as e:
-            self._write_jsonrpc(
-                jsonrpc_error(req.id, ERR_METHOD_NOT_FOUND, f"method not found: {e}"),
-            )
-            return
         except _RpcClientError as e:
             self._write_jsonrpc(jsonrpc_error(req.id, e.code, e.message))
             return
@@ -649,42 +633,41 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
         self._write_jsonrpc(jsonrpc_result(req.id, result))
 
     def _dispatch(self, req: JsonRpcRequest, config: ServerConfig) -> object:
-        def check(params: dict[str, object]) -> object:
-            return handle_check_proposal(
-                params,
-                resolver=self._resolver_or_fail(),
-                source_ip=self.client_address[0],
-                identity_token=self._identity_token(),
-            )
-
-        def propose(params: dict[str, object]) -> object:
-            return handle_tools_call(
-                params,
-                config,
-                resolver=self._resolver_or_fail(),
-                source_ip=self.client_address[0],
-                identity_token=self._identity_token(),
-            )
-
-        def list_routes(_params: dict[str, object]) -> object:
-            try:
-                return resolved_routes_payload(
-                    self._resolver_or_fail(),
-                    self.client_address[0],
-                    self._identity_token(),
+        method = req.method
+        if method == "initialize":
+            return handle_initialize(req.params)
+        if method == "notifications/initialized":
+            return None  # ack-only
+        if method == "tools/list":
+            return handle_tools_list(req.params)
+        if method == "tools/call":
+            # `list-egress-routes` is read-only introspection. The shared gateway
+            # has no static route table (routes are resolved per request by
+            # source IP), so answer it from the calling bottle's resolved policy.
+            # Otherwise the agent sees an empty allowlist and composes an egress
+            # proposal that *replaces* the live routes instead of extending them
+            # — silently dropping base routes like api.anthropic.com on approval.
+            if req.params.get("name") == _sv.TOOL_LIST_EGRESS_ROUTES:
+                return self._resolved_routes_payload()
+            resolver = self._resolver_or_fail()
+            source_ip = self.client_address[0]
+            token = self._identity_token()
+            # `check-proposal` is a non-blocking read of the calling bottle's
+            # own queue — attributed by (source_ip, identity_token) like a
+            # proposal, but it never queues or blocks.
+            if req.params.get("name") == _sv.TOOL_CHECK_PROPOSAL:
+                return handle_check_proposal(
+                    req.params, resolver=resolver,
+                    source_ip=source_ip, identity_token=token,
                 )
-            except RouteResolutionError as exc:
-                raise _RpcInternalError(
-                    f"could not resolve live egress routes: {exc}"
-                ) from exc
-
-        return dispatch(req, DispatchHandlers(
-            initialize=handle_initialize,
-            tools_list=handle_tools_list,
-            list_routes=list_routes,
-            check_proposal=check,
-            propose=propose,
-        ))
+            # The control plane attributes the proposal to the source-IP + token
+            # resolved bottle, so the one shared queue holds each bottle's
+            # proposal under its own id — no slug is asserted by this daemon.
+            return handle_tools_call(
+                req.params, config, resolver=resolver,
+                source_ip=source_ip, identity_token=token,
+            )
+        raise _RpcClientError(ERR_METHOD_NOT_FOUND, f"method not found: {method}")
 
     def _identity_token(self) -> str:
         """The agent's per-bottle identity token from the request header (the
@@ -703,6 +686,20 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
             raise _RpcInternalError("supervise server has no policy resolver")
         return resolver
 
+    def _resolved_routes_payload(self) -> dict[str, object]:
+        """The calling bottle's live egress routes as the `list-egress-routes`
+        JSON payload, resolved by (source_ip, identity token). Fail-closed: an
+        unattributed source or an unreachable orchestrator yields an empty route
+        list (never another bottle's), courtesy of `resolve_client_context`."""
+        resolver = self._resolver_or_fail()
+        conf, _slug, _tokens = resolve_client_context(
+            resolver, self.client_address[0], self._identity_token(),
+        )
+        body = json.dumps(
+            {"routes": [route_to_yaml_dict(r) for r in conf.routes]}, indent=2,
+        )
+        return {"content": [{"type": "text", "text": body}], "isError": False}
+
     def _write_jsonrpc(self, body: bytes) -> None:
         self.send_response(200)
         self.send_header("Content-Type", "application/json")
@@ -722,7 +719,7 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
             self.wfile.write(encoded)
 
 
-class MCPServer(BoundedThreadingHTTPServer):
+class MCPServer(socketserver.ThreadingMixIn, http.server.HTTPServer):
     allow_reuse_address = True
     daemon_threads = True
     config: ServerConfig = ServerConfig()
@@ -731,9 +728,6 @@ class MCPServer(BoundedThreadingHTTPServer):
     # closed per request (see `_resolver_or_fail`).
     policy_resolver: "PolicyResolver | None" = None
 
-    def __init__(self, *args, **kwargs):  # type: ignore[no-untyped-def]
-        super().__init__(*args, max_workers=MAX_REQUEST_WORKERS, **kwargs)
-
 
 # --- Entry point -----------------------------------------------------------
 

docs/prds/0082-authoritative-failure-boundaries.md

@@ -13,9 +13,7 @@ resource-consuming boundary revalidate the assumptions it acts on. This
 finishes the focused quality work begun under #444 without broad rewrites:
 cleanup cannot act on stale identities, policy introspection cannot publish a
 fabricated empty policy, gateway servers bound untrusted work, and daemon
-shutdown does not emit uncaught background-thread failures. Shared
-control-plane storage and gateway credential provisioning also enforce their
-filesystem security contract before sensitive data is written.
+shutdown does not emit uncaught background-thread failures.
 
 ## Problem
 
@@ -56,9 +54,6 @@ misleading behavior:
 11. Git smart-HTTP can retain sixteen 100 MiB request bodies concurrently,
     cleanup mutations have no subprocess deadline, and Firecracker signalling
     failures bypass shared mutation accounting.
-12. SQLite creates the shared control-plane database before its mode is
-    restricted, then suppresses permission-repair failures. Gateway transports
-    also differ in whether copied deploy-key modes are preserved.
 
 These are one design problem: state used to authorize deletion, replacement,
 or resource allocation must be authoritative at the point of use.
@@ -96,11 +91,6 @@ or resource allocation must be authoritative at the point of use.
 - Git request bodies spool to disk behind a separate heavy-work semaphore;
   cleanup commands have configurable deadlines; Firecracker signalling
   failures aggregate while identity-verification uncertainty still aborts.
-- The shared database directory and file are private before SQLite writes any
-  control-plane state; an inability to enforce those modes aborts startup.
-- Gateway credential directories and files receive explicit private modes
-  inside the gateway, independent of Docker, Apple Container, or SSH copy
-  semantics.
 - Unit tests cover PID/path reuse, partial backend enumeration, transient
   policy resolution failure, slow bodies, concurrency saturation, and stream
   closure races.
@@ -163,17 +153,6 @@ The gateway output pump catches only stream-closure exceptions expected after
 the supervisor closes child pipes. Other I/O failures remain visible and are
 reported through the supervisor's normal diagnostic channel.
 
-### Shared filesystem security
-
-The common SQLite store owns database creation for every backend. It creates
-the parent directory and an empty database with private modes before opening
-SQLite, repairs existing modes, verifies the resulting state, and propagates
-every enforcement failure. Backend launchers do not duplicate this policy.
-
-The backend-neutral gateway provisioner likewise applies directory and file
-modes after transport copies complete. This avoids relying on copy behavior
-that differs among Docker, Apple Container, and Firecracker's SSH transport.
-
 ## Implementation chunks
 
 1. Existing fail-closed security and backend enumeration fixes.
@@ -189,8 +168,6 @@ that differs among Docker, Apple Container, and Firecracker's SSH transport.
    and mutation accounting, and contained Git backend process failures.
 10. Disk-spooled and separately bounded Git bodies, cleanup command deadlines,
     and classified Firecracker signalling failures.
-11. Fail-closed shared database creation and backend-neutral gateway credential
-    permissions.
 
 ## Open questions
 

tests/unit/test_cli_cleanup_cross_backend.py

@@ -41,8 +41,8 @@ class TestCmdCleanup(unittest.TestCase):
         ):
             self.assertEqual(0, cmd.cmd_cleanup([]))
 
-        self.assertEqual(2, docker.prepare_cleanup.call_count)
-        self.assertEqual(2, fc.prepare_cleanup.call_count)
+        docker.prepare_cleanup.assert_called_once()
+        fc.prepare_cleanup.assert_called_once()
         docker.cleanup.assert_called_once_with(docker_plan)
         fc.cleanup.assert_called_once_with(fc_plan)
 
@@ -68,7 +68,7 @@ class TestCmdCleanup(unittest.TestCase):
         ):
             self.assertEqual(0, cmd.cmd_cleanup([]))
 
-        self.assertEqual(2, docker.prepare_cleanup.call_count)
+        docker.prepare_cleanup.assert_called_once()
         docker.cleanup.assert_called_once_with(docker_plan)
         macos.prepare_cleanup.assert_not_called()
 
@@ -135,25 +135,6 @@ class TestCmdCleanup(unittest.TestCase):
         docker.cleanup.assert_called_once_with(docker_plan)
         fc.cleanup.assert_not_called()
 
-    def test_executes_refreshed_plan_after_confirmation(self):
-        backend = MagicMock()
-        preview = MagicMock(empty=False)
-        refreshed = MagicMock(empty=False)
-        backend.prepare_cleanup.side_effect = [preview, refreshed]
-
-        with patch.object(
-            cmd, "known_backend_names", return_value=("firecracker",),
-        ), patch.object(
-            cmd, "get_bottle_backend", return_value=backend,
-        ), patch.object(
-            cmd, "has_backend", return_value=True,
-        ), patch.object(
-            cmd, "_prompt_yes", return_value=True,
-        ):
-            self.assertEqual(0, cmd.cmd_cleanup([]))
-
-        backend.cleanup.assert_called_once_with(refreshed)
-
 
 if __name__ == "__main__":
     unittest.main()

tests/unit/test_docker_cleanup.py

@@ -14,12 +14,9 @@ from __future__ import annotations
 import tempfile
 import unittest
 from pathlib import Path
-from unittest.mock import patch
 
 from tests.unit import use_bottle_root
 from bot_bottle import bottle_state
-from bot_bottle.backend import EnumerationError
-from bot_bottle.backend.docker import cleanup
 from bot_bottle.backend.docker.cleanup import _list_orphan_state_dirs
 
 
@@ -119,37 +116,5 @@ class TestOrphanStateDirs(_FakeHomeMixin, unittest.TestCase):
         )
 
 
-class TestAuthoritativeDiscovery(unittest.TestCase):
-    def test_prepare_requires_authoritative_compose_projects(self):
-        with patch.object(cleanup.docker_mod, "require_docker"), \
-             patch.object(
-                 cleanup, "list_compose_projects",
-                 side_effect=EnumerationError("compose unavailable"),
-             ) as projects, self.assertRaisesRegex(
-                 EnumerationError, "compose unavailable",
-             ):
-            cleanup.prepare_cleanup()
-        projects.assert_called_once_with(
-            warn_on_error=False,
-            raise_on_error=True,
-        )
-
-    def test_container_query_failure_raises(self):
-        failed = cleanup.subprocess.CompletedProcess(
-            [], 1, stdout="", stderr="daemon unavailable",
-        )
-        with patch.object(cleanup.subprocess, "run", return_value=failed), \
-             self.assertRaisesRegex(EnumerationError, "daemon unavailable"):
-            cleanup._list_prefixed_containers()
-
-    def test_network_query_failure_raises(self):
-        failed = cleanup.subprocess.CompletedProcess(
-            [], 1, stdout="", stderr="daemon unavailable",
-        )
-        with patch.object(cleanup.subprocess, "run", return_value=failed), \
-             self.assertRaisesRegex(EnumerationError, "daemon unavailable"):
-            cleanup._list_prefixed_networks()
-
-
 if __name__ == "__main__":
     unittest.main()

tests/unit/test_egress_outbound_pipeline.py

@@ -1,81 +0,0 @@
-"""Unit tests for framework-neutral outbound DLP request stages."""
-
-from __future__ import annotations
-
-import unittest
-
-from bot_bottle.gateway.egress.outbound_pipeline import (
-    MutableHeaders,
-    redact_request,
-    scan_request,
-)
-from bot_bottle.gateway.egress.types import Route
-
-
-class _Headers(dict[str, str]):
-    pass
-
-
-class _Request:
-    def __init__(
-        self,
-        *,
-        host: str = "api.example.com",
-        path: str = "/v1/messages",
-        headers: dict[str, str] | None = None,
-        body: str = "",
-    ) -> None:
-        self.pretty_host = host
-        self.path = path
-        self.headers: MutableHeaders = _Headers(headers or {})
-        self.text = body
-
-    def get_text(self, strict: bool = False) -> str | None:
-        del strict
-        return self.text
-
-
-class TestOutboundScan(unittest.TestCase):
-    def test_detects_secret_in_body(self) -> None:
-        request = _Request(body="token=sk-" + "a" * 48)
-
-        result = scan_request(request, Route(host="api.example.com"), {})
-
-        self.assertIsNotNone(result)
-        self.assertEqual("block", result.severity if result else None)
-
-    def test_safe_token_is_ignored(self) -> None:
-        token = "sk-" + "a" * 48
-        request = _Request(body=f"token={token}")
-
-        result = scan_request(
-            request,
-            Route(host="api.example.com"),
-            {},
-            safe_tokens={token},
-        )
-
-        self.assertIsNone(result)
-
-
-class TestOutboundRedaction(unittest.TestCase):
-    def test_redacts_body_header_and_path_but_preserves_host(self) -> None:
-        token = "sk-" + "a" * 48
-        request = _Request(
-            path=f"/v1/messages?key={token}",
-            headers={"Host": "api.example.com", "X-Token": token + "\r\nInjected: yes"},
-            body=f"token={token}",
-        )
-
-        clean = redact_request(request, Route(host="api.example.com"), {})
-
-        self.assertTrue(clean)
-        self.assertNotIn(token, request.path)
-        self.assertNotIn(token, request.headers["X-Token"])
-        self.assertNotIn("\r", request.headers["X-Token"])
-        self.assertNotIn(token, request.text)
-        self.assertEqual("api.example.com", request.headers["Host"])
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/unit/test_egress_request_pipeline.py

@@ -1,89 +0,0 @@
-"""Unit tests for framework-neutral egress request policy stages."""
-
-from __future__ import annotations
-
-import unittest
-
-from bot_bottle.gateway.egress.request_pipeline import (
-    GIT_PUSH_BLOCK_REASON,
-    evaluate_route_policy,
-    git_block_reason,
-)
-from bot_bottle.gateway.egress.types import Config, LOG_FULL, Route
-
-
-class TestGitPolicy(unittest.TestCase):
-    def test_push_is_always_blocked(self) -> None:
-        reason = git_block_reason(
-            (), "git.example.com", "/repo.git/git-receive-pack", "",
-        )
-        self.assertEqual(GIT_PUSH_BLOCK_REASON, reason)
-
-    def test_fetch_requires_route_opt_in(self) -> None:
-        path = "/repo.git/git-upload-pack"
-        blocked = git_block_reason((), "git.example.com", path, "")
-        allowed = git_block_reason(
-            (Route(host="git.example.com", git_fetch=True),),
-            "git.example.com",
-            path,
-            "",
-        )
-        self.assertTrue(blocked)
-        self.assertEqual("", allowed)
-
-    def test_non_git_request_is_not_decided_here(self) -> None:
-        self.assertEqual(
-            "",
-            git_block_reason((), "api.example.com", "/v1/messages", ""),
-        )
-
-
-class TestRoutePolicy(unittest.TestCase):
-    def test_strips_agent_auth_and_injects_gateway_auth(self) -> None:
-        route = Route(
-            host="api.example.com",
-            auth_scheme="Bearer",
-            token_env="API_TOKEN",
-        )
-        result = evaluate_route_policy(
-            Config(routes=(route,)),
-            route,
-            host="api.example.com",
-            request_path="/v1/messages",
-            method="POST",
-            headers={"Authorization": "agent-secret"},
-            env={"API_TOKEN": "gateway-secret"},
-        )
-        self.assertTrue(result.strip_authorization)
-        self.assertEqual("Bearer gateway-secret", result.inject_authorization)
-        self.assertFalse(result.block_reason)
-
-    def test_preserved_auth_participates_in_matching(self) -> None:
-        route = Route(host="registry.example.com", preserve_auth=True)
-        result = evaluate_route_policy(
-            Config(routes=(route,), log=LOG_FULL),
-            route,
-            host="registry.example.com",
-            request_path="/v2/",
-            method="GET",
-            headers={"Authorization": "Bearer agent-token"},
-            env={},
-        )
-        self.assertFalse(result.strip_authorization)
-        self.assertTrue(result.log_request)
-
-    def test_missing_route_fails_closed(self) -> None:
-        result = evaluate_route_policy(
-            Config(routes=(), deny_reason="not allowed"),
-            None,
-            host="blocked.example.com",
-            request_path="/",
-            method="GET",
-            headers={},
-            env={},
-        )
-        self.assertEqual("not allowed", result.block_reason)
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/unit/test_firecracker_cleanup.py

@@ -32,19 +32,15 @@ class TestProcessScan(unittest.TestCase):
         self.assertEqual(
             Path("/cache/run/dev-a"),
             fc_cleanup._run_dir_of(
-                ("firecracker", "--config-file",
-                 f"{run_root}/dev-a/config.json"), run_root
+                f"firecracker --config-file {run_root}/dev-a/config.json", run_root
             ),
         )
         # infra/builder VMs elsewhere, or nested paths, are not ours.
         self.assertIsNone(
-            fc_cleanup._run_dir_of(
-                ("firecracker", "--config-file", "/elsewhere/config.json"),
-                run_root,
-            )
+            fc_cleanup._run_dir_of("firecracker --config-file /elsewhere/config.json", run_root)
         )
         self.assertIsNone(
-            fc_cleanup._run_dir_of(("firecracker", "--no-config"), run_root)
+            fc_cleanup._run_dir_of("firecracker --no-config", run_root)
         )
 
     def test_scan_splits_live_dirs_from_orphan_pids(self):
@@ -52,40 +48,17 @@ class TestProcessScan(unittest.TestCase):
             run_root = Path(tmp)
             (run_root / "live-a").mkdir()  # dir present -> live VM, protected
             # "gone-b" dir intentionally absent -> lingering VMM, orphan pid
-            args = {
-                111: ("firecracker", "--config-file",
-                      f"{run_root}/live-a/config.json"),
-                222: ("firecracker", "--config-file",
-                      f"{run_root}/gone-b/config.json"),
-                333: ("firecracker", "--config-file", "/elsewhere/config.json"),
-            }
-            with patch.object(
-                fc_cleanup.subprocess, "run",
-                return_value=_proc("111\n222\n333\nnotanint\n"),
-            ), patch.object(
-                fc_cleanup, "_process_args", side_effect=args.get,
-            ):
+            out = (
+                f"111 firecracker --config-file {run_root}/live-a/config.json\n"
+                f"222 firecracker --config-file {run_root}/gone-b/config.json\n"
+                "333 firecracker --config-file /elsewhere/config.json\n"
+                "notanint firecracker --config-file x\n"
+            )
+            with patch.object(fc_cleanup.subprocess, "run", return_value=_proc(out)):
                 live, orphan_pids = fc_cleanup._scan_processes(run_root)
         self.assertEqual({str(run_root / "live-a")}, live)
         self.assertEqual([222], orphan_pids)
 
-    def test_scan_preserves_spaces_in_config_path(self):
-        with tempfile.TemporaryDirectory(prefix="fc cache ") as tmp:
-            run_root = Path(tmp)
-            live = run_root / "live bottle"
-            live.mkdir()
-            with patch.object(
-                fc_cleanup.subprocess, "run", return_value=_proc("111\n"),
-            ), patch.object(
-                fc_cleanup, "_process_args",
-                return_value=("firecracker", "--config-file",
-                              str(live / "config.json")),
-            ):
-                self.assertEqual(
-                    ({str(live)}, []),
-                    fc_cleanup._scan_processes(run_root),
-                )
-
     def test_scan_empty_when_pgrep_finds_no_processes(self):
         with patch.object(fc_cleanup.subprocess, "run", return_value=_proc(returncode=1)):
             self.assertEqual((set(), []), fc_cleanup._scan_processes(Path("/x")))
@@ -144,14 +117,9 @@ class TestProcessScan(unittest.TestCase):
             run_root = Path(tmp)
             (run_root / "live-a").mkdir()
             (run_root / "dead-b").mkdir()
+            out = f"111 firecracker --config-file {run_root}/live-a/config.json\n"
             with patch.object(fc_cleanup, "_run_root", return_value=run_root), \
-                 patch.object(fc_cleanup.subprocess, "run",
-                              return_value=_proc("111\n")), \
-                 patch.object(
-                     fc_cleanup, "_process_args",
-                     return_value=("firecracker", "--config-file",
-                                   str(run_root / "live-a/config.json")),
-                 ):
+                 patch.object(fc_cleanup.subprocess, "run", return_value=_proc(out)):
                 plan = fc_cleanup.prepare_cleanup()
         self.assertEqual((), plan.vm_pids)
         self.assertEqual((str(run_root / "dead-b"),), plan.run_dirs)
@@ -164,46 +132,18 @@ class TestCleanupRemoval(unittest.TestCase):
             vm_pids=(101,),
             run_dirs=("/run/dev-x",),
         )
-        with patch.object(fc_cleanup, "prepare_cleanup", return_value=plan), \
-             patch.object(fc_cleanup, "_run_root", return_value=Path("/run")), \
-             patch.object(fc_cleanup, "_terminate_orphan") as terminate, \
+        with patch.object(fc_cleanup.os, "kill") as kill, \
              patch.object(fc_cleanup.shutil, "rmtree") as rmtree, \
              patch.object(fc_cleanup, "info"):
             fc_cleanup.cleanup(plan)
-        terminate.assert_called_once_with(101, Path("/run"))
+        kill.assert_called_once()
         rmtree.assert_called_once_with("/run/dev-x", ignore_errors=True)
 
-    def test_cleanup_skips_resources_no_longer_in_refreshed_plan(self):
-        preview = FirecrackerBottleCleanupPlan(
-            vm_pids=(999,), run_dirs=("/run/reused",),
-        )
-        with patch.object(
-            fc_cleanup, "prepare_cleanup",
-            return_value=FirecrackerBottleCleanupPlan(),
-        ), patch.object(fc_cleanup, "_terminate_orphan") as terminate, \
-             patch.object(fc_cleanup.shutil, "rmtree") as rmtree:
-            fc_cleanup.cleanup(preview)
-        terminate.assert_not_called()
-        rmtree.assert_not_called()
-
-    def test_pidfd_prevents_pid_reuse_from_signalling_unrelated_process(self):
-        with patch.object(fc_cleanup.os, "pidfd_open", return_value=7), \
-             patch.object(
-                 fc_cleanup.Path, "read_bytes",
-                 return_value=b"/usr/bin/python\0worker.py\0",
-             ), patch.object(fc_cleanup.signal, "pidfd_send_signal") as send, \
-             patch.object(fc_cleanup.os, "close"):
-            fc_cleanup._terminate_orphan(101, Path("/run"))
-        send.assert_not_called()
-
-    def test_pidfd_signals_revalidated_orphan(self):
-        command = b"firecracker\0--config-file\0/run/gone/config.json\0"
-        with patch.object(fc_cleanup.os, "pidfd_open", return_value=7), \
-             patch.object(fc_cleanup.Path, "read_bytes", return_value=command), \
-             patch.object(fc_cleanup.signal, "pidfd_send_signal") as send, \
-             patch.object(fc_cleanup.os, "close"), patch.object(fc_cleanup, "info"):
-            fc_cleanup._terminate_orphan(101, Path("/run"))
-        send.assert_called_once_with(7, fc_cleanup.signal.SIGTERM)
+    def test_cleanup_tolerates_dead_pid(self):
+        plan = FirecrackerBottleCleanupPlan(vm_pids=(999,))
+        with patch.object(fc_cleanup.os, "kill", side_effect=ProcessLookupError), \
+             patch.object(fc_cleanup, "info"):
+            fc_cleanup.cleanup(plan)  # must not raise
 
 
 class TestCleanupPlan(unittest.TestCase):

tests/unit/test_gateway_bounded_http.py

@@ -1,79 +0,0 @@
-"""Unit tests for shared gateway stdlib HTTP resource boundaries."""
-# pylint: disable=protected-access
-
-from __future__ import annotations
-
-import io
-import socket
-import unittest
-
-from bot_bottle.gateway.bounded_http import (
-    BodyReadError,
-    BoundedThreadingHTTPServer,
-    read_declared_body,
-)
-
-
-class _Handler:
-    pass
-
-
-class _TimeoutStream:
-    def read(self, _size: int = -1, /) -> bytes:
-        raise TimeoutError
-
-
-class TestDeclaredBody(unittest.TestCase):
-    def setUp(self) -> None:
-        self.left, self.right = socket.socketpair()
-
-    def tearDown(self) -> None:
-        self.left.close()
-        self.right.close()
-
-    def test_rejects_incomplete_body(self) -> None:
-        with self.assertRaisesRegex(BodyReadError, "incomplete"):
-            read_declared_body(
-                io.BytesIO(b"short"),
-                self.left,
-                "10",
-                maximum=100,
-                timeout_seconds=1,
-                require_length=True,
-            )
-
-    def test_maps_read_timeout(self) -> None:
-        with self.assertRaises(BodyReadError) as caught:
-            read_declared_body(
-                _TimeoutStream(),
-                self.left,
-                "1",
-                maximum=100,
-                timeout_seconds=1,
-                require_length=True,
-            )
-        self.assertEqual(408, caught.exception.status)
-
-
-class TestBoundedServer(unittest.TestCase):
-    def test_saturated_server_rejects_without_spawning_thread(self) -> None:
-        client, peer = socket.socketpair()
-        with BoundedThreadingHTTPServer(
-            ("127.0.0.1", 0), _Handler, max_workers=1,  # type: ignore[arg-type]
-        ) as server:
-            with client, peer:
-                # Directly reserve the only slot to model an in-flight handler.
-                self.assertTrue(
-                    server._request_slots.acquire(  # pylint: disable=consider-using-with
-                        blocking=False,
-                    ),
-                )
-                try:
-                    server.process_request(client, ("127.0.0.1", 1))
-                    self.assertIn(b"503 Service Unavailable", peer.recv(1024))
-                finally:
-                    server._request_slots.release()
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/unit/test_gateway_init.py

@@ -23,7 +23,6 @@ from bot_bottle.gateway.bootstrap import (
     _DaemonManager,
     _argv_for_daemon,
     _env_for_daemon,
-    _pump,
     _selected_daemons,
 )
 from tests._bin import SLEEP
@@ -566,26 +565,5 @@ class TestMainEndToEnd(unittest.TestCase):
         self.assertIn("no daemons selected", out)
 
 
-class _FailingStream:
-    def __init__(self, *, closed: bool) -> None:
-        self.closed = closed
-
-    def readline(self) -> bytes:
-        raise ValueError("I/O operation on closed file")
-
-
-class TestOutputPump(unittest.TestCase):
-    def test_closed_stream_race_is_normal_completion(self) -> None:
-        with patch("bot_bottle.gateway.bootstrap._log") as log:
-            _pump("egress", _FailingStream(closed=True))  # type: ignore[arg-type]
-        log.assert_not_called()
-
-    def test_unexpected_io_failure_is_logged(self) -> None:
-        with patch("bot_bottle.gateway.bootstrap._log") as log:
-            _pump("egress", _FailingStream(closed=False))  # type: ignore[arg-type]
-        log.assert_called_once()
-        self.assertIn("output pump stopped", log.call_args.args[0])
-
-
 if __name__ == "__main__":
     unittest.main()

tests/unit/test_infra_artifact.py

@@ -284,18 +284,6 @@ class TestEnsureArtifact(_CacheMixin):
             ia.ensure_artifact_gz(version, role=_ROLE)
             self.assertEqual(first_calls, len(net.calls))
 
-    def test_download_uses_network_deadline(self) -> None:
-        response = mock.MagicMock()
-        response.__enter__.return_value = io.BytesIO(b"payload")
-        with tempfile.TemporaryDirectory() as d, mock.patch.object(
-            ia.urllib.request, "urlopen", return_value=response,
-        ) as urlopen:
-            ia._download("https://registry/artifact", Path(d) / "artifact")
-        self.assertEqual(
-            ia.ARTIFACT_HTTP_TIMEOUT_SECONDS,
-            urlopen.call_args.kwargs["timeout"],
-        )
-
     def test_checksum_mismatch_fails_closed(self) -> None:
         version = "beefbeefbeefbeef"
         gz = _gz(b"payload")

tests/unit/test_macos_container_cleanup.py

@@ -42,22 +42,6 @@ class TestMacosContainerCleanup(unittest.TestCase):
             run.call_args_list[1].args[0],
         )
 
-    def test_container_enumeration_failure_aborts(self):
-        completed = cleanup.subprocess.CompletedProcess(
-            args=[], returncode=1, stdout="", stderr="service unavailable",
-        )
-        with patch.object(cleanup.subprocess, "run", return_value=completed), \
-                self.assertRaisesRegex(EnumerationError, "service unavailable"):
-            cleanup._list_prefixed_containers()
-
-    def test_network_enumeration_failure_aborts(self):
-        completed = cleanup.subprocess.CompletedProcess(
-            args=[], returncode=1, stdout="", stderr="service unavailable",
-        )
-        with patch.object(cleanup.subprocess, "run", return_value=completed), \
-                self.assertRaisesRegex(EnumerationError, "service unavailable"):
-            cleanup._list_prefixed_networks()
-
 
 class TestMacosContainerEnumerate(unittest.TestCase):
     """The backend launches bottles again (PRD 0070), so enumeration is real

tests/unit/test_publish_infra.py

@@ -49,16 +49,6 @@ class TestPut(unittest.TestCase):
         self.assertNotIsInstance(req.data, (bytes, bytearray))
         self.assertEqual(str(len(payload)), req.get_header("Content-length"))
 
-    def test_put_uses_network_deadline(self) -> None:
-        with mock.patch.object(
-            pub.urllib.request, "urlopen", return_value=_Resp(),
-        ) as urlopen:
-            pub._put("https://reg/pkg", b"payload", token="")
-        self.assertEqual(
-            pub._REGISTRY_HTTP_TIMEOUT_SECONDS,
-            urlopen.call_args.kwargs["timeout"],
-        )
-
     def test_small_bytes_body_still_works(self) -> None:
         captured: list[urllib.request.Request] = []
 

tests/unit/test_supervise_server.py

@@ -13,7 +13,6 @@ import tempfile
 import threading
 import time
 import types
-import typing
 import unittest
 from pathlib import Path
 
@@ -48,7 +47,6 @@ from bot_bottle.gateway.supervisor.server import (
     jsonrpc_error,
     jsonrpc_result,
     parse_jsonrpc,
-    resolved_routes_payload,
     validate_proposed_file,
 )
 
@@ -703,40 +701,22 @@ class TestResolvedRoutesPayload(unittest.TestCase):
             "  - host: api.anthropic.com\n"
             "  - host: www.google.com\n"
         )
-        payload = resolved_routes_payload(
-            typing.cast(
-                supervise_server.PolicyResolver,
-                _FakeSuperviseResolver(bottle_id="b1", policy=policy),
-            ),
-            _SRC,
-            _TOK,
-        )
+        payload = _handler(
+            _FakeSuperviseResolver(bottle_id="b1", policy=policy)
+        )._resolved_routes_payload()
         assert payload is not None
         self.assertFalse(payload["isError"])  # type: ignore[index]
         data = json.loads(payload["content"][0]["text"])  # type: ignore[index]
         hosts = {r["host"] for r in data["routes"]}
         self.assertEqual({"api.anthropic.com", "www.google.com"}, hosts)
 
-    def test_orchestrator_error_is_not_reported_as_empty_policy(self) -> None:
-        with self.assertRaises(supervise_server.RouteResolutionError):
-            resolved_routes_payload(
-                typing.cast(
-                    supervise_server.PolicyResolver,
-                    _FakeSuperviseResolver(raises=True),
-                ),
-                _SRC,
-                _TOK,
-            )
-
-    def test_authoritative_empty_policy_remains_successful(self) -> None:
-        payload = resolved_routes_payload(
-            typing.cast(
-                supervise_server.PolicyResolver,
-                _FakeSuperviseResolver(bottle_id="b1", policy="routes: []\n"),
-            ),
-            _SRC,
-            _TOK,
-        )
+    def test_orchestrator_error_fails_closed_to_empty(self) -> None:
+        # resolve_client_context swallows resolver errors → deny-all (empty),
+        # never another bottle's routes.
+        payload = _handler(
+            _FakeSuperviseResolver(raises=True)
+        )._resolved_routes_payload()
+        assert payload is not None
         data = json.loads(payload["content"][0]["text"])  # type: ignore[index]
         self.assertEqual([], data["routes"])
 
@@ -744,13 +724,7 @@ class TestResolvedRoutesPayload(unittest.TestCase):
         # A server without a resolver is a misconfig, not a mode: raise rather
         # than list anything.
         with self.assertRaises(_RpcInternalError):
-            _handler(None)._dispatch(
-                parse_jsonrpc(
-                    b'{"jsonrpc":"2.0","id":1,"method":"tools/call",'
-                    b'"params":{"name":"list-egress-routes"}}',
-                ),
-                ServerConfig(),
-            )
+            _handler(None)._resolved_routes_payload()
 
 
 class TestNonBlockingSupervise(unittest.TestCase):

tests/unit/test_supervisor_mcp_dispatch.py

@@ -1,81 +0,0 @@
-"""Unit tests for framework-neutral supervisor MCP dispatch."""
-
-from __future__ import annotations
-
-import unittest
-from dataclasses import dataclass
-
-from bot_bottle.gateway.supervisor.mcp_dispatch import (
-    Handlers,
-    MethodNotFoundError,
-    dispatch,
-)
-from bot_bottle.supervisor import types as _sv
-
-
-@dataclass(frozen=True)
-class _Request:
-    method: str
-    params: dict[str, object]
-
-
-class TestDispatch(unittest.TestCase):
-    def setUp(self) -> None:
-        self.calls: list[str] = []
-
-        def handler(name: str):
-            def call(_params: dict[str, object]) -> str:
-                self.calls.append(name)
-                return name
-
-            return call
-
-        self.handlers = Handlers(
-            initialize=handler("initialize"),
-            tools_list=handler("tools_list"),
-            list_routes=handler("list_routes"),
-            check_proposal=handler("check_proposal"),
-            propose=handler("propose"),
-        )
-
-    def request(self, method: str, **params: object) -> _Request:
-        return _Request(method=method, params=params)
-
-    def test_routes_protocol_methods(self) -> None:
-        self.assertEqual(
-            "initialize", dispatch(self.request("initialize"), self.handlers),
-        )
-        self.assertEqual(
-            "tools_list", dispatch(self.request("tools/list"), self.handlers),
-        )
-        self.assertIsNone(
-            dispatch(self.request("notifications/initialized"), self.handlers),
-        )
-
-    def test_routes_each_tool_class(self) -> None:
-        self.assertEqual(
-            "list_routes",
-            dispatch(
-                self.request("tools/call", name=_sv.TOOL_LIST_EGRESS_ROUTES),
-                self.handlers,
-            ),
-        )
-        self.assertEqual(
-            "check_proposal",
-            dispatch(
-                self.request("tools/call", name=_sv.TOOL_CHECK_PROPOSAL),
-                self.handlers,
-            ),
-        )
-        self.assertEqual(
-            "propose",
-            dispatch(self.request("tools/call", name=_sv.TOOL_EGRESS_ALLOW), self.handlers),
-        )
-
-    def test_unknown_method_is_typed(self) -> None:
-        with self.assertRaisesRegex(MethodNotFoundError, "unknown"):
-            dispatch(self.request("unknown"), self.handlers)
-
-
-if __name__ == "__main__":
-    unittest.main()