chore: tighten upkeep boundaries and static checks

fix(diagnostics): make optional failures observable and safe
refactor(backend): extract shared bottle preparation planner
2026-07-26 06:42:34 +00:00 · 2026-07-26 06:42:34 +00:00 · 2026-07-26 06:42:34 +00:00 · 2026-07-26 06:42:34 +00:00 · 2026-07-26 06:42:34 +00:00 · 2026-07-26 06:42:34 +00:00
148 changed files with 1353 additions and 12737 deletions
@@ -2,7 +2,7 @@
 # digest, etc.) without coupling every dev push to upstream registry
 # availability.
 #
-# Opt-in via BOT_BOTTLE_RUN_CANARIES=1 so the same files can be run
+# Opt-in via CLAUDE_BOTTLE_RUN_CANARIES=1 so the same files can be run
 # locally with the same gating.

 name: canaries
@@ -17,7 +17,7 @@ jobs:
  canaries:
    runs-on: ubuntu-latest
    env:
-      BOT_BOTTLE_RUN_CANARIES: "1"
+      CLAUDE_BOTTLE_RUN_CANARIES: "1"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -25,7 +25,4 @@ jobs:
      # No actions/setup-python: canaries are stdlib unittest on the image's
      # system Python 3.12 (older act_runner mishandles setup-python's PATH).
      - name: Run canaries
-        run: |
-          python3 -m scripts.unittest_gate \
-            -t . -s tests/canaries -v \
-            --minimum-executed 1 --fail-on-skip
+        run: python3 -m unittest discover -t . -s tests/canaries -v
@@ -4,13 +4,6 @@ on:
  push:
    paths:
      - "**.py"
-      - "Dockerfile*"
-      - "bot_bottle/contrib/*/Dockerfile"
-      - "bot_bottle/contrib/*/package.json"
-      - "bot_bottle/contrib/*/package-lock.json"
-      - "bot_bottle/contrib/codex/codex-package_SHA256SUMS"
-      - "requirements.gateway.*"
-      - "image-build-args.json"
      - ".pylintrc"
      - ".gitea/workflows/lint.yml"

@@ -20,9 +13,6 @@ jobs:
    steps:
      - uses: actions/checkout@v3

-      - name: Enforce immutable image inputs
-        run: python3 scripts/check_image_inputs.py
-
      # No actions/setup-python: the runner image already ships Python 3.12,
      # and older act_runner engines mishandle setup-python's PATH. Install
      # into the ephemeral job container's system Python — the pylint/pyright
@@ -1,27 +0,0 @@
-name: prd-number-check
-
-on:
-  pull_request:
-    types: [opened, reopened, synchronize]
-    branches: [main]
-
-jobs:
-  require-numbered-prds:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Reject unnumbered PRDs
-        run: |
-          unnumbered=$(find docs/prds -maxdepth 1 -type f \
-            -name 'prd-new-*.md' -print | sort)
-
-          if [ -n "$unnumbered" ]; then
-            echo "::error::Assign every new PRD its final sequential number before merge."
-            echo "Unnumbered PRDs:"
-            echo "$unnumbered"
-            exit 1
-          fi
-
-          echo "All PRDs have final numbers."
@@ -0,0 +1,122 @@
+# Assign sequential numbers to prd-new-*.md files on merge to main.
+#
+# When a PR merges to main and includes prd-new-*.md files this workflow:
+#   1. Finds the next available NNNN number by scanning existing PRDs.
+#   2. Renames each prd-new-*.md to NNNN-<slug>.md.
+#   3. Updates the title header (# PRD prd-new: → # PRD NNNN:).
+#   4. Flips Status: Draft → Active when the push touched files outside
+#      docs/prds/ anywhere in its commit range (i.e. the implementation
+#      shipped together with the PRD).
+#   5. Commits the renaming back to main.
+#
+# No-op if the working tree contains no prd-new-*.md files.
+#
+# NOTE: The workflow scans the working tree (not just HEAD~1..HEAD) because
+# PRs land as multi-commit pushes and the prd-new file is often added in an
+# earlier commit on the branch, not in the final squash/merge commit.
+
+name: prd-number
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'docs/prds/prd-new-*.md'
+
+jobs:
+  assign-numbers:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      # No actions/setup-python: the inline script is stdlib-only on the
+      # image's system Python 3.12 (older act_runner mishandles its PATH).
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Assign PRD numbers
+        run: |
+          python3 - <<'EOF'
+          import os
+          import re
+          import subprocess
+          import sys
+          from pathlib import Path
+
+          prds_dir = Path("docs/prds")
+
+          # Scan the working tree — prd-new files may have landed in any
+          # commit of a multi-commit push, not just HEAD.
+          new_prds = sorted(prds_dir.glob("prd-new-*.md"))
+
+          if not new_prds:
+              print("No prd-new-*.md files found — nothing to do.")
+              sys.exit(0)
+
+          # Determine whether non-PRD files were also changed anywhere in
+          # the push range (BEFORE_SHA → HEAD).  Falls back to HEAD~1 when
+          # the env var isn't set (e.g. local act runs).
+          before_sha = os.environ.get("GITHUB_EVENT_BEFORE", "HEAD~1")
+          all_changed = subprocess.run(
+              ["git", "diff", "--name-only", before_sha, "HEAD"],
+              capture_output=True, text=True, check=True,
+          ).stdout.splitlines()
+          non_prd_changed = any(
+              not f.startswith("docs/prds/") for f in all_changed
+          )
+
+          # Find next available number.
+          existing = sorted(
+              int(m.group(1))
+              for p in prds_dir.glob("*.md")
+              if (m := re.match(r"^(\d{4})-", p.name))
+          )
+          next_num = (max(existing) + 1) if existing else 1
+
+          for prd_path in sorted(new_prds):
+              slug = re.sub(r"^prd-new-", "", prd_path.stem)
+              new_name = f"{next_num:04d}-{slug}.md"
+              new_path = prds_dir / new_name
+              print(f"  {prd_path.name}  →  {new_name}")
+
+              content = prd_path.read_text()
+
+              # Update title header.
+              content = re.sub(
+                  r"^(#\s+PRD\s+)prd-new(:)",
+                  rf"\g<1>{next_num:04d}\2",
+                  content,
+                  count=1,
+                  flags=re.MULTILINE,
+              )
+
+              # Conditionally flip Status.
+              if non_prd_changed:
+                  content = re.sub(
+                      r"(\*\*Status:\*\*\s*)Draft",
+                      r"\g<1>Active",
+                      content,
+                      count=1,
+                  )
+
+              new_path.write_text(content)
+              subprocess.run(["git", "rm", str(prd_path)], check=True)
+              subprocess.run(["git", "add", str(new_path)], check=True)
+              next_num += 1
+
+          subprocess.run(
+              ["git", "commit", "-m", "ci(prd): assign sequential numbers to new PRDs"],
+              check=True,
+          )
+          subprocess.run(["git", "push"], check=True)
+          EOF
@@ -60,9 +60,6 @@ jobs:

  integration-docker:
    runs-on: ubuntu-latest
-    concurrency:
-      group: integration-docker-infra
-      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -87,30 +84,7 @@ jobs:
        env:
          BOT_BOTTLE_BACKEND: docker
          COVERAGE_FILE: ${{ github.workspace }}/.coverage.docker
-        run: |
-          set -euo pipefail
-          DOCKER_CLIENT_NETWORK=$(
-            docker inspect "$(hostname)" |
-              python3 -c 'import json,sys; n=json.load(sys.stdin)[0]["NetworkSettings"]["Networks"]; print(next(iter(n)))'
-          )
-          test -n "$DOCKER_CLIENT_NETWORK"
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          export NO_PROXY="*"
-          export no_proxy="*"
-          export BOT_BOTTLE_DOCKER_CLIENT_NETWORK="$DOCKER_CLIENT_NETWORK"
-          export BOT_BOTTLE_DOCKER_ROOT_MOUNT="bot-bottle-ci-root-$RUN_KEY"
-          export BOT_BOTTLE_DOCKER_CA_MOUNT="bot-bottle-ci-ca-$RUN_KEY"
-          python3 -m coverage run -m scripts.unittest_gate \
-            -t . -s tests/integration -v \
-            --minimum-executed 22 --fail-on-skip
-
-      - name: Clean Docker integration volumes
-        if: always()
-        run: |
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          docker volume rm --force \
-            "bot-bottle-ci-root-$RUN_KEY" \
-            "bot-bottle-ci-ca-$RUN_KEY" 2>/dev/null || true
+        run: python3 -m coverage run -m unittest discover -t . -s tests/integration -v

      # Non-dot name so upload-artifact's dotfile-skipping glob picks it up.
      - name: Stage docker coverage for upload
@@ -1,97 +0,0 @@
-# Manually refresh the committed package locks and the pinned Codex installer
-# checksum after deliberately changing a direct version in the source files.
-#
-# The job uploads the generated files for review; it never commits or pushes.
-
-name: refresh-image-locks
-
-on:
-  workflow_dispatch:
-  push:
-    paths:
-      - 'requirements.gateway.in'
-      - 'bot_bottle/contrib/claude/package.json'
-      - 'bot_bottle/contrib/pi/package.json'
-      - 'bot_bottle/contrib/codex/Dockerfile'
-      - 'image-build-args.json'
-      - '.gitea/workflows/refresh-image-locks.yml'
-
-permissions:
-  code: read
-
-jobs:
-  refresh:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Resolve image runtime versions
-        id: runtimes
-        run: |
-          python3 - <<'PY' >> "$GITHUB_OUTPUT"
-          import json
-          import re
-          inputs = json.load(open("image-build-args.json"))
-          for output, name in (
-              ("python-version", "PYTHON_BASE_IMAGE"),
-              ("node-version", "NODE_BASE_IMAGE"),
-          ):
-              match = re.search(r":(\d+\.\d+\.\d+)-", inputs[name])
-              if match is None:
-                  raise SystemExit(f"cannot resolve runtime version from {name}")
-              print(f"{output}={match.group(1)}")
-          PY
-
-      - name: Use the image Python version
-        uses: actions/setup-python@v5
-        with:
-          python-version: '${{ steps.runtimes.outputs.python-version }}'
-
-      - name: Use the image Node version
-        uses: actions/setup-node@v4
-        with:
-          node-version: '${{ steps.runtimes.outputs.node-version }}'
-
-      - name: Compile gateway Python lock
-        run: |
-          python3 -m venv /tmp/image-lock-tools
-          /tmp/image-lock-tools/bin/python -m pip install \
-            pip==25.2 \
-            pip-tools==7.5.1
-          /tmp/image-lock-tools/bin/python -m piptools compile \
-            --generate-hashes \
-            --output-file requirements.gateway.lock \
-            requirements.gateway.in
-
-      - name: Resolve provider npm locks
-        run: |
-          for provider in claude pi; do
-            (
-              cd "bot_bottle/contrib/$provider"
-              npm install --package-lock-only --ignore-scripts --no-audit --no-fund
-            )
-          done
-          python3 scripts/complete_npm_lock_integrity.py \
-            bot_bottle/contrib/claude/package-lock.json \
-            bot_bottle/contrib/pi/package-lock.json
-
-      - name: Refresh pinned Codex archive checksums
-        run: |
-          CODEX_VERSION=$(
-            sed -n 's/^ARG CODEX_VERSION=//p' bot_bottle/contrib/codex/Dockerfile
-          )
-          test -n "$CODEX_VERSION"
-          curl -fsSL \
-            "https://github.com/openai/codex/releases/download/rust-v${CODEX_VERSION}/codex-package_SHA256SUMS" \
-            -o bot_bottle/contrib/codex/codex-package_SHA256SUMS
-
-      - name: Upload refreshed inputs
-        uses: actions/upload-artifact@v3
-        with:
-          name: image-input-locks
-          path: |
-            requirements.gateway.lock
-            bot_bottle/contrib/claude/package-lock.json
-            bot_bottle/contrib/pi/package-lock.json
-            bot_bottle/contrib/codex/codex-package_SHA256SUMS
@@ -12,49 +12,33 @@ on:
      - 'bot_bottle/**'
      - 'tests/**/*.py'
      - 'cli.py'
-      - 'install.sh'
-      - 'setup.py'
-      - 'MANIFEST.in'
-      - 'flake.nix'
-      - 'nix/firecracker-netpool.nix'
      - 'scripts/coverage.sh'
      - 'scripts/critical-modules.txt'
-      - 'scripts/**/*.py'
+      - 'scripts/diff_coverage.py'
+      - 'scripts/tracker_policy.py'
      - 'scripts/firecracker-netpool.sh'
      - 'Dockerfile*'
-      - 'image-build-args.json'
      - 'pyproject.toml'
      - 'requirements-dev.txt'
-      - 'requirements.gateway.*'
      - '.coveragerc'
      - '.dockerignore'
      - '.gitea/workflows/test.yml'
-      - '.gitea/workflows/refresh-image-locks.yml'
-      - '.gitea/workflows/pre-release-test.yml'
  pull_request:
    paths:
      - 'bot_bottle/**'
      - 'tests/**/*.py'
      - 'cli.py'
-      - 'install.sh'
-      - 'setup.py'
-      - 'MANIFEST.in'
-      - 'flake.nix'
-      - 'nix/firecracker-netpool.nix'
      - 'scripts/coverage.sh'
      - 'scripts/critical-modules.txt'
-      - 'scripts/**/*.py'
+      - 'scripts/diff_coverage.py'
+      - 'scripts/tracker_policy.py'
      - 'scripts/firecracker-netpool.sh'
      - 'Dockerfile*'
-      - 'image-build-args.json'
      - 'pyproject.toml'
      - 'requirements-dev.txt'
-      - 'requirements.gateway.*'
      - '.coveragerc'
      - '.dockerignore'
      - '.gitea/workflows/test.yml'
-      - '.gitea/workflows/refresh-image-locks.yml'
-      - '.gitea/workflows/pre-release-test.yml'

 jobs:
  unit:
@@ -87,9 +71,6 @@ jobs:

  integration-docker:
    runs-on: ubuntu-latest
-    concurrency:
-      group: integration-docker-infra
-      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -102,51 +83,11 @@ jobs:
          python3 --version
          python3 cli.py backend status --backend=docker

-      - name: Preflight — clear any leftover poisoned gateway network
-        run: |
-          # The gateway network has a fixed name and persists across jobs on
-          # this shared runner. A pre-fix or concurrent launch can leave it with
-          # a malformed IPv6 subnet that trips docker's own ParseAddr in
-          # `network inspect` (see PR #515); the code now self-heals it, but the
-          # heal can't run if `network inspect` is what's broken on some daemon
-          # versions. Drop the network here so this run recreates it IPv4-only.
-          # Remove the attached gateway container first (else `network rm` fails
-          # on active endpoints); both are recreated by ensure_running. Harmless
-          # when absent.
-          docker rm --force bot-bottle-orch-gateway 2>/dev/null || true
-          docker network rm bot-bottle-gateway 2>/dev/null || true
-
      - name: Run integration tests (docker) with coverage
        env:
          BOT_BOTTLE_BACKEND: docker
          COVERAGE_FILE: ${{ github.workspace }}/.coverage.docker
-        run: |
-          set -euo pipefail
-          # act_runner executes this job in a container while sharing the host
-          # Docker socket. Attach control-plane siblings to the job's network,
-          # and use named volumes for state the host daemon must mount.
-          DOCKER_CLIENT_NETWORK=$(
-            docker inspect "$(hostname)" |
-              python3 -c 'import json,sys; n=json.load(sys.stdin)[0]["NetworkSettings"]["Networks"]; print(next(iter(n)))'
-          )
-          test -n "$DOCKER_CLIENT_NETWORK"
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          export NO_PROXY="*"
-          export no_proxy="*"
-          export BOT_BOTTLE_DOCKER_CLIENT_NETWORK="$DOCKER_CLIENT_NETWORK"
-          export BOT_BOTTLE_DOCKER_ROOT_MOUNT="bot-bottle-ci-root-$RUN_KEY"
-          export BOT_BOTTLE_DOCKER_CA_MOUNT="bot-bottle-ci-ca-$RUN_KEY"
-          python3 -m coverage run -m scripts.unittest_gate \
-            -t . -s tests/integration -v \
-            --minimum-executed 22 --fail-on-skip
-
-      - name: Clean Docker integration volumes
-        if: always()
-        run: |
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          docker volume rm --force \
-            "bot-bottle-ci-root-$RUN_KEY" \
-            "bot-bottle-ci-ca-$RUN_KEY" 2>/dev/null || true
+        run: python3 -m coverage run -m unittest discover -t . -s tests/integration -v

      - name: Stage docker coverage for upload
        run: cp .coverage.docker coverage-docker.dat
@@ -157,114 +98,6 @@ jobs:
          name: coverage-docker
          path: coverage-docker.dat

-  image-input-builds:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Verify shared bases cover supported architectures
-        run: |
-          set -euo pipefail
-          python_ref=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["PYTHON_BASE_IMAGE"])')
-          node_ref=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["NODE_BASE_IMAGE"])')
-          docker_cli_ref=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["DOCKER_CLI_BASE_IMAGE"])')
-          test -n "$python_ref"
-          test -n "$node_ref"
-          test -n "$docker_cli_ref"
-          for ref in "$python_ref" "$node_ref" "$docker_cli_ref"; do
-            docker buildx imagetools inspect --raw "$ref" |
-              python3 -c '
-          import json
-          import sys
-          manifest = json.load(sys.stdin)
-          platforms = {
-              (item["platform"]["os"], item["platform"]["architecture"])
-              for item in manifest["manifests"]
-              if item.get("platform", {}).get("os") != "unknown"
-          }
-          required = {("linux", "amd64"), ("linux", "arm64")}
-          missing = required - platforms
-          if missing:
-              raise SystemExit(f"base manifest lacks supported platforms: {missing}")
-          '
-          done
-
-      - name: Verify Codex archives for all supported architectures
-        run: |
-          set -euo pipefail
-          codex_version=$(
-            sed -n 's/^ARG CODEX_VERSION=//p' bot_bottle/contrib/codex/Dockerfile
-          )
-          test -n "$codex_version"
-          tmp=$(mktemp -d)
-          trap 'rm -rf "$tmp"' EXIT
-          for target in \
-            aarch64-unknown-linux-musl \
-            x86_64-unknown-linux-musl
-          do
-            asset="codex-package-${target}.tar.gz"
-            expected=$(
-              awk -v asset="$asset" '$2 == asset { print $1 }' \
-                bot_bottle/contrib/codex/codex-package_SHA256SUMS
-            )
-            test -n "$expected"
-            curl -fsSL \
-              "https://github.com/openai/codex/releases/download/rust-v${codex_version}/${asset}" \
-              -o "$tmp/$asset"
-            echo "$expected  $tmp/$asset" | sha256sum -c -
-            tar -tzf "$tmp/$asset" > "$tmp/$asset.contents"
-            grep -Fx 'bin/codex' "$tmp/$asset.contents"
-            grep -Fx 'bin/codex-code-mode-host' "$tmp/$asset.contents"
-            grep -Fx 'codex-package.json' "$tmp/$asset.contents"
-          done
-
-      - name: Build and smoke-test all supported images
-        run: |
-          set -euo pipefail
-          suffix="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-image-inputs}}"
-          orchestrator="bot-bottle-orchestrator-inputs:${suffix}"
-          gateway="bot-bottle-gateway-inputs:${suffix}"
-          orchestrator_fc="bot-bottle-orchestrator-fc-inputs:${suffix}"
-          claude="bot-bottle-claude-inputs:${suffix}"
-          codex="bot-bottle-codex-inputs:${suffix}"
-          pi="bot-bottle-pi-inputs:${suffix}"
-          python_base=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["PYTHON_BASE_IMAGE"])')
-          node_base=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["NODE_BASE_IMAGE"])')
-
-          docker build --build-arg "PYTHON_BASE_IMAGE=$python_base" \
-            -t "$orchestrator" -f Dockerfile.orchestrator .
-          orchestrator_id=$(docker image inspect --format '{{.Id}}' "$orchestrator")
-          case "$orchestrator_id" in sha256:*) ;; *) exit 1 ;; esac
-          orchestrator_base="bot-bottle-orchestrator-inputs:sha256-${orchestrator_id#sha256:}"
-          docker image tag "$orchestrator_id" "$orchestrator_base"
-          test "$(
-            docker image inspect --format '{{.Id}}' "$orchestrator_base"
-          )" = "$orchestrator_id"
-          docker build --build-arg "PYTHON_BASE_IMAGE=$python_base" \
-            -t "$gateway" -f Dockerfile.gateway .
-          docker build \
-            --build-arg "ORCHESTRATOR_BASE_IMAGE=$orchestrator_base" \
-            -t "$orchestrator_fc" -f Dockerfile.orchestrator.fc .
-          docker build --build-arg "NODE_BASE_IMAGE=$node_base" \
-            -t "$claude" -f bot_bottle/contrib/claude/Dockerfile .
-          docker build --build-arg "NODE_BASE_IMAGE=$node_base" \
-            -t "$codex" -f bot_bottle/contrib/codex/Dockerfile .
-          docker build --build-arg "NODE_BASE_IMAGE=$node_base" \
-            -t "$pi" -f bot_bottle/contrib/pi/Dockerfile .
-
-          docker run --rm --entrypoint python3 "$orchestrator" -c \
-            'import bot_bottle.orchestrator'
-          docker run --rm --entrypoint mitmdump "$gateway" --version
-          docker run --rm "$claude" claude --version
-          docker run --rm "$codex" codex --version
-          docker run --rm "$pi" pi --version
-
  coverage:
    needs: [unit, integration-docker]
    timeout-minutes: 15
@@ -298,7 +131,7 @@ jobs:
      - name: Combined coverage (unit + docker integration)
        run: PYTHON=python3 bash scripts/coverage.sh aggregate critical

-      - name: Diff-coverage gate (changed lines >= 80%)
+      - name: Diff-coverage gate (changed lines >= 90%)
        run: |
          git fetch --no-tags origin main:refs/remotes/origin/main
-          python3 scripts/diff_coverage.py --base origin/main --min 80
+          python3 scripts/diff_coverage.py --base origin/main --min 90
@@ -33,28 +33,19 @@ jobs:
      - name: Run coverage and extract percentage
        id: coverage
        run: |
-          set -euo pipefail
-          # Never publish a badge from a failed or partial test run.
-          python3 -m coverage run -m unittest discover -t . -s tests/unit
-          REPORT=$(python3 -m coverage report)
-          printf '%s\n' "$REPORT"
-          PERCENT=$(printf '%s\n' "$REPORT" | awk '$1 == "TOTAL" {gsub("%", "", $NF); print $NF}')
-          test -n "$PERCENT"
+          python3 -m coverage run -m unittest discover -t . -s tests/unit > /dev/null 2>&1 || true
+          PERCENT=$(python3 -m coverage report 2>/dev/null | grep '^TOTAL' | grep -oP '\d+(?=%)' | tail -1)
          echo "percent=$PERCENT" >> $GITHUB_OUTPUT
          echo "Coverage: $PERCENT%"

      - name: Extract core (critical-module) coverage percentage
        id: core_coverage
        run: |
-          set -euo pipefail
          # Reuses the .coverage data from the previous step. The core list is
-          # validated single source of truth. Fail if a listed path disappeared
-          # or if the measured core falls below ADR 0004's 90% minimum.
-          INCLUDE=$(python3 scripts/critical_modules.py)
-          REPORT=$(python3 -m coverage report --include="$INCLUDE" --fail-under=90)
-          printf '%s\n' "$REPORT"
-          PERCENT=$(printf '%s\n' "$REPORT" | awk '$1 == "TOTAL" {gsub("%", "", $NF); print $NF}')
-          test -n "$PERCENT"
+          # the single source of truth in scripts/critical-modules.txt; every
+          # core module is unit-tested, so the unit-only run is accurate for it.
+          INCLUDE=$(grep -vE '^[[:space:]]*(#|$)' scripts/critical-modules.txt | paste -sd, -)
+          PERCENT=$(python3 -m coverage report --include="$INCLUDE" 2>/dev/null | grep '^TOTAL' | grep -oP '\d+(?=%)' | tail -1)
          echo "percent=$PERCENT" >> $GITHUB_OUTPUT
          echo "Core coverage: $PERCENT%"

@@ -44,10 +44,10 @@ backend remains available with `BOT_BOTTLE_BACKEND=docker` or

 - Three kinds of doc, each with its own conventions in-folder; see
  `docs/README.md` for when to write which:
-  - **PRDs** (`docs/prds/`) — one feature per file. A draft may initially
-    use `prd-new-<kebab>.md`, but its author must assign the next
-    sequential number before merge; CI rejects unnumbered PRDs. A
-    `Status:` line tracks lifecycle: Draft → Active (shipped to `main`) →
+  - **PRDs** (`docs/prds/`) — one feature per file. While a PR is open
+    the file is named `prd-new-<kebab>.md`; CI assigns a sequential
+    number on merge to `main` and renames it. A `Status:` line tracks
+    lifecycle: Draft → Active (shipped to `main`) →
    Superseded/Retargeted. Format in `docs/prds/README.md`.
  - **Research notes** (`docs/research/`) — opinionated investigations;
    unnumbered kebab-case, freeform and verdict-first. See
@@ -36,23 +36,11 @@
 #   9420  git-gate smart HTTP (VM-backend agent-facing transport)
 #   9100  supervise (MCP HTTP)

-# Based on an exact `python:3.12.13-slim-trixie` multi-architecture manifest
-# rather than the
+# Based on `python:3.12-slim` (Debian trixie) rather than the
 # `mitmproxy/mitmproxy` image (Debian bookworm), matching the trixie base the
 # orchestrator image needs for buildah (Dockerfile.orchestrator.fc). mitmproxy
 # is pip-installed to the same effect as the upstream image.
-ARG PYTHON_BASE_IMAGE
-FROM ${PYTHON_BASE_IMAGE}
-
-# Freeze apt's package universe as well as the base filesystem. Without a
-# snapshot, the same Dockerfile resolves different package versions over time.
-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
+FROM python:3.12-slim

 # Runtime system deps:
 #   git supplies the `git daemon` subcommand (no separate package)
@@ -60,19 +48,16 @@ RUN sed -i \
 #   openssh-client supplies the upstream SSH transport the
 #     pre-receive hook uses to forward accepted refs.
 #   ca-certificates is needed for mitmdump upstream TLS.
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      git openssh-client ca-certificates \
 && rm -rf /var/lib/apt/lists/*

 # mitmdump (the egress data plane). The upstream mitmproxy image baked
-# this in; on the plain python base we install a fully resolved lock whose
-# distributions are all hash-verified. Its CA dir is set explicitly via
-# `--set confdir=` in
+# this in; on the plain python base we pip-install the same pinned
+# version. Its CA dir is set explicitly via `--set confdir=` in
 # egress-entrypoint.sh, so it doesn't depend on a `mitmproxy` home user.
-COPY requirements.gateway.lock /tmp/requirements.gateway.lock
-RUN pip install --no-cache-dir --require-hashes \
-      -r /tmp/requirements.gateway.lock
+RUN pip install --no-cache-dir mitmproxy==11.1.3

 # gitleaks (the pre-receive hook's secret scanner). Installed from its
 # official release, pinned by version + SHA256 and verified — rather than
@@ -9,24 +9,19 @@
 #     Keeping the content in one place means future orchestrator deps (e.g.
 #     iroh) are added here once, not duplicated per backend.
 #
-# It stays deliberately lean: only the pinned FastAPI/Uvicorn control-plane
-# stack is installed here — none of the gateway's mitmproxy/git/gitleaks
-# (that's Dockerfile.gateway) and no buildah (that's firecracker-only).
+# It stays deliberately lean: the control plane is **stdlib-only** today, so
+# no third-party payload — none of the gateway's mitmproxy/git/gitleaks
+# (that's Dockerfile.gateway) and no buildah (that's the firecracker
+# builder, and lives only in Dockerfile.orchestrator.fc). Keeping the
+# secret-dense control plane on a minimal dependency surface is the point
+# (PRD 0070's "secret concentration").
 #
-# Shares an exact multi-architecture Python/trixie manifest with the gateway
-# image. The version-qualified tag keeps the human-readable upstream version;
-# the digest makes the bytes immutable.
+# Shares the trixie `python:3.12-slim` base with the gateway image.

-ARG PYTHON_BASE_IMAGE
-FROM ${PYTHON_BASE_IMAGE}
+FROM python:3.12-slim

 WORKDIR /app

-COPY requirements.orchestrator.lock /tmp/requirements.orchestrator.lock
-RUN pip install --no-cache-dir --require-hashes \
-        -r /tmp/requirements.orchestrator.lock \
-    && rm /tmp/requirements.orchestrator.lock
-
 # The orchestrator content. Baked so the image is self-contained (runs from
 # a built image, no runtime bind-mount); the docker backend may still
 # bind-mount /app for dev live-reload, which simply overlays this copy.
@@ -12,21 +12,10 @@
 # bare microVM (no fuse-overlayfs / overlay module / subuid maps). The trixie
 # base (from Dockerfile.orchestrator's python:3.12-slim) carries buildah 1.39,
 # which parses the Dockerfile heredocs agent images use (bookworm's 1.28 can't).
-# Matches image_builder. There is deliberately no default: the build coordinator
-# passes the exact local image ID returned by `docker image inspect`, so this
-# stage cannot silently resolve a stale `:latest` tag.
-ARG ORCHESTRATOR_BASE_IMAGE
-FROM ${ORCHESTRATOR_BASE_IMAGE}
+# Matches image_builder.
+FROM bot-bottle-orchestrator:latest

-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
-
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
 && apt-get install -y --no-install-recommends \
      buildah crun netavark aardvark-dns \
 && rm -rf /var/lib/apt/lists/*
@@ -4,8 +4,5 @@
 include Dockerfile.gateway
 include Dockerfile.orchestrator
 include Dockerfile.orchestrator.fc
-include image-build-args.json
-include requirements.gateway.in
-include requirements.gateway.lock
 include nix/firecracker-netpool.nix
 include scripts/firecracker-netpool.sh
@@ -5,7 +5,7 @@
 # bot-bottle

 [![test](https://gitea.dideric.is/didericis/bot-bottle/actions/workflows/test.yml/badge.svg?branch=main)](https://gitea.dideric.is/didericis/bot-bottle/actions?workflow=test.yml)
-[![coverage](https://img.shields.io/badge/coverage-84%25-brightgreen)](https://coverage.readthedocs.io/)
+[![coverage](https://img.shields.io/badge/coverage-83%25-brightgreen)](https://coverage.readthedocs.io/)
 [![core coverage](https://img.shields.io/badge/core%20coverage-94%25-brightgreen)](https://gitea.dideric.is/didericis/bot-bottle/src/branch/main/docs/decisions/0004-coverage-policy.md)

 **Problem:** Developer wants to run a coding agent without supervision, but they don't want a prompt injected or misbehaving agent wrecking their environment or exfiltrating sensitive data.
@@ -75,7 +75,7 @@ On compatible macOS hosts, the default backend requires Apple's `container` CLI

 Use `BOT_BOTTLE_BACKEND=docker ./cli.py start <agent>` on hosts where neither Apple Container nor KVM is available and Docker is the desired backend.

-> **CI (macOS Apple Container):** the advisory `integration-macos` job in `.gitea/workflows/pre-release-test.yml` runs only on manual dispatch. It targets a self-hosted host-mode runner labelled `macos`; Apple Container cannot run inside the Linux pull-request runner. Provision an Apple Silicon host with the `container` CLI running and Python ≥ 3.11 plus `coverage` on the launchd service's explicit `PATH`. The infra container is a singleton (`bot-bottle-mac-infra`), so keep runner concurrency at 1. Its coverage is reported separately and never feeds the required pull-request gate.
+> **CI (macOS Apple Container):** the `integration-macos` job (`.gitea/workflows/test.yml`) runs the integration suite against `BOT_BOTTLE_BACKEND=macos-container` on a self-hosted macOS runner labelled `macos`, because Apple Container needs the host virtualization framework and cannot run in a Linux container (so it can't reuse the `kvm` runner). Provision an Apple Silicon host with the `container` CLI on `PATH` and `container system status` running, then register the runner in **host mode** (not docker mode) with the `macos` label — `brew install gitea-runner` (the `act_runner` rename). Give it a Python ≥ 3.11 with `coverage` importable on the launchd service's `PATH` (a launchd service doesn't inherit your shell profile, so pin `node` and the Python env explicitly). The job is **advisory** — `workflow_dispatch` (manual) only, never triggered by push or PR — since a single laptop that sleeps/roams must not block merges or churn on every push to main; its coverage doesn't feed the gate. The infra container is a singleton (`bot-bottle-mac-infra`), so keep runner concurrency at 1.

 ### Containers inside a bottle

@@ -174,7 +174,7 @@ BOT_BOTTLE_BACKEND=firecracker ./cli.py start <agent>

 > **NixOS:** enable `virtualisation.docker`, ensure the KVM module is loaded (`boot.kernelModules = [ "kvm-intel" ];` or `kvm-amd`), and add your user to the `kvm` and `docker` groups. For the network pool, consume the flake module — `imports = [ inputs.bot-bottle.nixosModules.firecracker-netpool ]; services.bot-bottle-firecracker = { enable = true; owner = "you"; };` — then `nixos-rebuild switch` (imperative nft/TAP rules don't survive a rebuild; channel users can `imports = [ <bot-bottle>/nix/firecracker-netpool.nix ]`). `firecracker` isn't in nixpkgs by default as a user binary — install the release binary (pin the version) and put it on `PATH`.

-> **CI:** Firecracker integration runs in the manually dispatched `.gitea/workflows/pre-release-test.yml` on a self-hosted runner labelled `kvm`; privileged KVM hosts never execute unreviewed PR code automatically. Provision it like a normal Firecracker host: `firecracker` on `PATH`, `/dev/kvm`, the cached guest kernel and static dropbear, and the persistent TAP/nft pool. The required pull-request workflow runs unit plus the complete Docker integration suite on `ubuntu-latest`; see `docs/ci.md`.
+> **CI:** the coverage gate (`.gitea/workflows/test.yml` → `coverage` job) runs on a self-hosted runner labelled `kvm`, because the Firecracker backend's VM/SSH orchestration is exercised only by the integration suite, which needs `/dev/kvm` + the provisioned pool (a container runner would skip it and read as uncovered). Provision that runner exactly like a normal Firecracker host — `firecracker` on `PATH`, `/dev/kvm`, the cached guest kernel + static dropbear, and the pool installed as the persistent systemd unit — then register it with the `kvm` label. A Docker-capable hosted job builds the candidate once; KVM tests boot those exact bytes, and a successful main run publishes them. The unit/lint jobs still run on `ubuntu-latest`.

 ```sh
 ./cli.py start <agent>   # builds the image on first run, drops you into claude
@@ -30,7 +30,6 @@ if TYPE_CHECKING:
        BottleImages,
        BottlePlan,
        BottleSpec,
-        EnumerationError,
        ExecResult,
    )
    from .selection import (
@@ -60,7 +59,6 @@ _LAZY_MODULES: dict[str, str] = {
    "BottleImages": "base",
    "BottleBackend": "base",
    "BackendStatus": "base",
-    "EnumerationError": "base",
    "get_bottle_backend": "selection",
    "known_backend_names": "selection",
    "has_backend": "selection",
@@ -102,7 +100,6 @@ __all__ = [
    "BottlePlan",
    "BottleSpec",
    "ExecResult",
-    "EnumerationError",
    "CommitCancelled",
    "Freezer",
    "get_freezer",
@@ -42,10 +42,6 @@ class BackendStatus(enum.IntEnum):
    READY = 0


-class EnumerationError(RuntimeError):
-    """A backend could not produce an authoritative live-resource snapshot."""
-
-
@dataclass(frozen=True)
 class BottleSpec:
    """CLI-supplied intent. Backend-agnostic — each backend's prepare
@@ -172,10 +168,6 @@ class BottleCleanupPlan(ABC):
        """True iff there is nothing to clean up; the CLI uses this to
        short-circuit before showing the y/N."""

-    @abstractmethod
-    def intersect(self, current: "BottleCleanupPlan") -> "BottleCleanupPlan":
-        """Resources both displayed to the operator and currently removable."""
-

@dataclass(frozen=True)
 class ExecResult:
@@ -1,60 +0,0 @@
-"""Shared destructive-cleanup execution and failure accounting."""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-from collections.abc import Sequence
-from pathlib import Path
-
-
-class CleanupError(RuntimeError):
-    """One or more approved cleanup mutations did not complete."""
-
-
-class CleanupFailures:
-    """Attempt every approved mutation, then fail with complete diagnostics."""
-
-    def __init__(self) -> None:
-        self._messages: list[str] = []
-
-    def run(self, argv: Sequence[str], description: str) -> None:
-        raw_timeout = os.environ.get(
-            "BOT_BOTTLE_CLEANUP_COMMAND_TIMEOUT_SECONDS", "120",
-        )
-        try:
-            timeout = float(raw_timeout)
-        except ValueError:
-            timeout = 120.0
-        try:
-            result = subprocess.run(
-                list(argv), capture_output=True, text=True, check=False,
-                timeout=max(timeout, 1.0),
-            )
-        except (OSError, subprocess.SubprocessError) as exc:
-            self._messages.append(f"{description}: {exc}")
-            return
-        if result.returncode != 0:
-            detail = (result.stderr or result.stdout).strip()
-            self._messages.append(
-                f"{description}: {detail or f'exit {result.returncode}'}"
-            )
-
-    def remove_tree(self, path: Path, description: str) -> None:
-        try:
-            shutil.rmtree(path)
-        except FileNotFoundError:
-            return
-        except OSError as exc:
-            self._messages.append(f"{description}: {exc}")
-
-    def record(self, message: str) -> None:
-        self._messages.append(message)
-
-    def raise_if_any(self) -> None:
-        if self._messages:
-            raise CleanupError("; ".join(self._messages))
-
-
-__all__ = ["CleanupError", "CleanupFailures"]
@@ -46,22 +46,6 @@ class DockerBottleCleanupPlan(BottleCleanupPlan):
            and not self.orphan_state_dirs
        )

-    def intersect(self, current: BottleCleanupPlan) -> "DockerBottleCleanupPlan":
-        if not isinstance(current, DockerBottleCleanupPlan):
-            raise TypeError("cleanup plans must have the same backend type")
-        return DockerBottleCleanupPlan(
-            projects=tuple(x for x in self.projects if x in current.projects),
-            stray_containers=tuple(
-                x for x in self.stray_containers if x in current.stray_containers
-            ),
-            stray_networks=tuple(
-                x for x in self.stray_networks if x in current.stray_networks
-            ),
-            orphan_state_dirs=tuple(
-                x for x in self.orphan_state_dirs if x in current.orphan_state_dirs
-            ),
-        )
-
    def print(self) -> None:
        print(file=sys.stderr)
        for name in self.projects:
@@ -23,12 +23,11 @@ Active-agent enumeration lives in `backend/docker/enumerate.py`.

 from __future__ import annotations

+import shutil
 import subprocess

 from ...paths import bot_bottle_root
-from ...log import info
-from .. import EnumerationError
-from ..cleanup_control import CleanupFailures
+from ...log import info, warn
 from . import util as docker_mod
 from .bottle_cleanup_plan import DockerBottleCleanupPlan
 from ...bottle_state import bottle_state_dir, is_preserved
@@ -37,17 +36,15 @@ from .compose import COMPOSE_PROJECT_PREFIX, list_compose_projects

 def _list_prefixed_containers() -> list[str]:
    """All bot-bottle-prefixed containers, running or stopped."""
-    try:
-        result = subprocess.run(
-            ["docker", "ps", "-a",
-             "--filter", f"name=^{COMPOSE_PROJECT_PREFIX}",
-             "--format", "{{.Names}}\t{{.Label \"com.docker.compose.project\"}}"],
-            capture_output=True, text=True, check=False,
-        )
-    except OSError as exc:
-        raise EnumerationError(f"docker ps failed: {exc}") from exc
+    result = subprocess.run(
+        ["docker", "ps", "-a",
+         "--filter", f"name=^{COMPOSE_PROJECT_PREFIX}",
+         "--format", "{{.Names}}\t{{.Label \"com.docker.compose.project\"}}"],
+        capture_output=True, text=True, check=False,
+    )
    if result.returncode != 0:
-        raise EnumerationError(f"docker ps failed: {result.stderr.strip()}")
+        warn(f"docker ps failed: {result.stderr.strip()}")
+        return []
    out: list[str] = []
    for line in (result.stdout or "").splitlines():
        if not line:
@@ -66,19 +63,15 @@ def _list_prefixed_networks() -> list[str]:
    to a compose project. Compose-managed networks have a
    `com.docker.compose.project` label; bare ones (from pre-compose
    code paths) don't."""
-    try:
-        result = subprocess.run(
-            ["docker", "network", "ls",
-             "--filter", f"name={COMPOSE_PROJECT_PREFIX}",
-             "--format", "{{.Name}}\t{{.Label \"com.docker.compose.project\"}}"],
-            capture_output=True, text=True, check=False,
-        )
-    except OSError as exc:
-        raise EnumerationError(f"docker network ls failed: {exc}") from exc
+    result = subprocess.run(
+        ["docker", "network", "ls",
+         "--filter", f"name={COMPOSE_PROJECT_PREFIX}",
+         "--format", "{{.Name}}\t{{.Label \"com.docker.compose.project\"}}"],
+        capture_output=True, text=True, check=False,
+    )
    if result.returncode != 0:
-        raise EnumerationError(
-            f"docker network ls failed: {result.stderr.strip()}"
-        )
+        warn(f"docker network ls failed: {result.stderr.strip()}")
+        return []
    out: list[str] = []
    for line in (result.stdout or "").splitlines():
        if not line:
@@ -127,10 +120,7 @@ def prepare_cleanup() -> DockerBottleCleanupPlan:
    `enumerate_active_agents()` so the orphan-state-dir bucket
    doesn't include slugs whose non-docker bottle is still up."""
    docker_mod.require_docker()
-    projects = list_compose_projects(
-        warn_on_error=False,
-        raise_on_error=True,
-    )
+    projects = list_compose_projects()
    project_set = set(projects)
    # Late import to avoid a circular at module-load time —
    # the backend package's __init__ imports this module.
@@ -150,30 +140,40 @@ def cleanup(plan: DockerBottleCleanupPlan) -> None:
    """Remove everything in the plan. Projects first (whose `compose
    down` reaps their containers + networks atomically), then stray
    legacy resources, then orphan state dirs."""
-    failures = CleanupFailures()
    for project in plan.projects:
        info(f"docker compose down  ({project})")
-        failures.run(
+        result = subprocess.run(
            ["docker", "compose", "-p", project, "down", "--volumes"],
-            f"docker compose down failed for {project}",
+            capture_output=True, text=True, check=False,
        )
+        if result.returncode != 0:
+            warn(
+                f"compose down failed for {project}: "
+                f"{result.stderr.strip()}"
+            )

    for name in plan.stray_containers:
        info(f"removing stray container {name}")
-        failures.run(
+        subprocess.run(
            ["docker", "rm", "-f", name],
-            f"removing stray container {name}",
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
        )

    for name in plan.stray_networks:
        info(f"removing stray network {name}")
-        failures.run(
+        subprocess.run(
            ["docker", "network", "rm", name],
-            f"removing stray network {name}",
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
        )

    for identity in plan.orphan_state_dirs:
        path = bottle_state_dir(identity)
        info(f"removing orphan state dir {path}")
-        failures.remove_tree(path, f"removing orphan state dir {path}")
-    failures.raise_if_any()
+        try:
+            shutil.rmtree(path, ignore_errors=True)
+        except OSError as e:
+            warn(f"failed to remove {path}: {e}")
@@ -16,7 +16,6 @@ from pathlib import Path
 from typing import Any

 from ...log import die, warn
-from ..base import EnumerationError


 # --- Lifecycle helpers (PRD 0018 chunk 3) ----------------------------------
@@ -53,20 +52,19 @@ def slug_from_compose_project(project: str) -> str:


 def list_compose_projects(
-    *,
-    include_stopped: bool = True,
-    warn_on_error: bool = True,
-    raise_on_error: bool = False,
+    *, include_stopped: bool = True, warn_on_error: bool = True,
 ) -> list[str]:
    """All compose project names starting with `bot-bottle-`.
    `include_stopped=True` (default) runs `docker compose ls --all`
    so exited projects appear too; pass False to get only projects
    with at least one running container.

-    Best-effort callers get ``[]`` on Docker errors or malformed output.
-    Enumeration callers pass ``raise_on_error=True`` so a failed query is not
-    reported as an authoritative empty result.
-    """
+    Returns [] on docker daemon errors or malformed output rather
+    than raising — callers should treat the empty list as "no
+    projects discoverable", not "no projects exist". `warn_on_error`
+    stays true for explicit operator commands like cleanup, but active
+    discovery paths set it false so dashboard refreshes don't spam
+    stderr while Docker Desktop is stopped."""
    argv = ["docker", "compose", "ls", "--format", "json"]
    if include_stopped:
        argv.insert(3, "--all")
@@ -74,27 +72,19 @@ def list_compose_projects(
        result = subprocess.run(
            argv, capture_output=True, text=True, check=False,
        )
-    except FileNotFoundError as exc:
-        if raise_on_error:
-            raise EnumerationError(
-                "docker compose ls failed: docker not found"
-            ) from exc
+    except FileNotFoundError:
+        # docker binary not on PATH — same shape as a daemon-down
+        # error from the caller's POV: no projects discoverable.
        return []
    if result.returncode != 0:
-        message = f"docker compose ls failed: {result.stderr.strip()}"
-        if raise_on_error:
-            raise EnumerationError(message)
        if warn_on_error:
-            warn(message)
+            warn(f"docker compose ls failed: {result.stderr.strip()}")
        return []
    try:
        projects = json.loads(result.stdout or "[]")
    except json.JSONDecodeError as e:
-        message = f"docker compose ls returned malformed JSON: {e}"
-        if raise_on_error:
-            raise EnumerationError(message) from e
        if warn_on_error:
-            warn(message)
+            warn(f"docker compose ls returned malformed JSON: {e}")
        return []
    names: list[str] = []
    for p in projects:
@@ -107,10 +97,7 @@ def list_compose_projects(


 def list_active_slugs(
-    *,
-    include_stopped: bool = False,
-    warn_on_error: bool = True,
-    raise_on_error: bool = False,
+    *, include_stopped: bool = False, warn_on_error: bool = True,
 ) -> list[str]:
    """Slugs (project name minus prefix) of currently-running
    bottles. Used by the dashboard's operator-edit verbs to choose
@@ -121,7 +108,6 @@ def list_active_slugs(
            for p in list_compose_projects(
                include_stopped=include_stopped,
                warn_on_error=warn_on_error,
-                raise_on_error=raise_on_error,
            )
        ) if slug
    )
@@ -68,11 +68,6 @@ def _network_container_ips(network: str) -> list[str]:
        "docker", "network", "inspect", "--format",
        "{{range .Containers}}{{.IPv4Address}} {{end}}", network,
    ])
-    if proc.returncode != 0:
-        detail = proc.stderr.strip() or f"exit {proc.returncode}"
-        raise ConsolidatedLaunchError(
-            f"could not inspect addresses on gateway network {network}: {detail}"
-        )
    ips: list[str] = []
    for entry in proc.stdout.split():
        ips.append(entry.split("/", 1)[0])
@@ -1,8 +1,9 @@
 """Active-agent enumeration for the docker backend.

 Returns `ActiveAgent` records the CLI `active` command and the
-dashboard agents pane consume. Docker query failures raise rather
-than masquerading as an authoritative empty result.
+dashboard agents pane consume. Empty when docker isn't reachable
+— gated by `has_backend('docker')` at the cross-backend caller
+so this module trusts that docker is available when called.

 The parser (`_parse_services_by_project`) is exposed for direct
 unit testing; the docker `docker ps` invocation is in
@@ -12,18 +13,17 @@ from __future__ import annotations

 import subprocess

-from .. import ActiveAgent, EnumerationError
+from .. import ActiveAgent
 from ...bottle_state import read_metadata
 from .compose import compose_project_name, list_active_slugs


 def enumerate_active() -> list[ActiveAgent]:
-    """All currently-running docker-backed agents."""
-    slugs = list_active_slugs(
-        include_stopped=False,
-        warn_on_error=False,
-        raise_on_error=True,
-    )
+    """All currently-running docker-backed agents. Caller is
+    responsible for gating on `has_backend('docker')` if it
+    matters; if docker is missing the `docker ps` call below
+    returns an empty list silently."""
+    slugs = list_active_slugs(include_stopped=False, warn_on_error=False)
    if not slugs:
        return []
    services_by_project = _query_services_by_project()
@@ -74,8 +74,8 @@ def _query_services_by_project() -> dict[str, set[str]]:
            ],
            capture_output=True, text=True, check=False,
        )
-    except FileNotFoundError as exc:
-        raise EnumerationError("docker ps failed: docker not found") from exc
+    except FileNotFoundError:
+        return {}
    if r.returncode != 0:
-        raise EnumerationError(f"docker ps failed: {r.stderr.strip()}")
+        return {}
    return _parse_services_by_project(r.stdout or "")
@@ -17,10 +17,6 @@ from ...gateway import (
  DEFAULT_CA_TIMEOUT_SECONDS, CA_POLL_SECONDS, GATEWAY_CA_CERT, GatewayError
 )

-DEFAULT_GATEWAY_SUBNET = "10.242.255.0/24"
-_GATEWAY_SUBNET_LABEL = "bot-bottle.gateway-subnet"
-
-
 class DockerGateway(Gateway):
    """The consolidated gateway as a single, fixed-name Docker container.

@@ -39,8 +35,6 @@ class DockerGateway(Gateway):
        build_context: Path | None = None,
        dockerfile: str | None = GATEWAY_DOCKERFILE,
        host_port_bindings: tuple[int, ...] = (),
-        ca_mount_source: str | Path | None = None,
-        subnet: str | None = None,
    ) -> None:
        self.image_ref = image_ref
        self.name = name
@@ -65,15 +59,6 @@ class DockerGateway(Gateway):
        # backend's dev-harness gateway so VMs can reach it via their TAP link;
        # Docker's DNAT + the nft `ct status dnat accept` rule handle the rest.
        self._host_port_bindings = host_port_bindings
-        self._subnet = (
-            subnet
-            or os.environ.get("BOT_BOTTLE_DOCKER_GATEWAY_SUBNET", "").strip()
-            or DEFAULT_GATEWAY_SUBNET
-        )
-        configured_ca = os.environ.get("BOT_BOTTLE_DOCKER_CA_MOUNT", "").strip()
-        self._ca_mount_source = str(
-            ca_mount_source or configured_ca or host_gateway_ca_dir()
-        )

    def image_exists(self) -> bool:
        return run_docker(["docker", "image", "inspect", self.image_ref]).returncode == 0
@@ -96,11 +81,6 @@ class DockerGateway(Gateway):
                str(context)]
        if os.environ.get("BOT_BOTTLE_NO_CACHE"):
            argv.insert(2, "--no-cache")
-        for name, value in resources.image_build_args(
-            self._dockerfile,
-            context=context,
-        ).items():
-            argv[-1:-1] = ["--build-arg", f"{name}={value}"]
        proc = run_docker(argv)
        if proc.returncode != 0:
            raise GatewayError(f"gateway image build failed: {proc.stderr.strip()}")
@@ -129,72 +109,10 @@ class DockerGateway(Gateway):
    def _ensure_network(self) -> None:
        """Create the shared gateway network if it doesn't exist. Idempotent —
        a concurrent create loses harmlessly (the loser sees 'already exists').
-        The explicit subnet is required because bottle attribution pins source
-        IPs; Docker rejects static endpoint addresses on an auto-IPAM network."""
-        inspected = run_docker([
-            "docker", "network", "inspect",
-            "--format", f'{{{{index .Labels "{_GATEWAY_SUBNET_LABEL}"}}}}',
-            self.network,
-        ])
-        if inspected.returncode == 0:
-            marker = inspected.stdout.strip()
-            if marker in {"", self._subnet}:
-                return
-            # Inspectable but mislabelled: the stale auto-IPAM network created
-            # by older releases. Replace it below.
-            stale = True
-        else:
-            # inspect failed. Classify by stderr — do NOT assume "not absent"
-            # implies "poisoned": a transient daemon/API error, permission
-            # failure, timeout, or bad context also fails here, and destroying
-            # the shared gateway on that guess would tear the network out from
-            # under every live bottle.
-            err = inspected.stderr.lower()
-            if "no such network" in err or "not found" in err:
-                # Absent: nothing to replace — create it below.
-                stale = False
-            elif "parseaddr" in err:
-                # Present but poisoned. A daemon that default-enables IPv6
-                # attaches an fdd0::/64 subnet whose `::1/64` gateway trips
-                # docker's own netip.ParseAddr in `network inspect`/`ls`, so the
-                # command exits non-zero with that signature. A fixed release
-                # never *creates* such a network, but one can survive on a
-                # shared host from an older or concurrent launch — and
-                # `--ipv6=false` alone can't heal it, since the create below only
-                # no-ops on "already exists". Force-replace it so later reads
-                # (e.g. `_network_cidr` pinning a source IP) stop failing.
-                stale = True
-            else:
-                # Unrecognized failure: no evidence the network is malformed.
-                # Surface it rather than mutate shared state on a guess.
-                raise GatewayError(
-                    f"gateway network {self.network} could not be inspected: "
-                    f"{inspected.stderr.strip()}"
-                )
-        if stale:
-            # Migrate the stale/poisoned network. Removing the fixed gateway is
-            # safe here: this launch recreates it.
-            run_docker(["docker", "rm", "--force", self.name])
-            removed = run_docker(["docker", "network", "rm", self.network])
-            if removed.returncode != 0 and "no such network" not in removed.stderr.lower():
-                raise GatewayError(
-                    f"gateway network {self.network} needs explicit subnet "
-                    f"{self._subnet} but could not be replaced: "
-                    f"{removed.stderr.strip()}"
-                )
-        proc = run_docker([
-            "docker", "network", "create",
-            # bot-bottle attribution pins IPv4 source IPs; it has no IPv6
-            # support. Disable IPv6 explicitly so a daemon that default-enables
-            # it (default-address-pools) can't attach an fdd0::/64 subnet — a
-            # malformed `::1/64` gateway address then trips docker's own
-            # ParseAddr in `network inspect`/`ls`, which poisons every launch
-            # that reads this network's subnet.
-            "--ipv6=false",
-            "--subnet", self._subnet,
-            "--label", f"{_GATEWAY_SUBNET_LABEL}={self._subnet}",
-            self.network,
-        ])
+        Docker picks the subnet; the launcher reads it back to allocate IPs."""
+        if run_docker(["docker", "network", "inspect", self.network]).returncode == 0:
+            return
+        proc = run_docker(["docker", "network", "create", self.network])
        if proc.returncode != 0 and "already exists" not in proc.stderr:
            raise GatewayError(
                f"gateway network {self.network} failed to create: {proc.stderr.strip()}"
@@ -225,9 +143,9 @@ class DockerGateway(Gateway):
        # Recreate when the running container's image is stale (a rebuild),
        # so source changes to the gateway's flat daemons take effect — not
        # just when the container is absent.
-        self._ensure_network()
        if self.is_running() and self._running_image_is_current():
            return
+        self._ensure_network()
        # Clear any stale (stopped OR outdated-image) container holding the
        # fixed name, then start fresh. `rm --force` on an absent name is a
        # tolerated no-op.
@@ -240,7 +158,7 @@ class DockerGateway(Gateway):
            # Persist the self-generated CA on the host so it survives both
            # container recreation AND docker volume pruning (agents trust it)
            # — see host_gateway_ca_dir / issue #450.
-            "--volume", f"{self._ca_mount_source}:{MITMPROXY_HOME}",
+            "--volume", f"{host_gateway_ca_dir()}:{MITMPROXY_HOME}",
            # No DB mount: the data plane (egress / supervise / git-gate) reaches
            # the supervise queue over the control-plane RPC and never opens
            # bot-bottle.db, so the gateway container gets no file handle on it
@@ -335,4 +253,4 @@ class DockerGateway(Gateway):
    def provisioning_transport(self) -> GatewayTransport:
        """The exec/cp transport git-gate provisioning stages per-bottle repos +
        deploy keys through (over the docker socket)."""
-        return DockerGatewayTransport(self.name)
+        return DockerGatewayTransport(self.name)
@@ -33,6 +33,7 @@ from .orchestrator import (
    ORCHESTRATOR_NAME,
    ORCHESTRATOR_NETWORK,
 )
+from ...paths import bot_bottle_root
 from ... import resources
 from ...gateway import (
    GATEWAY_IMAGE,
@@ -68,8 +69,6 @@ class DockerInfraService(InfraService):
        gateway_image: str = GATEWAY_IMAGE,
        repo_root: Path | None = None,
        host_root: Path | None = None,
-        root_mount_source: str | Path | None = None,
-        gateway_ca_mount_source: str | Path | None = None,
        orchestrator_name: str = ORCHESTRATOR_NAME,
        orchestrator_label: str = ORCHESTRATOR_LABEL,
        gateway_name: str = GATEWAY_NAME,
@@ -79,14 +78,10 @@ class DockerInfraService(InfraService):
        self.control_network = control_network
        self.orchestrator_image = orchestrator_image
        self.gateway_image = gateway_image
-        # Build context: the repo root in a checkout, a staged copy from the
-        # installed wheel otherwise (bot_bottle.resources).
+        # Build context / bind-mount source: the repo root in a checkout, a
+        # staged copy from the installed wheel otherwise (bot_bottle.resources).
        self._repo_root = repo_root if repo_root is not None else resources.build_root()
-        if host_root is not None and root_mount_source is not None:
-            raise ValueError("pass host_root or root_mount_source, not both")
-        self._host_root = host_root
-        self._root_mount_source = root_mount_source
-        self._gateway_ca_mount_source = gateway_ca_mount_source
+        self._host_root = host_root or bot_bottle_root()
        self._orchestrator_name = orchestrator_name
        self._orchestrator_label = orchestrator_label
        self._gateway_name = gateway_name
@@ -103,7 +98,6 @@ class DockerInfraService(InfraService):
            control_network=self.control_network,
            repo_root=self._repo_root,
            host_root=self._host_root,
-            root_mount_source=self._root_mount_source,
        )

    def gateway(self) -> DockerGateway:
@@ -118,7 +112,6 @@ class DockerInfraService(InfraService):
            network=self.network,
            control_network=self.control_network,
            build_context=self._repo_root,
-            ca_mount_source=self._gateway_ca_mount_source,
        )

    def ensure_running(
@@ -42,9 +42,13 @@ ORCHESTRATOR_IMAGE = os.environ.get(
 )
 ORCHESTRATOR_DOCKERFILE = "Dockerfile.orchestrator"
 # Baked as a container label so `ensure_running` can detect whether the running
-# orchestrator image was built from the current source.
+# orchestrator is executing the current bind-mounted source.
 ORCHESTRATOR_SOURCE_HASH_LABEL = "bot-bottle-orchestrator-source-hash"

+# The bind-mount path for the live control-plane source inside the container.
+# PYTHONPATH points here so a code change takes effect on the next launch
+# without an image rebuild.
+_SRC_IN_CONTAINER = "/bot-bottle-src"
 # Bot-bottle host-root bind-mount (DB + state) inside the orchestrator. The
 # control plane opens bot-bottle.db under here (via BOT_BOTTLE_ROOT ->
 # host_db_path()); it is the ONLY container with a handle on it (issue #469).
@@ -68,51 +72,23 @@ class DockerOrchestrator(Orchestrator):
        control_network: str = ORCHESTRATOR_NETWORK,
        repo_root: Path | None = None,
        host_root: Path | None = None,
-        root_mount_source: str | Path | None = None,
-        client_host: str | None = None,
-        client_network: str | None = None,
-        bind_host: str | None = None,
        dockerfile: str | None = ORCHESTRATOR_DOCKERFILE,
    ) -> None:
-        if host_root is not None and root_mount_source is not None:
-            raise ValueError("pass host_root or root_mount_source, not both")
        self.image_ref = image_ref
        self.name = name
        self.label = label
        self.port = port
        self.control_network = control_network
-        # Build context: the repo root in a checkout, a staged copy from the
-        # installed wheel otherwise (bot_bottle.resources).
+        # Build context / bind-mount source: the repo root in a checkout, a
+        # staged copy from the installed wheel otherwise (bot_bottle.resources).
        self._repo_root = repo_root if repo_root is not None else resources.build_root()
-        configured_root = os.environ.get("BOT_BOTTLE_DOCKER_ROOT_MOUNT", "").strip()
-        self._root_mount_source = str(
-            root_mount_source or configured_root or host_root or bot_bottle_root()
-        )
-        configured_network = os.environ.get(
-            "BOT_BOTTLE_DOCKER_CLIENT_NETWORK", ""
-        ).strip()
-        self._client_network = client_network or configured_network or None
-        configured_host = os.environ.get(
-            "BOT_BOTTLE_DOCKER_HOST_ADDRESS", ""
-        ).strip()
-        self._client_host = (
-            client_host or configured_host
-            or (self.name if self._client_network else "127.0.0.1")
-        )
-        # A socket-shared CI runner reaches published ports through its Docker
-        # network rather than its own loopback. Production stays bound to host
-        # loopback unless a caller explicitly selects another client.
-        self._bind_host = bind_host or (
-            "0.0.0.0"
-            if not self._client_network and self._client_host != "127.0.0.1"
-            else "127.0.0.1"
-        )
+        self._host_root = host_root or bot_bottle_root()
        self._dockerfile = dockerfile

    def url(self) -> str:
-        """Control-plane URL reachable by this Docker client."""
-        port = DEFAULT_PORT if self._client_network else self.port
-        return f"http://{self._client_host}:{port}"
+        """Host-side control-plane URL — the orchestrator's published loopback,
+        which the CLI reaches."""
+        return f"http://127.0.0.1:{self.port}"

    def gateway_url(self) -> str:
        """The URL the gateway's data plane resolves policy against — the
@@ -131,11 +107,6 @@ class DockerOrchestrator(Orchestrator):
                str(self._repo_root)]
        if os.environ.get("BOT_BOTTLE_NO_CACHE"):
            argv.insert(2, "--no-cache")
-        for name, value in resources.image_build_args(
-            self._dockerfile,
-            context=self._repo_root,
-        ).items():
-            argv[-1:-1] = ["--build-arg", f"{name}={value}"]
        proc = run_docker(argv)
        if proc.returncode != 0:
            raise GatewayError(
@@ -148,7 +119,8 @@ class DockerOrchestrator(Orchestrator):
        return self.name in proc.stdout.split()

    def _source_current(self, current_hash: str) -> bool:
-        """True iff the running orchestrator image matches current source."""
+        """True iff the running orchestrator was started from the current
+        bind-mounted source."""
        if not self.is_running():
            return False
        proc = run_docker([
@@ -210,19 +182,15 @@ class DockerOrchestrator(Orchestrator):
            # Control network only — agents are never on it, so they have no
            # route to the control plane (the L3 block, not just the JWT).
            "--network", self.control_network,
-            # Host CLI reaches the control plane here (loopback by default).
-            # Socket-shared CI joins the container directly to the job network;
-            # the host-side mapping remains loopback-only in that topology. The
+            # Host CLI reaches the control plane here (loopback only). The
            # orchestrator listens on the fixed DEFAULT_PORT inside the
            # container; self.port is the host-side published port.
-            "--publish", f"{self._bind_host}:{self.port}:{DEFAULT_PORT}",
-            # The image was rebuilt from `_repo_root` immediately before this
-            # launch. Running its baked package avoids a host-path bind mount,
-            # which is both more production-like and works with socket-shared
-            # CI where the daemon cannot see the job container's workspace.
+            "--publish", f"127.0.0.1:{self.port}:{DEFAULT_PORT}",
+            # Live control-plane source (code changes without an image rebuild).
+            "--volume", f"{self._repo_root}:{_SRC_IN_CONTAINER}:ro",
+            "--env", f"PYTHONPATH={_SRC_IN_CONTAINER}",
            # Orchestrator registry DB on the host (sole writer: control plane).
-            # `root_mount_source` may be a host path or a named Docker volume.
-            "--volume", f"{self._root_mount_source}:{_ROOT_IN_CONTAINER}",
+            "--volume", f"{self._host_root}:{_ROOT_IN_CONTAINER}",
            "--env", f"BOT_BOTTLE_ROOT={_ROOT_IN_CONTAINER}",
            # The signing key — held ONLY by the orchestrator (it verifies
            # tokens); the gateway gets the pre-minted `gateway` JWT, never the
@@ -237,15 +205,6 @@ class DockerOrchestrator(Orchestrator):
            raise OrchestratorStartError(
                f"orchestrator container failed to start: {proc.stderr.strip()}"
            )
-        if self._client_network:
-            proc = run_docker([
-                "docker", "network", "connect", self._client_network, self.name,
-            ])
-            if proc.returncode != 0:
-                raise OrchestratorStartError(
-                    f"orchestrator container failed to join client network "
-                    f"{self._client_network}: {proc.stderr.strip()}"
-                )

    def stop(self) -> None:
        """Remove the control-plane container (idempotent)."""
@@ -10,7 +10,6 @@ import shutil
 import subprocess
 from typing import Iterator

-from ... import resources
 from ...log import die, info
 from ...util import slugify as _slugify

@@ -120,13 +119,7 @@ def docker_cp(src: str, dest: str) -> None:
            f"{(result.stderr or '').strip() or '<no stderr>'}")


-def build_image(
-    ref: str,
-    context: str,
-    *,
-    dockerfile: str = "",
-    build_args: dict[str, str] | None = None,
-) -> None:
+def build_image(ref: str, context: str, *, dockerfile: str = "") -> None:
    """Invokes `docker build` every call. Layer cache makes no-change
    rebuilds cheap; running every time means Dockerfile edits land
    without manual `docker rmi`.
@@ -146,61 +139,10 @@ def build_image(
        args.append("--no-cache")
    if dockerfile:
        args.extend(["-f", dockerfile])
-    effective_build_args = resources.image_build_args(
-        dockerfile,
-        context=context,
-    ) if dockerfile else {}
-    effective_build_args.update(build_args or {})
-    for name, value in effective_build_args.items():
-        args.extend(["--build-arg", f"{name}={value}"])
    args.append(context)
    subprocess.run(args, check=True)


-def image_id(ref: str) -> str:
-    """Return the exact content-addressed ID for a local image.
-
-    This is used when one locally built image is another Dockerfile's base:
-    passing the ID prevents a mutable tag from being resolved between builds.
-    """
-    result = run_docker(["docker", "image", "inspect", "--format", "{{.Id}}", ref])
-    image = result.stdout.strip()
-    if result.returncode != 0 or not image.startswith("sha256:"):
-        detail = (result.stderr or result.stdout or "").strip()
-        die(f"could not resolve exact image ID for {ref!r}: {detail or '<no detail>'}")
-    return image
-
-
-def pinned_local_image_ref(ref: str) -> str:
-    """Give a local image a content-derived tag and verify the tag resolves
-    back to the same image ID.
-
-    BuildKit treats a bare ``sha256:...`` ID in ``FROM`` as a registry
-    repository name. A tag whose complete suffix is the local image ID remains
-    resolvable by BuildKit, while the post-tag inspection keeps the handoff
-    fail-closed.
-    """
-    image = image_id(ref)
-    digest = image.removeprefix("sha256:")
-    if len(digest) != 64 or any(char not in "0123456789abcdef" for char in digest):
-        die(f"could not derive a local base tag from invalid image ID {image!r}")
-
-    repository = ref.split("@", 1)[0]
-    last_slash = repository.rfind("/")
-    last_colon = repository.rfind(":")
-    if last_colon > last_slash:
-        repository = repository[:last_colon]
-    pinned_ref = f"{repository}:sha256-{digest}"
-
-    result = run_docker(["docker", "image", "tag", image, pinned_ref])
-    if result.returncode != 0:
-        detail = (result.stderr or result.stdout or "").strip()
-        die(f"could not tag exact local image {image}: {detail or '<no detail>'}")
-    if image_id(pinned_ref) != image:
-        die(f"content-derived local tag {pinned_ref!r} did not resolve to {image}")
-    return pinned_ref
-
-
 def verify_agent_image(image: str, argv: tuple[str, ...]) -> None:
    """Run `argv` inside a throwaway container of a freshly built agent
    image and die loudly if it fails, instead of shipping an image
@@ -27,11 +27,3 @@ class FirecrackerBottleCleanupPlan(BottleCleanupPlan):
    @property
    def empty(self) -> bool:
        return not (self.vm_pids or self.run_dirs)
-
-    def intersect(self, current: BottleCleanupPlan) -> "FirecrackerBottleCleanupPlan":
-        if not isinstance(current, FirecrackerBottleCleanupPlan):
-            raise TypeError("cleanup plans must have the same backend type")
-        return FirecrackerBottleCleanupPlan(
-            vm_pids=tuple(x for x in self.vm_pids if x in current.vm_pids),
-            run_dirs=tuple(x for x in self.run_dirs if x in current.run_dirs),
-        )
@@ -11,9 +11,10 @@ Reaps *orphans* only — resources with no live VM behind them:
    — a VMM left lingering after its dir was removed.

 A run dir with a *live* firecracker process is a running bottle and is
-left strictly alone: it is neither killed nor removed. Active-agent
-enumeration uses this same process snapshot, so cleanup and generic
-backend consumers agree about which bottles are running.
+left strictly alone: it is neither killed nor removed. (The backend's
+`enumerate_active` registry is still a stub — #354 — so a live process
+is the only reliable "this bottle is in use" signal we have. Once the
+registry lands, registry-orphaned-but-running VMs can be reaped too.)

 TAP slots free themselves (the flock drops when the launcher exits), so
 there is nothing to reclaim there.
@@ -21,16 +22,14 @@ there is nothing to reclaim there.

 from __future__ import annotations

-from collections.abc import Sequence
 import os
+import shutil
 import signal
 import subprocess
 from pathlib import Path

 from ...log import info
-from .. import EnumerationError
-from ..cleanup_control import CleanupError, CleanupFailures
-from . import lifecycle_lock, util
+from . import util
 from .bottle_cleanup_plan import FirecrackerBottleCleanupPlan


@@ -38,7 +37,7 @@ def _run_root() -> Path:
    return util.cache_dir() / "run"


-def _run_dir_of(args: Sequence[str], run_root: Path) -> Path | None:
+def _run_dir_of(cmd: str, run_root: Path) -> Path | None:
    """The bottle run dir a firecracker cmdline belongs to, or None.

    A bottle VM is launched with `--config-file <run_root>/<slug>/config.json`,
@@ -46,35 +45,15 @@ def _run_dir_of(args: Sequence[str], run_root: Path) -> Path | None:
    the run root. Anything else (a builder VM, the infra VM elsewhere) is
    not ours to reap here.
    """
-    for i, arg in enumerate(args):
-        if arg == "--config-file" and i + 1 < len(args):
-            parent = Path(args[i + 1]).parent
+    toks = cmd.split()
+    for i, tok in enumerate(toks):
+        if tok == "--config-file" and i + 1 < len(toks):
+            parent = Path(toks[i + 1]).parent
            if parent.parent == run_root:
                return parent
    return None


-def _decode_cmdline(raw: bytes) -> tuple[str, ...]:
-    """Decode Linux's NUL-delimited argv without losing embedded spaces."""
-    return tuple(
-        value.decode(errors="surrogateescape")
-        for value in raw.split(b"\0") if value
-    )
-
-
-def _process_args(pid: int) -> tuple[str, ...] | None:
-    """Read one process's lossless argv, or None when it exited meanwhile."""
-    try:
-        raw = Path(f"/proc/{pid}/cmdline").read_bytes()
-    except FileNotFoundError:
-        return None
-    except OSError as exc:
-        raise EnumerationError(
-            f"could not inspect Firecracker pid {pid}: {exc}"
-        ) from exc
-    return _decode_cmdline(raw)
-
-
 def _scan_processes(run_root: Path) -> tuple[set[str], list[int]]:
    """Inspect running firecracker VMs under ``run_root``.

@@ -83,34 +62,23 @@ def _scan_processes(run_root: Path) -> tuple[set[str], list[int]]:
      * ``orphan_pids`` — firecracker pids whose run dir no longer exists
        (a lingering VMM to kill).
    """
-    try:
-        result = subprocess.run(
-            ["pgrep", "firecracker"],
-            capture_output=True, text=True, check=False,
-        )
-    except OSError as exc:
-        raise EnumerationError(
-            f"could not enumerate Firecracker processes: {exc}"
-        ) from exc
-    if result.returncode == 1:
-        # pgrep's documented "no processes matched" result.
-        return set(), []
+    result = subprocess.run(
+        ["pgrep", "-a", "firecracker"],
+        capture_output=True, text=True, check=False,
+    )
    if result.returncode != 0:
-        detail = (result.stderr or "").strip() or f"exit {result.returncode}"
-        raise EnumerationError(
-            f"could not enumerate Firecracker processes: {detail}"
-        )
+        return set(), []
    live: set[str] = set()
    orphan_pids: list[int] = []
    for line in result.stdout.splitlines():
+        parts = line.split(None, 1)
+        if len(parts) != 2:
+            continue
        try:
-            pid = int(line.strip())
+            pid = int(parts[0])
        except ValueError:
            continue
-        args = _process_args(pid)
-        if args is None:
-            continue
-        run_dir = _run_dir_of(args, run_root)
+        run_dir = _run_dir_of(parts[1], run_root)
        if run_dir is None:
            continue
        if run_dir.is_dir():
@@ -146,54 +114,12 @@ def prepare_cleanup() -> FirecrackerBottleCleanupPlan:


 def cleanup(plan: FirecrackerBottleCleanupPlan) -> None:
-    """Revalidate the preview under the launch lock, then remove its survivors."""
-    with lifecycle_lock.hold():
-        fresh = prepare_cleanup()
-        approved_pids = set(plan.vm_pids).intersection(fresh.vm_pids)
-        approved_dirs = set(plan.run_dirs).intersection(fresh.run_dirs)
-        failures = CleanupFailures()
-        for pid in sorted(approved_pids):
-            try:
-                _terminate_orphan(pid, _run_root())
-            except CleanupError as exc:
-                failures.record(str(exc))
-        for path in sorted(approved_dirs):
-            info(f"rm -rf {path}")
-            failures.remove_tree(Path(path), f"removing Firecracker run dir {path}")
-        failures.raise_if_any()
-
-
-def _terminate_orphan(pid: int, run_root: Path) -> None:
-    """Signal exactly the process identity that still owns an orphan config."""
-    try:
-        pidfd = os.pidfd_open(pid)
-    except ProcessLookupError:
-        return
-    except OSError as exc:
-        raise EnumerationError(
-            f"could not pin Firecracker pid {pid} for cleanup: {exc}"
-        ) from exc
-    try:
-        try:
-            raw = Path(f"/proc/{pid}/cmdline").read_bytes()
-        except FileNotFoundError:
-            return
-        except OSError as exc:
-            raise EnumerationError(
-                f"could not revalidate Firecracker pid {pid}: {exc}"
-            ) from exc
-        args = _decode_cmdline(raw)
-        run_dir = _run_dir_of(args, run_root)
-        if run_dir is None or run_dir.is_dir():
-            return
+    for pid in plan.vm_pids:
        info(f"kill firecracker VM pid {pid}")
        try:
-            signal.pidfd_send_signal(pidfd, signal.SIGTERM)
+            os.kill(pid, signal.SIGTERM)
        except ProcessLookupError:
-            return
-        except OSError as exc:
-            raise CleanupError(
-                f"could not signal Firecracker pid {pid}: {exc}"
-            ) from exc
-    finally:
-        os.close(pidfd)
+            pass
+    for path in plan.run_dirs:
+        info(f"rm -rf {path}")
+        shutil.rmtree(path, ignore_errors=True)
@@ -1,32 +1,14 @@
 """Active-agent enumeration for the Firecracker backend.

-Running bottles are the Firecracker processes whose ``--config-file`` points
-at an existing per-bottle run directory. The same authoritative process scan
-protects cleanup from deleting live VMs; operational scan failures propagate
-as ``EnumerationError`` instead of masquerading as an empty host.
+The backend is disabled during the companion-container removal (#385) — it can't
+launch bottles, so there are none to enumerate. Real enumeration returns
+with the backend's consolidated relaunch (#354).
 """

 from __future__ import annotations

-from ...bottle_state import read_metadata
 from .. import ActiveAgent
-from .cleanup import live_run_dirs


 def enumerate_active() -> list[ActiveAgent]:
-    out: list[ActiveAgent] = []
-    for run_dir in live_run_dirs():
-        slug = run_dir.name
-        metadata = read_metadata(slug)
-        out.append(ActiveAgent(
-            backend_name="firecracker",
-            slug=slug,
-            agent_name=metadata.agent_name if metadata else "?",
-            started_at=metadata.started_at if metadata else "",
-            # Firecracker uses the shared gateway, so there are no
-            # per-bottle gateway service containers to report.
-            services=(),
-            label=metadata.label if metadata else "",
-            color=metadata.color if metadata else "",
-        ))
-    return out
+    return []
@@ -19,14 +19,12 @@ from __future__ import annotations
 import fcntl
 import hashlib
 import os
-import shlex
 import shutil
 import subprocess
 from contextlib import contextmanager
 from pathlib import Path
 from typing import Generator

-from ... import resources
 from ...log import die, info
 from . import util
 from .infra import FirecrackerInfraService
@@ -57,11 +55,6 @@ def _rootfs_digest(dockerfile: Path) -> str:
    h = hashlib.sha256()
    h.update(_dockerfile_hash(dockerfile).encode())
    h.update(b"\0")
-    for name, value in resources.image_build_args(dockerfile).items():
-        h.update(name.encode())
-        h.update(b"=")
-        h.update(value.encode())
-        h.update(b"\0")
    h.update(util._GUEST_INIT.encode())
    return h.hexdigest()[:16]

@@ -154,13 +147,7 @@ def _build_in_infra(
        if prep.returncode != 0:
            die(f"preparing build dir in the infra VM failed: {prep.stderr.strip()}")
        _send_dockerfile(key, ip, dockerfile, ctx)
-        _buildah_build(
-            key,
-            ip,
-            ctx,
-            tag,
-            resources.image_build_args(dockerfile),
-        )
+        _buildah_build(key, ip, ctx, tag)
        _smoke_test(key, ip, tag, smoke_ctr, smoke_test)
        _stream_rootfs(key, ip, tag, export_ctr, base)
    finally:
@@ -197,26 +184,15 @@ def _send_dockerfile(private_key: Path, guest_ip: str, dockerfile: Path, ctx: st
            f"{proc.stderr.decode(errors='replace').strip()}")


-def _buildah_build(
-    private_key: Path,
-    guest_ip: str,
-    ctx: str,
-    tag: str,
-    build_args: dict[str, str],
-) -> None:
+def _buildah_build(private_key: Path, guest_ip: str, ctx: str, tag: str) -> None:
    # Stream buildah's step-by-step output straight to our stderr (like the
    # docker backend's `docker build`), so a long first build (base pull +
    # apt/npm installs) shows live progress instead of a silent wait. The
    # remote stderr is where buildah writes its `STEP i/n` lines.
    info(f"buildah build {tag} in the infra VM (streaming output)")
-    arg_flags = " ".join(
-        f"--build-arg {shlex.quote(f'{name}={value}')}"
-        for name, value in build_args.items()
-    )
    rc = _ssh_streamed(
        private_key, guest_ip,
-        f"buildah build {_BUILD_FLAGS} {arg_flags} "
-        f"-t {tag} -f {ctx}/Dockerfile {ctx}/ctx",
+        f"buildah build {_BUILD_FLAGS} -t {tag} -f {ctx}/Dockerfile {ctx}/ctx",
        timeout=_BUILD_TIMEOUT_SECONDS,
    )
    if rc != 0:
@@ -41,8 +41,6 @@ from ... import resources
 from ...log import die, info
 from . import util

-ARTIFACT_HTTP_TIMEOUT_SECONDS = 30.0
-
 # Bump if the on-disk artifact *format* changes (compression, layout) so a new
 # scheme can't collide with a cached/published artifact of the old one.
 _ARTIFACT_FORMAT = "1"
@@ -51,18 +49,9 @@ _ARTIFACT_FORMAT = "1"
 # from its own generic package; the Dockerfiles baked into each differ (only the
 # orchestrator rootfs carries buildah), so the versions are hashed separately.
 ROLES = ("orchestrator", "gateway")
-_BUILD_INPUTS = {
-    "orchestrator": (
-        "image-build-args.json",
-        "Dockerfile.orchestrator",
-        "Dockerfile.orchestrator.fc",
-        "requirements.orchestrator.lock",
-    ),
-    "gateway": (
-        "image-build-args.json",
-        "Dockerfile.gateway",
-        "requirements.gateway.lock",
-    ),
+_DOCKERFILES = {
+    "orchestrator": ("Dockerfile.orchestrator", "Dockerfile.orchestrator.fc"),
+    "gateway": ("Dockerfile.gateway",),
 }

 _DEFAULT_BASE = "https://gitea.dideric.is"
@@ -112,7 +101,7 @@ def infra_artifact_version(
        h.update(str(path.relative_to(repo_root)).encode())
        h.update(b"\0")
        h.update(path.read_bytes())
-    for name in _BUILD_INPUTS[role]:
+    for name in _DOCKERFILES[role]:
        h.update(name.encode())
        h.update(b"\0")
        h.update((repo_root / name).read_bytes())
@@ -166,9 +155,7 @@ def _download(url: str, dest: Path) -> None:
    """Stream `url` to `dest` (atomic via a `.part` sibling)."""
    tmp = dest.with_suffix(dest.suffix + ".part")
    try:
-        with urllib.request.urlopen(
-            _open(url), timeout=ARTIFACT_HTTP_TIMEOUT_SECONDS,
-        ) as resp, open(tmp, "wb") as out:
+        with urllib.request.urlopen(_open(url)) as resp, open(tmp, "wb") as out:
            shutil.copyfileobj(resp, out, _CHUNK)
    except urllib.error.HTTPError as e:
        tmp.unlink(missing_ok=True)
@@ -133,15 +133,10 @@ def build_infra_images_with_docker() -> None:
    root = str(resources.build_root())
    docker_mod.build_image(
        _ORCHESTRATOR_IMAGE, root, dockerfile="Dockerfile.orchestrator")
-    orchestrator_base = docker_mod.pinned_local_image_ref(_ORCHESTRATOR_IMAGE)
    docker_mod.build_image(
        _GATEWAY_IMAGE, root, dockerfile="Dockerfile.gateway")
    docker_mod.build_image(
-        _ORCHESTRATOR_FC_IMAGE,
-        root,
-        dockerfile="Dockerfile.orchestrator.fc",
-        build_args={"ORCHESTRATOR_BASE_IMAGE": orchestrator_base},
-    )
+        _ORCHESTRATOR_FC_IMAGE, root, dockerfile="Dockerfile.orchestrator.fc")


 def build_rootfs_dir(role: str) -> Path:
@@ -46,7 +46,7 @@ from ...log import die, info, warn
 from ...supervisor.types import SUPERVISE_PORT
 from ..docker.egress import EGRESS_PORT
 from ..util import AGENT_CA_BUNDLE, AGENT_CA_PATH
-from . import firecracker_vm, image_builder, isolation_probe, lifecycle_lock, netpool, util
+from . import firecracker_vm, image_builder, isolation_probe, netpool, util
 from .bottle import FirecrackerBottle
 from .bottle_plan import FirecrackerBottlePlan
 from ...orchestrator.store.config_store import resolve_teardown_timeout
@@ -164,29 +164,25 @@ def launch(
        )

        # Step 6: build the per-bottle rootfs + SSH key, then boot.
-        # Cleanup takes the same lock while refreshing its process snapshot.
-        # Hold it until the VMM exists so a newly-created run dir can never be
-        # mistaken for an orphan in the build-before-boot window.
-        with lifecycle_lock.hold():
-            run_dir = util.cache_dir() / "run" / plan.slug
-            run_dir.mkdir(parents=True, exist_ok=True)
-            # Remove the run dir on teardown so the per-bottle rootfs.ext4 (~1G)
-            # doesn't leak. Registered before vm.terminate below so it runs
-            # *after* it (ExitStack is LIFO).
-            stack.callback(lambda: shutil.rmtree(run_dir, ignore_errors=True))
-            rootfs = run_dir / "rootfs.ext4"
-            util.build_rootfs_ext4(agent_base, rootfs)
-            private_key, pubkey = util.generate_keypair(run_dir)
+        run_dir = util.cache_dir() / "run" / plan.slug
+        run_dir.mkdir(parents=True, exist_ok=True)
+        # Remove the run dir on teardown so the per-bottle rootfs.ext4 (~1G)
+        # doesn't leak. Registered before vm.terminate below so it runs *after*
+        # it (ExitStack is LIFO): the VM is gone before we rm its rootfs.
+        stack.callback(lambda: shutil.rmtree(run_dir, ignore_errors=True))
+        rootfs = run_dir / "rootfs.ext4"
+        util.build_rootfs_ext4(agent_base, rootfs)
+        private_key, pubkey = util.generate_keypair(run_dir)

-            vm = firecracker_vm.boot(
-                name=plan.container_name,
-                rootfs=rootfs,
-                tap=slot.iface,
-                guest_ip=slot.guest_ip,
-                host_ip=slot.host_ip,
-                pubkey=pubkey,
-                run_dir=run_dir,
-            )
+        vm = firecracker_vm.boot(
+            name=plan.container_name,
+            rootfs=rootfs,
+            tap=slot.iface,
+            guest_ip=slot.guest_ip,
+            host_ip=slot.host_ip,
+            pubkey=pubkey,
+            run_dir=run_dir,
+        )
        stack.callback(vm.terminate)
        firecracker_vm.wait_for_ssh(vm, private_key)
        persist_env_var_secret(private_key, slot.guest_ip, ctx.env_var_secret)
@@ -1,30 +0,0 @@
-"""Serialize Firecracker run-directory creation with orphan cleanup."""
-
-from __future__ import annotations
-
-import fcntl
-from contextlib import contextmanager
-from pathlib import Path
-from typing import Generator
-
-from . import util
-
-
-def _lock_path() -> Path:
-    return util.cache_dir() / "run.lifecycle.lock"
-
-
-@contextmanager
-def hold() -> Generator[None]:
-    """Exclude cleanup while a launch directory lacks a visible VMM."""
-    path = _lock_path()
-    path.parent.mkdir(parents=True, exist_ok=True)
-    with path.open("a", encoding="utf-8") as handle:
-        fcntl.flock(handle, fcntl.LOCK_EX)
-        try:
-            yield
-        finally:
-            fcntl.flock(handle, fcntl.LOCK_UN)
-
-
-__all__ = ["hold"]
@@ -34,7 +34,6 @@ from pathlib import Path
 from . import infra_artifact, infra_vm, util

 _CHUNK = 1 << 20
-_REGISTRY_HTTP_TIMEOUT_SECONDS = 30.0

 _GZ_NAME = "rootfs.ext4.gz"
 _SHA_NAME = "rootfs.ext4.gz.sha256"
@@ -92,9 +91,7 @@ def _put(url: str, body: "bytes | Path", token: str) -> None:
        req.add_header("Authorization", f"token {token}")
    req.add_header("Content-Type", "application/octet-stream")
    try:
-        with urllib.request.urlopen(
-            req, timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ) as resp:
+        with urllib.request.urlopen(req) as resp:
            print(f"  uploaded {url} (HTTP {resp.status})")
    except urllib.error.HTTPError as e:
        if e.code == 409:
@@ -115,9 +112,7 @@ def _delete(url: str, token: str) -> None:
    if token:
        req.add_header("Authorization", f"token {token}")
    try:
-        with urllib.request.urlopen(
-            req, timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ):
+        with urllib.request.urlopen(req):
            pass
    except urllib.error.HTTPError as e:
        if e.code != 404:
@@ -156,10 +151,7 @@ def _try_download_published(role: str, role_dir: Path) -> str | None:
    version = _role_version(role)
    sha_url = infra_artifact.artifact_url(version, _SHA_NAME, role=role)
    try:
-        with urllib.request.urlopen(
-            infra_artifact._open(sha_url),
-            timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ):
+        with urllib.request.urlopen(infra_artifact._open(sha_url)):
            pass
    except urllib.error.HTTPError as e:
        if e.code == 404:
@@ -203,10 +195,7 @@ def _publish_bundle(role: str, role_dir: Path, token: str) -> str:
    # present, a re-publish is a no-op. Otherwise clear any partial upload left
    # by an interrupted prior attempt and upload the complete set.
    try:
-        with urllib.request.urlopen(
-            infra_artifact._open(sha_url),
-            timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ) as resp:
+        with urllib.request.urlopen(infra_artifact._open(sha_url)) as resp:
            remote_sha = resp.read().decode("utf-8").split()[0].strip().lower()
    except urllib.error.HTTPError as e:
        if e.code != 404:
@@ -25,11 +25,3 @@ class MacosContainerBottleCleanupPlan(BottleCleanupPlan):
    @property
    def empty(self) -> bool:
        return not self.containers and not self.networks
-
-    def intersect(self, current: BottleCleanupPlan) -> "MacosContainerBottleCleanupPlan":
-        if not isinstance(current, MacosContainerBottleCleanupPlan):
-            raise TypeError("cleanup plans must have the same backend type")
-        return MacosContainerBottleCleanupPlan(
-            containers=tuple(x for x in self.containers if x in current.containers),
-            networks=tuple(x for x in self.networks if x in current.networks),
-        )
@@ -4,9 +4,7 @@ from __future__ import annotations

 import subprocess

-from .. import EnumerationError
-from ..cleanup_control import CleanupFailures
-from ...log import info
+from ...log import info, warn
 from . import util as container_mod
 from .bottle_cleanup_plan import MacosContainerBottleCleanupPlan

@@ -21,8 +19,8 @@ def _list_prefixed_containers() -> list[str]:
        check=False,
    )
    if result.returncode != 0:
-        detail = result.stderr.strip() or f"exit {result.returncode}"
-        raise EnumerationError(f"container list failed: {detail}")
+        warn(f"container list failed: {result.stderr.strip()}")
+        return []
    return sorted(
        name for name in (line.strip() for line in result.stdout.splitlines())
        if name.startswith(_PREFIX)
@@ -37,8 +35,7 @@ def _list_prefixed_networks() -> list[str]:
        check=False,
    )
    if result.returncode != 0:
-        detail = result.stderr.strip() or f"exit {result.returncode}"
-        raise EnumerationError(f"container network list failed: {detail}")
+        return []
    return sorted(
        name for name in (line.strip() for line in result.stdout.splitlines())
        if name.startswith(_PREFIX)
@@ -54,17 +51,19 @@ def prepare_cleanup() -> MacosContainerBottleCleanupPlan:


 def cleanup(plan: MacosContainerBottleCleanupPlan) -> None:
-    failures = CleanupFailures()
    for name in plan.containers:
        info(f"container delete --force {name}")
-        failures.run(
+        subprocess.run(
            ["container", "delete", "--force", name],
-            f"deleting container {name}",
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
        )
    for name in plan.networks:
        info(f"container network delete {name}")
-        failures.run(
+        subprocess.run(
            ["container", "network", "delete", name],
-            f"deleting network {name}",
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
        )
-    failures.raise_if_any()
@@ -5,7 +5,7 @@ from __future__ import annotations
 import subprocess

 from ...bottle_state import read_metadata
-from .. import ActiveAgent, EnumerationError
+from .. import ActiveAgent
 from .infra import INFRA_NAME, ORCHESTRATOR_NAME

 # The name every agent container carries: `bot-bottle-<slug>`. Exported
@@ -20,18 +20,17 @@ CONTAINER_NAME_PREFIX = "bot-bottle-"
 _INFRA_NAMES = frozenset({INFRA_NAME, ORCHESTRATOR_NAME})


+class EnumerationError(RuntimeError):
+    """container list failed; the resulting live set is not authoritative."""
+
+
 def enumerate_active() -> list[ActiveAgent]:
-    try:
-        result = subprocess.run(
-            ["container", "list", "--quiet"],
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-    except FileNotFoundError as exc:
-        raise EnumerationError(
-            "container list failed: container CLI not found"
-        ) from exc
+    result = subprocess.run(
+        ["container", "list", "--quiet"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
    if result.returncode != 0:
        raise EnumerationError(
            f"container list failed: "
@@ -107,8 +107,7 @@ def _layer_nested_containers(
    """
    if not plan.nested_containers:
        return agent_image
-    pinned_base = container_mod.pinned_local_image_ref(agent_image)
-    derived = f"{pinned_base}{nested_containers_mod.IMAGE_SUFFIX}"
+    derived = f"{agent_image}{nested_containers_mod.IMAGE_SUFFIX}"
    if plan.spec.image_policy == "cached":
        if not container_mod.image_exists(derived):
            die(
@@ -117,10 +116,7 @@ def _layer_nested_containers(
            )
        info(f"using cached nested-container image {derived!r}")
        return derived
-    return nested_containers_mod.build_image(
-        pinned_base,
-        container_mod.build_image,
-    )
+    return nested_containers_mod.build_image(agent_image, container_mod.build_image)


@contextmanager
@@ -55,7 +55,7 @@ _GUEST_DEVICES = ("/dev/fuse", "/dev/net/tun")


 def build_image(
-    pinned_base: str,
+    base_image: str,
    build: Callable[..., None],
 ) -> str:
    """Layer the nested-container tooling onto an already-built agent image.
@@ -66,15 +66,14 @@ def build_image(
    # TODO(#394): replace this hand-rolled Dockerfile with a docker-layer
    # abstraction once that infrastructure exists.
    """
-    image = f"{pinned_base}{IMAGE_SUFFIX}"
+    image = f"{base_image}{IMAGE_SUFFIX}"
    init_script = Path(__file__).with_name("nested-containers-init.sh")
    with tempfile.TemporaryDirectory(prefix="bot-bottle-nested-containers.") as tmp:
        context = Path(tmp)
        shutil.copy2(init_script, context / "nested-containers-init.sh")
        (context / "Dockerfile").write_text(
-            "ARG DOCKER_CLI_BASE_IMAGE\n"
-            "FROM ${DOCKER_CLI_BASE_IMAGE} AS docker_cli\n"
-            f"FROM {pinned_base}\n"
+            "FROM docker:28-cli AS docker_cli\n"
+            f"FROM {base_image}\n"
            "USER root\n"
            "COPY --from=docker_cli /usr/local/bin/docker /usr/local/bin/docker\n"
            "COPY --from=docker_cli /usr/local/libexec/docker/cli-plugins/"
@@ -13,7 +13,6 @@ import time
 from datetime import datetime, timezone
 from typing import Iterable

-from ... import resources
 from ...log import die, info


@@ -61,13 +60,7 @@ def dns_server() -> str:
    return _host_ipv4_dns() or _DEFAULT_DNS


-def build_image(
-    ref: str,
-    context: str,
-    *,
-    dockerfile: str = "",
-    build_args: dict[str, str] | None = None,
-) -> None:
+def build_image(ref: str, context: str, *, dockerfile: str = "") -> None:
    """Build an OCI image with Apple's BuildKit-backed `container build`.

    Set `BOT_BOTTLE_NO_CACHE=1` (the `start --no-cache` flag) to force
@@ -90,13 +83,6 @@ def build_image(
        if not os.path.isabs(dockerfile):
            dockerfile = os.path.join(context, dockerfile)
        args.extend(["-f", dockerfile])
-    effective_build_args = resources.image_build_args(
-        dockerfile,
-        context=context,
-    ) if dockerfile else {}
-    effective_build_args.update(build_args or {})
-    for name, value in effective_build_args.items():
-        args.extend(["--build-arg", f"{name}={value}"])
    args.append(context)
    subprocess.run(args, check=True)

@@ -682,40 +668,6 @@ def image_id(ref: str) -> str:
    raise AssertionError("unreachable")


-def pinned_local_image_ref(ref: str) -> str:
-    """Tag a local image with its complete content ID for a stable ``FROM``.
-
-    Agent images are immediately used as bases for the optional
-    nested-containers layer. A content-derived tag prevents another concurrent
-    build from moving the provider's ordinary ``:latest`` tag between those
-    two builds.
-    """
-    image = image_id(ref)
-    digest = image.removeprefix("sha256:")
-    if len(digest) != 64 or any(char not in "0123456789abcdef" for char in digest):
-        die(f"could not derive a local base tag from invalid image ID {image!r}")
-    repository = ref.split("@", 1)[0]
-    last_slash = repository.rfind("/")
-    last_colon = repository.rfind(":")
-    if last_colon > last_slash:
-        repository = repository[:last_colon]
-    pinned_ref = f"{repository}:sha256-{digest}"
-    result = subprocess.run(
-        [_CONTAINER, "image", "tag", image, pinned_ref],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        die(
-            f"could not tag exact local image {image}: "
-            f"{(result.stderr or result.stdout or '').strip() or '<no detail>'}"
-        )
-    if image_id(pinned_ref) != image:
-        die(f"content-derived local tag {pinned_ref!r} did not resolve to {image}")
-    return pinned_ref
-
-
 def image_created_at(ref: str) -> datetime | None:
    """Return the image creation timestamp as an aware UTC datetime, or None
    when the field is absent or unparseable (e.g. FROM-scratch images, images
@@ -22,7 +22,6 @@ from __future__ import annotations
 import sys

 from ...backend import get_bottle_backend, has_backend, known_backend_names
-from ...backend.cleanup_control import CleanupError
 from ...log import info
 from ...util import read_tty_line

@@ -53,20 +52,10 @@ def cmd_cleanup(_argv: list[str]) -> int:
        info("cleanup: skipped")
        return 0

-    # Confirmation authorizes a fresh authoritative snapshot, not blind use of
-    # identities that may have changed while the operator reviewed the preview.
-    failures: list[str] = []
-    for name, backend, displayed in prepared:
-        current = backend.prepare_cleanup()
-        approved = displayed.intersect(current)
-        if approved.empty:
+    for name, backend, plan in prepared:
+        if plan.empty:
            continue
-        try:
-            backend.cleanup(approved)
-        except CleanupError as exc:
-            failures.append(f"{name}: {exc}")
-    if failures:
-        raise CleanupError("cleanup incomplete: " + "; ".join(failures))
+        backend.cleanup(plan)
    info("cleanup: done")
    return 0

@@ -8,17 +8,9 @@
 # Layer ordering is deliberate: the npm install lives in its own layer so
 # changes to the rest of the repo (or to the CMD) don't bust it.

-# Version-qualified Node LTS, pinned to its multi-architecture manifest.
-ARG NODE_BASE_IMAGE
-FROM ${NODE_BASE_IMAGE}
-
-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
+# Current Node LTS; slim variant keeps the image small while still
+# providing apt-get for any future additions.
+FROM node:22-trixie-slim

 # Install runtime system deps. claude-code shells out to git for several
 # features (status checks, commits, PR creation) — without git in the
@@ -28,7 +20,7 @@ RUN sed -i \
 # HTTPS_PROXY-aware tool (curl itself, plus anything that shells out
 # to it) works against egress's bumped TLS without the agent needing
 # local DNS.
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
  && apt-get install -y --no-install-recommends \
  git \
  ca-certificates \
@@ -43,17 +35,15 @@ RUN apt-get -o Acquire::Check-Valid-Until=false update \
 # (claude-code is a Node CLI), but is convenient for the agent to
 # shell out to for ad-hoc scripts. Kept on its own layer so it can
 # be moved to a downstream image if the base ever needs to shrink.
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
  && apt-get install -y --no-install-recommends python3 python3-pip python3-venv \
  && rm -rf /var/lib/apt/lists/*

-# Install from the committed npm lock. `npm ci` verifies every registry
-# artifact against its lockfile integrity and refuses dependency drift.
-COPY bot_bottle/contrib/claude/package.json \
-     bot_bottle/contrib/claude/package-lock.json /opt/claude/
-RUN cd /opt/claude \
-  && npm ci --omit=dev --no-fund --no-audit \
-  && ln -s /opt/claude/node_modules/.bin/claude /usr/local/bin/claude \
+# Install claude-code globally. Pinned to the version verified in the v1
+# build (`claude --version` returns 2.1.126). Bump deliberately when
+# rolling forward; an unpinned install would mean rebuilds silently pick
+# up new behavior.
+RUN npm install -g --no-fund --no-audit @anthropic-ai/claude-code@2.1.172 \
  && npm cache clean --force

 # Git reads both ~/.gitconfig and ~/.config/git/config. Keep its XDG config
@@ -1,140 +0,0 @@
-{
-  "name": "bot-bottle-claude-image",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "bot-bottle-claude-image",
-      "dependencies": {
-        "@anthropic-ai/claude-code": "2.1.172"
-      }
-    },
-    "node_modules/@anthropic-ai/claude-code": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-2.1.172.tgz",
-      "integrity": "sha512-SfwC+5fQcmNbvvm+1vLiZbfUxt0PQz9lbXapj9+FI+XY/2e+3zgteBM4JFEXBjULZj1DtZXHmKtAROUrMM9GZg==",
-      "hasInstallScript": true,
-      "license": "SEE LICENSE IN README.md",
-      "bin": {
-        "claude": "bin/claude.exe"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      },
-      "optionalDependencies": {
-        "@anthropic-ai/claude-code-darwin-arm64": "2.1.172",
-        "@anthropic-ai/claude-code-darwin-x64": "2.1.172",
-        "@anthropic-ai/claude-code-linux-arm64": "2.1.172",
-        "@anthropic-ai/claude-code-linux-arm64-musl": "2.1.172",
-        "@anthropic-ai/claude-code-linux-x64": "2.1.172",
-        "@anthropic-ai/claude-code-linux-x64-musl": "2.1.172",
-        "@anthropic-ai/claude-code-win32-arm64": "2.1.172",
-        "@anthropic-ai/claude-code-win32-x64": "2.1.172"
-      }
-    },
-    "node_modules/@anthropic-ai/claude-code-darwin-arm64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-darwin-arm64/-/claude-code-darwin-arm64-2.1.172.tgz",
-      "integrity": "sha512-pBRgDo8PAgbt2aE4oc6ZrKdOa/Ax36RAduhLCaI8NWD3a0RDb5mETzQciQLwnuenk0bs27vIRh9Yg1jAYG/0+A==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-darwin-x64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-darwin-x64/-/claude-code-darwin-x64-2.1.172.tgz",
-      "integrity": "sha512-vSgibgeCyvCFiLJSXu/sgcd3L/tUjSiS/tfS9rJLXUjElw8satMJhA5pqPUiBmKMflOWKMufbZgzXvLx+OhvFw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-linux-arm64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-arm64/-/claude-code-linux-arm64-2.1.172.tgz",
-      "integrity": "sha512-Ql7AbyaXnlA6NwDUaQGO7ZZis21rMjYjbKzpksMCvY35CmsJqanYgbYSn/rE83u/tZpKo+NqOv+bWEDSzsZ02w==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-linux-arm64-musl": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-arm64-musl/-/claude-code-linux-arm64-musl-2.1.172.tgz",
-      "integrity": "sha512-Pa9mGGmp8QCRC2j1cgcWRRkwsK1x4bPsS3CcLRd936Op0k5et62tD3qIYhUPQOIxeuxe9Tt/y7lX1cx7JTDxyA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-linux-x64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-x64/-/claude-code-linux-x64-2.1.172.tgz",
-      "integrity": "sha512-RYCY9EHkmtoAlwBKcWRzGIhuus+GM2CIVCfU81cTQAwDcCHunoBeFn3NqAcFV1VKb4dk9TRarAmQcWMKJrpPig==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-linux-x64-musl": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-x64-musl/-/claude-code-linux-x64-musl-2.1.172.tgz",
-      "integrity": "sha512-1NflAnV/MqIlD4rzlGDVsJgGK2xJ2ldVd5pkcbu7PsDJBW5dzKYVa4PmD0715K8Yiji8jQovh/nhIo6gYyTfVQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-win32-arm64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-win32-arm64/-/claude-code-win32-arm64-2.1.172.tgz",
-      "integrity": "sha512-Gj8mIbHDDSGWnoriqB1Jt1uH6cvNBFDQBtIYarCcv0fs+QGCEP6qm2GIaKqxAbwkUaLT0sCW/7+ukvkNdSltuQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-win32-x64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-win32-x64/-/claude-code-win32-x64-2.1.172.tgz",
-      "integrity": "sha512-OkheFwagiCEKaO2Sb0j3JTO1NrcR3zTlFik/AN+yQPefhUIGP6vHQDbBG5ksuFe+Dyd9s+P95OUh8WDhccb+Ng==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    }
-  }
-}
@@ -1,7 +0,0 @@
-{
-  "name": "bot-bottle-claude-image",
-  "private": true,
-  "dependencies": {
-    "@anthropic-ai/claude-code": "2.1.172"
-  }
-}
@@ -3,22 +3,9 @@
 # Mirrors the default Claude image shape: Node LTS, git/network tooling,
 # non-root node user, and the provider CLI installed for that user.

-ARG NODE_BASE_IMAGE
-FROM ${NODE_BASE_IMAGE}
+FROM node:22-trixie-slim

-# Remote-control requires the standalone package layout. Keep this exact release
-# in sync with the committed upstream archive checksums.
-ARG CODEX_VERSION=0.145.0
-
-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
-
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
  && apt-get install -y --no-install-recommends \
  git \
  ca-certificates \
@@ -32,7 +19,7 @@ RUN apt-get -o Acquire::Check-Valid-Until=false update \
 # (codex is a Node CLI), but is convenient for the agent to shell
 # out to for ad-hoc scripts. Kept on its own layer so it can be
 # moved to a downstream image if the base ever needs to shrink.
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
  && apt-get install -y --no-install-recommends python3 python3-pip python3-venv \
  && rm -rf /var/lib/apt/lists/*

@@ -43,29 +30,10 @@ WORKDIR /home/node

 ENV PATH="/home/node/.local/bin:${PATH}"

-# Install the exact standalone release archive selected by the target
-# architecture. The checksum list is copied from the immutable upstream release
-# and committed so a rebuild cannot silently accept changed release bytes.
-COPY --chown=node:node bot_bottle/contrib/codex/codex-package_SHA256SUMS /tmp/codex-package_SHA256SUMS
-RUN case "$(dpkg --print-architecture)" in \
-      amd64) codex_target=x86_64-unknown-linux-musl ;; \
-      arm64) codex_target=aarch64-unknown-linux-musl ;; \
-      *) echo "unsupported Codex architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
-    esac \
-  && codex_asset="codex-package-${codex_target}.tar.gz" \
-  && codex_sha256="$(awk -v asset="${codex_asset}" '$2 == asset { print $1 }' /tmp/codex-package_SHA256SUMS)" \
-  && test -n "${codex_sha256}" \
-  && curl -fsSL \
-      "https://github.com/openai/codex/releases/download/rust-v${CODEX_VERSION}/${codex_asset}" \
-      -o "/tmp/${codex_asset}" \
-  && echo "${codex_sha256}  /tmp/${codex_asset}" | sha256sum -c - \
-  && codex_release="/home/node/.codex/packages/standalone/releases/${CODEX_VERSION}-${codex_target}" \
-  && mkdir -p "${codex_release}" /home/node/.local/bin \
-  && tar -xzf "/tmp/${codex_asset}" -C "${codex_release}" \
-  && ln -s bin/codex "${codex_release}/codex" \
-  && ln -s "${codex_release}" /home/node/.codex/packages/standalone/current \
-  && ln -s /home/node/.codex/packages/standalone/current/bin/codex /home/node/.local/bin/codex \
-  && rm "/tmp/${codex_asset}" \
-  && test "$(codex --version)" = "codex-cli ${CODEX_VERSION}"
+# Remote-control support requires the standalone Codex install layout
+# under ~/.codex/packages/standalone/current. The npm package can run
+# the TUI, but remote-control commands expect this installer-owned path.
+RUN mkdir -p /home/node/.codex \
+  && curl -fsSL https://chatgpt.com/codex/install.sh | sh

 CMD ["codex"]
@@ -1,2 +0,0 @@
-54f79a05aba6f9abf8ef988abcae8bf2fcefba20beb549b4ff2b3acdb2cb6f54  codex-package-aarch64-unknown-linux-musl.tar.gz
-71a28d362c96ac9829bf8203a2c71be451aeb726adb843167fdaf0eae8fe7dd9  codex-package-x86_64-unknown-linux-musl.tar.gz
@@ -2,18 +2,9 @@
 #
 # Node LTS, git/network tooling, and the Pi coding-agent CLI installed globally.

-ARG NODE_BASE_IMAGE
-FROM ${NODE_BASE_IMAGE}
+FROM node:22-trixie-slim

-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
-
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
  && apt-get install -y --no-install-recommends \
  git \
  ca-certificates \
@@ -24,10 +15,13 @@ RUN apt-get -o Acquire::Check-Valid-Until=false update \
  && ln -s /usr/bin/fdfind /usr/local/bin/fd \
  && rm -rf /var/lib/apt/lists/*

-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
  && apt-get install -y --no-install-recommends python3 python3-pip python3-venv \
  && rm -rf /var/lib/apt/lists/*

+RUN npm install -g --ignore-scripts --no-fund --no-audit @earendil-works/pi-coding-agent \
+  && npm cache clean --force
+
 RUN install -d -o node -g node -m 755 /home/node/.config /home/node/.config/git \
  && mkdir -p /home/node/.pi/agent \
  /home/node/.pi/context-mode/sessions \
@@ -40,15 +34,10 @@ RUN install -d -o node -g node -m 755 /home/node/.config /home/node/.config/git
 USER node
 WORKDIR /home/node

-# Pi discovers npm packages from its agent directory. Installing the CLI and
-# extensions together from the committed lock makes all direct and transitive
-# package versions deterministic, with npm integrity verification.
-COPY --chown=node:node bot_bottle/contrib/pi/package.json \
-     bot_bottle/contrib/pi/package-lock.json /home/node/.pi/agent/
-RUN cd /home/node/.pi/agent \
-  && npm ci --omit=dev --no-fund --no-audit \
-  && npm cache clean --force
-
-ENV PATH="/home/node/.pi/agent/node_modules/.bin:${PATH}"
+RUN pi install npm:@harms-haus/pi-cwd \
+  && pi install npm:pi-web-access \
+  && pi install npm:context-mode \
+  && pi install npm:pi-subagents \
+  && pi install npm:pi-mcp-adapter

 CMD ["pi"]
@@ -1,15 +0,0 @@
-{
-  "name": "bot-bottle-pi-image",
-  "private": true,
-  "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.81.1",
-    "@earendil-works/pi-agent-core": "0.81.1",
-    "@earendil-works/pi-ai": "0.81.1",
-    "@earendil-works/pi-tui": "0.81.1",
-    "@harms-haus/pi-cwd": "1.0.0",
-    "context-mode": "1.0.169",
-    "pi-mcp-adapter": "2.11.0",
-    "pi-subagents": "0.35.1",
-    "pi-web-access": "0.13.0"
-  }
-}
@@ -136,18 +136,10 @@ def _pump(name: str, stream: IO[bytes]) -> None:
    """Read lines from `stream`, prefix with `[name]`, write to
    stdout. Runs in its own thread per child; daemon=True so a
    blocked read doesn't keep the process alive after main exits."""
-    try:
-        for raw in iter(stream.readline, b""):
-            line = raw.decode("utf-8", errors="replace").rstrip("\n")
-            sys.stdout.write(f"[{name}] {line}\n")
-            sys.stdout.flush()
-    except (OSError, ValueError) as exc:
-        # The manager closes a dead child's pipe after wait() and before a
-        # restart. A pump can be between readline calls at that exact moment;
-        # closed-stream errors are normal completion, not uncaught thread
-        # failures. Preserve genuinely unexpected I/O diagnostics.
-        if not stream.closed:
-            _log(f"{name} output pump stopped: {type(exc).__name__}: {exc}")
+    for raw in iter(stream.readline, b""):
+        line = raw.decode("utf-8", errors="replace").rstrip("\n")
+        sys.stdout.write(f"[{name}] {line}\n")
+        sys.stdout.flush()


 def _spawn(spec: _DaemonSpec) -> subprocess.Popen[bytes]:
@@ -1,137 +0,0 @@
-"""Shared resource boundaries for gateway stdlib HTTP services."""
-
-from __future__ import annotations
-
-import http.server
-import io
-import socket
-import threading
-import time
-from dataclasses import dataclass
-from typing import Any, Protocol
-
-
-class Readable(Protocol):
-    def read(self, size: int = -1, /) -> bytes: ...
-
-
-class Writable(Protocol):
-    def write(self, data: bytes, /) -> object: ...
-
-
-@dataclass(frozen=True)
-class BodyReadError(Exception):
-    status: int
-    message: str
-
-
-def read_declared_body(
-    stream: Readable,
-    connection: socket.socket,
-    raw_length: str | None,
-    *,
-    maximum: int,
-    timeout_seconds: float,
-    require_length: bool,
-) -> bytes:
-    """Validate and read exactly one declared body under a read deadline."""
-    output = io.BytesIO()
-    copy_declared_body(
-        stream, output, connection, raw_length, maximum=maximum,
-        timeout_seconds=timeout_seconds, require_length=require_length,
-    )
-    return output.getvalue()
-
-
-def copy_declared_body(
-    stream: Readable,
-    output: Writable,
-    connection: socket.socket,
-    raw_length: str | None,
-    *,
-    maximum: int,
-    timeout_seconds: float,
-    require_length: bool,
-) -> int:
-    """Copy one declared body to a sink without retaining it in memory."""
-    if raw_length is None:
-        if require_length:
-            raise BodyReadError(411, "Content-Length required")
-        raw_length = "0"
-    try:
-        length = int(raw_length)
-    except ValueError as exc:
-        raise BodyReadError(400, "invalid Content-Length") from exc
-    if length < 0:
-        raise BodyReadError(400, "invalid Content-Length")
-    if length > maximum:
-        raise BodyReadError(413, "request body too large")
-    previous_timeout = connection.gettimeout()
-    deadline = time.monotonic() + timeout_seconds
-    remaining = length
-    try:
-        while remaining:
-            timeout = deadline - time.monotonic()
-            if timeout <= 0:
-                raise BodyReadError(408, "request body read timed out")
-            connection.settimeout(timeout)
-            chunk = stream.read(min(remaining, 64 * 1024))
-            if not chunk:
-                raise BodyReadError(400, "incomplete request body")
-            output.write(chunk)
-            remaining -= len(chunk)
-    except TimeoutError as exc:
-        raise BodyReadError(408, "request body read timed out") from exc
-    finally:
-        connection.settimeout(previous_timeout)
-    return length
-
-
-class BoundedThreadingHTTPServer(http.server.ThreadingHTTPServer):
-    """ThreadingHTTPServer with a hard cap on in-flight request threads."""
-
-    daemon_threads = True
-
-    def __init__(  # pylint: disable=consider-using-with
-        self, *args, max_workers: int = 32, **kwargs,  # type: ignore[no-untyped-def]
-    ):
-        if max_workers < 1:
-            raise ValueError("max_workers must be positive")
-        self._request_slots = threading.BoundedSemaphore(max_workers)
-        super().__init__(*args, **kwargs)
-
-    def process_request(
-        self, request: Any, client_address: Any,
-    ) -> None:
-        if not self._request_slots.acquire(  # pylint: disable=consider-using-with
-            blocking=False,
-        ):
-            try:
-                request.sendall(
-                    b"HTTP/1.1 503 Service Unavailable\r\n"
-                    b"Content-Length: 0\r\nConnection: close\r\n\r\n"
-                )
-            finally:
-                self.shutdown_request(request)
-            return
-        try:
-            super().process_request(request, client_address)
-        except BaseException:
-            self._request_slots.release()
-            raise
-
-    def process_request_thread(
-        self, request: Any, client_address: Any,
-    ) -> None:
-        try:
-            super().process_request_thread(request, client_address)
-        finally:
-            self._request_slots.release()
-
-
-__all__ = [
-    "BodyReadError",
-    "BoundedThreadingHTTPServer",
-    "copy_declared_body",
-    "read_declared_body",
-]
@@ -16,7 +16,7 @@ import typing
 from mitmproxy import http  # type: ignore[import-not-found]  # pylint: disable=import-error

 from bot_bottle.constants import IDENTITY_HEADER
-from bot_bottle.gateway.egress.dlp_detectors import redact_tokens
+from bot_bottle.gateway.egress.dlp_detectors import redact_tokens, strip_crlf
 from bot_bottle.gateway.egress.dlp_config import (
    DEFAULT_OUTBOUND_ON_MATCH,
    ON_MATCH_BLOCK,
@@ -25,19 +25,19 @@ from bot_bottle.gateway.egress.dlp_config import (
 from bot_bottle.gateway.egress.context import resolve_client_context
 from bot_bottle.gateway.egress.dlp import (
    build_inbound_scan_text,
+    build_outbound_scan_text,
    build_token_allow_payload,
+    outbound_scan_headers,
    scan_inbound,
    scan_outbound,
 )
-from bot_bottle.gateway.egress.outbound_pipeline import redact_request, scan_request
 from bot_bottle.gateway.egress.matching import (
    decide,
+    decide_git_fetch,
+    is_git_fetch_request,
+    is_git_push_request,
    match_route,
 )
-from bot_bottle.gateway.egress.request_pipeline import (
-    evaluate_route_policy,
-    git_block_reason,
-)
 from bot_bottle.gateway.egress.schema import route_to_yaml_dict
 from bot_bottle.gateway.egress.types import (
    LOG_BLOCKS,
@@ -389,9 +389,19 @@ class EgressAddon:
        self._passthrough_conns.discard(conn_id)

    async def request(self, flow: http.HTTPFlow) -> None:
-        config, slug, env = self._request_context(flow)
        request_path, _, query = flow.request.path.partition("?")

+        # Reuse the context stashed by http_connect for HTTPS flows (one
+        # orchestrator round-trip per connection). Plain-HTTP flows have no
+        # prior CONNECT stash, so resolve now and stash for response/websocket.
+        meta = getattr(flow, "metadata", None)
+        if isinstance(meta, dict) and _FLOW_CTX_KEY in meta:
+            config, slug, env = meta[_FLOW_CTX_KEY]
+            self._request_token(flow)  # strip identity headers; token already resolved
+        else:
+            config, slug, env = self._resolve_flow(flow)
+            self._stash_flow_ctx(flow, config, slug, env)
+
        # Introspection ("_egress.local/allowlist") reports the calling bottle's
        # own resolved routes — served after resolution so it reflects this
        # bottle's policy, not a stale global.
@@ -412,66 +422,56 @@ class EgressAddon:
            # the path/query the git checks below rely on.
            request_path, _, query = flow.request.path.partition("?")

-        if not self._allow_git_request(flow, config, request_path, query):
+        if is_git_push_request(request_path, query):
+            self._block(
+                flow,
+                "egress: git push over HTTPS is not supported; "
+                "use the bottle.git SSH path (gitleaks-scanned by "
+                "git-gate's pre-receive hook).",
+                ctx=self._req_ctx(flow),
+            )
            return

-        self._apply_route_policy(flow, config, route, request_path, env)
+        if is_git_fetch_request(request_path, query):
+            git_decision = decide_git_fetch(
+                config.routes, flow.request.pretty_host,
+            )
+            if git_decision.action == "block":
+                self._block(
+                    flow,
+                    git_decision.reason,
+                    ctx=self._req_ctx(flow),
+                )
+                return

-    def _request_context(
-        self, flow: http.HTTPFlow,
-    ) -> tuple[Config, str, "typing.Mapping[str, str]"]:
-        """Resolve one bottle context, reusing the HTTPS CONNECT snapshot."""
-        meta = getattr(flow, "metadata", None)
-        if isinstance(meta, dict) and _FLOW_CTX_KEY in meta:
-            config, slug, env = meta[_FLOW_CTX_KEY]
-            self._request_token(flow)
-            return config, slug, env
-        config, slug, env = self._resolve_flow(flow)
-        self._stash_flow_ctx(flow, config, slug, env)
-        return config, slug, env
-
-    def _allow_git_request(
-        self, flow: http.HTTPFlow, config: Config,
-        request_path: str, query: str,
-    ) -> bool:
-        """Apply the HTTPS Git push/fetch boundary before general routing."""
-        reason = git_block_reason(
-            config.routes, flow.request.pretty_host, request_path, query,
-        )
-        if not reason:
-            return True
-        self._block(flow, reason, ctx=self._req_ctx(flow))
-        return False
-
-    def _apply_route_policy(
-        self, flow: http.HTTPFlow, config: Config, route: Route | None,
-        request_path: str, env: "typing.Mapping[str, str]",
-    ) -> None:
-        """Strip agent auth, evaluate the route, then inject gateway auth."""
        # Strip agent-set Authorization after DLP scan so smuggled tokens
        # are caught above; the route may inject gateway-owned auth below.
        # Routes with preserve_auth=True pass the header through as-is so the
        # agent's own credentials (e.g. registry bearer tokens) reach the upstream.
-        result = evaluate_route_policy(
-            config,
-            route,
-            host=flow.request.pretty_host,
-            request_path=request_path,
-            method=flow.request.method,
-            headers=dict(flow.request.headers),
-            env=env,
-        )
-        if result.strip_authorization:
+        if route is None or not route.preserve_auth:
            flow.request.headers.pop("authorization", None)

-        if result.block_reason:
-            self._block(flow, result.block_reason, ctx=self._req_ctx(flow))
+        # Build headers mapping for match evaluation
+        req_headers = {k.lower(): v for k, v in flow.request.headers.items()}
+
+        decision = decide(
+            config.routes,
+            flow.request.pretty_host,
+            request_path,
+            env,
+            request_method=flow.request.method,
+            request_headers=req_headers,
+            deny_reason=config.deny_reason,
+        )
+
+        if decision.action == "block":
+            self._block(flow, decision.reason, ctx=self._req_ctx(flow))
            return

-        if result.inject_authorization is not None:
-            flow.request.headers["authorization"] = result.inject_authorization
+        if decision.inject_authorization is not None:
+            flow.request.headers["authorization"] = decision.inject_authorization

-        if result.log_request:
+        if config.log >= LOG_FULL:
            self._log_request(flow, env)

    def _block_dlp(self, flow: http.HTTPFlow, result: ScanResult) -> None:
@@ -495,12 +495,20 @@ class EgressAddon:
        Loops so the supervise policy can re-scan after each approval — a
        second, un-approved token in the same request is still caught."""
        while True:
-            request_path, _, _ = flow.request.path.partition("?")
-            result = scan_request(
-                flow.request,
-                route,
-                env,
-                safe_tokens=self._safe_tokens_for(slug),
+            request_path, _, query = flow.request.path.partition("?")
+            body = flow.request.get_text(strict=False) or ""
+            headers = outbound_scan_headers(route, dict(flow.request.headers))
+            scan_text = build_outbound_scan_text(
+                flow.request.pretty_host, request_path, query, headers, body,
+            )
+            # CRLF is scanned only over the request line + headers, never the
+            # body (see scan_outbound) — a body is not an injection vector.
+            crlf_text = build_outbound_scan_text(
+                flow.request.pretty_host, request_path, query, headers, "",
+            )
+            result = scan_outbound(
+                route, scan_text, env,
+                safe_tokens=self._safe_tokens_for(slug), crlf_text=crlf_text,
            )
            if result is None or result.severity != "block":
                return True
@@ -510,7 +518,7 @@ class EgressAddon:
            # redact scrubs every detection (tokens and structural CRLF) and
            # forwards; it fails closed only if a match survives the scrub.
            if policy == ON_MATCH_REDACT:
-                if redact_request(flow.request, route, env):
+                if self._redact_outbound(flow, route, env):
                    if self._flow_log(flow) >= LOG_BLOCKS:
                        sys.stderr.write(json.dumps({
                            "event": "egress_redacted",
@@ -543,6 +551,41 @@ class EgressAddon:
                return False  # _supervise_token_block wrote the 403 response
            # loop: the approved value is now in safe_tokens; re-scan.

+    def _redact_outbound(
+        self, flow: http.HTTPFlow, route: Route, env: "typing.Mapping[str, str]",
+    ) -> bool:
+        """Scrub detected tokens (and CRLF injection sequences) from the mutable
+        request surfaces (body, headers, path/query) and re-scan. `env` is the
+        per-bottle env overlay. Returns True if the request is now clean; False
+        if a block-severity match remains on a surface redaction cannot rewrite
+        (the hostname) so the caller fails closed."""
+        body = flow.request.get_text(strict=False)
+        if body:
+            redacted_body = redact_tokens(body, env=env)
+            if redacted_body != body:
+                flow.request.text = redacted_body
+        for name, value in list(flow.request.headers.items()):
+            if name.lower() == "host":
+                continue  # routing-critical; never a legitimate token
+            redacted = strip_crlf(redact_tokens(value, env=env))
+            if redacted != value:
+                flow.request.headers[name] = redacted
+        redacted_path = strip_crlf(redact_tokens(flow.request.path, env=env))
+        if redacted_path != flow.request.path:
+            flow.request.path = redacted_path
+
+        request_path, _, query = flow.request.path.partition("?")
+        new_body = flow.request.get_text(strict=False) or ""
+        headers = outbound_scan_headers(route, dict(flow.request.headers))
+        scan_text = build_outbound_scan_text(
+            flow.request.pretty_host, request_path, query, headers, new_body,
+        )
+        crlf_text = build_outbound_scan_text(
+            flow.request.pretty_host, request_path, query, headers, "",
+        )
+        result = scan_outbound(route, scan_text, env, crlf_text=crlf_text)
+        return result is None or result.severity != "block"
+
    async def _supervise_token_block(
        self,
        flow: http.HTTPFlow,
@@ -1,83 +0,0 @@
-"""Outbound DLP request scanning and redaction for the egress pipeline."""
-
-from __future__ import annotations
-
-from typing import ItemsView, Mapping, Protocol
-
-from .dlp import (
-    build_outbound_scan_text,
-    outbound_scan_headers,
-    scan_outbound,
-)
-from .dlp_detectors import redact_tokens, strip_crlf
-from .types import Route, ScanResult
-
-
-class MutableHeaders(Protocol):
-    def items(self) -> ItemsView[str, str]: ...
-    def __getitem__(self, name: str, /) -> str: ...
-    def __setitem__(self, name: str, value: str, /) -> None: ...
-
-
-class MutableRequest(Protocol):
-    pretty_host: str
-    path: str
-    headers: MutableHeaders
-    text: str
-
-    def get_text(self, strict: bool = False) -> str | None: ...
-
-
-def scan_request(
-    request: MutableRequest,
-    route: Route,
-    env: Mapping[str, str],
-    *,
-    safe_tokens: set[str] | None = None,
-) -> ScanResult | None:
-    """Scan all mutable outbound request surfaces in their canonical order."""
-    request_path, _, query = request.path.partition("?")
-    headers = outbound_scan_headers(route, dict(request.headers.items()))
-    body = request.get_text(strict=False) or ""
-    scan_text = build_outbound_scan_text(
-        request.pretty_host, request_path, query, headers, body,
-    )
-    # Bodies cannot alter HTTP framing, so CRLF detection is deliberately
-    # restricted to the request line and headers.
-    crlf_text = build_outbound_scan_text(
-        request.pretty_host, request_path, query, headers, "",
-    )
-    return scan_outbound(
-        route,
-        scan_text,
-        env,
-        safe_tokens=safe_tokens,
-        crlf_text=crlf_text,
-    )
-
-
-def redact_request(
-    request: MutableRequest,
-    route: Route,
-    env: Mapping[str, str],
-) -> bool:
-    """Redact mutable request surfaces and return whether the result is clean."""
-    body = request.get_text(strict=False)
-    if body:
-        redacted_body = redact_tokens(body, env=env)
-        if redacted_body != body:
-            request.text = redacted_body
-    for name, value in list(request.headers.items()):
-        if name.lower() == "host":
-            continue
-        redacted = strip_crlf(redact_tokens(value, env=env))
-        if redacted != value:
-            request.headers[name] = redacted
-    redacted_path = strip_crlf(redact_tokens(request.path, env=env))
-    if redacted_path != request.path:
-        request.path = redacted_path
-    result = scan_request(request, route, env)
-    return result is None or result.severity != "block"
-
-
-__all__ = ["MutableRequest", "redact_request", "scan_request"]
@@ -1,92 +0,0 @@
-"""Framework-neutral request policy stages for the egress adapter.
-
-The mitmproxy addon owns flow mutation and response construction. This module
-owns the ordered Git and route-policy decisions so those rules remain directly
-testable without a live proxy flow.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Mapping, Sequence
-
-from .matching import (
-    decide,
-    decide_git_fetch,
-    is_git_fetch_request,
-    is_git_push_request,
-)
-from .types import LOG_FULL, Config, Route
-
-GIT_PUSH_BLOCK_REASON = (
-    "egress: git push over HTTPS is not supported; "
-    "use the bottle.git SSH path (gitleaks-scanned by "
-    "git-gate's pre-receive hook)."
-)
-
-
-@dataclass(frozen=True)
-class RoutePolicyResult:
-    """The flow mutations and outcome produced by general route policy."""
-
-    block_reason: str = ""
-    strip_authorization: bool = False
-    inject_authorization: str | None = None
-    log_request: bool = False
-
-
-def git_block_reason(
-    routes: Sequence[Route],
-    host: str,
-    request_path: str,
-    query: str,
-) -> str:
-    """Return the HTTPS Git policy denial, or ``""`` when allowed."""
-    if is_git_push_request(request_path, query):
-        return GIT_PUSH_BLOCK_REASON
-    if not is_git_fetch_request(request_path, query):
-        return ""
-    decision = decide_git_fetch(routes, host)
-    return decision.reason if decision.action == "block" else ""
-
-
-def evaluate_route_policy(
-    config: Config,
-    route: Route | None,
-    *,
-    host: str,
-    request_path: str,
-    method: str,
-    headers: Mapping[str, str],
-    env: Mapping[str, str],
-) -> RoutePolicyResult:
-    """Evaluate authorization stripping, matching, injection, and logging."""
-    strip_authorization = route is None or not route.preserve_auth
-    effective_headers = {
-        name.lower(): value
-        for name, value in headers.items()
-        if not (strip_authorization and name.lower() == "authorization")
-    }
-    decision = decide(
-        config.routes,
-        host,
-        request_path,
-        env,
-        request_method=method,
-        request_headers=effective_headers,
-        deny_reason=config.deny_reason,
-    )
-    return RoutePolicyResult(
-        block_reason=decision.reason if decision.action == "block" else "",
-        strip_authorization=strip_authorization,
-        inject_authorization=decision.inject_authorization,
-        log_request=config.log >= LOG_FULL,
-    )
-
-
-__all__ = [
-    "GIT_PUSH_BLOCK_REASON",
-    "RoutePolicyResult",
-    "evaluate_route_policy",
-    "git_block_reason",
-]
@@ -21,19 +21,12 @@ from __future__ import annotations
 import os
 import subprocess
 import sys
-import tempfile
-import threading
 import typing
-from http.server import BaseHTTPRequestHandler
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from urllib.parse import urlsplit

 from bot_bottle.constants import GIT_GATE_TIMEOUT_SECS, IDENTITY_HEADER
-from bot_bottle.gateway.bounded_http import (
-    BodyReadError,
-    BoundedThreadingHTTPServer,
-    copy_declared_body,
-)
 from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver


@@ -84,10 +77,6 @@ def resolve_sandbox_root(

 # Bound memory use while still allowing ordinary git push packfiles.
 MAX_BODY_BYTES = 100 * 1024 * 1024
-REQUEST_BODY_TIMEOUT_SECONDS = 30.0
-MAX_REQUEST_WORKERS = 16
-MAX_BODY_WORKERS = 2
-_BODY_WORK_SLOTS = threading.BoundedSemaphore(MAX_BODY_WORKERS)


 class GitHttpHandler(BaseHTTPRequestHandler):
@@ -195,40 +184,27 @@ class GitHttpHandler(BaseHTTPRequestHandler):
            value = self.headers.get(header)
            if value:
                env[variable] = value
-        if not _BODY_WORK_SLOTS.acquire(blocking=False):
-            self.send_error(503, "git request capacity exhausted")
-            return
+        raw_length = self.headers.get("content-length", "0") or "0"
        try:
-            with tempfile.TemporaryFile() as body:
-                try:
-                    copy_declared_body(
-                        self.rfile,
-                        body,
-                        self.connection,
-                        self.headers.get("content-length"),
-                        maximum=MAX_BODY_BYTES,
-                        timeout_seconds=REQUEST_BODY_TIMEOUT_SECONDS,
-                        require_length=False,
-                    )
-                except BodyReadError as exc:
-                    self.send_error(exc.status, exc.message)
-                    return
-                body.seek(0)
-                try:
-                    proc = subprocess.run(
-                        ["git", "http-backend"],
-                        stdin=body,
-                        env=env,
-                        capture_output=True,
-                        check=False,
-                        timeout=GIT_GATE_TIMEOUT_SECS,
-                    )
-                except (OSError, subprocess.SubprocessError) as exc:
-                    self.log_message("git http-backend unavailable: %s", exc)
-                    self.send_error(503, "git backend unavailable")
-                    return
-        finally:
-            _BODY_WORK_SLOTS.release()
+            length = int(raw_length)
+        except ValueError:
+            self.send_error(400, "Bad Content-Length")
+            return
+        if length < 0:
+            self.send_error(400, "Negative Content-Length")
+            return
+        if length > MAX_BODY_BYTES:
+            self.send_error(413, "Request body too large")
+            return
+        body = self.rfile.read(length) if length else b""
+        proc = subprocess.run(
+            ["git", "http-backend"],
+            input=body,
+            env=env,
+            capture_output=True,
+            check=False,
+            timeout=GIT_GATE_TIMEOUT_SECS,
+        )
        self._write_cgi_response(proc.stdout)

    def _repo_dir(self, sandbox_root: Path, path: str) -> Path | None:
@@ -297,9 +273,7 @@ def main() -> int:
            "(no single-tenant flat-root fallback)\n"
        )
        return 1
-    server = BoundedThreadingHTTPServer(
-        ("0.0.0.0", port), GitHttpHandler, max_workers=MAX_REQUEST_WORKERS,
-    )
+    server = ThreadingHTTPServer(("0.0.0.0", port), GitHttpHandler)
    # Resolve each request's sandbox namespace by source IP against the
    # orchestrator control plane.
    server.policy_resolver = PolicyResolver(orch_url)  # type: ignore[attr-defined]
@@ -252,27 +252,6 @@ cat > "$refs_file"

 zero=0000000000000000000000000000000000000000

-# Phase 0: reject Gitea AGit review refs before scanning or forwarding.
-# A push to refs/for/*, refs/draft/*, or refs/for-review/* asks Gitea to
-# open a pull request backed by a server-managed refs/pull/<n>/head rather
-# than an ordinary refs/heads/* branch. That breaks the git-gate workflow:
-# follow-up commits can't be pushed back through the branch, and Gitea
-# rejects later direct updates to the generated review ref. Fail the whole
-# push here (before any gitleaks scan or upstream forward) so the caller
-# pushes a real branch and opens the PR against it instead. Deletions
-# (new == zero) stay allowed so stale AGit refs can still be cleaned up.
-while IFS=' ' read -r old new ref; do
-  [ -z "$ref" ] && continue
-  [ "$new" = "$zero" ] && continue
-  case "$ref" in
-    refs/for/*|refs/draft/*|refs/for-review/*)
-      echo "git-gate: refusing AGit review ref $ref" >&2
-      echo "git-gate: push to refs/heads/<branch> and open a branch-backed pull request instead" >&2
-      exit 1
-      ;;
-  esac
-done < "$refs_file"
-
 supervise_gitleaks_allow() {
  log_opts=$1
  ref=$2
@@ -1,92 +0,0 @@
-"""Framework-neutral MCP method and tool dispatch."""
-
-from __future__ import annotations
-
-import json
-from dataclasses import dataclass
-from typing import Callable, Protocol
-
-from bot_bottle.gateway.egress.schema import load_config, route_to_yaml_dict
-from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver
-from bot_bottle.supervisor import types as _sv
-
-
-class Request(Protocol):
-    @property
-    def method(self) -> str: ...
-
-    @property
-    def params(self) -> dict[str, object]: ...
-
-
-class MethodNotFoundError(Exception):
-    """Raised when a JSON-RPC method has no MCP handler."""
-
-
-class RouteResolutionError(Exception):
-    """The caller's live route table could not be resolved authoritatively."""
-
-
-Handler = Callable[[dict[str, object]], object]
-
-
-@dataclass(frozen=True)
-class Handlers:
-    initialize: Handler
-    tools_list: Handler
-    list_routes: Handler
-    check_proposal: Handler
-    propose: Handler
-
-
-def dispatch(request: Request, handlers: Handlers) -> object:
-    """Route one parsed request without depending on the HTTP server."""
-    if request.method == "initialize":
-        return handlers.initialize(request.params)
-    if request.method == "notifications/initialized":
-        return None
-    if request.method == "tools/list":
-        return handlers.tools_list(request.params)
-    if request.method != "tools/call":
-        raise MethodNotFoundError(request.method)
-
-    tool = request.params.get("name")
-    if tool == _sv.TOOL_LIST_EGRESS_ROUTES:
-        return handlers.list_routes(request.params)
-    if tool == _sv.TOOL_CHECK_PROPOSAL:
-        return handlers.check_proposal(request.params)
-    return handlers.propose(request.params)
-
-
-def resolved_routes_payload(
-    resolver: PolicyResolver,
-    source_ip: str,
-    identity_token: str,
-) -> dict[str, object]:
-    """Render an authoritatively resolved route table for the calling bottle."""
-    try:
-        policy, bottle_id, _tokens = resolver.resolve_policy_and_bottle_id(
-            source_ip, identity_token,
-        )
-    except PolicyResolveError as exc:
-        raise RouteResolutionError("orchestrator unavailable") from exc
-    if not bottle_id:
-        raise RouteResolutionError("request source is not attributed to a bottle")
-    try:
-        config = load_config(policy or "")
-    except ValueError as exc:
-        raise RouteResolutionError("resolved policy is invalid") from exc
-    body = json.dumps(
-        {"routes": [route_to_yaml_dict(route) for route in config.routes]},
-        indent=2,
-    )
-    return {"content": [{"type": "text", "text": body}], "isError": False}
-
-
-__all__ = [
-    "Handlers",
-    "MethodNotFoundError",
-    "RouteResolutionError",
-    "dispatch",
-    "resolved_routes_payload",
-]
@@ -51,27 +51,17 @@ from __future__ import annotations
 import http.server
 import json
 import os
+import socketserver
 import sys
 import time
 import typing
 from dataclasses import dataclass

 from bot_bottle.constants import IDENTITY_HEADER
-from bot_bottle.gateway.bounded_http import (
-    BodyReadError,
-    BoundedThreadingHTTPServer,
-    read_declared_body,
-)
-from bot_bottle.gateway.egress.schema import load_config
+from bot_bottle.gateway.egress.context import resolve_client_context
+from bot_bottle.gateway.egress.schema import load_config, route_to_yaml_dict
 from bot_bottle.gateway.egress.types import LOG_OFF
 from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver
-from bot_bottle.gateway.supervisor.mcp_dispatch import (
-    Handlers as DispatchHandlers,
-    MethodNotFoundError,
-    RouteResolutionError,
-    dispatch,
-    resolved_routes_payload,
-)
 from bot_bottle.supervisor import types as _sv


@@ -575,8 +565,6 @@ def format_unknown_proposal_text(proposal_id: str) -> str:
 # Max request body the server accepts. 1 MB is well above any realistic
 # routes.yaml proposal.
 MAX_BODY_BYTES = 1 * 1024 * 1024
-REQUEST_BODY_TIMEOUT_SECONDS = 10.0
-MAX_REQUEST_WORKERS = 32


 class MCPHandler(http.server.BaseHTTPRequestHandler):
@@ -599,18 +587,19 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
        self._write_text(405, "use POST for MCP requests\n")

    def do_POST(self) -> None:
-        try:
-            body = read_declared_body(
-                self.rfile,
-                self.connection,
-                self.headers.get("Content-Length"),
-                maximum=MAX_BODY_BYTES,
-                timeout_seconds=REQUEST_BODY_TIMEOUT_SECONDS,
-                require_length=True,
-            )
-        except BodyReadError as exc:
-            self._write_text(exc.status, exc.message + "\n")
+        length_header = self.headers.get("Content-Length")
+        if length_header is None:
+            self._write_text(411, "Content-Length required\n")
            return
+        try:
+            length = int(length_header)
+        except ValueError:
+            self._write_text(400, "invalid Content-Length\n")
+            return
+        if length < 0 or length > MAX_BODY_BYTES:
+            self._write_text(413, "request body too large\n")
+            return
+        body = self.rfile.read(length)

        try:
            req = parse_jsonrpc(body)
@@ -622,11 +611,6 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):

        try:
            result = self._dispatch(req, config)
-        except MethodNotFoundError as e:
-            self._write_jsonrpc(
-                jsonrpc_error(req.id, ERR_METHOD_NOT_FOUND, f"method not found: {e}"),
-            )
-            return
        except _RpcClientError as e:
            self._write_jsonrpc(jsonrpc_error(req.id, e.code, e.message))
            return
@@ -649,42 +633,41 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
        self._write_jsonrpc(jsonrpc_result(req.id, result))

    def _dispatch(self, req: JsonRpcRequest, config: ServerConfig) -> object:
-        def check(params: dict[str, object]) -> object:
-            return handle_check_proposal(
-                params,
-                resolver=self._resolver_or_fail(),
-                source_ip=self.client_address[0],
-                identity_token=self._identity_token(),
-            )
-
-        def propose(params: dict[str, object]) -> object:
-            return handle_tools_call(
-                params,
-                config,
-                resolver=self._resolver_or_fail(),
-                source_ip=self.client_address[0],
-                identity_token=self._identity_token(),
-            )
-
-        def list_routes(_params: dict[str, object]) -> object:
-            try:
-                return resolved_routes_payload(
-                    self._resolver_or_fail(),
-                    self.client_address[0],
-                    self._identity_token(),
+        method = req.method
+        if method == "initialize":
+            return handle_initialize(req.params)
+        if method == "notifications/initialized":
+            return None  # ack-only
+        if method == "tools/list":
+            return handle_tools_list(req.params)
+        if method == "tools/call":
+            # `list-egress-routes` is read-only introspection. The shared gateway
+            # has no static route table (routes are resolved per request by
+            # source IP), so answer it from the calling bottle's resolved policy.
+            # Otherwise the agent sees an empty allowlist and composes an egress
+            # proposal that *replaces* the live routes instead of extending them
+            # — silently dropping base routes like api.anthropic.com on approval.
+            if req.params.get("name") == _sv.TOOL_LIST_EGRESS_ROUTES:
+                return self._resolved_routes_payload()
+            resolver = self._resolver_or_fail()
+            source_ip = self.client_address[0]
+            token = self._identity_token()
+            # `check-proposal` is a non-blocking read of the calling bottle's
+            # own queue — attributed by (source_ip, identity_token) like a
+            # proposal, but it never queues or blocks.
+            if req.params.get("name") == _sv.TOOL_CHECK_PROPOSAL:
+                return handle_check_proposal(
+                    req.params, resolver=resolver,
+                    source_ip=source_ip, identity_token=token,
                )
-            except RouteResolutionError as exc:
-                raise _RpcInternalError(
-                    f"could not resolve live egress routes: {exc}"
-                ) from exc
-
-        return dispatch(req, DispatchHandlers(
-            initialize=handle_initialize,
-            tools_list=handle_tools_list,
-            list_routes=list_routes,
-            check_proposal=check,
-            propose=propose,
-        ))
+            # The control plane attributes the proposal to the source-IP + token
+            # resolved bottle, so the one shared queue holds each bottle's
+            # proposal under its own id — no slug is asserted by this daemon.
+            return handle_tools_call(
+                req.params, config, resolver=resolver,
+                source_ip=source_ip, identity_token=token,
+            )
+        raise _RpcClientError(ERR_METHOD_NOT_FOUND, f"method not found: {method}")

    def _identity_token(self) -> str:
        """The agent's per-bottle identity token from the request header (the
@@ -703,6 +686,20 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
            raise _RpcInternalError("supervise server has no policy resolver")
        return resolver

+    def _resolved_routes_payload(self) -> dict[str, object]:
+        """The calling bottle's live egress routes as the `list-egress-routes`
+        JSON payload, resolved by (source_ip, identity token). Fail-closed: an
+        unattributed source or an unreachable orchestrator yields an empty route
+        list (never another bottle's), courtesy of `resolve_client_context`."""
+        resolver = self._resolver_or_fail()
+        conf, _slug, _tokens = resolve_client_context(
+            resolver, self.client_address[0], self._identity_token(),
+        )
+        body = json.dumps(
+            {"routes": [route_to_yaml_dict(r) for r in conf.routes]}, indent=2,
+        )
+        return {"content": [{"type": "text", "text": body}], "isError": False}
+
    def _write_jsonrpc(self, body: bytes) -> None:
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
@@ -722,7 +719,7 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
            self.wfile.write(encoded)


-class MCPServer(BoundedThreadingHTTPServer):
+class MCPServer(socketserver.ThreadingMixIn, http.server.HTTPServer):
    allow_reuse_address = True
    daemon_threads = True
    config: ServerConfig = ServerConfig()
@@ -731,9 +728,6 @@ class MCPServer(BoundedThreadingHTTPServer):
    # closed per request (see `_resolver_or_fail`).
    policy_resolver: "PolicyResolver | None" = None

-    def __init__(self, *args, **kwargs):  # type: ignore[no-untyped-def]
-        super().__init__(*args, max_workers=MAX_REQUEST_WORKERS, **kwargs)
-

 # --- Entry point -----------------------------------------------------------

@@ -44,7 +44,7 @@ if TYPE_CHECKING:
    from ..gateway import Gateway, GatewayError
    from .lifecycle import Orchestrator
    from .service import OrchestratorCore
-    from .server import OrchestratorServer, create_app, make_server
+    from .server import OrchestratorServer, dispatch, make_server


 # Facade name -> submodule that defines it. Lazy so importing a leaf (or the
@@ -67,8 +67,8 @@ _LAZY: dict[str, str] = {
    "GatewayError": "..gateway",
    "Orchestrator": ".lifecycle",
    "OrchestratorCore": ".service",
-    "create_app": ".server",
    "OrchestratorServer": ".server",
+    "dispatch": ".server",
    "make_server": ".server",
 }

@@ -100,7 +100,7 @@ __all__ = [
    "GatewayError",
    "Orchestrator",
    "OrchestratorCore",
-    "create_app",
    "OrchestratorServer",
+    "dispatch",
    "make_server",
 ]
@@ -1,7 +1,6 @@
 """Run the orchestrator control plane as a plain process (PRD 0070 dev-harness).

-    BOT_BOTTLE_ORCHESTRATOR_TOKEN=<signing-key> \
-        python -m bot_bottle.orchestrator [--host H] [--port P] [--db PATH]
+    python -m bot_bottle.orchestrator [--host H] [--port P] [--db PATH]

 The PRD sequences the orchestrator as a plain-process dev-harness first, so
 the consolidation core (registry + attribution + HTTP control plane + live
@@ -17,13 +16,12 @@ import secrets
 from pathlib import Path

 from .. import log
-from ..trust_domain import CONTROL_PLANE
-from .broker import LaunchBroker, StubBroker
-from .docker_broker import DockerBroker
-from .server import make_server
-from .service import OrchestratorCore
 from .store.store_manager import StoreManager
+from .broker import LaunchBroker, StubBroker
+from .server import make_server
+from .docker_broker import DockerBroker
 from .store.registry_store import RegistryStore, default_db_path
+from .service import OrchestratorCore


 def main(argv: list[str] | None = None) -> int:
@@ -40,11 +38,6 @@ def main(argv: list[str] | None = None) -> int:
        help="launch broker: 'stub' records requests; 'docker' runs containers",
    )
    args = parser.parse_args(argv)
-    if not CONTROL_PLANE.key_from_env():
-        log.die(
-            f"{CONTROL_PLANE.key_env} is required; refusing to start the "
-            "orchestrator without caller authentication"
-        )

    registry = RegistryStore(args.db)
    registry.migrate()
@@ -62,14 +55,17 @@ def main(argv: list[str] | None = None) -> int:
    orchestrator = OrchestratorCore(registry, broker, secret)

    server = make_server(orchestrator, host=args.host, port=args.port)
+    bound_host, bound_port = server.server_address[0], server.server_address[1]
    log.info(
        "orchestrator control plane listening",
-        context={"host": args.host, "port": args.port, "db": str(registry.db_path)},
+        context={"host": bound_host, "port": bound_port, "db": str(registry.db_path)},
    )
    try:
-        server.run()
+        server.serve_forever()
    except KeyboardInterrupt:
        log.info("orchestrator shutting down")
+    finally:
+        server.server_close()
    return 0


@@ -1,339 +0,0 @@
-"""FastAPI control-plane routes for the orchestrator."""
-# pyright: reportUnusedFunction=false
-
-from __future__ import annotations
-
-import asyncio
-import math
-import sys
-from fastapi import FastAPI, HTTPException
-from fastapi.responses import JSONResponse
-from pydantic import BaseModel, ConfigDict, StrictStr
-from starlette.types import ASGIApp, Message, Receive, Scope, Send
-
-from ..orchestrator_auth import ROLE_CLI, ROLES
-from ..supervisor.types import TOOLS
-from ..trust_domain import CONTROL_PLANE
-from .http_contract import (
-    MAX_BODY_BYTES,
-    ORCHESTRATOR_AUTH_HEADER,
-    REQUEST_BODY_TIMEOUT_SECONDS,
-)
-from .service import OrchestratorCore
-
-_GATEWAY_ROUTES = frozenset({
-    ("POST", "/resolve"),
-    ("POST", "/supervise/propose"),
-    ("POST", "/supervise/poll"),
-})
-
-
-class _StrictModel(BaseModel):
-    model_config = ConfigDict(extra="ignore", strict=True)
-
-
-class LaunchBody(_StrictModel):
-    source_ip: StrictStr
-    image_ref: StrictStr = ""
-    metadata: StrictStr = ""
-    policy: StrictStr = ""
-    tokens: dict[StrictStr, StrictStr] = {}
-    env_var_secret: StrictStr = ""
-
-
-class PolicyBody(_StrictModel):
-    policy: StrictStr
-
-
-class ReprovisionBody(_StrictModel):
-    env_var_secret: StrictStr
-
-
-class ReconcileBody(_StrictModel):
-    live_source_ips: list[StrictStr]
-    grace_seconds: float | None = None
-
-
-class IdentityBody(_StrictModel):
-    source_ip: StrictStr
-    identity_token: StrictStr = ""
-
-
-class AttributeBody(_StrictModel):
-    source_ip: StrictStr
-    identity_token: StrictStr
-
-
-class RespondBody(_StrictModel):
-    proposal_id: StrictStr
-    bottle_slug: StrictStr
-    decision: StrictStr
-    notes: StrictStr = ""
-    final_file: StrictStr | None = None
-
-
-class ProposeBody(IdentityBody):
-    tool: StrictStr
-    proposed_file: StrictStr
-    justification: StrictStr
-
-
-class PollBody(IdentityBody):
-    proposal_id: StrictStr
-
-
-class ControlPlaneBoundary:
-    """Reject unauthenticated and oversized requests before reading a body."""
-
-    def __init__(self, app: ASGIApp, signing_key: str) -> None:
-        self.app = app
-        self.signing_key = signing_key
-
-    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
-        if scope["type"] != "http":
-            await self.app(scope, receive, send)
-            return
-        method = scope["method"]
-        route = scope["path"].rstrip("/") or "/"
-        if not (method == "GET" and route == "/health"):
-            headers = dict(scope["headers"])
-            presented = headers.get(
-                ORCHESTRATOR_AUTH_HEADER.encode(), b"",
-            ).decode(errors="ignore")
-            role = CONTROL_PLANE.verify(presented, self.signing_key)
-            if role is None:
-                await self._reject(
-                    scope, send, 401, "control-plane authentication required",
-                )
-                return
-            allowed = ROLES if (method, route) in _GATEWAY_ROUTES else {ROLE_CLI}
-            if role not in allowed:
-                await self._reject(scope, send, 403, "insufficient role for this route")
-                return
-            scope.setdefault("state", {})["role"] = role
-        raw_length = dict(scope["headers"]).get(b"content-length")
-        if raw_length is not None:
-            try:
-                length = int(raw_length)
-            except ValueError:
-                await self._reject(scope, send, 400, "invalid Content-Length")
-                return
-            if length < 0:
-                await self._reject(scope, send, 400, "invalid Content-Length")
-                return
-            if length > MAX_BODY_BYTES:
-                await self._reject(scope, send, 413, "request body too large")
-                return
-        try:
-            body = await self._read_body(receive)
-        except _BodyTooLarge:
-            await self._reject(scope, send, 413, "request body too large")
-            return
-        except TimeoutError:
-            await self._reject(scope, send, 408, "request body read timed out")
-            return
-        try:
-            await self.app(scope, self._replay_body(body), send)
-        except Exception as exc:  # noqa: BLE001 - redact control-plane failures
-            sys.stderr.write(
-                f"orchestrator: {method} {route} failed "
-                f"[error_type={type(exc).__name__}]\n"
-            )
-            sys.stderr.flush()
-            await self._reject(scope, send, 500, "internal error")
-
-    @staticmethod
-    async def _reject(
-        scope: Scope, send: Send, status: int, error: str,
-    ) -> None:
-        response = JSONResponse({"error": error}, status_code=status)
-        await response(scope, ControlPlaneBoundary._empty_receive, send)
-
-    @staticmethod
-    async def _empty_receive() -> Message:
-        return {"type": "http.disconnect"}
-
-    @staticmethod
-    async def _read_body(receive: Receive) -> bytes:
-        body = bytearray()
-        async with asyncio.timeout(REQUEST_BODY_TIMEOUT_SECONDS):
-            while True:
-                message = await receive()
-                if message["type"] != "http.request":
-                    break
-                body.extend(message.get("body", b""))
-                if len(body) > MAX_BODY_BYTES:
-                    raise _BodyTooLarge
-                if not message.get("more_body", False):
-                    break
-        return bytes(body)
-
-    @staticmethod
-    def _replay_body(body: bytes) -> Receive:
-        sent = False
-
-        async def replay() -> Message:
-            nonlocal sent
-            if sent:
-                return {"type": "http.disconnect"}
-            sent = True
-            return {"type": "http.request", "body": body, "more_body": False}
-
-        return replay
-
-
-class _BodyTooLarge(Exception):
-    """The streamed request exceeded the control-plane body limit."""
-
-
-def _required(value: str, name: str) -> str:
-    if not value:
-        raise HTTPException(400, f"{name} (string) is required")
-    return value
-
-
-def create_app(orch: OrchestratorCore, *, signing_key: str) -> FastAPI:
-    """Build the authenticated orchestrator ASGI application."""
-    key = signing_key.strip()
-    if not key:
-        raise ValueError(
-            "orchestrator control-plane signing key is required; "
-            "refusing to start without caller authentication"
-        )
-    app = FastAPI(
-        title="bot-bottle orchestrator",
-        docs_url=None,
-        redoc_url=None,
-        openapi_url=None,
-    )
-    app.add_middleware(ControlPlaneBoundary, signing_key=key)
-
-    @app.get("/health")
-    def health() -> dict[str, str]:
-        return {"status": "ok"}
-
-    @app.get("/gateway")
-    def gateway() -> dict[str, object]:
-        return orch.gateway_status()
-
-    @app.get("/bottles")
-    def bottles() -> dict[str, object]:
-        return {"bottles": [record.redacted() for record in orch.registry.all()]}
-
-    @app.post("/bottles", status_code=201)
-    def launch(body: LaunchBody) -> dict[str, str]:
-        rec = orch.launch_bottle(
-            _required(body.source_ip, "source_ip"),
-            image_ref=body.image_ref,
-            metadata=body.metadata,
-            policy=body.policy,
-            tokens=dict(body.tokens),
-            env_var_secret=body.env_var_secret,
-        )
-        return {"bottle_id": rec.bottle_id, "identity_token": rec.identity_token}
-
-    @app.put("/bottles/{bottle_id}/policy")
-    def set_policy(bottle_id: str, body: PolicyBody) -> dict[str, object]:
-        if orch.set_policy(bottle_id, body.policy):
-            return {"updated": True}
-        raise HTTPException(404, "no such bottle")
-
-    @app.post("/bottles/{bottle_id}/reprovision_gateway")
-    def reprovision(bottle_id: str, body: ReprovisionBody) -> dict[str, object]:
-        secret = _required(body.env_var_secret, "env_var_secret")
-        if orch.reprovision_from_secret(bottle_id, secret):
-            return {"reprovisioned": True}
-        raise HTTPException(404, "no stored secrets for this bottle")
-
-    @app.delete("/bottles/{bottle_id}")
-    def teardown(bottle_id: str) -> dict[str, object]:
-        if orch.teardown_bottle(bottle_id):
-            return {"torn_down": True}
-        raise HTTPException(404, "no such bottle")
-
-    @app.post("/reconcile")
-    def reconcile(body: ReconcileBody) -> dict[str, object]:
-        if any(not ip for ip in body.live_source_ips):
-            raise HTTPException(400, "live_source_ips must contain non-empty strings")
-        kwargs: dict[str, float] = {}
-        if body.grace_seconds is not None:
-            if not math.isfinite(body.grace_seconds) or body.grace_seconds < 0:
-                raise HTTPException(
-                    400, "grace_seconds must be a non-negative finite number",
-                )
-            kwargs["grace_seconds"] = body.grace_seconds
-        return {"reaped": orch.reconcile(body.live_source_ips, **kwargs)}
-
-    @app.post("/attribute")
-    def attribute(body: AttributeBody) -> dict[str, str]:
-        rec = orch.attribute(body.source_ip, body.identity_token)
-        if rec is None:
-            raise HTTPException(403, "unattributed")
-        return {"bottle_id": rec.bottle_id}
-
-    @app.get("/supervise/proposals")
-    def proposals() -> dict[str, object]:
-        return {"proposals": orch.supervise_pending()}
-
-    @app.post("/supervise/respond")
-    def respond(body: RespondBody) -> dict[str, object]:
-        ok, error = orch.supervise_respond(
-            _required(body.proposal_id, "proposal_id"),
-            bottle_slug=_required(body.bottle_slug, "bottle_slug"),
-            decision=_required(body.decision, "decision"),
-            notes=body.notes,
-            final_file=body.final_file,
-        )
-        if not ok:
-            raise HTTPException(409, error)
-        return {"responded": True}
-
-    @app.post("/supervise/propose", status_code=201)
-    def propose(body: ProposeBody) -> dict[str, str]:
-        source_ip = _required(body.source_ip, "source_ip")
-        if body.tool not in TOOLS:
-            raise HTTPException(400, f"tool (string) must be one of {TOOLS}")
-        rec = orch.resolve(source_ip, body.identity_token)
-        if rec is None:
-            raise HTTPException(403, "unattributed")
-        proposal_id = orch.supervise_queue_proposal(
-            rec.bottle_id,
-            tool=body.tool,
-            proposed_file=_required(body.proposed_file, "proposed_file"),
-            justification=_required(body.justification, "justification"),
-        )
-        return {"proposal_id": proposal_id}
-
-    @app.post("/supervise/poll")
-    def poll(body: PollBody) -> dict[str, object]:
-        rec = orch.resolve(
-            _required(body.source_ip, "source_ip"), body.identity_token,
-        )
-        if rec is None:
-            raise HTTPException(403, "unattributed")
-        return orch.supervise_poll_response(
-            rec.bottle_id, _required(body.proposal_id, "proposal_id"),
-        )
-
-    @app.post("/resolve")
-    def resolve(body: IdentityBody) -> dict[str, object]:
-        rec = orch.resolve(
-            _required(body.source_ip, "source_ip"), body.identity_token,
-        )
-        if rec is None:
-            raise HTTPException(403, "unattributed")
-        return {
-            "bottle_id": rec.bottle_id,
-            "policy": rec.policy,
-            "tokens": orch.tokens_for(rec.bottle_id),
-        }
-
-    return app
-
-
-__all__ = [
-    "ControlPlaneBoundary",
-    "MAX_BODY_BYTES",
-    "ORCHESTRATOR_AUTH_HEADER",
-    "create_app",
-]
@@ -21,7 +21,7 @@ from dataclasses import dataclass
 from ..log import debug
 from ..orchestrator_auth import ROLE_CLI
 from ..trust_domain import CONTROL_PLANE
-from .http_contract import ORCHESTRATOR_AUTH_HEADER
+from .server import ORCHESTRATOR_AUTH_HEADER

 DEFAULT_TIMEOUT_SECONDS = 5.0

@@ -1,11 +0,0 @@
-"""Dependency-free constants shared by orchestrator HTTP clients and server."""
-
-ORCHESTRATOR_AUTH_HEADER = "x-bot-bottle-orchestrator-auth"
-MAX_BODY_BYTES = 1 * 1024 * 1024
-REQUEST_BODY_TIMEOUT_SECONDS = 10.0
-
-__all__ = [
-    "MAX_BODY_BYTES",
-    "ORCHESTRATOR_AUTH_HEADER",
-    "REQUEST_BODY_TIMEOUT_SECONDS",
-]
@@ -1,80 +1,464 @@
-"""Uvicorn transport for the FastAPI orchestrator control plane."""
+"""Orchestrator HTTP control plane (PRD 0070).
+
+The backend-agnostic control-plane RPC (CLI / console -> orchestrator) over
+**HTTP** — the universal transport chosen in 0070 (works on every host; no
+vsock / unix-socket portability caveats):
+
+    GET    /health                    -> 200 {"status": "ok"}
+    GET    /gateway                   -> 200 {"configured", ["name","running"]}
+    GET    /bottles                   -> 200 {"bottles": [ <redacted record>, ...]}
+    POST   /bottles                   -> 201 {"bottle_id","identity_token"}  (launch)
+                                         body: {"source_ip", ["image_ref"],
+                                                ["metadata"], ["policy"],
+                                                ["tokens"], ["env_var_secret"]}
+    PUT    /bottles/<bottle_id>/policy -> 200 {"updated": true} | 404  (live reload)
+                                         body: {"policy"}
+    POST   /bottles/<bottle_id>/reprovision_gateway
+                                      -> 200 {"reprovisioned": true} | 404
+                                         body: {"env_var_secret"}
+    DELETE /bottles/<bottle_id>        -> 200 {"torn_down": true} | 404  (teardown)
+    POST   /reconcile                 -> 200 {"reaped": [bottle_id, ...]}
+                                         body: {"live_source_ips": [...],
+                                                ["grace_seconds"]}
+    POST   /attribute                 -> 200 {"bottle_id"} | 403
+    POST   /resolve                   -> 200 {"bottle_id","policy"} | 403
+                                         body: {"source_ip","identity_token"}
+    GET    /supervise/proposals       -> 200 {"proposals": [ <proposal>, ...]}
+    POST   /supervise/respond         -> 200 {"responded": true} | 409  (operator)
+                                         body: {"proposal_id","bottle_slug",
+                                                "decision", ["notes"],["final_file"]}
+    POST   /supervise/propose         -> 201 {"proposal_id"} | 403  (agent)
+                                         body: {"source_ip","identity_token",
+                                                "tool","proposed_file","justification"}
+    POST   /supervise/poll            -> 200 {"status", ["notes"],["final_file"]} | 403
+                                         body: {"source_ip","identity_token",
+                                                "proposal_id"}
+
+The `/supervise/propose` + `/supervise/poll` pair is the **agent** half of the
+supervise flow: the data plane (supervise / egress / git-gate) queues a proposal
+and polls for its response over RPC instead of opening `bot-bottle.db` directly.
+`poll` is idempotent — it never archives, so a dropped connection can't lose an
+operator decision (the row is reaped when the bottle is torn down / reconciled).
+Both attribute the caller by `(source_ip, identity_token)` exactly like
+`/resolve`, so a bottle can only ever queue or read its own proposals.
+
+`POST /bottles` / `DELETE` drive the full launch lifecycle: they mint (or
+tear down) the bottle in the registry AND broker the backend-native launch
+via the orchestrator. Register/deregister without a launch are internal to
+`OrchestratorCore`, not exposed here.
+
+Routing/handling is the pure function `dispatch()` so it is unit-testable
+without a socket; `Handler` / `OrchestratorServer` / `make_server` are a
+thin stdlib adapter around it. Listing redacts identity tokens — they are
+returned only once, to the caller that launches the bottle.
+"""

 from __future__ import annotations

+import http.server
+import json
+import math
 import os
-import socket
-import threading
-
-import uvicorn
+import socketserver
+import sys
+import typing
+from urllib.parse import urlsplit

+from ..orchestrator_auth import ROLE_CLI, ROLES
 from ..trust_domain import CONTROL_PLANE
-from .api import create_app
-from .http_contract import MAX_BODY_BYTES, ORCHESTRATOR_AUTH_HEADER
+from ..supervisor.types import TOOLS
 from .service import OrchestratorCore

-MAX_REQUESTS = 32
-KEEP_ALIVE_TIMEOUT_SECONDS = 10
+# JSON body payload type (parsed request / rendered response).
+Json = dict[str, object]
+
+# The request header carrying the caller's role-scoped control-plane token (a
+# signed JWT naming the caller's role — see orchestrator_auth). The role gates which
+# routes the caller may reach: the data plane holds a `gateway` token good only
+# for the agent-facing lookups; the host CLI holds a `cli` token for the
+# operator/mutating routes. An agent that can merely *reach* the port holds no
+# token at all, and a compromised gateway holds only `gateway` — neither can
+# drive the operator routes (approve proposals, rewrite policy, read tokens).
+ORCHESTRATOR_AUTH_HEADER = "x-bot-bottle-orchestrator-auth"
+
+# The routes the data plane (role `gateway`) is allowed to reach — exactly the
+# per-request lookups PolicyResolver makes. Every other authenticated route is
+# operator-only. `cli` is a superset role: it may reach any route.
+_GATEWAY_ROUTES: frozenset[tuple[str, str]] = frozenset({
+    ("POST", "/resolve"),
+    ("POST", "/supervise/propose"),
+    ("POST", "/supervise/poll"),
+})


-class OrchestratorServer:
-    """Small lifecycle wrapper around Uvicorn with an eagerly bound socket."""
+def _allowed_roles(method: str, route: str) -> frozenset[str]:
+    """The roles permitted on `(method, route)`: `gateway` or `cli` on the
+    data-plane routes, `cli`-only everywhere else."""
+    if (method, route) in _GATEWAY_ROUTES:
+        return ROLES
+    return frozenset({ROLE_CLI})

-    def __init__(self, config: uvicorn.Config) -> None:
-        self._server = uvicorn.Server(config)
-        self._stopped = threading.Event()
-        self._socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-        self._socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-        self._socket.bind((config.host, config.port))
-        self._socket.listen(config.backlog)
-        self.server_address = self._socket.getsockname()

-    def run(self) -> None:
+def _parse_json_object(body: bytes) -> Json:
+    """Parse a JSON object body. Raises ValueError for non-objects / bad JSON."""
+    if not body:
+        return {}
+    obj = json.loads(body)  # raises json.JSONDecodeError (a ValueError)
+    if not isinstance(obj, dict):
+        raise ValueError("request body must be a JSON object")
+    return obj
+
+
+def dispatch(  # pylint: disable=too-many-return-statements,too-many-branches
+    orch: OrchestratorCore, method: str, path: str, body: bytes, *, role: str | None = ROLE_CLI,
+) -> tuple[int, Json]:
+    """Route one control-plane request to a (status, payload) pair. Pure —
+    no I/O beyond the orchestrator — so it is fully testable without a socket.
+
+    `role` is the caller's verified control-plane role (`gateway` or `cli`), or
+    None for an unauthenticated request; an open-mode server (no signing key
+    configured — see `OrchestratorServer`) passes `cli`. Every route except
+    `GET /health` requires a role: a missing role is 401, and a role that
+    doesn't cover the route is 403 — so a `gateway` data-plane token can reach
+    `/resolve` + `/supervise/{propose,poll}` but not the operator routes
+    (rewrite policy, read injected tokens, approve its own supervise proposals).
+    The source-IP + identity-token checks inside `/resolve` and `/attribute`
+    authenticate the *bottle* a request is about, not the *caller*, so this role
+    gate is what protects the caller-privileged routes. Defaults `cli` so unit
+    tests of the routing logic don't have to thread it through."""
+    route = urlsplit(path).path.rstrip("/") or "/"
+
+    if method == "GET" and route == "/health":
+        return 200, {"status": "ok"}
+
+    # Role gate — every route below is a trusted-caller operation. Deny before
+    # touching the registry / broker / supervise store.
+    if role is None:
+        return 401, {"error": "control-plane authentication required"}
+    if role not in _allowed_roles(method, route):
+        return 403, {"error": "insufficient role for this route"}
+
+    if method == "GET" and route == "/gateway":
+        return 200, orch.gateway_status()
+
+    if method == "GET" and route == "/bottles":
+        return 200, {"bottles": [r.redacted() for r in orch.registry.all()]}
+
+    if method == "POST" and route == "/bottles":
        try:
-            self._server.run(sockets=[self._socket])
-        finally:
-            self._stopped.set()
+            data = _parse_json_object(body)
+        except ValueError as e:
+            return 400, {"error": f"invalid JSON: {e}"}
+        source_ip = data.get("source_ip")
+        if not isinstance(source_ip, str) or not source_ip:
+            return 400, {"error": "source_ip (string) is required"}
+        image_ref = data.get("image_ref")
+        metadata = data.get("metadata")
+        policy = data.get("policy")
+        raw_tokens = data.get("tokens")
+        tokens = {
+            k: v for k, v in raw_tokens.items() if isinstance(k, str) and isinstance(v, str)
+        } if isinstance(raw_tokens, dict) else {}
+        env_var_secret = data.get("env_var_secret", "")
+        rec = orch.launch_bottle(
+            source_ip,
+            image_ref=image_ref if isinstance(image_ref, str) else "",
+            metadata=metadata if isinstance(metadata, str) else "",
+            policy=policy if isinstance(policy, str) else "",
+            tokens=tokens,
+            env_var_secret=env_var_secret if isinstance(env_var_secret, str) else "",
+        )
+        return 201, {"bottle_id": rec.bottle_id, "identity_token": rec.identity_token}

-    def serve_forever(self) -> None:
-        self.run()
+    if method == "PUT" and route.startswith("/bottles/") and route.endswith("/policy"):
+        bottle_id = route[len("/bottles/"):-len("/policy")]
+        try:
+            data = _parse_json_object(body)
+        except ValueError as e:
+            return 400, {"error": f"invalid JSON: {e}"}
+        policy = data.get("policy")
+        if not isinstance(policy, str):
+            return 400, {"error": "policy (string) is required"}
+        if orch.set_policy(bottle_id, policy):
+            return 200, {"updated": True}
+        return 404, {"error": "no such bottle"}

-    def shutdown(self) -> None:
-        self._server.should_exit = True
-        self._stopped.wait(timeout=5)
+    if (
+        method == "POST"
+        and route.startswith("/bottles/")
+        and route.endswith("/reprovision_gateway")
+    ):
+        bottle_id = route[len("/bottles/") : -len("/reprovision_gateway")]
+        try:
+            data = _parse_json_object(body)
+        except ValueError as e:
+            return 400, {"error": f"invalid JSON: {e}"}
+        env_var_secret = data.get("env_var_secret")
+        if not isinstance(env_var_secret, str) or not env_var_secret:
+            return 400, {"error": "env_var_secret (string) is required"}
+        if orch.reprovision_from_secret(bottle_id, env_var_secret):
+            return 200, {"reprovisioned": True}
+        return 404, {"error": "no stored secrets for this bottle"}

-    def server_close(self) -> None:
-        self._socket.close()
+    if method == "DELETE" and route.startswith("/bottles/"):
+        bottle_id = route[len("/bottles/"):]
+        if orch.teardown_bottle(bottle_id):
+            return 200, {"torn_down": True}
+        return 404, {"error": "no such bottle"}
+
+    if method == "POST" and route == "/reconcile":
+        # Host-driven self-heal: the caller enumerates its live bottles (only
+        # the host can see the backend) and the orchestrator drops rows for
+        # every other active bottle. Trusted-caller only — an agent that could
+        # reach this would be able to unregister its neighbours.
+        try:
+            data = _parse_json_object(body)
+        except ValueError as e:
+            return 400, {"error": f"invalid JSON: {e}"}
+        raw_ips = data.get("live_source_ips")
+        if not isinstance(raw_ips, list):
+            return 400, {"error": "live_source_ips (list of strings) is required"}
+        if any(not isinstance(ip, str) or not ip for ip in raw_ips):
+            return 400, {"error": "live_source_ips must contain non-empty strings"}
+        live = raw_ips
+        grace = data.get("grace_seconds")
+        kwargs: dict[str, float] = {}
+        if grace is not None:
+            if isinstance(grace, bool) or not isinstance(grace, (int, float)):
+                return 400, {"error": "grace_seconds must be a non-negative finite number"}
+            parsed_grace = float(grace)
+            if not math.isfinite(parsed_grace) or parsed_grace < 0:
+                return 400, {"error": "grace_seconds must be a non-negative finite number"}
+            kwargs["grace_seconds"] = parsed_grace
+        return 200, {"reaped": orch.reconcile(live, **kwargs)}
+
+    if method == "POST" and route == "/attribute":
+        try:
+            data = _parse_json_object(body)
+        except ValueError as e:
+            return 400, {"error": f"invalid JSON: {e}"}
+        source_ip = data.get("source_ip")
+        token = data.get("identity_token")
+        if not isinstance(source_ip, str) or not isinstance(token, str):
+            return 400, {"error": "source_ip and identity_token (strings) required"}
+        rec = orch.attribute(source_ip, token)
+        if rec is None:
+            return 403, {"error": "unattributed"}
+        return 200, {"bottle_id": rec.bottle_id}
+
+    if method == "GET" and route == "/supervise/proposals":
+        # Operator TUI: pending supervise proposals across all bottles.
+        return 200, {"proposals": orch.supervise_pending()}
+
+    if method == "POST" and route == "/supervise/respond":
+        # Operator decision: apply (approve/modify rewrites egress policy),
+        # write the queued response, audit — all server-side on the one DB.
+        try:
+            data = _parse_json_object(body)
+        except ValueError as e:
+            return 400, {"error": f"invalid JSON: {e}"}
+        proposal_id = data.get("proposal_id")
+        bottle_slug = data.get("bottle_slug")
+        decision = data.get("decision")
+        if not (isinstance(proposal_id, str) and proposal_id):
+            return 400, {"error": "proposal_id (string) is required"}
+        if not (isinstance(bottle_slug, str) and bottle_slug):
+            return 400, {"error": "bottle_slug (string) is required"}
+        if not (isinstance(decision, str) and decision):
+            return 400, {"error": "decision (string) is required"}
+        notes = data.get("notes")
+        final_file = data.get("final_file")
+        ok, err = orch.supervise_respond(
+            proposal_id,
+            bottle_slug=bottle_slug,
+            decision=decision,
+            notes=notes if isinstance(notes, str) else "",
+            final_file=final_file if isinstance(final_file, str) else None,
+        )
+        if ok:
+            return 200, {"responded": True}
+        return 409, {"error": err}
+
+    if method == "POST" and route == "/supervise/propose":
+        # Agent half: queue a proposal, attributed to the caller resolved from
+        # (source_ip, identity_token) — never a caller-supplied slug — so the
+        # data plane can't forge attribution. Fail-closed 403 when unattributed.
+        try:
+            data = _parse_json_object(body)
+        except ValueError as e:
+            return 400, {"error": f"invalid JSON: {e}"}
+        source_ip = data.get("source_ip")
+        token = data.get("identity_token")
+        tool = data.get("tool")
+        proposed_file = data.get("proposed_file")
+        justification = data.get("justification")
+        if not isinstance(source_ip, str) or not source_ip:
+            return 400, {"error": "source_ip (string) is required"}
+        if not isinstance(tool, str) or tool not in TOOLS:
+            return 400, {"error": f"tool (string) must be one of {TOOLS}"}
+        if not isinstance(proposed_file, str) or not proposed_file:
+            return 400, {"error": "proposed_file (string) is required"}
+        if not isinstance(justification, str) or not justification:
+            return 400, {"error": "justification (string) is required"}
+        rec = orch.resolve(source_ip, token if isinstance(token, str) else "")
+        if rec is None:
+            return 403, {"error": "unattributed"}
+        proposal_id = orch.supervise_queue_proposal(
+            rec.bottle_id, tool=tool, proposed_file=proposed_file,
+            justification=justification,
+        )
+        return 201, {"proposal_id": proposal_id}
+
+    if method == "POST" and route == "/supervise/poll":
+        # Agent half: non-blocking read of the caller's own proposal decision.
+        # Attributed like /propose, and scoped to the resolved bottle id, so a
+        # guessed proposal_id can never read another bottle's response.
+        try:
+            data = _parse_json_object(body)
+        except ValueError as e:
+            return 400, {"error": f"invalid JSON: {e}"}
+        source_ip = data.get("source_ip")
+        token = data.get("identity_token")
+        proposal_id = data.get("proposal_id")
+        if not isinstance(source_ip, str) or not source_ip:
+            return 400, {"error": "source_ip (string) is required"}
+        if not isinstance(proposal_id, str) or not proposal_id:
+            return 400, {"error": "proposal_id (string) is required"}
+        rec = orch.resolve(source_ip, token if isinstance(token, str) else "")
+        if rec is None:
+            return 403, {"error": "unattributed"}
+        return 200, orch.supervise_poll_response(rec.bottle_id, proposal_id)
+
+    if method == "POST" and route == "/resolve":
+        # The per-request lookup the multi-tenant gateway makes: returns the
+        # bottle's policy. Requires a matching (source_ip, identity_token)
+        # pair — a missing/empty/mismatched token fail-closes (403), no
+        # source-IP-only fallback.
+        try:
+            data = _parse_json_object(body)
+        except ValueError as e:
+            return 400, {"error": f"invalid JSON: {e}"}
+        source_ip = data.get("source_ip")
+        token = data.get("identity_token")
+        if not isinstance(source_ip, str) or not source_ip:
+            return 400, {"error": "source_ip (string) is required"}
+        rec = orch.resolve(source_ip, token if isinstance(token, str) else "")
+        if rec is None:
+            return 403, {"error": "unattributed"}
+        # tokens are the in-memory per-bottle egress auth values the gateway
+        # injects; served here, never persisted.
+        return 200, {
+            "bottle_id": rec.bottle_id,
+            "policy": rec.policy,
+            "tokens": orch.tokens_for(rec.bottle_id),
+        }
+
+    return 404, {"error": "not found"}
+
+
+class Handler(http.server.BaseHTTPRequestHandler):
+    """Thin stdlib adapter: read the body, call `dispatch`, write JSON."""
+
+    # Quiet by default (the orchestrator has its own logging); opt back into
+    # stdlib access logging with BOT_BOTTLE_ORCHESTRATOR_DEBUG.
+    def log_message(self, format: str, *args: typing.Any) -> None:  # noqa: A002
+        if os.environ.get("BOT_BOTTLE_ORCHESTRATOR_DEBUG"):
+            super().log_message(format, *args)
+
+    def _serve(self, method: str) -> None:
+        """Read the request body, dispatch it, and write the JSON reply. A
+        dispatch failure (e.g. a broker error) returns a 500 rather than
+        crashing the connection, so one bad request can't take the control
+        plane down for the caller."""
+        server = self.server
+        assert isinstance(server, OrchestratorServer)
+        length = int(self.headers.get("Content-Length") or 0)
+        body = self.rfile.read(length) if length > 0 else b""
+        role = server.role_for(self.headers.get(ORCHESTRATOR_AUTH_HEADER, ""))
+        try:
+            status, payload = dispatch(
+                server.orchestrator, method, self.path, body, role=role)
+        except Exception as e:  # noqa: BLE001 — the control plane must stay up
+            # Do not echo exception messages to the caller or logs: broker and
+            # persistence exceptions can contain request data. The operation,
+            # route, and exception type are enough to correlate a traceback.
+            sys.stderr.write(
+                f"orchestrator: {method} {self.path} failed "
+                f"[error_type={type(e).__name__}]\n"
+            )
+            sys.stderr.flush()
+            status, payload = 500, {"error": "internal error"}
+        data = json.dumps(payload).encode()
+        self.send_response(status)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(data)))
+        self.end_headers()
+        self.wfile.write(data)
+
+    def do_GET(self) -> None:
+        self._serve("GET")
+
+    def do_POST(self) -> None:
+        self._serve("POST")
+
+    def do_PUT(self) -> None:
+        self._serve("PUT")
+
+    def do_DELETE(self) -> None:
+        self._serve("DELETE")
+
+
+class OrchestratorServer(socketserver.ThreadingMixIn, http.server.HTTPServer):
+    """Threading HTTP server that carries the orchestrator for its handlers.
+
+    Holds the per-host control-plane *signing key* (from
+    `$BOT_BOTTLE_ORCHESTRATOR_TOKEN`, injected by the launcher into the
+    orchestrator process only) and verifies each request's role-scoped token
+    against it. When a key is set, every route but `/health` requires a valid
+    token whose role covers the route; when it is unset the server runs **open**
+    (full `cli` access) and says so loudly at startup — a fail-visible fallback
+    for tests and any backend that hasn't wired the key yet (e.g. Firecracker,
+    whose nft boundary already blocks agents from the control-plane port)."""
+
+    daemon_threads = True
+    allow_reuse_address = True
+
+    def __init__(self, address: tuple[str, int], orchestrator: OrchestratorCore) -> None:
+        self.orchestrator = orchestrator
+        # The control-plane trust domain's signing key, as injected into THIS
+        # (the owning) process by the launcher (#476). Unset → open mode below.
+        self._signing_key = CONTROL_PLANE.key_from_env()
+        if not self._signing_key:
+            sys.stderr.write(
+                "orchestrator: WARNING — no control-plane signing key "
+                f"(${CONTROL_PLANE.key_env}); running WITHOUT caller "
+                "authentication. Any client that can reach this port can drive "
+                "it. Backends that put the control plane on an agent-reachable "
+                "network MUST set this.\n"
+            )
+            sys.stderr.flush()
+        super().__init__(address, Handler)
+
+    def role_for(self, presented: str) -> str | None:
+        """The role the request is authorized as, or None if unauthenticated.
+        Open mode (no signing key) grants full `cli` access — the fail-visible
+        fallback. Otherwise verify the presented signed token; a missing/invalid
+        token yields None (→ 401), a valid one yields its `gateway`/`cli`
+        role (→ per-route 401/403 in `dispatch`)."""
+        if not self._signing_key:
+            return ROLE_CLI
+        return CONTROL_PLANE.verify(presented, self._signing_key)


 def make_server(
-    orchestrator: OrchestratorCore,
-    host: str = "127.0.0.1",
-    port: int = 0,
-    *,
-    signing_key: str | None = None,
+    orchestrator: OrchestratorCore, host: str = "127.0.0.1", port: int = 0
 ) -> OrchestratorServer:
-    """Build a bounded Uvicorn server around the orchestrator application."""
-    key = CONTROL_PLANE.key_from_env() if signing_key is None else signing_key
-    app = create_app(orchestrator, signing_key=key)
-    config = uvicorn.Config(
-        app,
-        host=host,
-        port=port,
-        access_log=bool(os.environ.get("BOT_BOTTLE_ORCHESTRATOR_DEBUG")),
-        log_level="info",
-        limit_concurrency=MAX_REQUESTS,
-        timeout_keep_alive=KEEP_ALIVE_TIMEOUT_SECONDS,
-        server_header=False,
-    )
-    return OrchestratorServer(config)
+    """Build (but do not start) a control-plane server. `port=0` binds an
+    ephemeral port — read `server.server_address` for the actual one."""
+    return OrchestratorServer((host, port), orchestrator)


 __all__ = [
-    "KEEP_ALIVE_TIMEOUT_SECONDS",
-    "MAX_BODY_BYTES",
-    "MAX_REQUESTS",
+    "dispatch", "Handler", "OrchestratorServer", "make_server", "Json",
    "ORCHESTRATOR_AUTH_HEADER",
-    "OrchestratorServer",
-    "create_app",
-    "make_server",
 ]
@@ -371,12 +371,10 @@ class OrchestratorCore:
        if not encrypted:
            return False
        try:
-            decrypted = {
-                k: decrypt_value(env_var_secret, v) for k, v in encrypted.items()
-            }
+            self._tokens[bottle_id] = {k: decrypt_value(env_var_secret, v)
+                                       for k, v in encrypted.items()}
        except ValueError:
            return False
-        self._tokens[bottle_id] = decrypted
        return True

    # --- consolidated gateway ----------------------------------------------
@@ -113,7 +113,7 @@ _MIGRATIONS = TableMigrations(
        # egress allowlist / routes / git config selected by source IP. The
        # multi-tenant gateway resolves it per request via `attribute`.
        "ALTER TABLE orchestrator_bottles ADD COLUMN policy TEXT NOT NULL DEFAULT ''",
-        # v4 — per-bottle encrypted egress secrets (PRD 0080).
+        # v4 — per-bottle encrypted egress secrets (PRD prd-new-secret-provider).
        # One row per env-var: key (env-var name) is plaintext for auditing;
        # value is the encrypted token string. The encryption key (ENV_VAR_SECRET)
        # lives only in the agent's environment — a row alone cannot recover the
@@ -129,10 +129,6 @@ _MIGRATIONS = TableMigrations(
        # v5 — index for fast per-bottle lookups and bulk DELETE on teardown.
        "CREATE INDEX IF NOT EXISTS idx_bottled_agent_secrets_id "
        "ON bottled_agent_secrets (bottled_agent_id, type)",
-        # v6 — unauthenticated legacy ciphertext must never be selected by
-        # attacker-controlled blob contents. Existing local agents are
-        # intentionally reprovisioned instead of retaining downgrade support.
-        "DELETE FROM bottled_agent_secrets",
    ],
 )

@@ -1,4 +1,4 @@
-"""Symmetric encryption for per-bottle egress secrets (PRD 0080).
+"""Symmetric encryption for per-bottle egress secrets (PRD prd-new-secret-provider).

 Each agent receives a random ENV_VAR_SECRET at startup — passed as an env var,
 never logged or persisted. The host uses this key to encrypt each egress auth
@@ -12,15 +12,9 @@ reattachment path reads ENV_VAR_SECRET from the running agent container via
 ``POST /bottles/<id>/reprovision_gateway``; the orchestrator decrypts the
 stored rows and re-populates ``_tokens``.

-Encryption scheme: encrypt-then-MAC using independent HMAC-SHA256-derived
-encryption and authentication subkeys (stdlib-only, no external deps). Each
-value is encrypted independently. New output blobs are:
-
-``version || nonce (16 bytes) || ciphertext || tag (32 bytes)``
-
-encoded as URL-safe base64 (no padding). Unversioned legacy ciphertext is
-rejected; the registry migration clears those rows rather than allowing blob
-contents to select an unauthenticated decoder.
+Encryption scheme: HMAC-SHA256 used as a PRF in CTR mode (stdlib-only,
+no external deps). Each value is encrypted independently. The output blob is
+``nonce (16 bytes) || ciphertext`` encoded as URL-safe base64 (no padding).

    keystream_block_i = HMAC-SHA256(key, nonce || i.to_bytes(4, "big"))
    ciphertext_i      = plaintext_i XOR keystream_block_i[:len(plaintext_i)]
@@ -36,8 +30,6 @@ import secrets
 _KEY_BYTES = 32    # 256-bit key from ENV_VAR_SECRET
 _NONCE_BYTES = 16  # 128-bit random nonce per encrypt call
 _BLOCK = 32        # HMAC-SHA256 output width == one keystream block
-_TAG_BYTES = 32
-_VERSION = b"BBSE1"

 # Env-var name the agent container receives at startup.
 ENV_VAR_SECRET_NAME = "ENV_VAR_SECRET"
@@ -49,13 +41,7 @@ def new_env_var_secret() -> str:


 def _b64dec(s: str) -> bytes:
-    return base64.b64decode(
-        s + "=" * (-len(s) % 4), altchars=b"-_", validate=True,
-    )
-
-
-def _subkey(key: bytes, purpose: bytes) -> bytes:
-    return hmac.new(key, b"bot-bottle-secret-store:" + purpose, hashlib.sha256).digest()
+    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))


 def _keystream(key: bytes, nonce: bytes, block_index: int) -> bytes:
@@ -67,53 +53,37 @@ def _keystream(key: bytes, nonce: bytes, block_index: int) -> bytes:
 def encrypt_value(secret_b64: str, plaintext: str) -> str:
    """Encrypt a single string value with *secret_b64* (the ENV_VAR_SECRET).

-    Returns a URL-safe base64 authenticated blob suitable for
+    Returns a URL-safe base64 blob ``nonce || ciphertext`` suitable for
    the ``bottled_agent_secrets.value`` column."""
    key = _b64dec(secret_b64)
-    encryption_key = _subkey(key, b"encryption")
-    authentication_key = _subkey(key, b"authentication")
    pt = plaintext.encode()
    nonce = secrets.token_bytes(_NONCE_BYTES)
    ct = bytearray()
    for i in range(0, len(pt), _BLOCK):
        chunk = pt[i : i + _BLOCK]
-        ks = _keystream(encryption_key, nonce, i // _BLOCK)[: len(chunk)]
+        ks = _keystream(key, nonce, i)[: len(chunk)]
        ct.extend(p ^ k for p, k in zip(chunk, ks))
-    authenticated = _VERSION + nonce + bytes(ct)
-    tag = hmac.new(authentication_key, authenticated, hashlib.sha256).digest()
-    return base64.urlsafe_b64encode(authenticated + tag).rstrip(b"=").decode()
+    return base64.urlsafe_b64encode(nonce + bytes(ct)).rstrip(b"=").decode()


 def decrypt_value(secret_b64: str, blob_b64: str) -> str:
    """Decrypt a blob produced by :func:`encrypt_value`.

    Returns the original plaintext string. Raises ``ValueError`` for malformed
-    input, authentication failure, or a key mismatch."""
+    input or a key mismatch (wrong key produces garbage, not an error, unless
+    the plaintext is non-UTF-8 — treat all such failures as wrong key)."""
    key = _b64dec(secret_b64)
    try:
        blob = _b64dec(blob_b64)
-    except (ValueError, TypeError) as exc:
+    except Exception as exc:
        raise ValueError(f"invalid ciphertext blob: {exc}") from exc
-    if not blob.startswith(_VERSION):
-        raise ValueError("unsupported ciphertext format")
-    minimum = len(_VERSION) + _NONCE_BYTES + _TAG_BYTES
-    if len(blob) < minimum:
+    if len(blob) < _NONCE_BYTES:
        raise ValueError("ciphertext blob too short")
-    authenticated, supplied_tag = blob[:-_TAG_BYTES], blob[-_TAG_BYTES:]
-    authentication_key = _subkey(key, b"authentication")
-    expected_tag = hmac.new(
-        authentication_key, authenticated, hashlib.sha256,
-    ).digest()
-    if not hmac.compare_digest(supplied_tag, expected_tag):
-        raise ValueError("ciphertext authentication failed")
-    nonce_start = len(_VERSION)
-    nonce = blob[nonce_start : nonce_start + _NONCE_BYTES]
-    ciphertext = blob[nonce_start + _NONCE_BYTES : -_TAG_BYTES]
-    encryption_key = _subkey(key, b"encryption")
+    nonce, ciphertext = blob[:_NONCE_BYTES], blob[_NONCE_BYTES:]
    pt = bytearray()
    for i in range(0, len(ciphertext), _BLOCK):
        chunk = ciphertext[i : i + _BLOCK]
-        ks = _keystream(encryption_key, nonce, i // _BLOCK)[: len(chunk)]
+        ks = _keystream(key, nonce, i)[: len(chunk)]
        pt.extend(c ^ k for c, k in zip(chunk, ks))
    try:
        return bytes(pt).decode()
@@ -121,9 +91,4 @@ def decrypt_value(secret_b64: str, blob_b64: str) -> str:
        raise ValueError(f"decryption produced non-UTF-8 output (wrong key?): {exc}") from exc


-__all__ = [
-    "ENV_VAR_SECRET_NAME",
-    "new_env_var_secret",
-    "encrypt_value",
-    "decrypt_value",
-]
+__all__ = ["ENV_VAR_SECRET_NAME", "new_env_var_secret", "encrypt_value", "decrypt_value"]
@@ -20,9 +20,7 @@ from __future__ import annotations

 import fcntl
 import hashlib
-import json
 import os
-import re
 import shutil
 import tempfile
 from pathlib import Path
@@ -39,12 +37,9 @@ _BUNDLED = _PKG / "_resources"                   # wheel-shipped copies
 # the two lists in sync (``test_resources`` guards that every entry exists).
 BUNDLED_RESOURCES: tuple[str, ...] = (
    "pyproject.toml",
-    "image-build-args.json",
    "Dockerfile.gateway",
    "Dockerfile.orchestrator",
    "Dockerfile.orchestrator.fc",
-    "requirements.gateway.lock",
-    "requirements.orchestrator.lock",
    "nix/firecracker-netpool.nix",
    "scripts/firecracker-netpool.sh",
 )
@@ -52,12 +47,6 @@ BUNDLED_RESOURCES: tuple[str, ...] = (
 # Present at a checkout root, never in a bare installed package — the cheap
 # tell for which layout we're in.
 _CHECKOUT_MARKER = "Dockerfile.gateway"
-_IMAGE_BUILD_ARGS_FILE = "image-build-args.json"
-_CENTRAL_BUILD_ARG_NAMES = frozenset({
-    "DOCKER_CLI_BASE_IMAGE",
-    "NODE_BASE_IMAGE",
-    "PYTHON_BASE_IMAGE",
-})


 class ResourceError(RuntimeError):
@@ -89,69 +78,6 @@ def dockerfile(name: str) -> Path:
    return build_root() / name


-def image_build_args(
-    dockerfile_path: str | Path,
-    *,
-    context: str | Path | None = None,
-) -> dict[str, str]:
-    """Return centralized arguments declared by ``dockerfile_path``.
-
-    Base-image arguments deliberately have no Dockerfile defaults. Their
-    digest-pinned values live in one repository input file and every supported
-    build path calls this helper before invoking its OCI builder. Explicit
-    caller-supplied arguments may still override this returned mapping.
-    """
-    path = Path(dockerfile_path)
-    if not path.is_absolute() and context is not None:
-        path = Path(context) / path
-    try:
-        text = path.read_text(encoding="utf-8")
-    except OSError:
-        # Generic callers and tests may build an ephemeral Dockerfile outside
-        # bot-bottle. The builder will report a genuinely missing file.
-        return {}
-    declared = set(re.findall(
-        r"(?m)^\s*ARG\s+([A-Za-z_][A-Za-z0-9_]*)\s*$",
-        text,
-    ))
-    wanted = declared & _CENTRAL_BUILD_ARG_NAMES
-    if not wanted:
-        return {}
-    # Generated Dockerfiles (notably the macOS nested-container layer) live in
-    # temporary build contexts. Resolve their declaration there, but take the
-    # centralized values from that context only when it carries its own input
-    # file; otherwise use bot-bottle's staged build root.
-    context_root = Path(context) if context is not None else None
-    root = (
-        context_root
-        if context_root is not None
-        and (context_root / _IMAGE_BUILD_ARGS_FILE).is_file()
-        else build_root()
-    )
-    inputs_path = root / _IMAGE_BUILD_ARGS_FILE
-    try:
-        inputs = json.loads(inputs_path.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError) as exc:
-        raise ResourceError(
-            f"cannot read centralized image build arguments from {inputs_path}: {exc}"
-        ) from exc
-    if not isinstance(inputs, dict):
-        raise ResourceError(f"{inputs_path} must contain a JSON object")
-    missing = wanted - inputs.keys()
-    if missing:
-        raise ResourceError(
-            f"{inputs_path} lacks required image build arguments: "
-            f"{', '.join(sorted(missing))}"
-        )
-    invalid = [name for name in wanted if not isinstance(inputs[name], str)]
-    if invalid:
-        raise ResourceError(
-            f"{inputs_path} has non-string image build arguments: "
-            f"{', '.join(sorted(invalid))}"
-        )
-    return {name: inputs[name] for name in sorted(wanted)}
-
-
 def nix_netpool_module() -> Path:
    """Absolute path to the firecracker netpool NixOS module."""
    return build_root() / "nix" / "firecracker-netpool.nix"
@@ -40,7 +40,7 @@ from .paths import (

 class ProvisioningError(RuntimeError):
    """A control-plane auth invariant would be violated (e.g. starting the
-    orchestrator without its signing key)."""
+    orchestrator without its signing key — which would run OPEN)."""


@dataclass(frozen=True)
@@ -67,8 +67,9 @@ class TrustDomain:

    def key_from_env(self, environ: Mapping[str, str] | None = None) -> str:
        """The signing key as the owning process sees it — read from `key_env`
-        (default `os.environ`). ``""`` when unset; owning services reject that
-        value rather than start without authentication."""
+        (default `os.environ`). "" when unset; the caller decides whether that is
+        fatal (`ControlPlaneProvisioning`) or the open-mode fallback
+        (`OrchestratorServer`)."""
        env = os.environ if environ is None else environ
        return env.get(self.key_env, "").strip()

@@ -7,7 +7,6 @@ picking the right document for what you're capturing.

 | Artifact | For |
 |---|---|
-| **Design workflow** (`docs/design-workflow.md`) | How discussion becomes canonical design, how dependencies are recorded, and when implementation may begin. |
 | **Glossary** (`docs/glossary.md`) | Canonical term definitions — what words mean in this project. |
 | **PRD** (`docs/prds/`) | A feature: what to build, scope, success criteria. |
 | **Research note** (`docs/research/`) | A landscape/tradeoff investigation. |
@@ -1,53 +1,50 @@
 # CI

-## Required pull-request gate
+The test workflow lives at [`.gitea/workflows/test.yml`](../.gitea/workflows/test.yml).
+It runs the unit suite plus one integration job per backend
+(`integration-docker`, `integration-firecracker`, `integration-macos`) on:

-[`.gitea/workflows/test.yml`](../.gitea/workflows/test.yml) runs the unit
-suite, Docker integration suite, combined coverage report, and diff-coverage
-gate when tested package/build inputs change on a pull request or on `main`.
+- every push to a branch with an open pull request, and
+- every push to `main`.

-The Docker job preflights the backend before discovery. Gitea's `act_runner`
-runs the job in a container with the host Docker socket, so the test process
-reaches control-plane siblings through the job's Docker network and uses named
-Docker volumes for orchestrator/CA state the host daemon must mount. The
-orchestrator runs the package baked into the image built from the checkout; it
-does not bind the job container's invisible workspace into a sibling container.
-Docker integration jobs share fixed singleton names, so required and manual
-runs use one non-cancelling concurrency group. The shared agent/gateway network
-has an explicit subnet, which Docker requires for the pinned source IPs used as
-the isolation/attribution key.
+`integration-macos` is the exception: it is **advisory**, running only on
+`workflow_dispatch` (manual dispatch), never on push or pull requests. It targets the
+Apple Container backend on a self-hosted macOS runner (label `macos`,
+registered in host mode — Apple Container can't run in a Linux container, so it
+can't reuse the `kvm` runner). A single non-redundant laptop must not be able
+to block a PR merge, so the job stays out of the `coverage` job's `needs` and
+its coverage never feeds the diff-coverage gate. Because the infra container is
+a singleton (`bot-bottle-mac-infra`), the job declares a `concurrency` group
+and tears the container down on exit; keep runner concurrency at 1. See the
+README "macOS Apple Container" CI note for runner provisioning.

-`scripts.unittest_gate` enforces the Docker job's contract: all 22 integration
-tests must execute and none may skip. This includes the real gateway-image,
-control-plane authentication, multitenant policy/token isolation,
-sandbox-escape, and orphan-network tests. Backend skip decorators remain useful
-for local runs, but the CI preflight plus execution-count gate prevents a
-missing backend or runner-topology regression from becoming a green job.
+Each integration job selects its backend via `BOT_BOTTLE_BACKEND` and
+runs a **preflight** (`./cli.py backend status --backend=<name>`) that
+prints a clear per-check readiness summary and fails the job when the
+backend is missing — so absent infrastructure is visible at the job level
+rather than hidden among per-test `unittest.skip` lines. The skip guards in
+[`tests/_backend.py`](../tests/_backend.py) gate on the same readiness
+check (`bot_bottle.backend.has_backend`): backend-agnostic tests use
+`skip_unless_selected_backend_available()` and run through whichever
+backend is selected (checking, e.g., Linux + `/dev/kvm` for Firecracker
+rather than unrelated Docker availability); Docker-implementation tests use
+`skip_unless_backend("docker")` and no-op under a non-Docker run.

-Combined unit + Docker coverage is informational globally. Two focused gates
-are enforced:
+A small subset of integration tests skip when running specifically
+under Gitea Actions (`GITEA_ACTIONS=true`), because `act_runner` runs
+the job inside a container with the host's `/var/run/docker.sock`
+mounted in. That topology breaks two assumptions those tests make:

- changed executable Python lines must be at least 90% covered; and
- the validated critical security/logic core must remain at least 90% covered.
+- networks created via the host daemon aren't always visible to a
+  same-process `docker network ls` call from inside the job container,
+  and
+- ports published by sibling containers land on the host's loopback,
+  not on the job container's `127.0.0.1` — so HTTP probes against
+  `http://127.0.0.1:<host_port>` from inside the job time out.

-## Privileged pre-release matrix
-
-[`.gitea/workflows/pre-release-test.yml`](../.gitea/workflows/pre-release-test.yml)
-is manually dispatched before a release. It repeats unit and Docker integration
-coverage, then runs:
-
- Firecracker integration on the self-hosted `kvm` runner; and
- advisory Apple Container integration on the self-hosted `macos` runner.
-
-These privileged host-mode runners never execute unreviewed pull-request code
-automatically. Firecracker coverage is combined in the manual pre-release
-report; macOS reports advisory coverage in its own job. The macOS infra
-container is a singleton, so its job uses a concurrency group and always tears
-the service down.
-
-## Scheduled canary
-
-[`.gitea/workflows/canaries.yml`](../.gitea/workflows/canaries.yml) runs weekly
-and on manual dispatch. It verifies the pinned gitleaks release URL, checksum,
-archive shape, and executable. The same unittest execution gate requires at
-least one executed canary and rejects skips.
+The affected tests (`test_orphan_cleanup.test_create_and_remove`,
+`test_gateway_image.TestGatewayImage`) still run
+locally where the test process and Docker daemon share a host.
+Making them work in CI is a follow-up: either re-write them to
+discover container IPs via `docker inspect`, or reconfigure the
+runner with host networking.
@@ -3,10 +3,6 @@
 - **Status:** Accepted
 - **Date:** 2026-06-25
 - **Deciders:** didericis
- **Revised:** 2026-07-27 — thresholds relaxed (critical minimum 90→85%,
-  diff-coverage gate 90→80%) to cut low-value test churn on changed lines.
-  The risk-weighting structure and the "global is informational" rule are
-  unchanged.

 ## Context

@@ -38,13 +34,12 @@ a regression (Goodhart's law).
 Coverage is **risk-weighted**, measured over the **combined unit +
 integration** suites, with three rules:

-1. **Critical modules must remain ≥ 85%.** The curated security/logic core
-   covers the host and gateway egress policy, manifest trust boundary,
-   git-gate enforcement, supervise protocol/server, YAML parser, and bottle
-   state. The concrete module list lives in `scripts/critical-modules.txt`;
-   `scripts/critical_modules.py` rejects stale or ambiguous entries before
-   Coverage.py can silently ignore them. These modules are unit-testable, so
-   CI enforces the aggregate minimum independently of diff coverage.
+1. **Critical modules target ≥ 90%.** The security/logic core —
+   `egress_addon{,_core}.py`, `dlp_detectors.py`, `egress.py`,
+   `manifest*.py`, `git_gate.py`, `git_http_backend.py`, `supervise.py`,
+   `yaml_subset.py`, `bottle_state.py` — is Docker-independent and
+   unit-testable, so it carries the high bar. We ratchet toward 90% as
+   these modules are touched; new gaps in them are not acceptable.

 2. **Subprocess/backend orchestration is covered by the integration
   suite, not omitted.** `scripts/coverage.sh` runs unit + integration
@@ -59,7 +54,7 @@ integration** suites, with three rules:

 The forward-looking guard is a **diff-coverage gate**
 (`scripts/diff_coverage.py`): new/changed executable lines on a branch
-must be ≥ 80% covered. This catches regressions where they are
+must be ≥ 90% covered. This catches regressions where they are
 introduced without forcing a back-fill crusade through legacy glue. The
 gate skips lines in omitted files (there is no coverage data for them),
 so the omit list cannot launder *new* logic into the dark: anything that
@@ -87,9 +82,6 @@ omit list.
  (critical-module standard + diff coverage) are Docker-independent.
 - "We're at N%" is now a curated figure; outsiders should read the
  policy, not just the badge.
- A rename or removal in the curated list fails CI. Updating the list is an
-  explicit review of where the security-critical behavior moved, not a way to
-  improve the percentage by omission.

 ## Links

@@ -1,13 +1,9 @@
-# ADR 0005: Keep tracker metadata on one tracker object
+# ADR 0005: Keep tracker metadata on issues

 - **Status:** Accepted
 - **Date:** 2026-07-18
 - **Deciders:** didericis

-> **Amended 2026-07-26.** A pull request may carry labels directly instead of
-> linking a tracking issue. When a PR does link an issue, the issue remains the
-> canonical owner of planning metadata and the reference is validated.
-
 ## Context

 Gitea exposes labels on both issues and pull requests. Applying the same labels
@@ -24,29 +20,19 @@ would make the issue history less truthful.

 ## Decision

-Issues are the canonical tracker records and own labels when a separate work
-item exists. Every issue has at least one label. An issue opened or left
-without labels receives `Status/Needs Triage` automatically until it is
-classified.
+Issues are the canonical tracker records and own labels. Every issue has at
+least one label. An issue opened or left without labels receives
+`Status/Needs Triage` automatically until it is classified.

-Every new pull request is tracked in exactly one of two mutually exclusive
-ways:
-
-1. It deliberately references at least one existing issue in its title or
-   description. Tracker metadata stays on that issue and the PR remains
-   unlabelled.
-2. It carries at least one label directly when a separate issue would add no
-   useful planning context.
-
-Issue references use one of these forms:
+Pull requests carry no labels. Every new PR deliberately references at least
+one existing issue in its title or description with one of these forms:

 - `Closes #123`, `Fixes #123`, or `Resolves #123` when merging completes it.
 - `Part of #123`, `Related to #123`, `Refs #123`, or `References #123` when it
  contributes without completing it.

-Gitea Actions enforces the exclusive either/or PR rule, validates any issue
-references, and repairs the empty issue-label state. Branch protection makes
-the PR policy check required.
+Gitea Actions enforces both PR rules as a status check and repairs the empty
+issue-label state. Branch protection makes the PR policy check required.

 The policy applies from 2026-07-18 onward. Existing issues may be labelled as
 they are encountered, but closed PRs are grandfathered: no retrospective
@@ -54,13 +40,9 @@ issues or PR labels are created solely to make history conform.

 ## Consequences

- Classification, priority, and workflow metadata have one source of truth for
-  each change: the linked issue when one exists, otherwise the PR.
- For issue-backed changes, the PR's issue link is the navigation path to its
-  planning metadata.
+- Classification, priority, and workflow metadata have one source of truth.
+- A PR's issue link is the navigation path to its planning metadata.
 - Multi-PR issues do not require copied or synchronized labels.
- Small standalone changes do not require a tracking issue created solely to
-  satisfy automation.
 - `Status/Needs Triage` is an intentional fallback, not a final
  classification.
 - Direct issue creation remains convenient; automation repairs a missing label
@@ -71,6 +53,5 @@ issues or PR labels are created solely to make history conform.
 ## Links

 - Issue #405.
- `.gitea/workflows/tracker-policy-pr.yml`.
- `.gitea/workflows/tracker-policy-issues.yml`.
+- `.gitea/workflows/tracker-policy.yml`.
 - `scripts/tracker_policy.py`.
@@ -1,218 +0,0 @@
-# Design workflow
-
-How bot-bottle turns discussion into canonical design and then into
-implementation without leaving the repository's architecture scattered across
-issue and review threads.
-
-The goal is not more documentation. The goal is one discoverable current answer
-for every load-bearing design question.
-
-## Sources of truth
-
-Design artifacts have different jobs:
-
-| Artifact | Authority |
-|---|---|
-| Decision records | Stable system-wide boundaries, policies, and invariants |
-| PRDs | The current design for a feature |
-| Research notes | Evidence and tradeoff analysis; informative, not normative |
-| Issues | Work tracking, open questions, and discussion |
-| Pull-request comments | Review history; never the final home of a design decision |
-
-When a discussion changes the design, update the relevant PRD or decision
-record before treating the discussion as resolved. A comment may explain why a
-decision changed, but future implementers must not need to reconstruct the
-decision from a thread.
-
-Avoid duplicating the same rule in several canonical documents. Prefer one
-canonical statement and links from dependent documents.
-
-## Choosing the canonical artifact
-
-Use a PRD when the decision describes a feature: its behavior, scope, success
-criteria, trust model, implementation slices, and tests.
-
-Use a decision record when the choice is broader than one feature or will
-constrain several future features. Examples include state ownership, credential
-boundaries, compatibility policy, and what the project does or does not claim
-as a security guarantee.
-
-Use a research note when the conclusion depends on comparing external systems,
-protocols, or approaches. Promote any resulting project decision into a PRD or
-decision record.
-
-## From discussion to implementation
-
-### 1. Open the design discussion
-
-An issue may start with incomplete requirements. Record:
-
- the problem and desired outcome;
- known security or compatibility constraints;
- the current owner of affected state and credentials;
- related PRDs, decisions, issues, and pull requests;
- open questions that would materially change the implementation.
-
-Do not disguise an unresolved trust-boundary or state-ownership decision as an
-implementation detail.
-
-### 2. Draft or update the canonical design
-
-Before substantial implementation, write the feature PRD and update any
-system-wide decision it changes.
-
-An active design should make these relationships visible near its top:
-
-```markdown
-Status: Draft | Active | Superseded | Retargeted
-Depends on: #...
-Supersedes: ...
-```
-
-Record dependencies only on the dependent document. Do not maintain reverse
-`Blocks` lists that can drift as dependent work changes.
-
-For security-sensitive work, state:
-
- the exact guarantee and explicit non-guarantees;
- trusted and untrusted components;
- who creates each identity or attribution field;
- who owns durable state;
- failure and recovery behavior;
- how the design is tested at its boundaries.
-
-### 3. Resolve review into the repository
-
-When review settles a design-changing question:
-
-1. Update the canonical document in the same pull request.
-2. Mark conflicting documents Superseded or Retargeted, or update them.
-3. Add or adjust dependency links.
-4. Leave a concise resolution comment linking to the canonical change.
-
-A useful resolution comment is:
-
-```text
-Resolution: <what was decided>
-Canonicalized in: <document/section/commit>
-Supersedes: <older statement, if any>
-Follow-up: <remaining implementation or question>
-```
-
-The resolution is incomplete until the repository reflects it.
-
-### 4. Check design readiness
-
-Implementation may begin when:
-
- the PRD's material trust, ownership, and compatibility questions are settled;
- dependencies and blockers are explicit;
- the design agrees with current architecture and decision records;
- superseded documents are marked or updated;
- success criteria and boundary tests are concrete;
- remaining open questions can be answered during implementation without
-  changing the feature's guarantee or component ownership.
-
-Small exploratory spikes may happen earlier. A spike proves feasibility; it does
-not establish a production contract or silently settle the design.
-
-### 5. Implement in ordered slices
-
-Prefer small, independently reviewable slices after the parent design is
-accepted. Record the dependency chain explicitly.
-
-Parallel work is safe when slices do not compete for the same unsettled
-interface or ownership boundary. If a foundational change will alter the
-transport, schema, state owner, or trust domain used by another slice, land the
-foundation first.
-
-An implementation pull request should identify:
-
- the PRD or decision it implements;
- the implementation chunk;
- its base and blockers;
- any design deviation discovered during implementation.
-
-If implementation reveals a load-bearing design change, pause that slice and
-update the canonical design. Do not let the code and review thread become an
-undocumented replacement for the PRD.
-
-## Dependency and staleness management
-
-### Dependency direction
-
-Write dependencies in terms of contracts, not chronology:
-
-```text
-credential provisioning contract
-  -> host-controller authentication
-    -> privileged host operations
-```
-
-If only part of a feature is blocked, say so. For example, a manifest parser may
-proceed while that feature's durable audit-storage chunk waits for the canonical
-audit schema.
-
-### Superseding documents
-
-Do not silently edit history to make an old design appear to have always said
-the new thing. Preserve the rationale, but make current status unmistakable:
-
-```markdown
-Status: Superseded
-Superseded by: <document>
-Reason: <one paragraph>
-```
-
-If part of a PRD remains valid, mark it Retargeted and identify which scope moved
-elsewhere.
-
-Add a short supersession note near the top explaining what changed, why the old
-design is no longer current, and where the current design lives. For a research
-note whose original analysis remains useful, preserve that analysis and append
-a dated addendum with the newer finding instead of rewriting the note as though
-it had always reached the new conclusion.
-
-### Architecture sweeps
-
-After a foundational change, do a targeted architecture sweep before building
-more features on it:
-
-1. Identify the concepts the change affects, such as `bot-bottle.db`, host
-   controller, orchestrator, audit ownership, or signing key.
-2. Search active PRDs, decisions, and open issues for those concepts.
-3. Update or supersede contradictory statements.
-4. Refresh dependency links and the current architecture summary.
-5. Confirm stacked implementation branches still have the correct base.
-
-This is a milestone activity, not a recurring documentation ceremony.
-
-## Pull-request checklist
-
-Use the relevant items in design and implementation pull requests:
-
- [ ] The canonical PRD or decision is linked.
- [ ] Design-changing review decisions are reflected in-repo.
- [ ] Dependencies and blockers are explicit.
- [ ] State, credential, and trust ownership agree with current architecture.
- [ ] Superseded or retargeted documents are marked.
- [ ] Security guarantees and non-guarantees are precise.
- [ ] Open questions do not change the promised guarantee or ownership model.
- [ ] Implementation deviations updated the canonical design.
-
-## Lightweight maintenance
-
-Automation should enforce document shape, not pretend to understand
-architecture. Useful checks include:
-
- active PRDs contain status and dependency metadata;
- superseded PRDs link to their replacement;
- referenced documents and issues exist;
- implementation pull requests identify their PRD and chunk;
- document filenames and lifecycle states follow repository conventions.
-
-Human review remains responsible for detecting conflicting guarantees or
-ownership claims.
-
-The durable rule is simple: **discussion discovers the decision; the repository
-records it; implementation follows it.**
@@ -1,68 +0,0 @@
-# Container image build inputs
-
-Bot-bottle's supported images are intended to rebuild from the same declared
-inputs on Linux amd64 and arm64. The repository enforces four layers of
-immutability:
-
- Python, Node, and nested-container Docker CLI base images are required,
-  defaultless Docker build arguments.
-  Their version-qualified tags and multi-platform OCI index digests live
-  together in `image-build-args.json`; every supported builder reads that
-  file and passes only the arguments its Dockerfile declares.
- Debian packages resolve from the same dated `snapshot.debian.org` archive in
-  every image that runs `apt-get install`. The snapshot endpoint uses HTTP so a
-  fresh image does not need a host-specific TLS interception CA; APT still
-  authenticates the repository metadata and package hashes with Debian's
-  signed Release files.
- Gateway Python dependencies install from `requirements.gateway.lock` with
-  `pip --require-hashes`; provider npm packages install with `npm ci` from
-  committed lockfiles.
- The Codex standalone archive is fetched from the exact `CODEX_VERSION`
-  release and checked against the committed upstream
-  `codex-package_SHA256SUMS` before extraction.
-  The standalone layout is retained because Codex remote control requires it.
-
-`Dockerfile.orchestrator.fc` is the one intentionally dynamic `FROM`. It has no
-default value: the Firecracker build coordinator resolves the freshly built
-orchestrator's local `sha256:` image ID, creates a local tag containing the
-complete ID, verifies that tag resolves to the same ID, and supplies the
-content-derived reference as `ORCHESTRATOR_BASE_IMAGE`. This accommodates
-BuildKit, which treats a bare image ID in `FROM` as a registry repository.
-
-## Refreshing inputs
-
-Make refreshes on a feature branch and review them like an application
-dependency update:
-
-1. For a Python or Node base update, select a version-qualified tag and update
-   its one digest-pinned value in `image-build-args.json`. Confirm the index
-   still contains `linux/amd64` and `linux/arm64`.
-2. For Debian packages, advance `DEBIAN_SNAPSHOT` to one fixed UTC timestamp in
-   every Dockerfile that uses apt. Do not use the moving Debian mirrors.
-3. Change direct Python versions in `requirements.gateway.in`, direct npm
-   versions in the provider's `package.json`, or `CODEX_VERSION` in the Codex
-   Dockerfile. Direct versions must be exact—no ranges, dist-tags, or
-   unversioned package names.
-4. Push the feature branch or manually run the `refresh-image-locks` workflow.
-   It regenerates the four derived files with the image's exact Python and Node
-   versions and uploads them as the `image-input-locks` artifact. It never
-   writes to the branch, so a refresh cannot race with developer pushes.
-5. Download the artifact, replace the four committed files, review the lock
-   diff, and let both normal CI and `image-input-builds` pass.
-   The latter checks both base architectures, builds every supported image,
-   exercises the exact local Firecracker base-ID handoff, and runs each
-   provider CLI's version smoke test.
-
-Run the fast policy check locally at any point:
-
-```sh
-python3 scripts/check_image_inputs.py
-```
-
-The check rejects mutable or `latest` bases, moving apt repositories,
-network-to-shell installers, unlocked npm/Pi installs, non-exact direct
-dependencies, missing npm integrity values, and unhashed gateway Python
-requirements.
-
-Image signing and attestation are tracked separately in issue #339; this policy
-covers deterministic and integrity-checked build inputs.
@@ -4,11 +4,6 @@
 - **Author:** didericis
 - **Created:** 2026-05-26

-> **Superseded.** PRD 0049 removed the active-agents pane and agent-scoped
-> operator edit verbs when the dashboard was narrowed back to a proposal-only
-> supervise TUI. A future agent-management surface was deferred rather than
-> carried forward from this design. The design below is retained as history.
-
 ## Summary

 The dashboard today is proposal-centric: it lists every pending
@@ -4,11 +4,6 @@
 - **Author:** didericis
 - **Created:** 2026-05-26

-> **Superseded.** PRD 0049 removed start, re-attach, and stop actions from the
-> dashboard when it became the proposal-only supervise TUI. Bottle lifecycle
-> remains in the dedicated CLI commands; no dashboard replacement from this
-> design remains active. The design below is retained as history.
-
 ## Summary

 Today the dashboard is read-only: it surfaces pending proposals
@@ -4,11 +4,6 @@
 - **Author:** didericis
 - **Created:** 2026-05-26

-> **Superseded.** PRD 0049 removed agent handoff and tmux pane management when
-> the dashboard was reduced to the proposal-only supervise TUI. The split-pane
-> interaction described below has no active replacement and is retained only
-> as design history.
-
 ## Summary

 When the dashboard runs inside tmux, lay it out as the **left
@@ -56,7 +56,8 @@ key.
 - Rewriting the HMAC primitive: `orchestrator_auth.mint/verify` gain an optional
  `roles=` arg (default unchanged) so a key can carry a different role set;
  nothing else changes.
- Network topology or the plane split (#469).
+- Network topology, the plane split (#469), or the server's open-mode fallback
+  for tests.

 ## Design

@@ -1,197 +0,0 @@
-# PRD 0082: Authoritative failure boundaries
-
- **Status:** Draft
- **Author:** codex
- **Created:** 2026-07-27
- **Issue:** #444
-
-## Summary
-
-Make every security- or lifecycle-sensitive snapshot distinguish authoritative
-empty state from unavailable state, and make every destructive or
-resource-consuming boundary revalidate the assumptions it acts on. This
-finishes the focused quality work begun under #444 without broad rewrites:
-cleanup cannot act on stale identities, policy introspection cannot publish a
-fabricated empty policy, gateway servers bound untrusted work, and daemon
-shutdown does not emit uncaught background-thread failures. Shared
-control-plane storage and gateway credential provisioning also enforce their
-filesystem security contract before sensitive data is written.
-
-## Problem
-
-Several paths are individually fail-closed but compose into unsafe or
-misleading behavior:
-
-1. `cleanup` prepares a plan, waits indefinitely for operator confirmation,
-   then kills stored PIDs and removes stored paths without checking that those
-   identities still describe the same orphan. A PID may be reused or a run
-   directory may become active during the prompt.
-2. The supervisor reuses egress's deny-all fallback for
-   `list-egress-routes`. Deny-all is correct for enforcement, but presenting it
-   as a successful empty route table can cause a later replace-all proposal to
-   discard live routes.
-3. The supervisor and Git HTTP services accept bounded declared body sizes but
-   use blocking reads and unbounded request threads. An untrusted bottle can
-   exhaust the shared gateway with slow or parallel requests.
-4. macOS cleanup enumerates containers and networks independently and treats a
-   failed query as an empty class, so a partial snapshot can still become a
-   destructive plan.
-5. Gateway log-pump threads race stream closure during shutdown and emit
-   uncaught exceptions even when shutdown otherwise succeeds.
-6. Firecracker discovers VMs through whitespace-split `pgrep -a` output.
-   A configured cache path containing spaces can hide a live VM from the
-   snapshot and make its run directory appear orphaned.
-7. Docker cleanup asks compose for its project snapshot in best-effort mode.
-   A transient query failure can therefore become an empty stopped-project
-   set and authorize deletion of associated state directories.
-8. Firecracker artifact downloads and registry publication have no network
-   deadline, so an unresponsive registry can hold setup or release work
-   indefinitely.
-9. Authenticated secret blobs select the unauthenticated legacy decoder when
-   their in-band version prefix is changed, allowing storage tampering to
-   bypass tag verification.
-10. Cleanup executes the entire post-confirmation snapshot rather than the
-    intersection with what the operator saw, and mutation failures are not
-    reflected in the command result.
-11. Git smart-HTTP can retain sixteen 100 MiB request bodies concurrently,
-    cleanup mutations have no subprocess deadline, and Firecracker signalling
-    failures bypass shared mutation accounting.
-12. SQLite creates the shared control-plane database before its mode is
-    restricted, then suppresses permission-repair failures. Gateway transports
-    also differ in whether copied deploy-key modes are preserved.
-
-These are one design problem: state used to authorize deletion, replacement,
-or resource allocation must be authoritative at the point of use.
-
-## Goals / Success Criteria
-
- Cleanup never signals a PID or recursively deletes a path solely because it
-  appeared in a pre-confirmation snapshot.
- Firecracker cleanup proves immediately before action that a PID is still the
-  same Firecracker process and that a run directory is still orphaned.
- Firecracker process discovery reads NUL-delimited argv from `/proc`; paths
-  are never reconstructed from whitespace-delimited process listings.
- All backend cleanup discovery primitives raise a typed enumeration error on
-  operational failure. No backend may independently continue from a partial
-  snapshot.
- Shared cleanup control flow lives in the backend layer; concrete backends
-  override resource-specific discovery and validation primitives rather than
-  each implementing a bespoke failure policy.
- `list-egress-routes` returns an MCP error when attribution or policy
-  resolution is unavailable. A genuine, authoritatively resolved empty policy
-  remains a successful empty list.
- Supervisor and Git HTTP request bodies have total read deadlines, and each
-  service bounds concurrent request work. Limits apply to authenticated
-  callers because bottles themselves are untrusted.
- Gateway child-output pumping treats expected stream closure during shutdown
-  as completion while preserving diagnostics for unexpected failures.
- Artifact pull, existence-check, and publication requests use explicit
-  network deadlines.
- Persisted secrets accept only the authenticated format. The schema migration
-  intentionally clears legacy rows; local agents are reprovisioned rather
-  than retaining a ciphertext-controlled downgrade path.
- Cleanup executes only resources present in both the displayed and current
-  authoritative plans, attempts every approved mutation, and returns failure
-  when any mutation does not complete.
- Git request bodies spool to disk behind a separate heavy-work semaphore;
-  cleanup commands have configurable deadlines; Firecracker signalling
-  failures aggregate while identity-verification uncertainty still aborts.
- The shared database directory and file are private before SQLite writes any
-  control-plane state; an inability to enforce those modes aborts startup.
- Gateway credential directories and files receive explicit private modes
-  inside the gateway, independent of Docker, Apple Container, or SSH copy
-  semantics.
- Unit tests cover PID/path reuse, partial backend enumeration, transient
-  policy resolution failure, slow bodies, concurrency saturation, and stream
-  closure races.
-
-## Non-goals
-
- Further decomposition solely to reduce module line counts.
- Replacing gateway stdlib HTTP services with a web framework.
- Changing egress matching, DLP decisions, proposal semantics, or backend
-  launch behavior beyond the synchronization required for safe cleanup.
- Making cleanup silently skip uncertain resources. Uncertainty is an
-  operator-visible failure.
-
-## Design
-
-### Shared backend control flow
-
-Follow the backend architecture rule used by gateway attachment: shared
-behavior lives above concrete backends; subclasses provide primitives, not
-control flow.
-
-Cleanup remains previewable, but confirmation authorizes a *new authoritative
-evaluation*, not blind execution of the displayed object. The shared flow:
-
-1. asks each available backend for a preview;
-2. displays the union and asks for confirmation;
-3. refreshes each non-empty backend plan;
-4. validates destructive identities immediately before action;
-5. aborts loudly if the refreshed plan or any identity cannot be proven safe.
-
-Backend-specific primitives define how to identify a resource. Firecracker
-uses process start identity plus canonical config/run paths; container
-backends use authoritative CLI queries and stable resource names/labels.
-
-Container engines expose destructive name-based commands without a portable
-compare-and-delete operation. Cleanup therefore refreshes after confirmation
-and requires every discovery query to succeed, minimizing but not claiming to
-eliminate the final name-reuse race. A future engine-specific stable-ID
-primitive may close that residual window without moving control flow back
-into each backend.
-
-### Enforcement state versus introspection state
-
-Egress enforcement retains its deny-all fallback because uncertainty must not
-grant network access. Supervisor introspection uses a strict resolver path:
-unattributed callers and resolver failures become typed MCP errors, while a
-successfully resolved policy containing zero routes returns `routes: []`.
-
-### Gateway resource boundaries
-
-Both stdlib servers set a per-connection body deadline before reading and use a
-bounded request executor or semaphore. Saturated capacity fails quickly with a
-service-unavailable response. Existing size caps remain independent:
-supervisor proposals retain the 1 MiB cap and Git pack requests retain their
-larger protocol-appropriate cap.
-
-### Shutdown diagnostics
-
-The gateway output pump catches only stream-closure exceptions expected after
-the supervisor closes child pipes. Other I/O failures remain visible and are
-reported through the supervisor's normal diagnostic channel.
-
-### Shared filesystem security
-
-The common SQLite store owns database creation for every backend. It creates
-the parent directory and an empty database with private modes before opening
-SQLite, repairs existing modes, verifies the resulting state, and propagates
-every enforcement failure. Backend launchers do not duplicate this policy.
-
-The backend-neutral gateway provisioner likewise applies directory and file
-modes after transport copies complete. This avoids relying on copy behavior
-that differs among Docker, Apple Container, and Firecracker's SSH transport.
-
-## Implementation chunks
-
-1. Existing fail-closed security and backend enumeration fixes.
-2. FastAPI orchestrator transport and bounded control-plane bodies.
-3. Egress request-policy and outbound-DLP pipeline extraction.
-4. Supervisor MCP dispatch extraction.
-5. Shared cleanup refresh/revalidation plus authoritative macOS discovery.
-6. Strict supervisor introspection and bounded supervisor/Git HTTP work.
-7. Gateway shutdown log-pump closure handling.
-8. Lossless Firecracker process identities, authoritative Docker cleanup
-   queries, and bounded Firecracker artifact transfers.
-9. Mandatory authenticated secret storage, shared cleanup-plan intersection
-   and mutation accounting, and contained Git backend process failures.
-10. Disk-spooled and separately bounded Git bodies, cleanup command deadlines,
-    and classified Firecracker signalling failures.
-11. Fail-closed shared database creation and backend-neutral gateway credential
-    permissions.
-
-## Open questions
-
-None.
@@ -7,13 +7,10 @@ document vs. a research note or a decision record).

 ## Naming and numbering

-New PRDs may use a `prd-new-<kebab-title>.md` placeholder name while the
-design is being drafted. Before merge, assign the next sequential number
-after the highest-numbered PRD on `main`, rename the file to
-`NNNN-<kebab-title>.md`, and update the title header. CI blocks merging
-while any `prd-new-*.md` placeholder remains. If concurrent PRs select the
-same number, the later PR must take the next available number before it
-merges. Numbers are never reused; gaps are fine.
+New PRDs use a `prd-new-<kebab-title>.md` placeholder name while the PR
+is open. On merge to `main` a CI workflow assigns the next sequential
+number (`0024-…`, `0025-…`), renames the file, and updates the title
+header. Numbers are never reused; gaps are fine.

 Once numbered, the filename stays fixed for the life of the doc.

@@ -29,7 +26,7 @@ The `Status:` line near the top tracks the PRD's lifecycle:
 ## Format

 ```markdown
-# PRD prd-new: <short title>    ← replace with the final number before merge
+# PRD prd-new: <short title>    ← placeholder; CI fills in the number on merge

 - **Status:** Draft
 - **Author:** <who>
@@ -1,4 +1,4 @@
-# PRD 0080: Encrypted at-rest egress secrets (SecretProvider, interim slice)
+# PRD prd-new: Encrypted at-rest egress secrets (SecretProvider, interim slice)

 - **Status:** Draft
 - **Author:** didericis
@@ -1,5 +0,0 @@
-{
-  "DOCKER_CLI_BASE_IMAGE": "docker:28-cli@sha256:625d9431a9f54c5a2bc90f24f0e1c3d55b1349fd857dd85035f98c2c9acbdd4d",
-  "NODE_BASE_IMAGE": "node:22.23.1-trixie-slim@sha256:e6d9a389d34ff9678438af985c9913fbd1eb6ed36e80fea56644f4b4f6dd70ba",
-  "PYTHON_BASE_IMAGE": "python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de"
-}
@@ -38,13 +38,8 @@ include = ["bot_bottle*"]
 bot_bottle = [
    "gateway/egress/entrypoint.sh",
    "contrib/claude/Dockerfile",
-    "contrib/claude/package.json",
-    "contrib/claude/package-lock.json",
    "contrib/codex/Dockerfile",
-    "contrib/codex/codex-package_SHA256SUMS",
    "contrib/pi/Dockerfile",
-    "contrib/pi/package.json",
-    "contrib/pi/package-lock.json",
    "backend/firecracker/netpool.defaults.env",
    "backend/macos_container/nested-containers-init.sh",
 ]
@@ -2,12 +2,9 @@
 # The bot-bottle project itself has no runtime dependencies.
 # These tools are used for code quality checks in CI/CD.

-r requirements.orchestrator.in
 pylint>=3.0.0
 pyright>=1.1.411
 coverage>=7.0.0
 # PEP 517 build front-end used by tests/unit/test_wheel_install.py to build and
 # install a real wheel (proves the installed distribution is self-contained).
 build>=1.0.0
-# FastAPI's in-process TestClient transport.
-httpx>=0.28.0
@@ -1,5 +0,0 @@
-# Runtime-only third-party dependency for Dockerfile.gateway.
-#
-# Regenerate requirements.gateway.lock with the image-input refresh workflow;
-# Dockerfile.gateway installs the lock with --require-hashes.
-mitmproxy==11.1.3
@@ -1,837 +0,0 @@
-#
-# This file is autogenerated by pip-compile with Python 3.12
-# by the following command:
-#
-#    pip-compile --generate-hashes --output-file=requirements.gateway.lock requirements.gateway.in
-#
-aioquic==1.2.0 \
-    --hash=sha256:1de513772fd04ff38028fdf748a9e2dec33d7aa2fbf67fda3011d9a85b620c54 \
-    --hash=sha256:2466499759b31ea4f1d17f4aeb1f8d4297169e05e3c1216d618c9757f4dd740d \
-    --hash=sha256:358e2b9c1e0c24b9933094c3c2cf990faf44d03b64d6f8ff79b4b3f510c6c268 \
-    --hash=sha256:3976b75e82d83742c8b811e38d273eda2ca7f81394b6a85da33a02849c5f1d9d \
-    --hash=sha256:3e23964dfb04526ade6e66f5b7cd0c830421b8138303ab60ba6e204015e7cb0b \
-    --hash=sha256:43ae3b11d43400a620ca0b4b4885d12b76a599c2cbddba755f74bebfa65fe587 \
-    --hash=sha256:6371c3afa1036294e1505fdbda8c147bc41c5b6709a47459e8c1b4eec41a86ef \
-    --hash=sha256:6e418c92898a0af306e6f1b6a55a0d3d2597001c57a7b1ba36cf5b47bf41233b \
-    --hash=sha256:6fe683943ea3439dd0aca05ff80e85a552d4b39f9f34858c76ac54c205990e88 \
-    --hash=sha256:7dcc212bb529900757d8e99a76198b42c2a978ce735a1bfca394033c16cfc33c \
-    --hash=sha256:81650d59bef05c514af2cfdcb2946e9d13367b745e68b36881d43630ef563d38 \
-    --hash=sha256:84d733332927b76218a3b246216104116f766f5a9b2308ec306cd017b3049660 \
-    --hash=sha256:8e600da7aa7e4a7bc53ee8f45fd66808032127ae00938c119ac77d66633b8961 \
-    --hash=sha256:910d8c91da86bba003d491d15deaeac3087d1b9d690b9edc1375905d8867b742 \
-    --hash=sha256:bb917143e7a4de5beba1e695fa89f2b05ef080b450dea07338cc67a9c75e0a4d \
-    --hash=sha256:c22689c33fe4799624aed6faaba0af9e6ea7d31ac45047745828ee68d67fe1d9 \
-    --hash=sha256:c332cffa3c2124e5db82b2b9eb2662bd7c39ee2247606b74de689f6d3091b61a \
-    --hash=sha256:cbe7167b2faee887e115d83d25332c4b8fa4604d5175807d978cb4fe39b4e36e \
-    --hash=sha256:cd75015462ca5070a888110dc201f35a9f4c7459f9201b77adc3c06013611bb8 \
-    --hash=sha256:e2c3c127cc3d9eac7a6d05142036bf4b2c593d750a115a2fa42c1f86cbe8c0a0 \
-    --hash=sha256:e3dcfb941004333d477225a6689b55fc7f905af5ee6a556eb5083be0354e653a \
-    --hash=sha256:e7ce10198f8efa91986ad8ac83fa08e50972e0aacde45bdaf7b9365094e72c0c \
-    --hash=sha256:f209ad5edbff8239e994c189dc74428420957448a190f4343faee4caedef4eee \
-    --hash=sha256:f81e7946f09501a7c27e3f71b84a455e6bf92346fb5a28ef2d73c9d564463c63 \
-    --hash=sha256:f91263bb3f71948c5c8915b4d50ee370004f20a416f67fab3dcc90556c7e7199 \
-    --hash=sha256:fcc1eb083ed9f8d903482e375281c8c26a5ed2b6bee5ee2be3f13275d8fdb146
-    # via mitmproxy
-argon2-cffi==23.1.0 \
-    --hash=sha256:879c3e79a2729ce768ebb7d36d4609e3a78a4ca2ec3a9f12286ca057e3d0db08 \
-    --hash=sha256:c670642b78ba29641818ab2e68bd4e6a78ba53b7eff7b4c3815ae16abf91c7ea
-    # via mitmproxy
-argon2-cffi-bindings==25.1.0 \
-    --hash=sha256:1db89609c06afa1a214a69a462ea741cf735b29a57530478c06eb81dd403de99 \
-    --hash=sha256:1e021e87faa76ae0d413b619fe2b65ab9a037f24c60a1e6cc43457ae20de6dc6 \
-    --hash=sha256:21378b40e1b8d1655dd5310c84a40fc19a9aa5e6366e835ceb8576bf0fea716d \
-    --hash=sha256:2630b6240b495dfab90aebe159ff784d08ea999aa4b0d17efa734055a07d2f44 \
-    --hash=sha256:3c6702abc36bf3ccba3f802b799505def420a1b7039862014a65db3205967f5a \
-    --hash=sha256:3d3f05610594151994ca9ccb3c771115bdb4daef161976a266f0dd8aa9996b8f \
-    --hash=sha256:473bcb5f82924b1becbb637b63303ec8d10e84c8d241119419897a26116515d2 \
-    --hash=sha256:5acb4e41090d53f17ca1110c3427f0a130f944b896fc8c83973219c97f57b690 \
-    --hash=sha256:5d588dec224e2a83edbdc785a5e6f3c6cd736f46bfd4b441bbb5aa1f5085e584 \
-    --hash=sha256:6dca33a9859abf613e22733131fc9194091c1fa7cb3e131c143056b4856aa47e \
-    --hash=sha256:7aef0c91e2c0fbca6fc68e7555aa60ef7008a739cbe045541e438373bc54d2b0 \
-    --hash=sha256:84a461d4d84ae1295871329b346a97f68eade8c53b6ed9a7ca2d7467f3c8ff6f \
-    --hash=sha256:87c33a52407e4c41f3b70a9c2d3f6056d88b10dad7695be708c5021673f55623 \
-    --hash=sha256:8b8efee945193e667a396cbc7b4fb7d357297d6234d30a489905d96caabde56b \
-    --hash=sha256:a1c70058c6ab1e352304ac7e3b52554daadacd8d453c1752e547c76e9c99ac44 \
-    --hash=sha256:a98cd7d17e9f7ce244c0803cad3c23a7d379c301ba618a5fa76a67d116618b98 \
-    --hash=sha256:aecba1723ae35330a008418a91ea6cfcedf6d31e5fbaa056a166462ff066d500 \
-    --hash=sha256:b0fdbcf513833809c882823f98dc2f931cf659d9a1429616ac3adebb49f5db94 \
-    --hash=sha256:b55aec3565b65f56455eebc9b9f34130440404f27fe21c3b375bf1ea4d8fbae6 \
-    --hash=sha256:b957f3e6ea4d55d820e40ff76f450952807013d361a65d7f28acc0acbf29229d \
-    --hash=sha256:ba92837e4a9aa6a508c8d2d7883ed5a8f6c308c89a4790e1e447a220deb79a85 \
-    --hash=sha256:c4f9665de60b1b0e99bcd6be4f17d90339698ce954cfd8d9cf4f91c995165a92 \
-    --hash=sha256:c87b72589133f0346a1cb8d5ecca4b933e3c9b64656c9d175270a000e73b288d \
-    --hash=sha256:d3e924cfc503018a714f94a49a149fdc0b644eaead5d1f089330399134fa028a \
-    --hash=sha256:da0c79c23a63723aa5d782250fbf51b768abca630285262fb5144ba5ae01e520 \
-    --hash=sha256:e2fd3bfbff3c5d74fef31a722f729bf93500910db650c925c2d6ef879a7e51cb
-    # via argon2-cffi
-asgiref==3.8.1 \
-    --hash=sha256:3e1e3ecc849832fe52ccf2cb6686b7a55f82bb1d6aee72a58826471390335e47 \
-    --hash=sha256:c343bd80a0bec947a9860adb4c432ffa7db769836c64238fc34bdc3fec84d590
-    # via mitmproxy
-attrs==26.1.0 \
-    --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309 \
-    --hash=sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32
-    # via service-identity
-blinker==1.9.0 \
-    --hash=sha256:b4ce2265a7abece45e7cc896e98dbebe6cead56bcf805a3d23136d145f5445bf \
-    --hash=sha256:ba0efaa9080b619ff2f3459d1d500c57bddea4a6b424b60a91141db6fd2f08bc
-    # via flask
-brotli==1.1.0 \
-    --hash=sha256:03d20af184290887bdea3f0f78c4f737d126c74dc2f3ccadf07e54ceca3bf208 \
-    --hash=sha256:0541e747cce78e24ea12d69176f6a7ddb690e62c425e01d31cc065e69ce55b48 \
-    --hash=sha256:069a121ac97412d1fe506da790b3e69f52254b9df4eb665cd42460c837193354 \
-    --hash=sha256:0737ddb3068957cf1b054899b0883830bb1fec522ec76b1098f9b6e0f02d9419 \
-    --hash=sha256:0b63b949ff929fbc2d6d3ce0e924c9b93c9785d877a21a1b678877ffbbc4423a \
-    --hash=sha256:0c6244521dda65ea562d5a69b9a26120769b7a9fb3db2fe9545935ed6735b128 \
-    --hash=sha256:11d00ed0a83fa22d29bc6b64ef636c4552ebafcef57154b4ddd132f5638fbd1c \
-    --hash=sha256:141bd4d93984070e097521ed07e2575b46f817d08f9fa42b16b9b5f27b5ac088 \
-    --hash=sha256:19c116e796420b0cee3da1ccec3b764ed2952ccfcc298b55a10e5610ad7885f9 \
-    --hash=sha256:1ab4fbee0b2d9098c74f3057b2bc055a8bd92ccf02f65944a241b4349229185a \
-    --hash=sha256:1ae56aca0402a0f9a3431cddda62ad71666ca9d4dc3a10a142b9dce2e3c0cda3 \
-    --hash=sha256:1b2c248cd517c222d89e74669a4adfa5577e06ab68771a529060cf5a156e9757 \
-    --hash=sha256:1e9a65b5736232e7a7f91ff3d02277f11d339bf34099a56cdab6a8b3410a02b2 \
-    --hash=sha256:224e57f6eac61cc449f498cc5f0e1725ba2071a3d4f48d5d9dffba42db196438 \
-    --hash=sha256:22fc2a8549ffe699bfba2256ab2ed0421a7b8fadff114a3d201794e45a9ff578 \
-    --hash=sha256:23032ae55523cc7bccb4f6a0bf368cd25ad9bcdcc1990b64a647e7bbcce9cb5b \
-    --hash=sha256:2333e30a5e00fe0fe55903c8832e08ee9c3b1382aacf4db26664a16528d51b4b \
-    --hash=sha256:2954c1c23f81c2eaf0b0717d9380bd348578a94161a65b3a2afc62c86467dd68 \
-    --hash=sha256:2a24c50840d89ded6c9a8fdc7b6ed3692ed4e86f1c4a4a938e1e92def92933e0 \
-    --hash=sha256:2de9d02f5bda03d27ede52e8cfe7b865b066fa49258cbab568720aa5be80a47d \
-    --hash=sha256:2feb1d960f760a575dbc5ab3b1c00504b24caaf6986e2dc2b01c09c87866a943 \
-    --hash=sha256:30924eb4c57903d5a7526b08ef4a584acc22ab1ffa085faceb521521d2de32dd \
-    --hash=sha256:316cc9b17edf613ac76b1f1f305d2a748f1b976b033b049a6ecdfd5612c70409 \
-    --hash=sha256:32d95b80260d79926f5fab3c41701dbb818fde1c9da590e77e571eefd14abe28 \
-    --hash=sha256:38025d9f30cf4634f8309c6874ef871b841eb3c347e90b0851f63d1ded5212da \
-    --hash=sha256:39da8adedf6942d76dc3e46653e52df937a3c4d6d18fdc94a7c29d263b1f5b50 \
-    --hash=sha256:3c0ef38c7a7014ffac184db9e04debe495d317cc9c6fb10071f7fefd93100a4f \
-    --hash=sha256:3d7954194c36e304e1523f55d7042c59dc53ec20dd4e9ea9d151f1b62b4415c0 \
-    --hash=sha256:3ee8a80d67a4334482d9712b8e83ca6b1d9bc7e351931252ebef5d8f7335a547 \
-    --hash=sha256:4093c631e96fdd49e0377a9c167bfd75b6d0bad2ace734c6eb20b348bc3ea180 \
-    --hash=sha256:43395e90523f9c23a3d5bdf004733246fba087f2948f87ab28015f12359ca6a0 \
-    --hash=sha256:43ce1b9935bfa1ede40028054d7f48b5469cd02733a365eec8a329ffd342915d \
-    --hash=sha256:4410f84b33374409552ac9b6903507cdb31cd30d2501fc5ca13d18f73548444a \
-    --hash=sha256:494994f807ba0b92092a163a0a283961369a65f6cbe01e8891132b7a320e61eb \
-    --hash=sha256:4d4a848d1837973bf0f4b5e54e3bec977d99be36a7895c61abb659301b02c112 \
-    --hash=sha256:4ed11165dd45ce798d99a136808a794a748d5dc38511303239d4e2363c0695dc \
-    --hash=sha256:4f3607b129417e111e30637af1b56f24f7a49e64763253bbc275c75fa887d4b2 \
-    --hash=sha256:510b5b1bfbe20e1a7b3baf5fed9e9451873559a976c1a78eebaa3b86c57b4265 \
-    --hash=sha256:524f35912131cc2cabb00edfd8d573b07f2d9f21fa824bd3fb19725a9cf06327 \
-    --hash=sha256:587ca6d3cef6e4e868102672d3bd9dc9698c309ba56d41c2b9c85bbb903cdb95 \
-    --hash=sha256:58d4b711689366d4a03ac7957ab8c28890415e267f9b6589969e74b6e42225ec \
-    --hash=sha256:5b3cc074004d968722f51e550b41a27be656ec48f8afaeeb45ebf65b561481dd \
-    --hash=sha256:5dab0844f2cf82be357a0eb11a9087f70c5430b2c241493fc122bb6f2bb0917c \
-    --hash=sha256:5e55da2c8724191e5b557f8e18943b1b4839b8efc3ef60d65985bcf6f587dd38 \
-    --hash=sha256:5eeb539606f18a0b232d4ba45adccde4125592f3f636a6182b4a8a436548b914 \
-    --hash=sha256:5f4d5ea15c9382135076d2fb28dde923352fe02951e66935a9efaac8f10e81b0 \
-    --hash=sha256:5fb2ce4b8045c78ebbc7b8f3c15062e435d47e7393cc57c25115cfd49883747a \
-    --hash=sha256:6172447e1b368dcbc458925e5ddaf9113477b0ed542df258d84fa28fc45ceea7 \
-    --hash=sha256:6967ced6730aed543b8673008b5a391c3b1076d834ca438bbd70635c73775368 \
-    --hash=sha256:6974f52a02321b36847cd19d1b8e381bf39939c21efd6ee2fc13a28b0d99348c \
-    --hash=sha256:6c3020404e0b5eefd7c9485ccf8393cfb75ec38ce75586e046573c9dc29967a0 \
-    --hash=sha256:6c6e0c425f22c1c719c42670d561ad682f7bfeeef918edea971a79ac5252437f \
-    --hash=sha256:70051525001750221daa10907c77830bc889cb6d865cc0b813d9db7fefc21451 \
-    --hash=sha256:7905193081db9bfa73b1219140b3d315831cbff0d8941f22da695832f0dd188f \
-    --hash=sha256:7bc37c4d6b87fb1017ea28c9508b36bbcb0c3d18b4260fcdf08b200c74a6aee8 \
-    --hash=sha256:7c4855522edb2e6ae7fdb58e07c3ba9111e7621a8956f481c68d5d979c93032e \
-    --hash=sha256:7e4c4629ddad63006efa0ef968c8e4751c5868ff0b1c5c40f76524e894c50248 \
-    --hash=sha256:7eedaa5d036d9336c95915035fb57422054014ebdeb6f3b42eac809928e40d0c \
-    --hash=sha256:7f4bf76817c14aa98cc6697ac02f3972cb8c3da93e9ef16b9c66573a68014f91 \
-    --hash=sha256:81de08ac11bcb85841e440c13611c00b67d3bf82698314928d0b676362546724 \
-    --hash=sha256:832436e59afb93e1836081a20f324cb185836c617659b07b129141a8426973c7 \
-    --hash=sha256:861bf317735688269936f755fa136a99d1ed526883859f86e41a5d43c61d8966 \
-    --hash=sha256:87a3044c3a35055527ac75e419dfa9f4f3667a1e887ee80360589eb8c90aabb9 \
-    --hash=sha256:890b5a14ce214389b2cc36ce82f3093f96f4cc730c1cffdbefff77a7c71f2a97 \
-    --hash=sha256:89f4988c7203739d48c6f806f1e87a1d96e0806d44f0fba61dba81392c9e474d \
-    --hash=sha256:8bf32b98b75c13ec7cf774164172683d6e7891088f6316e54425fde1efc276d5 \
-    --hash=sha256:8dadd1314583ec0bf2d1379f7008ad627cd6336625d6679cf2f8e67081b83acf \
-    --hash=sha256:901032ff242d479a0efa956d853d16875d42157f98951c0230f69e69f9c09bac \
-    --hash=sha256:9011560a466d2eb3f5a6e4929cf4a09be405c64154e12df0dd72713f6500e32b \
-    --hash=sha256:906bc3a79de8c4ae5b86d3d75a8b77e44404b0f4261714306e3ad248d8ab0951 \
-    --hash=sha256:919e32f147ae93a09fe064d77d5ebf4e35502a8df75c29fb05788528e330fe74 \
-    --hash=sha256:91d7cc2a76b5567591d12c01f019dd7afce6ba8cba6571187e21e2fc418ae648 \
-    --hash=sha256:929811df5462e182b13920da56c6e0284af407d1de637d8e536c5cd00a7daf60 \
-    --hash=sha256:949f3b7c29912693cee0afcf09acd6ebc04c57af949d9bf77d6101ebb61e388c \
-    --hash=sha256:a090ca607cbb6a34b0391776f0cb48062081f5f60ddcce5d11838e67a01928d1 \
-    --hash=sha256:a1fd8a29719ccce974d523580987b7f8229aeace506952fa9ce1d53a033873c8 \
-    --hash=sha256:a37b8f0391212d29b3a91a799c8e4a2855e0576911cdfb2515487e30e322253d \
-    --hash=sha256:a3daabb76a78f829cafc365531c972016e4aa8d5b4bf60660ad8ecee19df7ccc \
-    --hash=sha256:a469274ad18dc0e4d316eefa616d1d0c2ff9da369af19fa6f3daa4f09671fd61 \
-    --hash=sha256:a599669fd7c47233438a56936988a2478685e74854088ef5293802123b5b2460 \
-    --hash=sha256:a743e5a28af5f70f9c080380a5f908d4d21d40e8f0e0c8901604d15cfa9ba751 \
-    --hash=sha256:a77def80806c421b4b0af06f45d65a136e7ac0bdca3c09d9e2ea4e515367c7e9 \
-    --hash=sha256:a7e53012d2853a07a4a79c00643832161a910674a893d296c9f1259859a289d2 \
-    --hash=sha256:a93dde851926f4f2678e704fadeb39e16c35d8baebd5252c9fd94ce8ce68c4a0 \
-    --hash=sha256:aac0411d20e345dc0920bdec5548e438e999ff68d77564d5e9463a7ca9d3e7b1 \
-    --hash=sha256:ae15b066e5ad21366600ebec29a7ccbc86812ed267e4b28e860b8ca16a2bc474 \
-    --hash=sha256:aea440a510e14e818e67bfc4027880e2fb500c2ccb20ab21c7a7c8b5b4703d75 \
-    --hash=sha256:af6fa6817889314555aede9a919612b23739395ce767fe7fcbea9a80bf140fe5 \
-    --hash=sha256:b760c65308ff1e462f65d69c12e4ae085cff3b332d894637f6273a12a482d09f \
-    --hash=sha256:be36e3d172dc816333f33520154d708a2657ea63762ec16b62ece02ab5e4daf2 \
-    --hash=sha256:c247dd99d39e0338a604f8c2b3bc7061d5c2e9e2ac7ba9cc1be5a69cb6cd832f \
-    --hash=sha256:c5529b34c1c9d937168297f2c1fde7ebe9ebdd5e121297ff9c043bdb2ae3d6fb \
-    --hash=sha256:c8146669223164fc87a7e3de9f81e9423c67a79d6b3447994dfb9c95da16e2d6 \
-    --hash=sha256:c8fd5270e906eef71d4a8d19b7c6a43760c6abcfcc10c9101d14eb2357418de9 \
-    --hash=sha256:ca63e1890ede90b2e4454f9a65135a4d387a4585ff8282bb72964fab893f2111 \
-    --hash=sha256:caf9ee9a5775f3111642d33b86237b05808dafcd6268faa492250e9b78046eb2 \
-    --hash=sha256:cb1dac1770878ade83f2ccdf7d25e494f05c9165f5246b46a621cc849341dc01 \
-    --hash=sha256:cdad5b9014d83ca68c25d2e9444e28e967ef16e80f6b436918c700c117a85467 \
-    --hash=sha256:cdbc1fc1bc0bff1cef838eafe581b55bfbffaed4ed0318b724d0b71d4d377619 \
-    --hash=sha256:ceb64bbc6eac5a140ca649003756940f8d6a7c444a68af170b3187623b43bebf \
-    --hash=sha256:d0c5516f0aed654134a2fc936325cc2e642f8a0e096d075209672eb321cff408 \
-    --hash=sha256:d143fd47fad1db3d7c27a1b1d66162e855b5d50a89666af46e1679c496e8e579 \
-    --hash=sha256:d192f0f30804e55db0d0e0a35d83a9fead0e9a359a9ed0285dbacea60cc10a84 \
-    --hash=sha256:d2b35ca2c7f81d173d2fadc2f4f31e88cc5f7a39ae5b6db5513cf3383b0e0ec7 \
-    --hash=sha256:d342778ef319e1026af243ed0a07c97acf3bad33b9f29e7ae6a1f68fd083e90c \
-    --hash=sha256:d487f5432bf35b60ed625d7e1b448e2dc855422e87469e3f450aa5552b0eb284 \
-    --hash=sha256:d7702622a8b40c49bffb46e1e3ba2e81268d5c04a34f460978c6b5517a34dd52 \
-    --hash=sha256:db85ecf4e609a48f4b29055f1e144231b90edc90af7481aa731ba2d059226b1b \
-    --hash=sha256:de6551e370ef19f8de1807d0a9aa2cdfdce2e85ce88b122fe9f6b2b076837e59 \
-    --hash=sha256:e1140c64812cb9b06c922e77f1c26a75ec5e3f0fb2bf92cc8c58720dec276752 \
-    --hash=sha256:e4fe605b917c70283db7dfe5ada75e04561479075761a0b3866c081d035b01c1 \
-    --hash=sha256:e6a904cb26bfefc2f0a6f240bdf5233be78cd2488900a2f846f3c3ac8489ab80 \
-    --hash=sha256:e79e6520141d792237c70bcd7a3b122d00f2613769ae0cb61c52e89fd3443839 \
-    --hash=sha256:e84799f09591700a4154154cab9787452925578841a94321d5ee8fb9a9a328f0 \
-    --hash=sha256:e93dfc1a1165e385cc8239fab7c036fb2cd8093728cbd85097b284d7b99249a2 \
-    --hash=sha256:efa8b278894b14d6da122a72fefcebc28445f2d3f880ac59d46c90f4c13be9a3 \
-    --hash=sha256:f0d8a7a6b5983c2496e364b969f0e526647a06b075d034f3297dc66f3b360c64 \
-    --hash=sha256:f0db75f47be8b8abc8d9e31bc7aad0547ca26f24a54e6fd10231d623f183d089 \
-    --hash=sha256:f296c40e23065d0d6650c4aefe7470d2a25fffda489bcc3eb66083f3ac9f6643 \
-    --hash=sha256:f31859074d57b4639318523d6ffdca586ace54271a73ad23ad021acd807eb14b \
-    --hash=sha256:f66b5337fa213f1da0d9000bc8dc0cb5b896b726eefd9c6046f699b169c41b9e \
-    --hash=sha256:f733d788519c7e3e71f0855c96618720f5d3d60c3cb829d8bbb722dddce37985 \
-    --hash=sha256:fce1473f3ccc4187f75b4690cfc922628aed4d3dd013d047f95a9b3919a86596 \
-    --hash=sha256:fd5f17ff8f14003595ab414e45fce13d073e0762394f957182e69035c9f3d7c2 \
-    --hash=sha256:fdc3ff3bfccdc6b9cc7c342c03aa2400683f0cb891d46e94b64a197910dc4064
-    # via mitmproxy
-certifi==2026.7.22 \
-    --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \
-    --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55
-    # via
-    #   aioquic
-    #   mitmproxy
-cffi==2.1.0 \
-    --hash=sha256:02cb7ff33ded4f1532476731f89ede53e2e488a8e6205515a82144246ffa7dcc \
-    --hash=sha256:03e9810d18c646077e501f661b682fbf5dee4676048527ca3cffe66faa9960dd \
-    --hash=sha256:0520e1f4c35f44e209cbbb421b67eec42e6a157f59444dfb6058874ff3610e5d \
-    --hash=sha256:0582a58f3051372229ca8e7f5f589f9e5632678208d8636fea3676711fdf7fe5 \
-    --hash=sha256:0611e7ebf90573a535ebdc33ae9da222d037853983e13359f580fab781ca017f \
-    --hash=sha256:0a42c688d19fca6e095a53c6a6e2295a5b050a8b289f109adab02a9e61a25de6 \
-    --hash=sha256:0a96b74cda968eebbad56d973efe5098974f0a9fb323865bf99ea1fd24e3e64c \
-    --hash=sha256:10537b1df4967ca26d21e5072d7d54188354483b91dc75058968d3f0cf13fbda \
-    --hash=sha256:11b3fb55f4f8ad92274ed26705f65d8f91457de71f5380061eb6d125a768fecd \
-    --hash=sha256:15faec4adfff450819f3aee0e2e02c812de6edb88203aa58807955db2003472a \
-    --hash=sha256:164bff1657b2a74f0b6d54e11c9b375bc97b931f2ca9c43fcf875838da1570dd \
-    --hash=sha256:1854b724d00f6654c742097d5387569021be12d3a0f770eae1df8f8acfcc6acd \
-    --hash=sha256:19c54ac121cad98450b4896fa9a43ee0180d57bc4bc911a33db6cab1efab6cd3 \
-    --hash=sha256:1b96bfe2c4bd825681b7d311ad6d9b7280a091f43e8f63da5729638083cd3bfb \
-    --hash=sha256:1e9f50d192a3e525b15a75ab5114e442d83d657b7ec29182a991bc9a88fd3a66 \
-    --hash=sha256:1ff3456eab0d889592d1936d6125bbfbc7ae4d3354a700f8bd80450a66445d4d \
-    --hash=sha256:2282cd5e38aa8accd03e99d1256af8411c84cdbee6a89d841b563fdbd1f3e50f \
-    --hash=sha256:276f20fffd7b396e12516ba8edf9509210ac248cbbc5acbc39cd512f9f59ebe6 \
-    --hash=sha256:2b71d409cccee78310ab5dec549aed052aaea483346e282c7b02362596e01bb0 \
-    --hash=sha256:2e9dabb9abcb7ad15938c7196ad5c1718a4e6d33cc79b4c0209bdb64c4a54a5c \
-    --hash=sha256:30b65779d598c370374fefabf138d456fd6f3216bfa7bedfab1ba82025b0cd93 \
-    --hash=sha256:33eb1ad83ebe8f313e0df035c406227d55a79456704a863fad9842136af5ad7d \
-    --hash=sha256:35aaea0c7ee0e58a5cd8c2fd1a48fdf7ece0d2699b7ecdda08194e9ce5dd9b3d \
-    --hash=sha256:3681e031db29958a7502f5c0c9d6bbc4c36cb20f7b104086fa642d1799631ff8 \
-    --hash=sha256:379de10ce1ba048b1448599d1b37b24caee16309d1ac98d3982fc997f768700b \
-    --hash=sha256:37f525a7e7e50c017fdebe58b787be310ad59357ae43a053943a6e1a6c526001 \
-    --hash=sha256:3b926723c13eba9f81d2ef3820d63aeceec3b2d4639906047bf675cb8a7a500d \
-    --hash=sha256:3d7f118b5adbfdfead90c25822690b02bc8074fba949bb7858bec4ebd55adb43 \
-    --hash=sha256:46b1c8db8f6122420f32d02fffb924c2fe9bc772d228c7c711748fff56aabb2b \
-    --hash=sha256:47ff3a8bfd8cb9da1af7524b965127095055654c177fcfc7578debcb015eecd0 \
-    --hash=sha256:4d433a51f1870e43a13b6732f92aaf540ff77c2015097c78556f75a2d6c030e0 \
-    --hash=sha256:4f26194e3d95e06501b942642855aed4f953d55e95d7d01b7c4483db3ecff458 \
-    --hash=sha256:510aeeeac94811b138077451da1fb18b308a5feab47dd2b603af55804155e1c8 \
-    --hash=sha256:5972433ad71a9e46516584ef60a0fda12d9dc459938d1539c3ddecf9bdc1368d \
-    --hash=sha256:5ecbd0499275d57506d397eebe1981cee87b47fcd9ef5c22cab7ed7644a39a94 \
-    --hash=sha256:6274dcb2d15cef48daa73ed1be5a40d501d74dccd0cd6db364776d12cb6ba022 \
-    --hash=sha256:63960549e4f8dc41e31accb97b975abaecfc44c03e396c093a6436763c2ea7db \
-    --hash=sha256:64c753a0f87a256020004f37a1c8c02c480e725f910f0b2a0f3f07debd1b2479 \
-    --hash=sha256:6af371f3767faeffc6ac1ef57cdfd25844403e9d3f476c5537caee499de96376 \
-    --hash=sha256:6ca4919c6e4f89aa99c42510b42cf54596892c00b3f9077f6bdd1505e24b9c8d \
-    --hash=sha256:6d194185eabd279f1c05ebe3504265ddfc5ad2b58d0714f7db9f01da592e9eb6 \
-    --hash=sha256:702c436735fbe99d59ada02a1f65cfc0d31c0ee8b7290912f8fbc5cd1e4b16c3 \
-    --hash=sha256:716ff8ec22f20b4d988b12884086bcef0fc99737043e503f7a3935a6be99b1ea \
-    --hash=sha256:762f99479dcb369f60ab9017ad4ab97a36a1dd7c1ee5a3b15db0f4b8659120cd \
-    --hash=sha256:7762faa47e8ff7eb80bd261d9a7d8eea2d8baa69de5e95b70c1f338bbe712f02 \
-    --hash=sha256:78474632761faa0fb96f30b1c928c84ebcf68713cbb80d15bab09dfe61640fde \
-    --hash=sha256:799416bae98336e400981ff6e532d67d5c709cfb30afb79865a1315f94b0e224 \
-    --hash=sha256:7d034dcffa09e9a46c93fa3a3be402096cb5354ac6e41ab8e5cc9cd8b642ad76 \
-    --hash=sha256:7d28dff1db6764108bc30788d85d61c876beff416d9a49cb9dd7c5a9f34f5804 \
-    --hash=sha256:7d3538f9c0e50670f4deb93dbb696576e60590369cae2faf7de681e597a8a1f1 \
-    --hash=sha256:7d5980a3433d4b71a5e120f9dd551403d7824e31e2e67124fe2769c404c06913 \
-    --hash=sha256:7ea6b3e2c4250ff1de21c630fe72d0f63eb95c2c32ffbf64a358cf4a8836d714 \
-    --hash=sha256:86cf8755a791f72c85dc287128cc62d4f24d392e3f1e15837245623f4a33cccc \
-    --hash=sha256:88023dfe18799507b73f1dbb0d14326a17465de1bc9c9c7655c22845e9ddc3a2 \
-    --hash=sha256:89095c1968b4ba8285840e131bf2891b09ae137fe2146905acae0354fbce1b5e \
-    --hash=sha256:8d35c139744adb3e727cd51b1a18324bbe44b8bd41bf8322bca4d41289f48eda \
-    --hash=sha256:8e74a6135550c4748af665b1b1118b6aab33b1fc6a16f9aff630af107c3b4512 \
-    --hash=sha256:8f9ec95b8a043d3dfbc74d9abc6f7baf524dd27a8dc160b0a32ff9cdab650c28 \
-    --hash=sha256:90bec57cf82089383bd06a605b3eb8daebf7e5a668520beaf6e327a83a947699 \
-    --hash=sha256:95f2954c2c9473d892eca6e0409f3568b37ab62a8eedb122461f73cc273476e3 \
-    --hash=sha256:961be50688f7fba2fa65f63712d3b9b341a22311f5253460ce933f52f0de1c8c \
-    --hash=sha256:98fff996e983a36d3aa2eca83af40c5821202e7e6f32d13ae94e3d2286f10cfe \
-    --hash=sha256:9b8f0f26ca4e7513c534d351eca551947d053fac438f2a04ac96d882909b0d3a \
-    --hash=sha256:9d72af0cf10a76a600a9690078fe31c63b9588c8e86bf9fd353f713c84b5db0f \
-    --hash=sha256:9d8272c0e483b024e1b9ad029821470ed8ec65631dbd90217469da0e7cd89f1c \
-    --hash=sha256:a016194dbe13d14ee9556e734b772d8d67b947092b268d757fd4290e3ba2dfc2 \
-    --hash=sha256:a5781494d4d400a3f47f8f1da94b324f6e6b440a53387774002890a2a2f4b50f \
-    --hash=sha256:a95b05f9baf29b91171b3a8bd2020b028835243e7b0ff6bb23e2a3c228518b1b \
-    --hash=sha256:aa7a1b53a2a4452ada2d1b5dade9960b2522f1e61293a811a077439e39029565 \
-    --hash=sha256:ac0f1a2d0cfa7eea3f2aaf006ab6e70e8feeb16b75d65b7e5939982ca2f11056 \
-    --hash=sha256:af5e2915d41fe6c961694d7bfdc8562942638200f3ce2765dfb8b745cf997629 \
-    --hash=sha256:b6422532152adf4e59b110cb2808cee7a033800952f5c036b4af047ee43199e7 \
-    --hash=sha256:b65f590ef2a44640f9a05dbb548a429b4ade77913ce683ac8b1480777658a6c0 \
-    --hash=sha256:ba00f661f8ba35d075c937174e27c2c421cec3942fd2e0ea3e66996757c0fdd9 \
-    --hash=sha256:bccbbb5ee76a61f9d99b5bf3846a51d7fca4b6a732fe46f89295610edaf41853 \
-    --hash=sha256:bf01d8c84cbea96b944c73b22182e6c7c432b3475632b8111dbfdc95ddad6e13 \
-    --hash=sha256:bf5c6cf48238b0eb4c086978c492ad1cbc22373fc5b2d7353b3a598ce6db887a \
-    --hash=sha256:c16914df9fb7f500e440e6875fa23ff5e0b31db01fa9c06af98d59a91f0dc2e4 \
-    --hash=sha256:c351efb95e832a853a29361675f33a7ce53de1a109cd73fd47af0712213aa4ce \
-    --hash=sha256:c4165821e131d6d4ca444347c2b694e2311bcfa3fe5a861cc72968f28867beac \
-    --hash=sha256:c5f5df567f6eb216de69be06ce55c8b714090fae02b18a3b40da8163b8c5fa9c \
-    --hash=sha256:c941bb58d5a6e1c3892d86e42927ed6c180302f07e6d395d08c416e594b98b46 \
-    --hash=sha256:c97f080ea627e2863524c5af3836e2270b5f5dfff1f104392b959f8df0c5d384 \
-    --hash=sha256:cb96698e3c7413d906ce83f8ffd245ec1bd94707541f299d0ce4d6b0193e982b \
-    --hash=sha256:cbb7640ce37159548d2147b5b8c241f962143d4c71231431820783f4dc78f210 \
-    --hash=sha256:cdf2448aab5f661c9315308ec8b93f4e8a1a67a3c733f8631067a2b67d5913dc \
-    --hash=sha256:d2117334c3af3bdcb9a88522b844a2bdb5efdc4f71c6c822df55486ae1c3347a \
-    --hash=sha256:d53d10f7da99ae46f7373b9150393e9c5eab9b224909982b43832668de4779f5 \
-    --hash=sha256:d9fafc5aa2e2a39aaf7f8cc0c1f044a9b07fca12e558dca53a3cc5c654ad67a7 \
-    --hash=sha256:db3eb7d46527159a878ec3460e9d40615bc25ba337d477db681aea6e4f05c5d2 \
-    --hash=sha256:dbf7c7a88e2bac086f06d14577332760bdeecc42bdec8ac4077f6260557d9326 \
-    --hash=sha256:df2b82571a1b30f58a87bf4e5a9e78d2b1eff6c6ce8fd3aa3757221f93f0863f \
-    --hash=sha256:df92f2aba50eb4d96718b68ef76f2e57a57b54f2fa62333496d16c6d585a85ca \
-    --hash=sha256:eb4e8997a49aa2c08a3e43c9045d224448b8941d88e7ac163c7d383e560cbf98 \
-    --hash=sha256:efc1cdd798b1aaf39b4610bba7aad28c9bea9b910f25c784ccf9ec1fa719d1f9 \
-    --hash=sha256:f146d154428a2523f9cc7936c02353c2459b8f6cf07d3cd1ee1c0a611109c5d5 \
-    --hash=sha256:f5bce581e6b8c235e566a14768a943b172ada3ed73537bb0c0be1edee312d4e7 \
-    --hash=sha256:f9912624a0c0b834b7520d7769b3644453aabc0a7e1c839da7359f050750e9bc \
-    --hash=sha256:fb62edb5bb52cca65fab91a63afa7561607120d26090a7e8fda6fb9f064726da \
-    --hash=sha256:ff067a8d8d880e7809e4ac88eb009bb848870115317b306666502ccad30b147f
-    # via
-    #   argon2-cffi-bindings
-    #   cryptography
-click==8.4.2 \
-    --hash=sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6 \
-    --hash=sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76
-    # via flask
-cryptography==44.0.3 \
-    --hash=sha256:02f55fb4f8b79c1221b0961488eaae21015b69b210e18c386b69de182ebb1259 \
-    --hash=sha256:157f1f3b8d941c2bd8f3ffee0af9b049c9665c39d3da9db2dc338feca5e98a43 \
-    --hash=sha256:192ed30fac1728f7587c6f4613c29c584abdc565d7417c13904708db10206645 \
-    --hash=sha256:21a83f6f35b9cc656d71b5de8d519f566df01e660ac2578805ab245ffd8523f8 \
-    --hash=sha256:25cd194c39fa5a0aa4169125ee27d1172097857b27109a45fadc59653ec06f44 \
-    --hash=sha256:3883076d5c4cc56dbef0b898a74eb6992fdac29a7b9013870b34efe4ddb39a0d \
-    --hash=sha256:3bb0847e6363c037df8f6ede57d88eaf3410ca2267fb12275370a76f85786a6f \
-    --hash=sha256:3be3f649d91cb182c3a6bd336de8b61a0a71965bd13d1a04a0e15b39c3d5809d \
-    --hash=sha256:3f07943aa4d7dad689e3bb1638ddc4944cc5e0921e3c227486daae0e31a05e54 \
-    --hash=sha256:479d92908277bed6e1a1c69b277734a7771c2b78633c224445b5c60a9f4bc1d9 \
-    --hash=sha256:4ffc61e8f3bf5b60346d89cd3d37231019c17a081208dfbbd6e1605ba03fa137 \
-    --hash=sha256:5639c2b16764c6f76eedf722dbad9a0914960d3489c0cc38694ddf9464f1bb2f \
-    --hash=sha256:58968d331425a6f9eedcee087f77fd3c927c88f55368f43ff7e0a19891f2642c \
-    --hash=sha256:5d186f32e52e66994dce4f766884bcb9c68b8da62d61d9d215bfe5fb56d21334 \
-    --hash=sha256:5d20cc348cca3a8aa7312f42ab953a56e15323800ca3ab0706b8cd452a3a056c \
-    --hash=sha256:6866df152b581f9429020320e5eb9794c8780e90f7ccb021940d7f50ee00ae0b \
-    --hash=sha256:7d5fe7195c27c32a64955740b949070f21cba664604291c298518d2e255931d2 \
-    --hash=sha256:896530bc9107b226f265effa7ef3f21270f18a2026bc09fed1ebd7b66ddf6375 \
-    --hash=sha256:962bc30480a08d133e631e8dfd4783ab71cc9e33d5d7c1e192f0b7c06397bb88 \
-    --hash=sha256:978631ec51a6bbc0b7e58f23b68a8ce9e5f09721940933e9c217068388789fe5 \
-    --hash=sha256:9b4d4a5dbee05a2c390bf212e78b99434efec37b17a4bff42f50285c5c8c9647 \
-    --hash=sha256:ab0b005721cc0039e885ac3503825661bd9810b15d4f374e473f8c89b7d5460c \
-    --hash=sha256:af653022a0c25ef2e3ffb2c673a50e5a0d02fecc41608f4954176f1933b12359 \
-    --hash=sha256:b0cc66c74c797e1db750aaa842ad5b8b78e14805a9b5d1348dc603612d3e3ff5 \
-    --hash=sha256:b424563394c369a804ecbee9b06dfb34997f19d00b3518e39f83a5642618397d \
-    --hash=sha256:c138abae3a12a94c75c10499f1cbae81294a6f983b3af066390adee73f433028 \
-    --hash=sha256:c6cd67722619e4d55fdb42ead64ed8843d64638e9c07f4011163e46bc512cf01 \
-    --hash=sha256:c91fc8e8fd78af553f98bc7f2a1d8db977334e4eea302a4bfd75b9461c2d8904 \
-    --hash=sha256:cad399780053fb383dc067475135e41c9fe7d901a97dd5d9c5dfb5611afc0d7d \
-    --hash=sha256:cb90f60e03d563ca2445099edf605c16ed1d5b15182d21831f58460c48bffb93 \
-    --hash=sha256:dad80b45c22e05b259e33ddd458e9e2ba099c86ccf4e88db7bbab4b747b18d06 \
-    --hash=sha256:dd3db61b8fe5be220eee484a17233287d0be6932d056cf5738225b9c05ef4fff \
-    --hash=sha256:e28d62e59a4dbd1d22e747f57d4f00c459af22181f0b2f787ea83f5a876d7c76 \
-    --hash=sha256:e909df4053064a97f1e6565153ff8bb389af12c5c8d29c343308760890560aff \
-    --hash=sha256:f3ffef566ac88f75967d7abd852ed5f182da252d23fac11b4766da3957766759 \
-    --hash=sha256:fc3c9babc1e1faefd62704bb46a69f359a9819eb0292e40df3fb6e3574715cd4 \
-    --hash=sha256:fe19d8bc5536a91a24a8133328880a41831b6c5df54599a8417b62fe015d3053
-    # via
-    #   aioquic
-    #   mitmproxy
-    #   pyopenssl
-    #   service-identity
-flask==3.1.0 \
-    --hash=sha256:5f873c5184c897c8d9d1b05df1e3d01b14910ce69607a117bd3277098a5836ac \
-    --hash=sha256:d667207822eb83f1c4b50949b1623c8fc8d51f2341d65f72e1a1815397551136
-    # via mitmproxy
-h11==0.14.0 \
-    --hash=sha256:8f19fbbe99e72420ff35c00b27a34cb9937e902a8b810e2c88300c6f0a3b699d \
-    --hash=sha256:e3fe4ac4b851c468cc8363d500db52c2ead036020723024a109d37346efaa761
-    # via
-    #   mitmproxy
-    #   wsproto
-h2==4.1.0 \
-    --hash=sha256:03a46bcf682256c95b5fd9e9a99c1323584c3eec6440d379b9903d709476bc6d \
-    --hash=sha256:a83aca08fbe7aacb79fec788c9c0bac936343560ed9ec18b82a13a12c28d2abb
-    # via mitmproxy
-hpack==4.2.0 \
-    --hash=sha256:0895cfa3b5531fc65fe439c05eb65144f123bf7a394fcaa56aa423548d8e45c0 \
-    --hash=sha256:858ac0b02280fa582b5080d68db0899c62a80375e0e5413a74970c5e518b6986
-    # via h2
-hyperframe==6.1.0 \
-    --hash=sha256:b03380493a519fce58ea5af42e4a42317bf9bd425596f7a0835ffce80f1a42e5 \
-    --hash=sha256:f630908a00854a7adeabd6382b43923a4c4cd4b821fcb527e6ab9e15382a3b08
-    # via
-    #   h2
-    #   mitmproxy
-itsdangerous==2.2.0 \
-    --hash=sha256:c6242fc49e35958c8b15141343aa660db5fc54d4f13a1db01a3f5891b98700ef \
-    --hash=sha256:e0050c0b7da1eea53ffaf149c0cfbb5c6e2e2b69c4bef22c81fa6eb73e5f6173
-    # via flask
-jinja2==3.1.6 \
-    --hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \
-    --hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67
-    # via flask
-kaitaistruct==0.10 \
-    --hash=sha256:a044dee29173d6afbacf27bcac39daf89b654dd418cfa009ab82d9178a9ae52a \
-    --hash=sha256:a97350919adbf37fda881f75e9365e2fb88d04832b7a4e57106ec70119efb235
-    # via mitmproxy
-ldap3==2.9.1 \
-    --hash=sha256:5869596fc4948797020d3f03b7939da938778a0f9e2009f7a072ccf92b8e8d70 \
-    --hash=sha256:f3e7fc4718e3f09dda568b57100095e0ce58633bcabbed8667ce3f8fbaa4229f
-    # via mitmproxy
-markupsafe==3.0.3 \
-    --hash=sha256:0303439a41979d9e74d18ff5e2dd8c43ed6c6001fd40e5bf2e43f7bd9bbc523f \
-    --hash=sha256:068f375c472b3e7acbe2d5318dea141359e6900156b5b2ba06a30b169086b91a \
-    --hash=sha256:0bf2a864d67e76e5c9a34dc26ec616a66b9888e25e7b9460e1c76d3293bd9dbf \
-    --hash=sha256:0db14f5dafddbb6d9208827849fad01f1a2609380add406671a26386cdf15a19 \
-    --hash=sha256:0eb9ff8191e8498cca014656ae6b8d61f39da5f95b488805da4bb029cccbfbaf \
-    --hash=sha256:0f4b68347f8c5eab4a13419215bdfd7f8c9b19f2b25520968adfad23eb0ce60c \
-    --hash=sha256:1085e7fbddd3be5f89cc898938f42c0b3c711fdcb37d75221de2666af647c175 \
-    --hash=sha256:116bb52f642a37c115f517494ea5feb03889e04df47eeff5b130b1808ce7c219 \
-    --hash=sha256:12c63dfb4a98206f045aa9563db46507995f7ef6d83b2f68eda65c307c6829eb \
-    --hash=sha256:133a43e73a802c5562be9bbcd03d090aa5a1fe899db609c29e8c8d815c5f6de6 \
-    --hash=sha256:1353ef0c1b138e1907ae78e2f6c63ff67501122006b0f9abad68fda5f4ffc6ab \
-    --hash=sha256:15d939a21d546304880945ca1ecb8a039db6b4dc49b2c5a400387cdae6a62e26 \
-    --hash=sha256:177b5253b2834fe3678cb4a5f0059808258584c559193998be2601324fdeafb1 \
-    --hash=sha256:1872df69a4de6aead3491198eaf13810b565bdbeec3ae2dc8780f14458ec73ce \
-    --hash=sha256:1b4b79e8ebf6b55351f0d91fe80f893b4743f104bff22e90697db1590e47a218 \
-    --hash=sha256:1b52b4fb9df4eb9ae465f8d0c228a00624de2334f216f178a995ccdcf82c4634 \
-    --hash=sha256:1ba88449deb3de88bd40044603fafffb7bc2b055d626a330323a9ed736661695 \
-    --hash=sha256:1cc7ea17a6824959616c525620e387f6dd30fec8cb44f649e31712db02123dad \
-    --hash=sha256:218551f6df4868a8d527e3062d0fb968682fe92054e89978594c28e642c43a73 \
-    --hash=sha256:26a5784ded40c9e318cfc2bdb30fe164bdb8665ded9cd64d500a34fb42067b1c \
-    --hash=sha256:2713baf880df847f2bece4230d4d094280f4e67b1e813eec43b4c0e144a34ffe \
-    --hash=sha256:2a15a08b17dd94c53a1da0438822d70ebcd13f8c3a95abe3a9ef9f11a94830aa \
-    --hash=sha256:2f981d352f04553a7171b8e44369f2af4055f888dfb147d55e42d29e29e74559 \
-    --hash=sha256:32001d6a8fc98c8cb5c947787c5d08b0a50663d139f1305bac5885d98d9b40fa \
-    --hash=sha256:3524b778fe5cfb3452a09d31e7b5adefeea8c5be1d43c4f810ba09f2ceb29d37 \
-    --hash=sha256:3537e01efc9d4dccdf77221fb1cb3b8e1a38d5428920e0657ce299b20324d758 \
-    --hash=sha256:35add3b638a5d900e807944a078b51922212fb3dedb01633a8defc4b01a3c85f \
-    --hash=sha256:38664109c14ffc9e7437e86b4dceb442b0096dfe3541d7864d9cbe1da4cf36c8 \
-    --hash=sha256:3a7e8ae81ae39e62a41ec302f972ba6ae23a5c5396c8e60113e9066ef893da0d \
-    --hash=sha256:3b562dd9e9ea93f13d53989d23a7e775fdfd1066c33494ff43f5418bc8c58a5c \
-    --hash=sha256:457a69a9577064c05a97c41f4e65148652db078a3a509039e64d3467b9e7ef97 \
-    --hash=sha256:4bd4cd07944443f5a265608cc6aab442e4f74dff8088b0dfc8238647b8f6ae9a \
-    --hash=sha256:4e885a3d1efa2eadc93c894a21770e4bc67899e3543680313b09f139e149ab19 \
-    --hash=sha256:4faffd047e07c38848ce017e8725090413cd80cbc23d86e55c587bf979e579c9 \
-    --hash=sha256:509fa21c6deb7a7a273d629cf5ec029bc209d1a51178615ddf718f5918992ab9 \
-    --hash=sha256:5678211cb9333a6468fb8d8be0305520aa073f50d17f089b5b4b477ea6e67fdc \
-    --hash=sha256:591ae9f2a647529ca990bc681daebdd52c8791ff06c2bfa05b65163e28102ef2 \
-    --hash=sha256:5a7d5dc5140555cf21a6fefbdbf8723f06fcd2f63ef108f2854de715e4422cb4 \
-    --hash=sha256:69c0b73548bc525c8cb9a251cddf1931d1db4d2258e9599c28c07ef3580ef354 \
-    --hash=sha256:6b5420a1d9450023228968e7e6a9ce57f65d148ab56d2313fcd589eee96a7a50 \
-    --hash=sha256:722695808f4b6457b320fdc131280796bdceb04ab50fe1795cd540799ebe1698 \
-    --hash=sha256:729586769a26dbceff69f7a7dbbf59ab6572b99d94576a5592625d5b411576b9 \
-    --hash=sha256:77f0643abe7495da77fb436f50f8dab76dbc6e5fd25d39589a0f1fe6548bfa2b \
-    --hash=sha256:795e7751525cae078558e679d646ae45574b47ed6e7771863fcc079a6171a0fc \
-    --hash=sha256:7be7b61bb172e1ed687f1754f8e7484f1c8019780f6f6b0786e76bb01c2ae115 \
-    --hash=sha256:7c3fb7d25180895632e5d3148dbdc29ea38ccb7fd210aa27acbd1201a1902c6e \
-    --hash=sha256:7e68f88e5b8799aa49c85cd116c932a1ac15caaa3f5db09087854d218359e485 \
-    --hash=sha256:83891d0e9fb81a825d9a6d61e3f07550ca70a076484292a70fde82c4b807286f \
-    --hash=sha256:8485f406a96febb5140bfeca44a73e3ce5116b2501ac54fe953e488fb1d03b12 \
-    --hash=sha256:8709b08f4a89aa7586de0aadc8da56180242ee0ada3999749b183aa23df95025 \
-    --hash=sha256:8f71bc33915be5186016f675cd83a1e08523649b0e33efdb898db577ef5bb009 \
-    --hash=sha256:915c04ba3851909ce68ccc2b8e2cd691618c4dc4c4232fb7982bca3f41fd8c3d \
-    --hash=sha256:949b8d66bc381ee8b007cd945914c721d9aba8e27f71959d750a46f7c282b20b \
-    --hash=sha256:94c6f0bb423f739146aec64595853541634bde58b2135f27f61c1ffd1cd4d16a \
-    --hash=sha256:9a1abfdc021a164803f4d485104931fb8f8c1efd55bc6b748d2f5774e78b62c5 \
-    --hash=sha256:9b79b7a16f7fedff2495d684f2b59b0457c3b493778c9eed31111be64d58279f \
-    --hash=sha256:a320721ab5a1aba0a233739394eb907f8c8da5c98c9181d1161e77a0c8e36f2d \
-    --hash=sha256:a4afe79fb3de0b7097d81da19090f4df4f8d3a2b3adaa8764138aac2e44f3af1 \
-    --hash=sha256:ad2cf8aa28b8c020ab2fc8287b0f823d0a7d8630784c31e9ee5edea20f406287 \
-    --hash=sha256:b8512a91625c9b3da6f127803b166b629725e68af71f8184ae7e7d54686a56d6 \
-    --hash=sha256:bc51efed119bc9cfdf792cdeaa4d67e8f6fcccab66ed4bfdd6bde3e59bfcbb2f \
-    --hash=sha256:bdc919ead48f234740ad807933cdf545180bfbe9342c2bb451556db2ed958581 \
-    --hash=sha256:bdd37121970bfd8be76c5fb069c7751683bdf373db1ed6c010162b2a130248ed \
-    --hash=sha256:be8813b57049a7dc738189df53d69395eba14fb99345e0a5994914a3864c8a4b \
-    --hash=sha256:c0c0b3ade1c0b13b936d7970b1d37a57acde9199dc2aecc4c336773e1d86049c \
-    --hash=sha256:c47a551199eb8eb2121d4f0f15ae0f923d31350ab9280078d1e5f12b249e0026 \
-    --hash=sha256:c4ffb7ebf07cfe8931028e3e4c85f0357459a3f9f9490886198848f4fa002ec8 \
-    --hash=sha256:ccfcd093f13f0f0b7fdd0f198b90053bf7b2f02a3927a30e63f3ccc9df56b676 \
-    --hash=sha256:d2ee202e79d8ed691ceebae8e0486bd9a2cd4794cec4824e1c99b6f5009502f6 \
-    --hash=sha256:d53197da72cc091b024dd97249dfc7794d6a56530370992a5e1a08983ad9230e \
-    --hash=sha256:d6dd0be5b5b189d31db7cda48b91d7e0a9795f31430b7f271219ab30f1d3ac9d \
-    --hash=sha256:d88b440e37a16e651bda4c7c2b930eb586fd15ca7406cb39e211fcff3bf3017d \
-    --hash=sha256:de8a88e63464af587c950061a5e6a67d3632e36df62b986892331d4620a35c01 \
-    --hash=sha256:df2449253ef108a379b8b5d6b43f4b1a8e81a061d6537becd5582fba5f9196d7 \
-    --hash=sha256:e1c1493fb6e50ab01d20a22826e57520f1284df32f2d8601fdd90b6304601419 \
-    --hash=sha256:e1cf1972137e83c5d4c136c43ced9ac51d0e124706ee1c8aa8532c1287fa8795 \
-    --hash=sha256:e2103a929dfa2fcaf9bb4e7c091983a49c9ac3b19c9061b6d5427dd7d14d81a1 \
-    --hash=sha256:e56b7d45a839a697b5eb268c82a71bd8c7f6c94d6fd50c3d577fa39a9f1409f5 \
-    --hash=sha256:e8afc3f2ccfa24215f8cb28dcf43f0113ac3c37c2f0f0806d8c70e4228c5cf4d \
-    --hash=sha256:e8fc20152abba6b83724d7ff268c249fa196d8259ff481f3b1476383f8f24e42 \
-    --hash=sha256:eaa9599de571d72e2daf60164784109f19978b327a3910d3e9de8c97b5b70cfe \
-    --hash=sha256:ec15a59cf5af7be74194f7ab02d0f59a62bdcf1a537677ce67a2537c9b87fcda \
-    --hash=sha256:f190daf01f13c72eac4efd5c430a8de82489d9cff23c364c3ea822545032993e \
-    --hash=sha256:f34c41761022dd093b4b6896d4810782ffbabe30f2d443ff5f083e0cbbb8c737 \
-    --hash=sha256:f3e98bb3798ead92273dc0e5fd0f31ade220f59a266ffd8a4f6065e0a3ce0523 \
-    --hash=sha256:f42d0984e947b8adf7dd6dde396e720934d12c506ce84eea8476409563607591 \
-    --hash=sha256:f71a396b3bf33ecaa1626c255855702aca4d3d9fea5e051b41ac59a9c1c41edc \
-    --hash=sha256:f9e130248f4462aaa8e2552d547f36ddadbeaa573879158d721bbd33dfe4743a \
-    --hash=sha256:fed51ac40f757d41b7c48425901843666a6677e3e8eb0abcff09e4ba6e664f50
-    # via
-    #   jinja2
-    #   werkzeug
-mitmproxy==11.1.3 \
-    --hash=sha256:2305880b46465d1a9bdcdac369655826f588d05f382b082249a3e532a0e52952
-    # via -r requirements.gateway.in
-mitmproxy-linux==0.11.5 \
-    --hash=sha256:00a40d08a1522d5718e9ff87458a950f06f62e5374d154d851122c0eb41c5dc0 \
-    --hash=sha256:544be1db84575fc8ecc71fb566032cabe4a65a4891d5bd0dc688e3023b49a18a \
-    --hash=sha256:d7ce0b91d7a510009d532e6abbebe59f027a011fa745b13faa5b4d9ebe92abf5 \
-    --hash=sha256:e6a31faf244a9e3d44db02e3e3301aa2e699da67188820982a93028884f4cba8 \
-    --hash=sha256:ee3782fe4e7ccc6a899fa0ef5ad3e35a3ec358587304bd4d212188d2462c8f82
-    # via mitmproxy-rs
-mitmproxy-rs==0.11.5 \
-    --hash=sha256:05f0da03165c2ee2803f91e6648bc9409692f42d796cbaf3fec5a20754ca8c39 \
-    --hash=sha256:2f668dc92573cc3c3ba8c75b166276d846ce7321daf37f4a68bd837538298c5c \
-    --hash=sha256:5353ad0c828aaa37ac53511f3960e39c0888848565f5faa3ea09e205ed8a7350 \
-    --hash=sha256:5a4ffe6d20b3a0edb47b40cd60e7b62709c29e8adf2573514cc0abd1442acf63 \
-    --hash=sha256:971241cb70bad87b55f12bc6e8d7dd3efd02a1acbe1730703e2cfeeb6edd3908
-    # via mitmproxy
-msgpack==1.1.0 \
-    --hash=sha256:06f5fd2f6bb2a7914922d935d3b8bb4a7fff3a9a91cfce6d06c13bc42bec975b \
-    --hash=sha256:071603e2f0771c45ad9bc65719291c568d4edf120b44eb36324dcb02a13bfddf \
-    --hash=sha256:0907e1a7119b337971a689153665764adc34e89175f9a34793307d9def08e6ca \
-    --hash=sha256:0f92a83b84e7c0749e3f12821949d79485971f087604178026085f60ce109330 \
-    --hash=sha256:115a7af8ee9e8cddc10f87636767857e7e3717b7a2e97379dc2054712693e90f \
-    --hash=sha256:13599f8829cfbe0158f6456374e9eea9f44eee08076291771d8ae93eda56607f \
-    --hash=sha256:17fb65dd0bec285907f68b15734a993ad3fc94332b5bb21b0435846228de1f39 \
-    --hash=sha256:2137773500afa5494a61b1208619e3871f75f27b03bcfca7b3a7023284140247 \
-    --hash=sha256:3180065ec2abbe13a4ad37688b61b99d7f9e012a535b930e0e683ad6bc30155b \
-    --hash=sha256:398b713459fea610861c8a7b62a6fec1882759f308ae0795b5413ff6a160cf3c \
-    --hash=sha256:3d364a55082fb2a7416f6c63ae383fbd903adb5a6cf78c5b96cc6316dc1cedc7 \
-    --hash=sha256:3df7e6b05571b3814361e8464f9304c42d2196808e0119f55d0d3e62cd5ea044 \
-    --hash=sha256:41c991beebf175faf352fb940bf2af9ad1fb77fd25f38d9142053914947cdbf6 \
-    --hash=sha256:42f754515e0f683f9c79210a5d1cad631ec3d06cea5172214d2176a42e67e19b \
-    --hash=sha256:452aff037287acb1d70a804ffd022b21fa2bb7c46bee884dbc864cc9024128a0 \
-    --hash=sha256:4676e5be1b472909b2ee6356ff425ebedf5142427842aa06b4dfd5117d1ca8a2 \
-    --hash=sha256:46c34e99110762a76e3911fc923222472c9d681f1094096ac4102c18319e6468 \
-    --hash=sha256:471e27a5787a2e3f974ba023f9e265a8c7cfd373632247deb225617e3100a3c7 \
-    --hash=sha256:4a1964df7b81285d00a84da4e70cb1383f2e665e0f1f2a7027e683956d04b734 \
-    --hash=sha256:4b51405e36e075193bc051315dbf29168d6141ae2500ba8cd80a522964e31434 \
-    --hash=sha256:4d1b7ff2d6146e16e8bd665ac726a89c74163ef8cd39fa8c1087d4e52d3a2325 \
-    --hash=sha256:53258eeb7a80fc46f62fd59c876957a2d0e15e6449a9e71842b6d24419d88ca1 \
-    --hash=sha256:534480ee5690ab3cbed89d4c8971a5c631b69a8c0883ecfea96c19118510c846 \
-    --hash=sha256:58638690ebd0a06427c5fe1a227bb6b8b9fdc2bd07701bec13c2335c82131a88 \
-    --hash=sha256:58dfc47f8b102da61e8949708b3eafc3504509a5728f8b4ddef84bd9e16ad420 \
-    --hash=sha256:59caf6a4ed0d164055ccff8fe31eddc0ebc07cf7326a2aaa0dbf7a4001cd823e \
-    --hash=sha256:5dbad74103df937e1325cc4bfeaf57713be0b4f15e1c2da43ccdd836393e2ea2 \
-    --hash=sha256:5e1da8f11a3dd397f0a32c76165cf0c4eb95b31013a94f6ecc0b280c05c91b59 \
-    --hash=sha256:646afc8102935a388ffc3914b336d22d1c2d6209c773f3eb5dd4d6d3b6f8c1cb \
-    --hash=sha256:64fc9068d701233effd61b19efb1485587560b66fe57b3e50d29c5d78e7fef68 \
-    --hash=sha256:65553c9b6da8166e819a6aa90ad15288599b340f91d18f60b2061f402b9a4915 \
-    --hash=sha256:685ec345eefc757a7c8af44a3032734a739f8c45d1b0ac45efc5d8977aa4720f \
-    --hash=sha256:6ad622bf7756d5a497d5b6836e7fc3752e2dd6f4c648e24b1803f6048596f701 \
-    --hash=sha256:73322a6cc57fcee3c0c57c4463d828e9428275fb85a27aa2aa1a92fdc42afd7b \
-    --hash=sha256:74bed8f63f8f14d75eec75cf3d04ad581da6b914001b474a5d3cd3372c8cc27d \
-    --hash=sha256:79ec007767b9b56860e0372085f8504db5d06bd6a327a335449508bbee9648fa \
-    --hash=sha256:7a946a8992941fea80ed4beae6bff74ffd7ee129a90b4dd5cf9c476a30e9708d \
-    --hash=sha256:7ad442d527a7e358a469faf43fda45aaf4ac3249c8310a82f0ccff9164e5dccd \
-    --hash=sha256:7c9a35ce2c2573bada929e0b7b3576de647b0defbd25f5139dcdaba0ae35a4cc \
-    --hash=sha256:7e7b853bbc44fb03fbdba34feb4bd414322180135e2cb5164f20ce1c9795ee48 \
-    --hash=sha256:879a7b7b0ad82481c52d3c7eb99bf6f0645dbdec5134a4bddbd16f3506947feb \
-    --hash=sha256:8a706d1e74dd3dea05cb54580d9bd8b2880e9264856ce5068027eed09680aa74 \
-    --hash=sha256:8a84efb768fb968381e525eeeb3d92857e4985aacc39f3c47ffd00eb4509315b \
-    --hash=sha256:8cf9e8c3a2153934a23ac160cc4cba0ec035f6867c8013cc6077a79823370346 \
-    --hash=sha256:8da4bf6d54ceed70e8861f833f83ce0814a2b72102e890cbdfe4b34764cdd66e \
-    --hash=sha256:8e59bca908d9ca0de3dc8684f21ebf9a690fe47b6be93236eb40b99af28b6ea6 \
-    --hash=sha256:914571a2a5b4e7606997e169f64ce53a8b1e06f2cf2c3a7273aa106236d43dd5 \
-    --hash=sha256:a51abd48c6d8ac89e0cfd4fe177c61481aca2d5e7ba42044fd218cfd8ea9899f \
-    --hash=sha256:a52a1f3a5af7ba1c9ace055b659189f6c669cf3657095b50f9602af3a3ba0fe5 \
-    --hash=sha256:ad33e8400e4ec17ba782f7b9cf868977d867ed784a1f5f2ab46e7ba53b6e1e1b \
-    --hash=sha256:b4c01941fd2ff87c2a934ee6055bda4ed353a7846b8d4f341c428109e9fcde8c \
-    --hash=sha256:bce7d9e614a04d0883af0b3d4d501171fbfca038f12c77fa838d9f198147a23f \
-    --hash=sha256:c40ffa9a15d74e05ba1fe2681ea33b9caffd886675412612d93ab17b58ea2fec \
-    --hash=sha256:c5a91481a3cc573ac8c0d9aace09345d989dc4a0202b7fcb312c88c26d4e71a8 \
-    --hash=sha256:c921af52214dcbb75e6bdf6a661b23c3e6417f00c603dd2070bccb5c3ef499f5 \
-    --hash=sha256:d46cf9e3705ea9485687aa4001a76e44748b609d260af21c4ceea7f2212a501d \
-    --hash=sha256:d8ce0b22b890be5d252de90d0e0d119f363012027cf256185fc3d474c44b1b9e \
-    --hash=sha256:dd432ccc2c72b914e4cb77afce64aab761c1137cc698be3984eee260bcb2896e \
-    --hash=sha256:e0856a2b7e8dcb874be44fea031d22e5b3a19121be92a1e098f46068a11b0870 \
-    --hash=sha256:e1f3c3d21f7cf67bcf2da8e494d30a75e4cf60041d98b3f79875afb5b96f3a3f \
-    --hash=sha256:f1ba6136e650898082d9d5a5217d5906d1e138024f836ff48691784bbe1adf96 \
-    --hash=sha256:f3e9b4936df53b970513eac1758f3882c88658a220b58dcc1e39606dccaaf01c \
-    --hash=sha256:f80bc7d47f76089633763f952e67f8214cb7b3ee6bfa489b3cb6a84cfac114cd \
-    --hash=sha256:fd2906780f25c8ed5d7b323379f6138524ba793428db5d0e9d226d3fa6aa1788
-    # via mitmproxy
-passlib==1.7.4 \
-    --hash=sha256:aa6bca462b8d8bda89c70b382f0c298a20b5560af6cbfa2dce410c0a2fb669f1 \
-    --hash=sha256:defd50f72b65c5402ab2c573830a6978e5f202ad0d984793c8dde2c4152ebe04
-    # via mitmproxy
-publicsuffix2==2.20191221 \
-    --hash=sha256:00f8cc31aa8d0d5592a5ced19cccba7de428ebca985db26ac852d920ddd6fe7b \
-    --hash=sha256:786b5e36205b88758bd3518725ec8cfe7a8173f5269354641f581c6b80a99893
-    # via mitmproxy
-pyasn1==0.6.4 \
-    --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \
-    --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b
-    # via
-    #   ldap3
-    #   pyasn1-modules
-    #   service-identity
-pyasn1-modules==0.4.2 \
-    --hash=sha256:29253a9207ce32b64c3ac6600edc75368f98473906e8fd1043bd6b5b1de2c14a \
-    --hash=sha256:677091de870a80aae844b1ca6134f54652fa2c8c5a52aa396440ac3106e941e6
-    # via service-identity
-pycparser==3.0 \
-    --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \
-    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
-    # via cffi
-pylsqpack==0.3.24 \
-    --hash=sha256:23b4d8af48836893beac356c10ca268161953de5bf9ed691526a93f5c82433e9 \
-    --hash=sha256:54978a9879471596d84bbad5e67d727014048926bc5bb2dac0eb3701b48c5ac9 \
-    --hash=sha256:6024854eb16d32803d4890fb90a73b9348c74b61c0770680aefaaa75f8456e8c \
-    --hash=sha256:8da12be7b35b7c9a8cf73a4c077f72e5022a311f80a401c79904213376f2d767 \
-    --hash=sha256:8ec455f44614228f89e38d40c1b1e37895620e20ec6b21e3b562fa8b79a23890 \
-    --hash=sha256:8edf48d0a023cd3629b2c4aaccac9b79a46d566c0f61e7416b5678228433763d \
-    --hash=sha256:b6a8bb42127d5ece8d301a673c8205df25b73b69f8c46b9f0c3034588de1789a \
-    --hash=sha256:c3e2327af25ee616ce4483a8748f0957cf017cbca82d58ed15efea68f70f94ff \
-    --hash=sha256:caf63ddc2e581c764d17432893acce02c5c29ff879d77c2abf1e26aa4eeb831b \
-    --hash=sha256:e3dc5f146fd456b50b227858aed59faa0ff8445aa426e69bb4e50d46c487aab0 \
-    --hash=sha256:e3f977d419c60c1d6c2240e6d7a52df820d37eb8c36b4057113bcd7859f53e2c \
-    --hash=sha256:e7d956dbc8f7d597b237b9157d0a16bc7c655a1b031239763c18dc8582aff8cc
-    # via aioquic
-pyopenssl==25.0.0 \
-    --hash=sha256:424c247065e46e76a37411b9ab1782541c23bb658bf003772c3405fbaa128e90 \
-    --hash=sha256:cd2cef799efa3936bb08e8ccb9433a575722b9dd986023f1cabc4ae64e9dac16
-    # via
-    #   aioquic
-    #   mitmproxy
-pyparsing==3.2.1 \
-    --hash=sha256:506ff4f4386c4cec0590ec19e6302d3aedb992fdc02c761e90416f158dacf8e1 \
-    --hash=sha256:61980854fd66de3a90028d679a954d5f2623e83144b5afe5ee86f43d762e5f0a
-    # via mitmproxy
-pyperclip==1.9.0 \
-    --hash=sha256:b7de0142ddc81bfc5c7507eea19da920b92252b548b96186caf94a5e2527d310
-    # via mitmproxy
-ruamel-yaml==0.18.10 \
-    --hash=sha256:20c86ab29ac2153f80a428e1254a8adf686d3383df04490514ca3b79a362db58 \
-    --hash=sha256:30f22513ab2301b3d2b577adc121c6471f28734d3d9728581245f1e76468b4f1
-    # via mitmproxy
-ruamel-yaml-clib==0.2.15 \
-    --hash=sha256:014181cdec565c8745b7cbc4de3bf2cc8ced05183d986e6d1200168e5bb59490 \
-    --hash=sha256:04d21dc9c57d9608225da28285900762befbb0165ae48482c15d8d4989d4af14 \
-    --hash=sha256:05c70f7f86be6f7bee53794d80050a28ae7e13e4a0087c1839dcdefd68eb36b6 \
-    --hash=sha256:0ba6604bbc3dfcef844631932d06a1a4dcac3fee904efccf582261948431628a \
-    --hash=sha256:11e5499db1ccbc7f4b41f0565e4f799d863ea720e01d3e99fa0b7b5fcd7802c9 \
-    --hash=sha256:1b45498cc81a4724a2d42273d6cfc243c0547ad7c6b87b4f774cb7bcc131c98d \
-    --hash=sha256:1bb7b728fd9f405aa00b4a0b17ba3f3b810d0ccc5f77f7373162e9b5f0ff75d5 \
-    --hash=sha256:1f66f600833af58bea694d5892453f2270695b92200280ee8c625ec5a477eed3 \
-    --hash=sha256:27dc656e84396e6d687f97c6e65fb284d100483628f02d95464fd731743a4afe \
-    --hash=sha256:2812ff359ec1f30129b62372e5f22a52936fac13d5d21e70373dbca5d64bb97c \
-    --hash=sha256:2b216904750889133d9222b7b873c199d48ecbb12912aca78970f84a5aa1a4bc \
-    --hash=sha256:331fb180858dd8534f0e61aa243b944f25e73a4dae9962bd44c46d1761126bbf \
-    --hash=sha256:3cb75a3c14f1d6c3c2a94631e362802f70e83e20d1f2b2ef3026c05b415c4900 \
-    --hash=sha256:3eb199178b08956e5be6288ee0b05b2fb0b5c1f309725ad25d9c6ea7e27f962a \
-    --hash=sha256:424ead8cef3939d690c4b5c85ef5b52155a231ff8b252961b6516ed7cf05f6aa \
-    --hash=sha256:45702dfbea1420ba3450bb3dd9a80b33f0badd57539c6aac09f42584303e0db6 \
-    --hash=sha256:468858e5cbde0198337e6a2a78eda8c3fb148bdf4c6498eaf4bc9ba3f8e780bd \
-    --hash=sha256:46895c17ead5e22bea5e576f1db7e41cb273e8d062c04a6a49013d9f60996c25 \
-    --hash=sha256:46e4cc8c43ef6a94885f72512094e482114a8a706d3c555a34ed4b0d20200600 \
-    --hash=sha256:480894aee0b29752560a9de46c0e5f84a82602f2bc5c6cde8db9a345319acfdf \
-    --hash=sha256:4b293a37dc97e2b1e8a1aec62792d1e52027087c8eea4fc7b5abd2bdafdd6642 \
-    --hash=sha256:4be366220090d7c3424ac2b71c90d1044ea34fca8c0b88f250064fd06087e614 \
-    --hash=sha256:4d1032919280ebc04a80e4fb1e93f7a738129857eaec9448310e638c8bccefcf \
-    --hash=sha256:4d3b58ab2454b4747442ac76fab66739c72b1e2bb9bd173d7694b9f9dbc9c000 \
-    --hash=sha256:4dcec721fddbb62e60c2801ba08c87010bd6b700054a09998c4d09c08147b8fb \
-    --hash=sha256:512571ad41bba04eac7268fe33f7f4742210ca26a81fe0c75357fa682636c690 \
-    --hash=sha256:542d77b72786a35563f97069b9379ce762944e67055bea293480f7734b2c7e5e \
-    --hash=sha256:56ea19c157ed8c74b6be51b5fa1c3aff6e289a041575f0556f66e5fb848bb137 \
-    --hash=sha256:5d3c9210219cbc0f22706f19b154c9a798ff65a6beeafbf77fc9c057ec806f7d \
-    --hash=sha256:5fea0932358e18293407feb921d4f4457db837b67ec1837f87074667449f9401 \
-    --hash=sha256:617d35dc765715fa86f8c3ccdae1e4229055832c452d4ec20856136acc75053f \
-    --hash=sha256:64da03cbe93c1e91af133f5bec37fd24d0d4ba2418eaf970d7166b0a26a148a2 \
-    --hash=sha256:65f48245279f9bb301d1276f9679b82e4c080a1ae25e679f682ac62446fac471 \
-    --hash=sha256:6f1d38cbe622039d111b69e9ca945e7e3efebb30ba998867908773183357f3ed \
-    --hash=sha256:713cd68af9dfbe0bb588e144a61aad8dcc00ef92a82d2e87183ca662d242f524 \
-    --hash=sha256:71845d377c7a47afc6592aacfea738cc8a7e876d586dfba814501d8c53c1ba60 \
-    --hash=sha256:753faf20b3a5906faf1fc50e4ddb8c074cb9b251e00b14c18b28492f933ac8ef \
-    --hash=sha256:7e74ea87307303ba91073b63e67f2c667e93f05a8c63079ee5b7a5c8d0d7b043 \
-    --hash=sha256:88eea8baf72f0ccf232c22124d122a7f26e8a24110a0273d9bcddcb0f7e1fa03 \
-    --hash=sha256:923816815974425fbb1f1bf57e85eca6e14d8adc313c66db21c094927ad01815 \
-    --hash=sha256:9b6f7d74d094d1f3a4e157278da97752f16ee230080ae331fcc219056ca54f77 \
-    --hash=sha256:a8220fd4c6f98485e97aea65e1df76d4fed1678ede1fe1d0eed2957230d287c4 \
-    --hash=sha256:ab0df0648d86a7ecbd9c632e8f8d6b21bb21b5fc9d9e095c796cacf32a728d2d \
-    --hash=sha256:ac9b8d5fa4bb7fd2917ab5027f60d4234345fd366fe39aa711d5dca090aa1467 \
-    --hash=sha256:badd1d7283f3e5894779a6ea8944cc765138b96804496c91812b2829f70e18a7 \
-    --hash=sha256:bdc06ad71173b915167702f55d0f3f027fc61abd975bd308a0968c02db4a4c3e \
-    --hash=sha256:bf0846d629e160223805db9fe8cc7aec16aaa11a07310c50c8c7164efa440aec \
-    --hash=sha256:bfd309b316228acecfa30670c3887dcedf9b7a44ea39e2101e75d2654522acd4 \
-    --hash=sha256:c583229f336682b7212a43d2fa32c30e643d3076178fb9f7a6a14dde85a2d8bd \
-    --hash=sha256:cb15a2e2a90c8475df45c0949793af1ff413acfb0a716b8b94e488ea95ce7cff \
-    --hash=sha256:d290eda8f6ada19e1771b54e5706b8f9807e6bb08e873900d5ba114ced13e02c \
-    --hash=sha256:da3d6adadcf55a93c214d23941aef4abfd45652110aed6580e814152f385b862 \
-    --hash=sha256:dcc7f3162d3711fd5d52e2267e44636e3e566d1e5675a5f0b30e98f2c4af7974 \
-    --hash=sha256:def5663361f6771b18646620fca12968aae730132e104688766cf8a3b1d65922 \
-    --hash=sha256:e5e9f630c73a490b758bf14d859a39f375e6999aea5ddd2e2e9da89b9953486a \
-    --hash=sha256:e9fde97ecb7bb9c41261c2ce0da10323e9227555c674989f8d9eb7572fc2098d \
-    --hash=sha256:ef71831bd61fbdb7aa0399d5c4da06bea37107ab5c79ff884cc07f2450910262 \
-    --hash=sha256:f4421ab780c37210a07d138e56dd4b51f8642187cdfb433eb687fe8c11de0144 \
-    --hash=sha256:f6d3655e95a80325b84c4e14c080b2470fe4f33b6846f288379ce36154993fb1 \
-    --hash=sha256:fd4c928ddf6bce586285daa6d90680b9c291cfd045fc40aad34e445d57b1bf51 \
-    --hash=sha256:fe239bdfdae2302e93bd6e8264bd9b71290218fff7084a9db250b55caaccf43f
-    # via ruamel-yaml
-service-identity==24.2.0 \
-    --hash=sha256:6b047fbd8a84fd0bb0d55ebce4031e400562b9196e1e0d3e0fe2b8a59f6d4a85 \
-    --hash=sha256:b8683ba13f0d39c6cd5d625d2c5f65421d6d707b013b375c355751557cbe8e09
-    # via aioquic
-sortedcontainers==2.4.0 \
-    --hash=sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88 \
-    --hash=sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0
-    # via mitmproxy
-tornado==6.4.2 \
-    --hash=sha256:072ce12ada169c5b00b7d92a99ba089447ccc993ea2143c9ede887e0937aa803 \
-    --hash=sha256:1a017d239bd1bb0919f72af256a970624241f070496635784d9bf0db640d3fec \
-    --hash=sha256:2876cef82e6c5978fde1e0d5b1f919d756968d5b4282418f3146b79b58556482 \
-    --hash=sha256:304463bd0772442ff4d0f5149c6f1c2135a1fae045adf070821c6cdc76980634 \
-    --hash=sha256:908b71bf3ff37d81073356a5fadcc660eb10c1476ee6e2725588626ce7e5ca38 \
-    --hash=sha256:92bad5b4746e9879fd7bf1eb21dce4e3fc5128d71601f80005afa39237ad620b \
-    --hash=sha256:932d195ca9015956fa502c6b56af9eb06106140d844a335590c1ec7f5277d10c \
-    --hash=sha256:bca9eb02196e789c9cb5c3c7c0f04fb447dc2adffd95265b2c7223a8a615ccbf \
-    --hash=sha256:c36e62ce8f63409301537222faffcef7dfc5284f27eec227389f2ad11b09d946 \
-    --hash=sha256:c82c46813ba483a385ab2a99caeaedf92585a1f90defb5693351fa7e4ea0bf73 \
-    --hash=sha256:e828cce1123e9e44ae2a50a9de3055497ab1d0aeb440c5ac23064d9e44880da1
-    # via mitmproxy
-typing-extensions==4.16.0 \
-    --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
-    --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5
-    # via
-    #   pyopenssl
-    #   urwid
-urwid==2.6.16 \
-    --hash=sha256:93ad239939e44c385e64aa00027878b9e5c486d59e855ec8ab5b1e1adcdb32a2 \
-    --hash=sha256:de14896c6df9eb759ed1fd93e0384a5279e51e0dde8f621e4083f7a8368c0797
-    # via mitmproxy
-wcwidth==0.8.2 \
-    --hash=sha256:91fbef97204b96a3d4d421609b80340b760cf33e26da123ff243d76b1fda8dda \
-    --hash=sha256:d63947694a0539a1d51e01eda7caf800c291020e6cdd7e28ad7b14dd33ad4f85
-    # via urwid
-werkzeug==3.1.8 \
-    --hash=sha256:63a77fb8892bf28ebc3178683445222aa500e48ebad5ec77b0ad80f8726b1f50 \
-    --hash=sha256:9bad61a4268dac112f1c5cd4630a56ede601b6ed420300677a869083d70a4c44
-    # via flask
-wsproto==1.2.0 \
-    --hash=sha256:ad565f26ecb92588a3e43bc3d96164de84cd9902482b130d0ddbaa9664a85065 \
-    --hash=sha256:b9acddd652b585d75b20477888c56642fdade28bdfd3579aa24a4d2c037dd736
-    # via mitmproxy
-zstandard==0.23.0 \
-    --hash=sha256:034b88913ecc1b097f528e42b539453fa82c3557e414b3de9d5632c80439a473 \
-    --hash=sha256:0a7f0804bb3799414af278e9ad51be25edf67f78f916e08afdb983e74161b916 \
-    --hash=sha256:11e3bf3c924853a2d5835b24f03eeba7fc9b07d8ca499e247e06ff5676461a15 \
-    --hash=sha256:12a289832e520c6bd4dcaad68e944b86da3bad0d339ef7989fb7e88f92e96072 \
-    --hash=sha256:1516c8c37d3a053b01c1c15b182f3b5f5eef19ced9b930b684a73bad121addf4 \
-    --hash=sha256:157e89ceb4054029a289fb504c98c6a9fe8010f1680de0201b3eb5dc20aa6d9e \
-    --hash=sha256:1bfe8de1da6d104f15a60d4a8a768288f66aa953bbe00d027398b93fb9680b26 \
-    --hash=sha256:1e172f57cd78c20f13a3415cc8dfe24bf388614324d25539146594c16d78fcc8 \
-    --hash=sha256:1fd7e0f1cfb70eb2f95a19b472ee7ad6d9a0a992ec0ae53286870c104ca939e5 \
-    --hash=sha256:203d236f4c94cd8379d1ea61db2fce20730b4c38d7f1c34506a31b34edc87bdd \
-    --hash=sha256:27d3ef2252d2e62476389ca8f9b0cf2bbafb082a3b6bfe9d90cbcbb5529ecf7c \
-    --hash=sha256:29a2bc7c1b09b0af938b7a8343174b987ae021705acabcbae560166567f5a8db \
-    --hash=sha256:2ef230a8fd217a2015bc91b74f6b3b7d6522ba48be29ad4ea0ca3a3775bf7dd5 \
-    --hash=sha256:2ef3775758346d9ac6214123887d25c7061c92afe1f2b354f9388e9e4d48acfc \
-    --hash=sha256:2f146f50723defec2975fb7e388ae3a024eb7151542d1599527ec2aa9cacb152 \
-    --hash=sha256:2fb4535137de7e244c230e24f9d1ec194f61721c86ebea04e1581d9d06ea1269 \
-    --hash=sha256:32ba3b5ccde2d581b1e6aa952c836a6291e8435d788f656fe5976445865ae045 \
-    --hash=sha256:34895a41273ad33347b2fc70e1bff4240556de3c46c6ea430a7ed91f9042aa4e \
-    --hash=sha256:379b378ae694ba78cef921581ebd420c938936a153ded602c4fea612b7eaa90d \
-    --hash=sha256:38302b78a850ff82656beaddeb0bb989a0322a8bbb1bf1ab10c17506681d772a \
-    --hash=sha256:3aa014d55c3af933c1315eb4bb06dd0459661cc0b15cd61077afa6489bec63bb \
-    --hash=sha256:4051e406288b8cdbb993798b9a45c59a4896b6ecee2f875424ec10276a895740 \
-    --hash=sha256:40b33d93c6eddf02d2c19f5773196068d875c41ca25730e8288e9b672897c105 \
-    --hash=sha256:43da0f0092281bf501f9c5f6f3b4c975a8a0ea82de49ba3f7100e64d422a1274 \
-    --hash=sha256:445e4cb5048b04e90ce96a79b4b63140e3f4ab5f662321975679b5f6360b90e2 \
-    --hash=sha256:48ef6a43b1846f6025dde6ed9fee0c24e1149c1c25f7fb0a0585572b2f3adc58 \
-    --hash=sha256:50a80baba0285386f97ea36239855f6020ce452456605f262b2d33ac35c7770b \
-    --hash=sha256:519fbf169dfac1222a76ba8861ef4ac7f0530c35dd79ba5727014613f91613d4 \
-    --hash=sha256:53dd9d5e3d29f95acd5de6802e909ada8d8d8cfa37a3ac64836f3bc4bc5512db \
-    --hash=sha256:53ea7cdc96c6eb56e76bb06894bcfb5dfa93b7adcf59d61c6b92674e24e2dd5e \
-    --hash=sha256:576856e8594e6649aee06ddbfc738fec6a834f7c85bf7cadd1c53d4a58186ef9 \
-    --hash=sha256:59556bf80a7094d0cfb9f5e50bb2db27fefb75d5138bb16fb052b61b0e0eeeb0 \
-    --hash=sha256:5d41d5e025f1e0bccae4928981e71b2334c60f580bdc8345f824e7c0a4c2a813 \
-    --hash=sha256:61062387ad820c654b6a6b5f0b94484fa19515e0c5116faf29f41a6bc91ded6e \
-    --hash=sha256:61f89436cbfede4bc4e91b4397eaa3e2108ebe96d05e93d6ccc95ab5714be512 \
-    --hash=sha256:62136da96a973bd2557f06ddd4e8e807f9e13cbb0bfb9cc06cfe6d98ea90dfe0 \
-    --hash=sha256:64585e1dba664dc67c7cdabd56c1e5685233fbb1fc1966cfba2a340ec0dfff7b \
-    --hash=sha256:65308f4b4890aa12d9b6ad9f2844b7ee42c7f7a4fd3390425b242ffc57498f48 \
-    --hash=sha256:66b689c107857eceabf2cf3d3fc699c3c0fe8ccd18df2219d978c0283e4c508a \
-    --hash=sha256:6a41c120c3dbc0d81a8e8adc73312d668cd34acd7725f036992b1b72d22c1772 \
-    --hash=sha256:6f77fa49079891a4aab203d0b1744acc85577ed16d767b52fc089d83faf8d8ed \
-    --hash=sha256:72c68dda124a1a138340fb62fa21b9bf4848437d9ca60bd35db36f2d3345f373 \
-    --hash=sha256:752bf8a74412b9892f4e5b58f2f890a039f57037f52c89a740757ebd807f33ea \
-    --hash=sha256:76e79bc28a65f467e0409098fa2c4376931fd3207fbeb6b956c7c476d53746dd \
-    --hash=sha256:774d45b1fac1461f48698a9d4b5fa19a69d47ece02fa469825b442263f04021f \
-    --hash=sha256:77da4c6bfa20dd5ea25cbf12c76f181a8e8cd7ea231c673828d0386b1740b8dc \
-    --hash=sha256:77ea385f7dd5b5676d7fd943292ffa18fbf5c72ba98f7d09fc1fb9e819b34c23 \
-    --hash=sha256:80080816b4f52a9d886e67f1f96912891074903238fe54f2de8b786f86baded2 \
-    --hash=sha256:80a539906390591dd39ebb8d773771dc4db82ace6372c4d41e2d293f8e32b8db \
-    --hash=sha256:82d17e94d735c99621bf8ebf9995f870a6b3e6d14543b99e201ae046dfe7de70 \
-    --hash=sha256:837bb6764be6919963ef41235fd56a6486b132ea64afe5fafb4cb279ac44f259 \
-    --hash=sha256:84433dddea68571a6d6bd4fbf8ff398236031149116a7fff6f777ff95cad3df9 \
-    --hash=sha256:8c24f21fa2af4bb9f2c492a86fe0c34e6d2c63812a839590edaf177b7398f700 \
-    --hash=sha256:8ed7d27cb56b3e058d3cf684d7200703bcae623e1dcc06ed1e18ecda39fee003 \
-    --hash=sha256:9206649ec587e6b02bd124fb7799b86cddec350f6f6c14bc82a2b70183e708ba \
-    --hash=sha256:983b6efd649723474f29ed42e1467f90a35a74793437d0bc64a5bf482bedfa0a \
-    --hash=sha256:98da17ce9cbf3bfe4617e836d561e433f871129e3a7ac16d6ef4c680f13a839c \
-    --hash=sha256:9c236e635582742fee16603042553d276cca506e824fa2e6489db04039521e90 \
-    --hash=sha256:9da6bc32faac9a293ddfdcb9108d4b20416219461e4ec64dfea8383cac186690 \
-    --hash=sha256:a05e6d6218461eb1b4771d973728f0133b2a4613a6779995df557f70794fd60f \
-    --hash=sha256:a0817825b900fcd43ac5d05b8b3079937073d2b1ff9cf89427590718b70dd840 \
-    --hash=sha256:a4ae99c57668ca1e78597d8b06d5af837f377f340f4cce993b551b2d7731778d \
-    --hash=sha256:a8c86881813a78a6f4508ef9daf9d4995b8ac2d147dcb1a450448941398091c9 \
-    --hash=sha256:a8fffdbd9d1408006baaf02f1068d7dd1f016c6bcb7538682622c556e7b68e35 \
-    --hash=sha256:a9b07268d0c3ca5c170a385a0ab9fb7fdd9f5fd866be004c4ea39e44edce47dd \
-    --hash=sha256:ab19a2d91963ed9e42b4e8d77cd847ae8381576585bad79dbd0a8837a9f6620a \
-    --hash=sha256:ac184f87ff521f4840e6ea0b10c0ec90c6b1dcd0bad2f1e4a9a1b4fa177982ea \
-    --hash=sha256:b0e166f698c5a3e914947388c162be2583e0c638a4703fc6a543e23a88dea3c1 \
-    --hash=sha256:b2170c7e0367dde86a2647ed5b6f57394ea7f53545746104c6b09fc1f4223573 \
-    --hash=sha256:b2d8c62d08e7255f68f7a740bae85b3c9b8e5466baa9cbf7f57f1cde0ac6bc09 \
-    --hash=sha256:b4567955a6bc1b20e9c31612e615af6b53733491aeaa19a6b3b37f3b65477094 \
-    --hash=sha256:b69bb4f51daf461b15e7b3db033160937d3ff88303a7bc808c67bbc1eaf98c78 \
-    --hash=sha256:b8c0bd73aeac689beacd4e7667d48c299f61b959475cdbb91e7d3d88d27c56b9 \
-    --hash=sha256:be9b5b8659dff1f913039c2feee1aca499cfbc19e98fa12bc85e037c17ec6ca5 \
-    --hash=sha256:bf0a05b6059c0528477fba9054d09179beb63744355cab9f38059548fedd46a9 \
-    --hash=sha256:c16842b846a8d2a145223f520b7e18b57c8f476924bda92aeee3a88d11cfc391 \
-    --hash=sha256:c363b53e257246a954ebc7c488304b5592b9c53fbe74d03bc1c64dda153fb847 \
-    --hash=sha256:c7c517d74bea1a6afd39aa612fa025e6b8011982a0897768a2f7c8ab4ebb78a2 \
-    --hash=sha256:d20fd853fbb5807c8e84c136c278827b6167ded66c72ec6f9a14b863d809211c \
-    --hash=sha256:d2240ddc86b74966c34554c49d00eaafa8200a18d3a5b6ffbf7da63b11d74ee2 \
-    --hash=sha256:d477ed829077cd945b01fc3115edd132c47e6540ddcd96ca169facff28173057 \
-    --hash=sha256:d50d31bfedd53a928fed6707b15a8dbeef011bb6366297cc435accc888b27c20 \
-    --hash=sha256:dc1d33abb8a0d754ea4763bad944fd965d3d95b5baef6b121c0c9013eaf1907d \
-    --hash=sha256:dc5d1a49d3f8262be192589a4b72f0d03b72dcf46c51ad5852a4fdc67be7b9e4 \
-    --hash=sha256:e2d1a054f8f0a191004675755448d12be47fa9bebbcffa3cdf01db19f2d30a54 \
-    --hash=sha256:e7792606d606c8df5277c32ccb58f29b9b8603bf83b48639b7aedf6df4fe8171 \
-    --hash=sha256:ed1708dbf4d2e3a1c5c69110ba2b4eb6678262028afd6c6fbcc5a8dac9cda68e \
-    --hash=sha256:f2d4380bf5f62daabd7b751ea2339c1a21d1c9463f1feb7fc2bdcea2c29c3160 \
-    --hash=sha256:f3513916e8c645d0610815c257cbfd3242adfd5c4cfa78be514e5a3ebb42a41b \
-    --hash=sha256:f8346bfa098532bc1fb6c7ef06783e969d87a99dd1d2a5a18a892c1d7a643c58 \
-    --hash=sha256:f83fa6cae3fff8e98691248c9320356971b59678a17f20656a9e59cd32cee6d8 \
-    --hash=sha256:fa6ce8b52c5987b3e34d5674b0ab529a4602b632ebab0a93b07bfb4dfc8f8a33 \
-    --hash=sha256:fb2b1ecfef1e67897d336de3a0e3f52478182d6a47eda86cbd42504c5cbd009a \
-    --hash=sha256:fc9ca1c9718cb3b06634c7c8dec57d24e9438b2aa9a0f02b8bb36bf478538880 \
-    --hash=sha256:fd30d9c67d13d891f2360b2a120186729c111238ac63b43dbd37a5a40670b8ca \
-    --hash=sha256:fd7699e8fd9969f455ef2926221e0233f81a2542921471382e77a9e2f2b57f4b \
-    --hash=sha256:fe3b385d996ee0822fd46528d9f0443b880d4d05528fd26a9119a54ec3f91c69
-    # via mitmproxy
@@ -1,3 +0,0 @@
-# Runtime dependencies baked only into the orchestrator images.
-fastapi==0.140.0
-uvicorn==0.51.0
@@ -1,182 +0,0 @@
-#
-# This file is autogenerated by pip-compile with Python 3.13
-# by the following command:
-#
-#    pip-compile --generate-hashes --output-file=requirements.orchestrator.lock requirements.orchestrator.in
-#
-annotated-doc==0.0.4 \
-    --hash=sha256:571ac1dc6991c450b25a9c2d84a3705e2ae7a53467b5d111c24fa8baabbed320 \
-    --hash=sha256:fbcda96e87e9c92ad167c2e53839e57503ecfda18804ea28102353485033faa4
-    # via fastapi
-annotated-types==0.8.0 \
-    --hash=sha256:13b2beaad985e05e2d6407ee4c4f35590b11f8d693a258a561055cac8f64cab7 \
-    --hash=sha256:f072f4d804ea359e4eaf198b1af7a8b0943881a87f31bb764f8bf219bb9419e0
-    # via pydantic
-anyio==4.14.2 \
-    --hash=sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494 \
-    --hash=sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f
-    # via starlette
-click==8.4.2 \
-    --hash=sha256:9a6cea6e60b17ebe0a44c5cc636d94f09bd66142c1cd7d8b4cd731c4917a15f6 \
-    --hash=sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76
-    # via uvicorn
-fastapi==0.140.0 \
-    --hash=sha256:e951c0a0d9540bf5d9a2a9e078fd415da2ab7e312d435139e7d9e2e7fe9f0b23 \
-    --hash=sha256:f338951b82fd74ca8f843163aec43ea1a1ce84d515415a50fa98fa25572a5544
-    # via -r requirements.orchestrator.in
-h11==0.16.0 \
-    --hash=sha256:4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208ee5ff1 \
-    --hash=sha256:63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86
-    # via uvicorn
-idna==3.18 \
-    --hash=sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2 \
-    --hash=sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848
-    # via anyio
-pydantic==2.13.4 \
-    --hash=sha256:45a282cde31d808236fd7ea9d919b128653c8b38b393d1c4ab335c62924d9aba \
-    --hash=sha256:c40756b57adaa8b1efeeced5c196f3f3b7c435f90e84ea7f443901bec8099ef6
-    # via fastapi
-pydantic-core==2.46.4 \
-    --hash=sha256:00c603d540afdd6b80eb39f078f33ebd46211f02f33e34a32d9f053bba711de0 \
-    --hash=sha256:0186750b482eefa11d7f435892b09c5c606193ef3375bcf94aa00ae6bfb66262 \
-    --hash=sha256:041bde0a48fd37cf71cab1c9d56d3e8625a3793fef1f7dd232b3ff37e978ecda \
-    --hash=sha256:0c563b08bca408dc7f65f700633d8442fffb2421fc47b8101377e9fd65051ff0 \
-    --hash=sha256:0cbe8b01f948de4286c74cdd6c667aceb38f5c1e26f0693b3983d9d74887c65e \
-    --hash=sha256:0ce40cd7b21210e99342afafbd4d0f76d784eb5b1d60f3bdc566be4983c6c73b \
-    --hash=sha256:0e96592440881c74a213e5ad528e2b24d3d4f940de2766bed9010ab1d9e51594 \
-    --hash=sha256:10e17cbb10a330363733efc4d7c4d0dd827ac0909b8f6a6542298fed1ea62f29 \
-    --hash=sha256:133878133d271ade3d41d1bfb2a45ec38dbdbda40bc065921c6b04e4630127e2 \
-    --hash=sha256:14d4edf427bdcf950a8a02d7cb44a08614388dd6e1bdcbf4f67504fa7887da9c \
-    --hash=sha256:14f4c5d6db102bd796a627bbb3a17b4cf4574b9ae861d8b7c9a9661c6dd3362d \
-    --hash=sha256:17299feefe090f2caa5b8e37222bb5f663e4935a8bfa6931d4102e5df1a9f398 \
-    --hash=sha256:184c081504d17f1c1066e430e117142b2c77d9448a97f7b65c6ac9fd9aee238d \
-    --hash=sha256:18e5ceec2ab67e6d5f1a9085e5a24c9c4e2ac4545730bfe668680bca05e555f3 \
-    --hash=sha256:19e51f073cd3df251856a8a4189fbdf1de4012c3ebacfb1884f94f1eb406079f \
-    --hash=sha256:1a7dd0b3ee80d90150e3495a3a13ac34dbcbfd4f012996a6a1d8900e91b5c0fb \
-    --hash=sha256:1d8ba486450b14f3b1d63bc521d410ec7565e52f887b9fb671791886436a42f7 \
-    --hash=sha256:2108ba5c1c1eca18030634489dc544844144ee36357f2f9f780b93e7ddbb44b5 \
-    --hash=sha256:228ee9bae8bef5b1e97ec58302f80357c37199e0d0a99174e138d28e6957b9d9 \
-    --hash=sha256:23ace664830ee0bfe014a0c7bc248b1f7f25ed7ad103852c317624a1083af462 \
-    --hash=sha256:2412e734dcb48da14d4e4006b82b46b74f2518b8a26ee7e58c6844a6cd6d03c4 \
-    --hash=sha256:29c61fc04a3d840155ff08e475a04809278972fe6aef51e2720554e96367e34b \
-    --hash=sha256:2f84c03c8607173d16b5a854ec68a2f9079ae03237a54fb506d13af47e1d018d \
-    --hash=sha256:3009f12e4e90b7f88b4f9adb1b0c4a3d58fe7820f3238c190047209d148026df \
-    --hash=sha256:3245406455a5d98187ec35530fd772b1d799b26667980872c8d4614991e2c4a2 \
-    --hash=sha256:3447661d99f75a3683a4cf5c87da72f2161964611864dbbeac7fbb118bb4bfc0 \
-    --hash=sha256:372429a130e469c9cd698925ce5fc50940b7a1336b0d82038e63d5bbc4edc519 \
-    --hash=sha256:395aebd9183f9d112f569aeb5b2214d1a10a33bec8456447f7fbdfa51d38d4cd \
-    --hash=sha256:3a233125ac121aa3ffba9a2b59edfc4a985a76092dc8279586ab4b71390875e7 \
-    --hash=sha256:3be77f45df024d789a672ae34f8b06fb346c4f9f46ea714956660ea4862e89ac \
-    --hash=sha256:3bf92c5d0e00fefaab325a4d27828fe6b6e2a21848686b5b60d2d9eeb09d76c6 \
-    --hash=sha256:3ecbc122d18468d06ca279dc26a8c2e2d5acb10943bb35e36ae92096dc3b5565 \
-    --hash=sha256:3fb702cd90b0446a3a1c5e470bfa0dd23c0233b676a9099ddcc964fa6ca13898 \
-    --hash=sha256:428e04521a40150c85216fc8b85e8d39fece235a9cf5e383761238c7fa9b96fb \
-    --hash=sha256:432c179df7874eeb73307aad2df0755e1ae0efa61ff0ea89b93e194411ae3928 \
-    --hash=sha256:4a05d69cba51d852c5c3e92758653245a50c0b646ced0cf05bd793ed592839d6 \
-    --hash=sha256:4c63ebc82684aa89d9a3bcbd13d515b3be44250dc68dd3bd81526c1cb31286c3 \
-    --hash=sha256:4fc73cb559bdb54b1134a706a2802a4cddd27a0633f5abb7e53056268751ac6a \
-    --hash=sha256:4fcbe087dbc2068af7eda3aa87634eba216dbda64d1ae73c8684b621d33f6596 \
-    --hash=sha256:56cb4851bcaf3d117eddcef4fe66afd750a50274b0da8e22be256d10e5611987 \
-    --hash=sha256:5855698a4856556d86e8e6cd8434bc3ac0314ee8e12089ae0e143f64c6256e4e \
-    --hash=sha256:5a4330cdbc57162e4b3aa303f588ba752257694c9c9be3e7ebb11b4aca659b5d \
-    --hash=sha256:5b712b53160b79a5850310b912a5ef8e57e56947c8ad690c227f5c9d7e561712 \
-    --hash=sha256:5d5902252db0d3cedf8d4a1bc68f70eeb430f7e4c7104c8c476753519b423008 \
-    --hash=sha256:617d7e2ca7dcb8c5cf6bcb8c59b8832c94b36196bbf1cbd1bfb56ed341905edd \
-    --hash=sha256:62f875393d7f270851f20523dd2e29f082bcc82292d66db2b64ea71f64b6e1c1 \
-    --hash=sha256:633147d34cf4550417f12e2b1a0383973bdf5cdfde212cb09e9a581cf10820be \
-    --hash=sha256:66ce7632c22d837c95301830e111ad0128a32b8207533b60896a96c4915192ea \
-    --hash=sha256:6b3ace8194b0e5204818c92802dcdca7fc6d88aabbb799d7c795540d9cd6d292 \
-    --hash=sha256:6f2eeda33a839975441c86a4119e1383c50b47faf0cbb5176985565c6bb02c33 \
-    --hash=sha256:7027560ee92211647d0d34e3f7cd6f50da56399d26a9c8ad0da286d3869a53f3 \
-    --hash=sha256:7283d57845ecf5a163403eb0702dfc220cc4fbdd18919cb5ccea4f95ee1cdab4 \
-    --hash=sha256:7a5f930472650a82629163023e630d160863fce524c616f4e5186e5de9d9a49b \
-    --hash=sha256:7bfb192b3f4b9e8a89b6277b6ce787564f62cfd272055f6e685726b111dc7826 \
-    --hash=sha256:811ff8e9c313ab425368bcbb36e5c4ebd7108c2bbf4e4089cfbb0b01eff63fac \
-    --hash=sha256:8233f2947cf85404441fd7e0085f53b10c93e0ee78611099b5c7237e36aacbf7 \
-    --hash=sha256:82cf5301172168103724d49a1444d3378cb20cdee30b116a1bd6031236298a5d \
-    --hash=sha256:8358a950c8909158e3df31538a7e4edc2d7265a7c54b47f0864d9e5bae9dcebf \
-    --hash=sha256:85bb3611ff1802f3ee7fdd7dbff26b56f343fb432d57a4728fdd49b6ef35e2f4 \
-    --hash=sha256:86e1a4418c6cd97d60c95c71164158eaf7324fae7b0923264016baa993eba6fc \
-    --hash=sha256:8b9bab013d1c7a79d3501ff86d0bc9c31bf587db4551677b96bec07df78c6b15 \
-    --hash=sha256:8c5dac79fa1614d1e06ca695109c6105923bd9c7d1d6c918d4e637b7e6b32fd3 \
-    --hash=sha256:8d0820e8192167f80d88d64038e609c31452eeca865b4e1d9950a27a4609b00b \
-    --hash=sha256:8daafc69c93ee8a0204506a3b6b30f586ef54028f52aeeeb5c4cfc5184fd5914 \
-    --hash=sha256:9037063db01f09b09e237c282b6792bd4da634b5402c4e7f0c61effed7701a04 \
-    --hash=sha256:905a0ed8ea6f2d61c1738835f99b699348d7857379083e5fc497fa0c967a407c \
-    --hash=sha256:90884113d8b48f760e9587002789ddd741e76ab9f89518cd1e43b1f1a52ec44b \
-    --hash=sha256:91a06d2e259ecfbd8c901d70c3c507900458498142b3026a296b7de4d1322cc9 \
-    --hash=sha256:926c9541b14b12b1681dca8a0b75feb510b06c6341b70a8e500c2fdcff837cce \
-    --hash=sha256:9401557acd873c3a7f3eb9383edef8ac4968f9510e340f4808d427e75667e7b4 \
-    --hash=sha256:9551187363ffc0de2a00b2e47c25aeaeb1020b69b668762966df15fc5659dd5a \
-    --hash=sha256:962ccbab7b642487b1d8b7df90ef677e03134cf1fd8880bf698649b22a69371f \
-    --hash=sha256:97e7cf2be5c77b7d1a9713a05605d49460d02c6078d38d8bef3cbe323c548424 \
-    --hash=sha256:9aa768456404a8bf48a4406685ac2bec8e72b62c69313734fa3b73cf33b3a894 \
-    --hash=sha256:9bc519fbf2b7578398853d815009ae5e4d4603d12f4e3f91da8c06852d3da3e9 \
-    --hash=sha256:9d56801be94b86a9da183e5f3766e6310752b99ff647e38b09a9500d88e46e76 \
-    --hash=sha256:9f444c499b3eefd3a92e348059471ea0c3a6e303d9c1cec09fa748fd9f895201 \
-    --hash=sha256:9fa8ae11da9e2b3126c6426f147e0fba88d96d65921799bb30c6abd1cb2c97fb \
-    --hash=sha256:a0f62d0a58f4e7da165457e995725421e0064f2255d8eccebc49f41bbc23b109 \
-    --hash=sha256:a396dcc17e5a0b164dbe026896245a4fa9ff402edca1dff0be3d53a517f74de4 \
-    --hash=sha256:aaa2a54443eff1950ba5ddc6b6ccda0d9c84a364276a62f969bdf2a390650848 \
-    --hash=sha256:ad785e92e6dc634c21555edc8bd6b64957ab844541bcb96a1366c202951ae526 \
-    --hash=sha256:af8244b2bef6aaad6d92cda81372de7f8c8d36c9f0c3ea36e827c60e7d9467a0 \
-    --hash=sha256:b078afbc25f3a1436c7a1d2cd3e322497ee99615ba97c563566fdf46aff1ee01 \
-    --hash=sha256:b2f69dec1725e79a012d920df1707de5caf7ed5e08f3be4435e25803efc47458 \
-    --hash=sha256:b8458003118a712e66286df6a707db01c52c0f52f7db8e4a38f0da1d3b94fc4e \
-    --hash=sha256:bb63e0198ca18aad131c089b9204c23079c3afa95487e561f4c522d519e55aba \
-    --hash=sha256:bfec22eab3c8cc2ceec0248aec886624116dc079afa027ecc8ad4a7e62010f8a \
-    --hash=sha256:c1747f85cee84c26985853c6f3d9bd3e75da5212912443fa111c113b9c246f39 \
-    --hash=sha256:c1b3f518abeca3aa13c712fd202306e145abf59a18b094a6bafb2d2bbf59192c \
-    --hash=sha256:c50f2528cf200c5eed56faf3f4e22fcd5f38c157a8b78576e6ba3168ec35f000 \
-    --hash=sha256:c68fcd102d71ea85c5b2dfac3f4f8476eff42a9e078fd5faefff6d145063536b \
-    --hash=sha256:c7a7bd4e39e8e4c12c39cd480356842b6a8a06e41b23a55a5e3e191718838ddf \
-    --hash=sha256:c94f0688e7b8d0a67abf40e57a7eaaecd17cc9586706a31b76c031f63df052b4 \
-    --hash=sha256:cbaf13819775b7f769bf4a1f066cb6df7a28d4480081a589828ef190226881cd \
-    --hash=sha256:cd2213145bcc2ba85884d0ac63d222fece9209678f77b9b4d76f054c561adb28 \
-    --hash=sha256:ce5c1d2a8b27468f433ca974829c44060b8097eedc39933e3c206a90ee49c4a9 \
-    --hash=sha256:d396ec2b979760aaf3218e76c24e65bd0aca24983298653b3a9d7a45f9e47b30 \
-    --hash=sha256:d51026d73fcfd93610abc7b27789c26b313920fcfb20e27462d74a7f8b06e983 \
-    --hash=sha256:d80ee3d731373b24cebbc10d689ca4ee1875caf0d5703a245db18efd4dd37fc1 \
-    --hash=sha256:d995260fdf4e1db774581b4900e0f832abe3c7c84996726bbc161b19c8f29e76 \
-    --hash=sha256:da4b951fe36dc7c3a1ccb4e3cd1747c3542b8c9ceede8fc86cae054e764485f5 \
-    --hash=sha256:daa27d92c36f24388fe3ad306b174781c747627f134452e4f128ea00ce1fe8c4 \
-    --hash=sha256:db06ffe51636ffe9ca531fe9023dd64bdd794be8754cb5df57c5498ae5b518a7 \
-    --hash=sha256:e0d65b8c354be7fb5f720c3caa8bc940bc2d20ce749c8e06135f07f8ed95dd7c \
-    --hash=sha256:e68b7a074f65a2fd746c52a7ce6142ab7006074ac269ace0c25cd8ba171f8066 \
-    --hash=sha256:e739fee756ba1010f8bcccb534252e85a35fe45ae92c295a06059ce58b74ccd3 \
-    --hash=sha256:e846ae7835bf0703ae43f534ab79a867146dadd59dc9ca5c8b53d5c8f7c9ef02 \
-    --hash=sha256:e9c26f834c65f5752f3f06cb08cb86a913ceb7274d0db6e267808a708b46bc89 \
-    --hash=sha256:ea793e075b70290d89d8142074262885d3f7da19634845135751bd6344f73b50 \
-    --hash=sha256:f027324c56cd5406ca49c124b0db10e56c69064fec039acc571c29020cc87c76 \
-    --hash=sha256:f13a646d65d09fbf1bc6b3a9635d30095c8e7e5cc419ff35ecc563c5fd04cd49 \
-    --hash=sha256:f47286a97f0bc9b8859519809077b91b2cefe4ae47fcbf5e466a009c1c5d742b \
-    --hash=sha256:f747929cf940cddb5b3668a390056ddd5ba2e5010615ea2dcf4f9c4f3ab8791d \
-    --hash=sha256:f99626688942fb746e545232e7726926f3be91b5975f8b55327665fafda991c7 \
-    --hash=sha256:f9fa868638bf362d3d138ea55829cefb3d5f4b0d7f142234382a15e2485dbec4 \
-    --hash=sha256:fbdb89b3e1c94a30cc5edfce477c6e6a5dc4d8f84665b455c27582f211a1c72c \
-    --hash=sha256:fc010ab034c8c7452522748bf937df58020d256ccae0874463d1f4d01758af8e \
-    --hash=sha256:fc3e9034a63de20e15e8ade85358bc6efc614008cab72898b4b4952bea0509ff \
-    --hash=sha256:fd8b3d9fd264be37976686c7f65cd52a83f5e84f4bfd2adf9c1d469676bbb6ae
-    # via pydantic
-starlette==1.3.1 \
-    --hash=sha256:05d0213193f2fbaae60e2ecb593b4add4262ad4e46536b54abe36f11a71724e0 \
-    --hash=sha256:c7372aae11c3c3f26a42df7bd626cec2f47d03483d261d369516a615a53714c6
-    # via fastapi
-typing-extensions==4.16.0 \
-    --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
-    --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5
-    # via
-    #   fastapi
-    #   pydantic
-    #   pydantic-core
-    #   typing-inspection
-typing-inspection==0.4.2 \
-    --hash=sha256:4ed1cacbdc298c220f1bd249ed5287caa16f34d44ef4e9c3d0cbad5b521545e7 \
-    --hash=sha256:ba561c48a67c5958007083d386c3295464928b01faa735ab8547c5692e87f464
-    # via
-    #   fastapi
-    #   pydantic
-uvicorn==0.51.0 \
-    --hash=sha256:5d38af6cd620f2ae3849fb44fd4879e0890aa1febe8d47eb355fb45d93fe6a5b \
-    --hash=sha256:f6f4b69b657c312f516dd2d268ab9ae6f254b11e4bac504f37b2ab58b24dd0b0
-    # via -r requirements.orchestrator.in
@@ -1,330 +0,0 @@
-#!/usr/bin/env python3
-"""Fail when a supported image reintroduces mutable build inputs."""
-
-from __future__ import annotations
-
-import json
-import re
-import sys
-from pathlib import Path
-
-REPO_ROOT = Path(__file__).resolve().parents[1]
-DOCKERFILES = (
-    Path("Dockerfile.gateway"),
-    Path("Dockerfile.orchestrator"),
-    Path("Dockerfile.orchestrator.fc"),
-    Path("bot_bottle/contrib/claude/Dockerfile"),
-    Path("bot_bottle/contrib/codex/Dockerfile"),
-    Path("bot_bottle/contrib/pi/Dockerfile"),
-)
-NPM_MANIFESTS = (
-    Path("bot_bottle/contrib/claude/package.json"),
-    Path("bot_bottle/contrib/pi/package.json"),
-)
-IMAGE_BUILD_ARGS = Path("image-build-args.json")
-CODEX_CHECKSUMS = Path("bot_bottle/contrib/codex/codex-package_SHA256SUMS")
-REQUIRED_CODEX_ASSETS = frozenset({
-    "codex-package-aarch64-unknown-linux-musl.tar.gz",
-    "codex-package-x86_64-unknown-linux-musl.tar.gz",
-})
-REQUIRED_BASE_ARGS = frozenset({
-    "DOCKER_CLI_BASE_IMAGE",
-    "NODE_BASE_IMAGE",
-    "PYTHON_BASE_IMAGE",
-})
-
-_DIGEST = re.compile(r"^[0-9a-f]{64}$")
-_EXACT_NPM_VERSION = re.compile(
-    r"^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?$",
-)
-_SNAPSHOT = re.compile(r"ARG\s+DEBIAN_SNAPSHOT=\d{8}T\d{6}Z")
-_NETWORK_TO_SHELL = re.compile(
-    r"(?:curl|wget)\b[^|\n]*\|\s*(?:ba)?sh\b",
-    re.IGNORECASE,
-)
-
-
-def _logical_lines(text: str) -> str:
-    """Join Dockerfile continuations so policy regexes see one instruction."""
-    return re.sub(r"\\\r?\n", " ", text)
-
-
-def check_dockerfile(
-    path: Path,
-    text: str,
-    image_build_args: dict[str, str] | None = None,
-) -> list[str]:
-    """Return policy violations for one Dockerfile."""
-    problems: list[str] = []
-    logical = _logical_lines(text)
-    instructions = "\n".join(
-        line for line in logical.splitlines()
-        if not line.lstrip().startswith("#")
-    )
-    from_matches = list(re.finditer(r"(?im)^\s*FROM\s+(\S+)", logical))
-    from_values = [match.group(1) for match in from_matches]
-    preamble = logical[:from_matches[0].start()] if from_matches else logical
-    base_args = {
-        match.group(1): match.group(2)
-        for match in re.finditer(
-            r"(?im)^\s*ARG\s+([A-Za-z_][A-Za-z0-9_]*)(?:=(\S+))?\s*$",
-            preamble,
-        )
-    }
-    if not from_values:
-        problems.append(f"{path}: missing FROM")
-    for value in from_values:
-        variable = re.fullmatch(r"\$\{([A-Za-z_][A-Za-z0-9_]*)\}", value)
-        if variable and variable.group(1) == "ORCHESTRATOR_BASE_IMAGE":
-            if (
-                "ORCHESTRATOR_BASE_IMAGE" not in base_args
-                or base_args["ORCHESTRATOR_BASE_IMAGE"] is not None
-            ):
-                problems.append(
-                    f"{path}: local base argument must have no mutable default",
-                )
-            continue
-        if variable:
-            name = variable.group(1)
-            if name not in base_args:
-                problems.append(
-                    f"{path}: dynamic base argument {name} is not declared before FROM",
-                )
-                continue
-            if base_args[name] is not None:
-                problems.append(
-                    f"{path}: base argument {name} must not define a default",
-                )
-                continue
-            if image_build_args is None or name not in image_build_args:
-                problems.append(
-                    f"{path}: base argument {name} lacks a centralized value",
-                )
-                continue
-            value = image_build_args[name]
-        if "$" in value:
-            problems.append(f"{path}: dynamic base image is not content-pinned: {value}")
-            continue
-        try:
-            image, digest = value.rsplit("@sha256:", 1)
-        except ValueError:
-            problems.append(f"{path}: base image lacks a sha256 digest: {value}")
-            continue
-        leaf = image.rsplit("/", 1)[-1]
-        if ":" not in leaf:
-            problems.append(f"{path}: base image lacks a version-qualified tag: {value}")
-        elif leaf.rsplit(":", 1)[1] == "latest":
-            problems.append(f"{path}: base image uses latest: {value}")
-        if not _DIGEST.fullmatch(digest):
-            problems.append(f"{path}: base image digest is not 64 lowercase hex: {value}")
-
-    if _NETWORK_TO_SHELL.search(instructions):
-        problems.append(f"{path}: downloads network content directly into a shell")
-    if re.search(r"\b(?:npm\s+(?:i|install)|pi\s+install)\b", instructions):
-        problems.append(f"{path}: use npm ci with a committed integrity lock")
-    if "apt-get install" in instructions:
-        if not _SNAPSHOT.search(text):
-            problems.append(f"{path}: apt install lacks a fixed Debian snapshot")
-        if "snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}" not in text:
-            problems.append(f"{path}: apt sources are not routed to the snapshot")
-        if "Acquire::Check-Valid-Until=false" not in text:
-            problems.append(f"{path}: snapshot apt update lacks validity override")
-    if path == Path("Dockerfile.gateway"):
-        if "--require-hashes" not in instructions:
-            problems.append(f"{path}: gateway Python install does not require hashes")
-        if "requirements.gateway.lock" not in text:
-            problems.append(f"{path}: gateway Python lock is not consumed")
-    if path == Path("bot_bottle/contrib/codex/Dockerfile"):
-        required = (
-            "codex-package_SHA256SUMS",
-            "sha256sum -c",
-            "codex-package-${codex_target}.tar.gz",
-        )
-        for marker in required:
-            if marker not in instructions:
-                problems.append(f"{path}: verified pinned Codex install lacks {marker!r}")
-    return problems
-
-
-def load_image_build_args(root: Path) -> tuple[dict[str, str], list[str]]:
-    """Load and validate the one repository location for base-image args."""
-    path = root / IMAGE_BUILD_ARGS
-    try:
-        data = json.loads(path.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError) as exc:
-        return {}, [f"{IMAGE_BUILD_ARGS}: cannot read image build arguments: {exc}"]
-    if not isinstance(data, dict):
-        return {}, [f"{IMAGE_BUILD_ARGS}: must contain a JSON object"]
-    problems: list[str] = []
-    names = set(data)
-    missing = REQUIRED_BASE_ARGS - names
-    unexpected = names - REQUIRED_BASE_ARGS
-    if missing:
-        problems.append(
-            f"{IMAGE_BUILD_ARGS}: missing arguments: {', '.join(sorted(missing))}",
-        )
-    if unexpected:
-        problems.append(
-            f"{IMAGE_BUILD_ARGS}: unexpected arguments: "
-            f"{', '.join(sorted(unexpected))}",
-        )
-    for name, value in data.items():
-        if not isinstance(value, str):
-            problems.append(f"{IMAGE_BUILD_ARGS}: {name} must be a string")
-    return {
-        name: value for name, value in data.items()
-        if isinstance(name, str) and isinstance(value, str)
-    }, problems
-
-
-def check_npm_manifest(root: Path, manifest_path: Path) -> list[str]:
-    """Validate exact direct versions and integrity-complete npm locks."""
-    problems: list[str] = []
-    manifest_file = root / manifest_path
-    lock_file = manifest_file.with_name("package-lock.json")
-    try:
-        manifest = json.loads(manifest_file.read_text(encoding="utf-8"))
-        lock = json.loads(lock_file.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError) as exc:
-        return [f"{manifest_path}: cannot read manifest and lock: {exc}"]
-
-    direct = manifest.get("dependencies", {})
-    for package, version in direct.items():
-        if not isinstance(version, str) or not _EXACT_NPM_VERSION.fullmatch(version):
-            problems.append(
-                f"{manifest_path}: {package} is not an exact version: {version!r}",
-            )
-    root_lock = lock.get("packages", {}).get("", {}).get("dependencies", {})
-    if root_lock != direct:
-        problems.append(f"{lock_file.relative_to(root)}: root dependencies are stale")
-    if lock.get("lockfileVersion") != 3:
-        problems.append(f"{lock_file.relative_to(root)}: require lockfileVersion 3")
-    for package_path, package in lock.get("packages", {}).items():
-        if not package_path or package.get("link"):
-            continue
-        resolved = package.get("resolved", "")
-        if isinstance(resolved, str) and resolved.startswith(("http://", "https://")):
-            integrity = package.get("integrity", "")
-            if not isinstance(integrity, str) or not integrity.startswith("sha512-"):
-                problems.append(
-                    f"{lock_file.relative_to(root)}: "
-                    f"{package_path} lacks sha512 integrity",
-                )
-    return problems
-
-
-def check_python_lock(root: Path) -> list[str]:
-    """Validate that every gateway Python requirement is exact and hashed."""
-    path = root / "requirements.gateway.lock"
-    try:
-        text = path.read_text(encoding="utf-8")
-    except OSError as exc:
-        return [f"requirements.gateway.lock: cannot read lock: {exc}"]
-    problems: list[str] = []
-    blocks = re.split(r"(?m)(?=^[A-Za-z0-9_.-]+==)", text)
-    requirements = [block for block in blocks if re.match(r"^[A-Za-z0-9_.-]+==", block)]
-    if not requirements:
-        problems.append("requirements.gateway.lock: contains no exact requirements")
-    for block in requirements:
-        name = block.split("==", 1)[0]
-        first_line = block.splitlines()[0]
-        if not re.match(r"^[A-Za-z0-9_.-]+==[^\s\\]+", first_line):
-            problems.append(f"requirements.gateway.lock: {name} is not exact")
-        if not re.search(r"--hash=sha256:[0-9a-f]{64}", block):
-            problems.append(f"requirements.gateway.lock: {name} lacks a sha256 hash")
-    try:
-        direct = [
-            line.strip()
-            for line in (root / "requirements.gateway.in").read_text().splitlines()
-            if line.strip() and not line.lstrip().startswith("#")
-        ]
-    except OSError as exc:
-        problems.append(f"requirements.gateway.in: cannot read input: {exc}")
-        direct = []
-    for requirement in direct:
-        if not re.fullmatch(r"[A-Za-z0-9_.-]+==[^\s]+", requirement):
-            problems.append(
-                f"requirements.gateway.in: direct dependency is not exact: {requirement}",
-            )
-        if not re.search(rf"(?m)^{re.escape(requirement)}(?:\s|\\)", text):
-            problems.append(
-                f"requirements.gateway.lock: missing direct dependency {requirement}",
-            )
-    return problems
-
-
-def check_codex_checksums(root: Path) -> list[str]:
-    """Require one valid digest for every supported standalone archive."""
-    try:
-        lines = (root / CODEX_CHECKSUMS).read_text(encoding="utf-8").splitlines()
-    except OSError as exc:
-        return [f"{CODEX_CHECKSUMS}: cannot read checksum manifest: {exc}"]
-    assets: dict[str, str] = {}
-    problems: list[str] = []
-    for line in lines:
-        match = re.fullmatch(r"([0-9a-f]{64})  (\S+)", line)
-        if match is None:
-            problems.append(f"{CODEX_CHECKSUMS}: malformed checksum line: {line!r}")
-            continue
-        digest, asset = match.groups()
-        if asset in assets:
-            problems.append(f"{CODEX_CHECKSUMS}: duplicate checksum for {asset}")
-        assets[asset] = digest
-    missing = REQUIRED_CODEX_ASSETS - assets.keys()
-    if missing:
-        problems.append(
-            f"{CODEX_CHECKSUMS}: missing supported archives: "
-            f"{', '.join(sorted(missing))}",
-        )
-    return problems
-
-
-def check_repo(root: Path = REPO_ROOT) -> list[str]:
-    """Return every repository image-input policy violation."""
-    image_build_args, problems = load_image_build_args(root)
-    for path in DOCKERFILES:
-        try:
-            text = (root / path).read_text(encoding="utf-8")
-        except OSError as exc:
-            problems.append(f"{path}: cannot read Dockerfile: {exc}")
-            continue
-        problems.extend(check_dockerfile(path, text, image_build_args))
-    for manifest in NPM_MANIFESTS:
-        problems.extend(check_npm_manifest(root, manifest))
-    problems.extend(check_codex_checksums(root))
-    nested_path = Path(
-        "bot_bottle/backend/macos_container/nested_containers.py",
-    )
-    try:
-        nested_source = (root / nested_path).read_text(encoding="utf-8")
-    except OSError as exc:
-        problems.append(f"{nested_path}: cannot read generated image source: {exc}")
-    else:
-        if "FROM docker:" in nested_source:
-            problems.append(
-                "nested-containers image uses a mutable Docker CLI base",
-            )
-        if '"ARG DOCKER_CLI_BASE_IMAGE\\n"' not in nested_source:
-            problems.append(
-                "nested-containers image does not consume DOCKER_CLI_BASE_IMAGE",
-            )
-        if 'image = f"{pinned_base}{IMAGE_SUFFIX}"' not in nested_source:
-            problems.append(
-                "nested-containers output is not keyed by its pinned agent base",
-            )
-    problems.extend(check_python_lock(root))
-    return problems
-
-
-def main() -> int:
-    problems = check_repo()
-    if problems:
-        for problem in problems:
-            print(f"image-input policy: {problem}", file=sys.stderr)
-        return 1
-    print("image-input policy: all supported image inputs are pinned and verified")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())
@@ -1,65 +0,0 @@
-#!/usr/bin/env python3
-"""Complete duplicate npm lock entries from an identical verified artifact."""
-
-from __future__ import annotations
-
-import argparse
-import json
-from pathlib import Path
-
-
-def complete_lock(path: Path) -> int:
-    """Fill missing SRI only from the same resolved URL; return change count."""
-    data = json.loads(path.read_text(encoding="utf-8"))
-    packages = data.get("packages", {})
-    integrity_by_url: dict[str, str] = {}
-    for package in packages.values():
-        resolved = package.get("resolved")
-        integrity = package.get("integrity")
-        if not isinstance(resolved, str) or not resolved.startswith(
-            ("http://", "https://"),
-        ):
-            continue
-        if not isinstance(integrity, str) or not integrity.startswith("sha512-"):
-            continue
-        prior = integrity_by_url.setdefault(resolved, integrity)
-        if prior != integrity:
-            raise ValueError(f"conflicting integrity values for {resolved}")
-
-    changed = 0
-    missing: list[str] = []
-    for package_path, package in packages.items():
-        resolved = package.get("resolved")
-        if not isinstance(resolved, str) or not resolved.startswith(
-            ("http://", "https://"),
-        ):
-            continue
-        integrity = package.get("integrity")
-        if isinstance(integrity, str) and integrity.startswith("sha512-"):
-            continue
-        known = integrity_by_url.get(resolved)
-        if known is None:
-            missing.append(package_path)
-            continue
-        package["integrity"] = known
-        changed += 1
-    if missing:
-        joined = ", ".join(missing)
-        raise ValueError(f"no verified duplicate artifact for: {joined}")
-    if changed:
-        path.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
-    return changed
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("locks", nargs="+", type=Path)
-    args = parser.parse_args()
-    for path in args.locks:
-        changed = complete_lock(path)
-        print(f"{path}: completed {changed} duplicate integrity entries")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -13,17 +13,17 @@
 #     are re-executed; no KVM or Docker dependency.
 #
 # Pass "critical" as the last argument in either mode to also report just the
-# critical modules (ADR 0004 target: 85%).
+# critical modules (ADR 0004 target: 90%).
 set -euo pipefail

 cd "$(dirname "$0")/.."

 PY="${PYTHON:-python3}"

-# Critical security/logic core held to the high bar by ADR 0004. The helper
-# fails before coverage when a curated path was renamed or removed; Coverage.py
-# itself would silently ignore that stale include and inflate the score.
-CRITICAL=$("$PY" scripts/critical_modules.py)
+# Critical security/logic core held to the high bar by ADR 0004. The list
+# lives in one place (scripts/critical-modules.txt) so this report and the
+# README "core coverage" badge can't drift; comma-join it for --include.
+CRITICAL=$(grep -vE '^[[:space:]]*(#|$)' scripts/critical-modules.txt | paste -sd, -)

 if [ "${1:-}" = "aggregate" ]; then
    # Aggregate mode: combine .coverage.* artifacts already in the workspace.
@@ -34,8 +34,8 @@ if [ "${1:-}" = "aggregate" ]; then
    "$PY" -m coverage report -m

    if [ "${2:-}" = "critical" ]; then
-        echo "== critical modules (ADR 0004 minimum: 85%) ==" >&2
-        "$PY" -m coverage report --include="$CRITICAL" --fail-under=85
+        echo "== critical modules (ADR 0004 target: 90%) ==" >&2
+        "$PY" -m coverage report --include="$CRITICAL"
    fi
    exit 0
 fi
@@ -55,6 +55,6 @@ echo "== combined report ==" >&2
 "$PY" -m coverage report -m

 if [ "${1:-}" = "critical" ]; then
-    echo "== critical modules (ADR 0004 minimum: 85%) ==" >&2
-    "$PY" -m coverage report --include="$CRITICAL" --fail-under=85
+    echo "== critical modules (ADR 0004 target: 90%) ==" >&2
+    "$PY" -m coverage report --include="$CRITICAL"
 fi
@@ -1,4 +1,4 @@
-# Critical security/logic core held to the >=85% coverage bar by
+# Critical security/logic core held to the >=90% coverage bar by
 # docs/decisions/0004-coverage-policy.md.
 #
 # SINGLE SOURCE OF TRUTH: scripts/coverage.sh (the `critical` report) and
@@ -7,48 +7,19 @@
 # number that silently stops measuring a module is worse than no badge.
 #
 # One module path per line, relative to the repo root. Blank lines and
-# `#` comments are ignored. scripts/critical_modules.py rejects missing,
-# duplicate, non-Python, and out-of-repository entries before coverage runs.
-
-# Host-side egress planning and secret preparation.
-bot_bottle/egress/plan.py
-bot_bottle/egress/service.py
-
-# Gateway egress policy, matching, and DLP enforcement.
+# `#` comments are ignored.
 bot_bottle/gateway/egress/addon.py
 bot_bottle/gateway/egress/addon_core.py
-bot_bottle/gateway/egress/context.py
-bot_bottle/gateway/egress/dlp.py
-bot_bottle/gateway/egress/dlp_config.py
 bot_bottle/gateway/egress/dlp_detectors.py
-bot_bottle/gateway/egress/matching.py
-bot_bottle/gateway/egress/schema.py
-bot_bottle/gateway/egress/types.py
-
-# Manifest trust boundary and schema.
-bot_bottle/manifest/agent.py
-bot_bottle/manifest/bottle.py
-bot_bottle/manifest/egress.py
-bot_bottle/manifest/extends.py
-bot_bottle/manifest/git.py
-bot_bottle/manifest/index.py
-bot_bottle/manifest/loader.py
-bot_bottle/manifest/schema.py
-bot_bottle/manifest/util.py
-
-# Host-side and gateway-side git policy enforcement.
-bot_bottle/git_gate/host_key.py
-bot_bottle/git_gate/plan.py
-bot_bottle/git_gate/provision.py
-bot_bottle/git_gate/service.py
+bot_bottle/egress.py
+bot_bottle/manifest.py
+bot_bottle/manifest_egress.py
+bot_bottle/manifest_agent.py
+bot_bottle/manifest_schema.py
+bot_bottle/git_gate.py
 bot_bottle/gateway/git_gate/render.py
+bot_bottle/git_gate_provision.py
 bot_bottle/gateway/git_gate/http_backend.py
-
-# Supervise proposal protocol and data plane.
-bot_bottle/supervisor/plan.py
-bot_bottle/supervisor/types.py
-bot_bottle/gateway/supervisor/server.py
-
-# Shared parsers and state validation.
+bot_bottle/supervise.py
 bot_bottle/yaml_subset.py
 bot_bottle/bottle_state.py
@@ -1,101 +0,0 @@
-#!/usr/bin/env python3
-"""Validate and render the critical-module coverage manifest.
-
-Coverage.py silently ignores an ``--include`` path that does not exist.  That
-is useful for broad globs, but dangerous for bot-bottle's curated security
-core: a rename could otherwise improve the reported percentage by removing a
-module from the measurement.  Keep the validation in one small stdlib helper
-and make every coverage consumer call it.
-"""
-
-from __future__ import annotations
-
-import argparse
-import sys
-from pathlib import Path
-
-
-REPO_ROOT = Path(__file__).resolve().parents[1]
-DEFAULT_MANIFEST = REPO_ROOT / "scripts" / "critical-modules.txt"
-
-
-class CriticalModulesError(ValueError):
-    """The critical-module manifest is empty, ambiguous, or stale."""
-
-
-def load_critical_modules(manifest: Path, *, root: Path) -> list[str]:
-    """Return validated module paths relative to *root*.
-
-    Entries must be unique, concrete Python files inside the repository.
-    Globs are deliberately rejected by the file check: each rename must update
-    this explicit security review surface.
-    """
-
-    root = root.resolve()
-    try:
-        lines = manifest.read_text(encoding="utf-8").splitlines()
-    except OSError as exc:
-        raise CriticalModulesError(
-            f"cannot read critical-module manifest {manifest}: {exc}"
-        ) from exc
-
-    modules: list[str] = []
-    seen: set[str] = set()
-    errors: list[str] = []
-    for line_number, raw in enumerate(lines, start=1):
-        entry = raw.strip()
-        if not entry or entry.startswith("#"):
-            continue
-        path = Path(entry)
-        prefix = f"{manifest}:{line_number}: {entry!r}"
-        if path.is_absolute():
-            errors.append(f"{prefix} must be relative to the repository root")
-            continue
-        try:
-            resolved = (root / path).resolve()
-            resolved.relative_to(root)
-        except ValueError:
-            errors.append(f"{prefix} escapes the repository root")
-            continue
-        if entry in seen:
-            errors.append(f"{prefix} is duplicated")
-            continue
-        seen.add(entry)
-        if path.suffix != ".py":
-            errors.append(f"{prefix} is not a Python module")
-            continue
-        if not resolved.is_file():
-            errors.append(f"{prefix} does not exist")
-            continue
-        modules.append(path.as_posix())
-
-    if not modules and not errors:
-        errors.append(f"{manifest}: contains no critical modules")
-    if errors:
-        raise CriticalModulesError("\n".join(errors))
-    return modules
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser(
-        description="validate and print the critical coverage include list"
-    )
-    parser.add_argument("--manifest", type=Path, default=DEFAULT_MANIFEST)
-    parser.add_argument("--root", type=Path, default=REPO_ROOT)
-    parser.add_argument(
-        "--check", action="store_true",
-        help="validate only; do not print the comma-separated include list",
-    )
-    args = parser.parse_args(argv)
-    try:
-        modules = load_critical_modules(args.manifest, root=args.root)
-    except CriticalModulesError as exc:
-        print(f"critical-modules: {exc}", file=sys.stderr)
-        return 1
-    if not args.check:
-        print(",".join(modules))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -35,12 +35,5 @@ chmod 600 "$fake_key_dir/fake-key"

 # Build the image graph quietly so the recorded run shows only the
 # bottle launch and the four `!` probes, not BuildKit progress.
-node_base_image=$(
-  python3 -c \
-    'import json; print(json.load(open("image-build-args.json"))["NODE_BASE_IMAGE"])'
-)
-docker build -q \
-  --build-arg "NODE_BASE_IMAGE=$node_base_image" \
-  -f bot_bottle/contrib/claude/Dockerfile \
-  -t bot-bottle-claude:latest . >/dev/null 2>&1 || true
+docker build -q -f bot_bottle/contrib/claude/Dockerfile -t bot-bottle-claude:latest . >/dev/null 2>&1 || true
 docker build -q -f Dockerfile.git-gate -t bot-bottle-git-gate:latest . >/dev/null 2>&1 || true
@@ -13,8 +13,8 @@ policy.

 Usage:
    scripts/coverage.sh                 # produce .coverage first
-    python3 scripts/diff_coverage.py    # gate against origin/main, min 80%
-    python3 scripts/diff_coverage.py --base main --min 75
+    python3 scripts/diff_coverage.py    # gate against origin/main, min 90%
+    python3 scripts/diff_coverage.py --base main --min 85
 """

 from __future__ import annotations
@@ -74,7 +74,7 @@ def main() -> int:
    ap = argparse.ArgumentParser()
    ap.add_argument("--base", default="origin/main",
                    help="git ref to diff against (default: origin/main)")
-    ap.add_argument("--min", type=float, default=80.0,
+    ap.add_argument("--min", type=float, default=90.0,
                    help="minimum %% of changed executable lines covered")
    args = ap.parse_args()

@@ -54,20 +54,18 @@ def check_pull_request(event: dict[str, Any], api: GiteaApi) -> list[str]:
    pull = event["pull_request"]
    errors: list[str] = []
    labels = pull.get("labels") or []
-    numbers = deliberate_issue_numbers(pull.get("title", ""), pull.get("body", ""))
-    if labels and numbers:
+    if labels:
        errors.append(
-            "PR must use exactly one tracking mode: remove PR labels when "
-            "linking an issue, or remove the issue reference when labels "
-            "belong on the PR."
+            "PRs must be unlabeled; put tracker metadata on the linked issue "
+            f"(found: {', '.join(label['name'] for label in labels)})."
        )
+
+    numbers = deliberate_issue_numbers(pull.get("title", ""), pull.get("body", ""))
    if not numbers:
-        if not labels:
-            errors.append(
-                "PR must either have a label or reference an issue with "
-                "Closes/Fixes/Resolves #N, Part of #N, Related to #N, "
-                "Refs #N, or References #N."
-            )
+        errors.append(
+            "PR must reference an issue with Closes/Fixes/Resolves #N, "
+            "Part of #N, Related to #N, Refs #N, or References #N."
+        )
        return errors

    real_issues = 0
@@ -1,67 +0,0 @@
-#!/usr/bin/env python3
-"""Run unittest discovery with explicit execution-count assurances.
-
-The standard unittest CLI exits successfully when a suite contains skipped
-tests. That is normally useful, but it let the Docker integration job stay
-green while its security-boundary classes were all skipped under act_runner.
-This wrapper keeps normal unittest output and adds opt-in minimum-executed and
-no-skip gates for jobs that promise a concrete integration surface.
-"""
-
-from __future__ import annotations
-
-import argparse
-import sys
-import unittest
-
-
-def assurance_errors(
-    *, tests_run: int, skipped: int, minimum_executed: int, fail_on_skip: bool
-) -> list[str]:
-    """Return human-readable assurance failures for a completed suite."""
-
-    executed = tests_run - skipped
-    errors: list[str] = []
-    if executed < minimum_executed:
-        errors.append(
-            f"executed {executed} test(s), below required minimum "
-            f"{minimum_executed} (discovered {tests_run}, skipped {skipped})"
-        )
-    if fail_on_skip and skipped:
-        errors.append(f"{skipped} test(s) skipped in a no-skip suite")
-    return errors
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser(
-        description="unittest discovery with execution-count assurance"
-    )
-    parser.add_argument("-s", "--start-directory", default=".")
-    parser.add_argument("-t", "--top-level-directory", default=None)
-    parser.add_argument("-p", "--pattern", default="test*.py")
-    parser.add_argument("--minimum-executed", type=int, default=0)
-    parser.add_argument("--fail-on-skip", action="store_true")
-    parser.add_argument("-v", "--verbose", action="store_true")
-    args = parser.parse_args(argv)
-
-    suite = unittest.defaultTestLoader.discover(
-        args.start_directory,
-        pattern=args.pattern,
-        top_level_dir=args.top_level_directory,
-    )
-    result = unittest.TextTestRunner(
-        verbosity=2 if args.verbose else 1,
-    ).run(suite)
-    failures = assurance_errors(
-        tests_run=result.testsRun,
-        skipped=len(result.skipped),
-        minimum_executed=args.minimum_executed,
-        fail_on_skip=args.fail_on_skip,
-    )
-    for failure in failures:
-        print(f"unittest-gate: {failure}", file=sys.stderr)
-    return 0 if result.wasSuccessful() and not failures else 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -21,12 +21,9 @@ _ROOT = Path(__file__).resolve().parent
 # Must match bot_bottle.resources.BUNDLED_RESOURCES (paths relative to root).
 _BUNDLED_RESOURCES = (
    "pyproject.toml",
-    "image-build-args.json",
    "Dockerfile.gateway",
    "Dockerfile.orchestrator",
    "Dockerfile.orchestrator.fc",
-    "requirements.gateway.lock",
-    "requirements.orchestrator.lock",
    "nix/firecracker-netpool.nix",
    "scripts/firecracker-netpool.sh",
 )
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
didericis-codex	571ea4dbf0	chore: tighten upkeep boundaries and static checks tracker-policy-pr / check-pr (pull_request) Successful in 10s Details test / integration-docker (pull_request) Successful in 19s Details test / unit (pull_request) Successful in 53s Details test / coverage (pull_request) Successful in 16s Details	2026-07-26 06:42:34 +00:00
didericis-codex	b8893d4c0c	fix(diagnostics): make optional failures observable and safe	2026-07-26 06:42:34 +00:00
didericis-codex	9c3dd003af	refactor(backend): extract shared bottle preparation planner	2026-07-26 06:42:34 +00:00
didericis-codex	f081fdf7dd	refactor(egress): make addon core a compatibility facade	2026-07-26 06:42:34 +00:00
didericis-codex	14827bc151	refactor(egress): separate matching, DLP, and context concerns	2026-07-26 06:42:34 +00:00
didericis-codex	97bd7caa76	refactor: validate reconciliation inputs and neutralize CLI helpers	2026-07-26 06:42:34 +00:00