chore: tighten upkeep boundaries and static checks

fix(diagnostics): make optional failures observable and safe
refactor(backend): extract shared bottle preparation planner
2026-07-26 06:42:34 +00:00 · 2026-07-26 06:42:34 +00:00 · 2026-07-26 06:42:34 +00:00 · 2026-07-26 06:42:34 +00:00 · 2026-07-26 06:42:34 +00:00 · 2026-07-26 06:42:34 +00:00
54 changed files with 399 additions and 1708 deletions
@@ -2,7 +2,7 @@
 # digest, etc.) without coupling every dev push to upstream registry
 # availability.
 #
-# Opt-in via BOT_BOTTLE_RUN_CANARIES=1 so the same files can be run
+# Opt-in via CLAUDE_BOTTLE_RUN_CANARIES=1 so the same files can be run
 # locally with the same gating.

 name: canaries
@@ -17,7 +17,7 @@ jobs:
  canaries:
    runs-on: ubuntu-latest
    env:
-      BOT_BOTTLE_RUN_CANARIES: "1"
+      CLAUDE_BOTTLE_RUN_CANARIES: "1"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -25,7 +25,4 @@ jobs:
      # No actions/setup-python: canaries are stdlib unittest on the image's
      # system Python 3.12 (older act_runner mishandles setup-python's PATH).
      - name: Run canaries
-        run: |
-          python3 -m scripts.unittest_gate \
-            -t . -s tests/canaries -v \
-            --minimum-executed 1 --fail-on-skip
+        run: python3 -m unittest discover -t . -s tests/canaries -v
@@ -1,27 +0,0 @@
-name: prd-number-check
-
-on:
-  pull_request:
-    types: [opened, reopened, synchronize]
-    branches: [main]
-
-jobs:
-  require-numbered-prds:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Reject unnumbered PRDs
-        run: |
-          unnumbered=$(find docs/prds -maxdepth 1 -type f \
-            -name 'prd-new-*.md' -print | sort)
-
-          if [ -n "$unnumbered" ]; then
-            echo "::error::Assign every new PRD its final sequential number before merge."
-            echo "Unnumbered PRDs:"
-            echo "$unnumbered"
-            exit 1
-          fi
-
-          echo "All PRDs have final numbers."
@@ -0,0 +1,122 @@
+# Assign sequential numbers to prd-new-*.md files on merge to main.
+#
+# When a PR merges to main and includes prd-new-*.md files this workflow:
+#   1. Finds the next available NNNN number by scanning existing PRDs.
+#   2. Renames each prd-new-*.md to NNNN-<slug>.md.
+#   3. Updates the title header (# PRD prd-new: → # PRD NNNN:).
+#   4. Flips Status: Draft → Active when the push touched files outside
+#      docs/prds/ anywhere in its commit range (i.e. the implementation
+#      shipped together with the PRD).
+#   5. Commits the renaming back to main.
+#
+# No-op if the working tree contains no prd-new-*.md files.
+#
+# NOTE: The workflow scans the working tree (not just HEAD~1..HEAD) because
+# PRs land as multi-commit pushes and the prd-new file is often added in an
+# earlier commit on the branch, not in the final squash/merge commit.
+
+name: prd-number
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'docs/prds/prd-new-*.md'
+
+jobs:
+  assign-numbers:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      # No actions/setup-python: the inline script is stdlib-only on the
+      # image's system Python 3.12 (older act_runner mishandles its PATH).
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Assign PRD numbers
+        run: |
+          python3 - <<'EOF'
+          import os
+          import re
+          import subprocess
+          import sys
+          from pathlib import Path
+
+          prds_dir = Path("docs/prds")
+
+          # Scan the working tree — prd-new files may have landed in any
+          # commit of a multi-commit push, not just HEAD.
+          new_prds = sorted(prds_dir.glob("prd-new-*.md"))
+
+          if not new_prds:
+              print("No prd-new-*.md files found — nothing to do.")
+              sys.exit(0)
+
+          # Determine whether non-PRD files were also changed anywhere in
+          # the push range (BEFORE_SHA → HEAD).  Falls back to HEAD~1 when
+          # the env var isn't set (e.g. local act runs).
+          before_sha = os.environ.get("GITHUB_EVENT_BEFORE", "HEAD~1")
+          all_changed = subprocess.run(
+              ["git", "diff", "--name-only", before_sha, "HEAD"],
+              capture_output=True, text=True, check=True,
+          ).stdout.splitlines()
+          non_prd_changed = any(
+              not f.startswith("docs/prds/") for f in all_changed
+          )
+
+          # Find next available number.
+          existing = sorted(
+              int(m.group(1))
+              for p in prds_dir.glob("*.md")
+              if (m := re.match(r"^(\d{4})-", p.name))
+          )
+          next_num = (max(existing) + 1) if existing else 1
+
+          for prd_path in sorted(new_prds):
+              slug = re.sub(r"^prd-new-", "", prd_path.stem)
+              new_name = f"{next_num:04d}-{slug}.md"
+              new_path = prds_dir / new_name
+              print(f"  {prd_path.name}  →  {new_name}")
+
+              content = prd_path.read_text()
+
+              # Update title header.
+              content = re.sub(
+                  r"^(#\s+PRD\s+)prd-new(:)",
+                  rf"\g<1>{next_num:04d}\2",
+                  content,
+                  count=1,
+                  flags=re.MULTILINE,
+              )
+
+              # Conditionally flip Status.
+              if non_prd_changed:
+                  content = re.sub(
+                      r"(\*\*Status:\*\*\s*)Draft",
+                      r"\g<1>Active",
+                      content,
+                      count=1,
+                  )
+
+              new_path.write_text(content)
+              subprocess.run(["git", "rm", str(prd_path)], check=True)
+              subprocess.run(["git", "add", str(new_path)], check=True)
+              next_num += 1
+
+          subprocess.run(
+              ["git", "commit", "-m", "ci(prd): assign sequential numbers to new PRDs"],
+              check=True,
+          )
+          subprocess.run(["git", "push"], check=True)
+          EOF
@@ -60,9 +60,6 @@ jobs:

  integration-docker:
    runs-on: ubuntu-latest
-    concurrency:
-      group: integration-docker-infra
-      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -87,34 +84,7 @@ jobs:
        env:
          BOT_BOTTLE_BACKEND: docker
          COVERAGE_FILE: ${{ github.workspace }}/.coverage.docker
-        run: |
-          set -euo pipefail
-          DOCKER_CLIENT_NETWORK=$(
-            docker inspect "$(hostname)" |
-              python3 -c 'import json,sys; n=json.load(sys.stdin)[0]["NetworkSettings"]["Networks"]; print(next(iter(n)))'
-          )
-          test -n "$DOCKER_CLIENT_NETWORK"
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          export NO_PROXY="*"
-          export no_proxy="*"
-          export BOT_BOTTLE_DOCKER_CLIENT_NETWORK="$DOCKER_CLIENT_NETWORK"
-          export BOT_BOTTLE_DOCKER_ROOT_MOUNT="bot-bottle-ci-root-$RUN_KEY"
-          export BOT_BOTTLE_DOCKER_CA_MOUNT="bot-bottle-ci-ca-$RUN_KEY"
-          export BOT_BOTTLE_DOCKER_GIT_MOUNT="bot-bottle-ci-git-$RUN_KEY"
-          export BOT_BOTTLE_DOCKER_CREDS_MOUNT="bot-bottle-ci-creds-$RUN_KEY"
-          python3 -m coverage run -m scripts.unittest_gate \
-            -t . -s tests/integration -v \
-            --minimum-executed 22 --fail-on-skip
-
-      - name: Clean Docker integration volumes
-        if: always()
-        run: |
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          docker volume rm --force \
-            "bot-bottle-ci-root-$RUN_KEY" \
-            "bot-bottle-ci-ca-$RUN_KEY" \
-            "bot-bottle-ci-git-$RUN_KEY" \
-            "bot-bottle-ci-creds-$RUN_KEY" 2>/dev/null || true
+        run: python3 -m coverage run -m unittest discover -t . -s tests/integration -v

      # Non-dot name so upload-artifact's dotfile-skipping glob picks it up.
      - name: Stage docker coverage for upload
@@ -12,14 +12,10 @@ on:
      - 'bot_bottle/**'
      - 'tests/**/*.py'
      - 'cli.py'
-      - 'install.sh'
-      - 'setup.py'
-      - 'MANIFEST.in'
-      - 'flake.nix'
-      - 'nix/firecracker-netpool.nix'
      - 'scripts/coverage.sh'
      - 'scripts/critical-modules.txt'
-      - 'scripts/**/*.py'
+      - 'scripts/diff_coverage.py'
+      - 'scripts/tracker_policy.py'
      - 'scripts/firecracker-netpool.sh'
      - 'Dockerfile*'
      - 'pyproject.toml'
@@ -27,20 +23,15 @@ on:
      - '.coveragerc'
      - '.dockerignore'
      - '.gitea/workflows/test.yml'
-      - '.gitea/workflows/pre-release-test.yml'
  pull_request:
    paths:
      - 'bot_bottle/**'
      - 'tests/**/*.py'
      - 'cli.py'
-      - 'install.sh'
-      - 'setup.py'
-      - 'MANIFEST.in'
-      - 'flake.nix'
-      - 'nix/firecracker-netpool.nix'
      - 'scripts/coverage.sh'
      - 'scripts/critical-modules.txt'
-      - 'scripts/**/*.py'
+      - 'scripts/diff_coverage.py'
+      - 'scripts/tracker_policy.py'
      - 'scripts/firecracker-netpool.sh'
      - 'Dockerfile*'
      - 'pyproject.toml'
@@ -48,7 +39,6 @@ on:
      - '.coveragerc'
      - '.dockerignore'
      - '.gitea/workflows/test.yml'
-      - '.gitea/workflows/pre-release-test.yml'

 jobs:
  unit:
@@ -81,9 +71,6 @@ jobs:

  integration-docker:
    runs-on: ubuntu-latest
-    concurrency:
-      group: integration-docker-infra
-      cancel-in-progress: false
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -100,37 +87,7 @@ jobs:
        env:
          BOT_BOTTLE_BACKEND: docker
          COVERAGE_FILE: ${{ github.workspace }}/.coverage.docker
-        run: |
-          set -euo pipefail
-          # act_runner executes this job in a container while sharing the host
-          # Docker socket. Attach control-plane siblings to the job's network,
-          # and use named volumes for state the host daemon must mount.
-          DOCKER_CLIENT_NETWORK=$(
-            docker inspect "$(hostname)" |
-              python3 -c 'import json,sys; n=json.load(sys.stdin)[0]["NetworkSettings"]["Networks"]; print(next(iter(n)))'
-          )
-          test -n "$DOCKER_CLIENT_NETWORK"
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          export NO_PROXY="*"
-          export no_proxy="*"
-          export BOT_BOTTLE_DOCKER_CLIENT_NETWORK="$DOCKER_CLIENT_NETWORK"
-          export BOT_BOTTLE_DOCKER_ROOT_MOUNT="bot-bottle-ci-root-$RUN_KEY"
-          export BOT_BOTTLE_DOCKER_CA_MOUNT="bot-bottle-ci-ca-$RUN_KEY"
-          export BOT_BOTTLE_DOCKER_GIT_MOUNT="bot-bottle-ci-git-$RUN_KEY"
-          export BOT_BOTTLE_DOCKER_CREDS_MOUNT="bot-bottle-ci-creds-$RUN_KEY"
-          python3 -m coverage run -m scripts.unittest_gate \
-            -t . -s tests/integration -v \
-            --minimum-executed 22 --fail-on-skip
-
-      - name: Clean Docker integration volumes
-        if: always()
-        run: |
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          docker volume rm --force \
-            "bot-bottle-ci-root-$RUN_KEY" \
-            "bot-bottle-ci-ca-$RUN_KEY" \
-            "bot-bottle-ci-git-$RUN_KEY" \
-            "bot-bottle-ci-creds-$RUN_KEY" 2>/dev/null || true
+        run: python3 -m coverage run -m unittest discover -t . -s tests/integration -v

      - name: Stage docker coverage for upload
        run: cp .coverage.docker coverage-docker.dat
@@ -33,28 +33,19 @@ jobs:
      - name: Run coverage and extract percentage
        id: coverage
        run: |
-          set -euo pipefail
-          # Never publish a badge from a failed or partial test run.
-          python3 -m coverage run -m unittest discover -t . -s tests/unit
-          REPORT=$(python3 -m coverage report)
-          printf '%s\n' "$REPORT"
-          PERCENT=$(printf '%s\n' "$REPORT" | awk '$1 == "TOTAL" {gsub("%", "", $NF); print $NF}')
-          test -n "$PERCENT"
+          python3 -m coverage run -m unittest discover -t . -s tests/unit > /dev/null 2>&1 || true
+          PERCENT=$(python3 -m coverage report 2>/dev/null | grep '^TOTAL' | grep -oP '\d+(?=%)' | tail -1)
          echo "percent=$PERCENT" >> $GITHUB_OUTPUT
          echo "Coverage: $PERCENT%"

      - name: Extract core (critical-module) coverage percentage
        id: core_coverage
        run: |
-          set -euo pipefail
          # Reuses the .coverage data from the previous step. The core list is
-          # validated single source of truth. Fail if a listed path disappeared
-          # or if the measured core falls below ADR 0004's 90% minimum.
-          INCLUDE=$(python3 scripts/critical_modules.py)
-          REPORT=$(python3 -m coverage report --include="$INCLUDE" --fail-under=90)
-          printf '%s\n' "$REPORT"
-          PERCENT=$(printf '%s\n' "$REPORT" | awk '$1 == "TOTAL" {gsub("%", "", $NF); print $NF}')
-          test -n "$PERCENT"
+          # the single source of truth in scripts/critical-modules.txt; every
+          # core module is unit-tested, so the unit-only run is accurate for it.
+          INCLUDE=$(grep -vE '^[[:space:]]*(#|$)' scripts/critical-modules.txt | paste -sd, -)
+          PERCENT=$(python3 -m coverage report --include="$INCLUDE" 2>/dev/null | grep '^TOTAL' | grep -oP '\d+(?=%)' | tail -1)
          echo "percent=$PERCENT" >> $GITHUB_OUTPUT
          echo "Core coverage: $PERCENT%"

@@ -44,10 +44,10 @@ backend remains available with `BOT_BOTTLE_BACKEND=docker` or

 - Three kinds of doc, each with its own conventions in-folder; see
  `docs/README.md` for when to write which:
-  - **PRDs** (`docs/prds/`) — one feature per file. A draft may initially
-    use `prd-new-<kebab>.md`, but its author must assign the next
-    sequential number before merge; CI rejects unnumbered PRDs. A
-    `Status:` line tracks lifecycle: Draft → Active (shipped to `main`) →
+  - **PRDs** (`docs/prds/`) — one feature per file. While a PR is open
+    the file is named `prd-new-<kebab>.md`; CI assigns a sequential
+    number on merge to `main` and renames it. A `Status:` line tracks
+    lifecycle: Draft → Active (shipped to `main`) →
    Superseded/Retargeted. Format in `docs/prds/README.md`.
  - **Research notes** (`docs/research/`) — opinionated investigations;
    unnumbered kebab-case, freeform and verdict-first. See
@@ -5,7 +5,7 @@
 # bot-bottle

 [![test](https://gitea.dideric.is/didericis/bot-bottle/actions/workflows/test.yml/badge.svg?branch=main)](https://gitea.dideric.is/didericis/bot-bottle/actions?workflow=test.yml)
-[![coverage](https://img.shields.io/badge/coverage-84%25-brightgreen)](https://coverage.readthedocs.io/)
+[![coverage](https://img.shields.io/badge/coverage-83%25-brightgreen)](https://coverage.readthedocs.io/)
 [![core coverage](https://img.shields.io/badge/core%20coverage-94%25-brightgreen)](https://gitea.dideric.is/didericis/bot-bottle/src/branch/main/docs/decisions/0004-coverage-policy.md)

 **Problem:** Developer wants to run a coding agent without supervision, but they don't want a prompt injected or misbehaving agent wrecking their environment or exfiltrating sensitive data.
@@ -75,7 +75,7 @@ On compatible macOS hosts, the default backend requires Apple's `container` CLI

 Use `BOT_BOTTLE_BACKEND=docker ./cli.py start <agent>` on hosts where neither Apple Container nor KVM is available and Docker is the desired backend.

-> **CI (macOS Apple Container):** the advisory `integration-macos` job in `.gitea/workflows/pre-release-test.yml` runs only on manual dispatch. It targets a self-hosted host-mode runner labelled `macos`; Apple Container cannot run inside the Linux pull-request runner. Provision an Apple Silicon host with the `container` CLI running and Python ≥ 3.11 plus `coverage` on the launchd service's explicit `PATH`. The infra container is a singleton (`bot-bottle-mac-infra`), so keep runner concurrency at 1. Its coverage is reported separately and never feeds the required pull-request gate.
+> **CI (macOS Apple Container):** the `integration-macos` job (`.gitea/workflows/test.yml`) runs the integration suite against `BOT_BOTTLE_BACKEND=macos-container` on a self-hosted macOS runner labelled `macos`, because Apple Container needs the host virtualization framework and cannot run in a Linux container (so it can't reuse the `kvm` runner). Provision an Apple Silicon host with the `container` CLI on `PATH` and `container system status` running, then register the runner in **host mode** (not docker mode) with the `macos` label — `brew install gitea-runner` (the `act_runner` rename). Give it a Python ≥ 3.11 with `coverage` importable on the launchd service's `PATH` (a launchd service doesn't inherit your shell profile, so pin `node` and the Python env explicitly). The job is **advisory** — `workflow_dispatch` (manual) only, never triggered by push or PR — since a single laptop that sleeps/roams must not block merges or churn on every push to main; its coverage doesn't feed the gate. The infra container is a singleton (`bot-bottle-mac-infra`), so keep runner concurrency at 1.

 ### Containers inside a bottle

@@ -174,7 +174,7 @@ BOT_BOTTLE_BACKEND=firecracker ./cli.py start <agent>

 > **NixOS:** enable `virtualisation.docker`, ensure the KVM module is loaded (`boot.kernelModules = [ "kvm-intel" ];` or `kvm-amd`), and add your user to the `kvm` and `docker` groups. For the network pool, consume the flake module — `imports = [ inputs.bot-bottle.nixosModules.firecracker-netpool ]; services.bot-bottle-firecracker = { enable = true; owner = "you"; };` — then `nixos-rebuild switch` (imperative nft/TAP rules don't survive a rebuild; channel users can `imports = [ <bot-bottle>/nix/firecracker-netpool.nix ]`). `firecracker` isn't in nixpkgs by default as a user binary — install the release binary (pin the version) and put it on `PATH`.

-> **CI:** Firecracker integration runs in the manually dispatched `.gitea/workflows/pre-release-test.yml` on a self-hosted runner labelled `kvm`; privileged KVM hosts never execute unreviewed PR code automatically. Provision it like a normal Firecracker host: `firecracker` on `PATH`, `/dev/kvm`, the cached guest kernel and static dropbear, and the persistent TAP/nft pool. The required pull-request workflow runs unit plus the complete Docker integration suite on `ubuntu-latest`; see `docs/ci.md`.
+> **CI:** the coverage gate (`.gitea/workflows/test.yml` → `coverage` job) runs on a self-hosted runner labelled `kvm`, because the Firecracker backend's VM/SSH orchestration is exercised only by the integration suite, which needs `/dev/kvm` + the provisioned pool (a container runner would skip it and read as uncovered). Provision that runner exactly like a normal Firecracker host — `firecracker` on `PATH`, `/dev/kvm`, the cached guest kernel + static dropbear, and the pool installed as the persistent systemd unit — then register it with the `kvm` label. A Docker-capable hosted job builds the candidate once; KVM tests boot those exact bytes, and a successful main run publishes them. The unit/lint jobs still run on `ubuntu-latest`.

 ```sh
 ./cli.py start <agent>   # builds the image on first run, drops you into claude
@@ -9,8 +9,6 @@ from .gateway_transport import DockerGatewayTransport
 from ...paths import (
    ORCHESTRATOR_AUTH_JWT_ENV,
    host_gateway_ca_dir,
-    host_gateway_git_dir,
-    host_gateway_creds_dir,
 )
 from ... import resources
 from ...gateway import (
@@ -19,10 +17,6 @@ from ...gateway import (
  DEFAULT_CA_TIMEOUT_SECONDS, CA_POLL_SECONDS, GATEWAY_CA_CERT, GatewayError
 )

-DEFAULT_GATEWAY_SUBNET = "10.242.255.0/24"
-_GATEWAY_SUBNET_LABEL = "bot-bottle.gateway-subnet"
-
-
 class DockerGateway(Gateway):
    """The consolidated gateway as a single, fixed-name Docker container.

@@ -41,10 +35,6 @@ class DockerGateway(Gateway):
        build_context: Path | None = None,
        dockerfile: str | None = GATEWAY_DOCKERFILE,
        host_port_bindings: tuple[int, ...] = (),
-        ca_mount_source: str | Path | None = None,
-        git_mount_source: str | Path | None = None,
-        creds_mount_source: str | Path | None = None,
-        subnet: str | None = None,
    ) -> None:
        self.image_ref = image_ref
        self.name = name
@@ -69,26 +59,6 @@ class DockerGateway(Gateway):
        # backend's dev-harness gateway so VMs can reach it via their TAP link;
        # Docker's DNAT + the nft `ct status dnat accept` rule handle the rest.
        self._host_port_bindings = host_port_bindings
-        self._subnet = (
-            subnet
-            or os.environ.get("BOT_BOTTLE_DOCKER_GATEWAY_SUBNET", "").strip()
-            or DEFAULT_GATEWAY_SUBNET
-        )
-        configured_ca = os.environ.get("BOT_BOTTLE_DOCKER_CA_MOUNT", "").strip()
-        self._ca_mount_source = str(
-            ca_mount_source or configured_ca or host_gateway_ca_dir()
-        )
-        # The persistent git-gate mounts (/git bare repos, /git-gate/creds deploy
-        # creds) — same host-bind-mount rationale as the CA (issue #512). The env
-        # overrides let CI point them at per-run named volumes it cleans up.
-        configured_git = os.environ.get("BOT_BOTTLE_DOCKER_GIT_MOUNT", "").strip()
-        self._git_mount_source = str(
-            git_mount_source or configured_git or host_gateway_git_dir()
-        )
-        configured_creds = os.environ.get("BOT_BOTTLE_DOCKER_CREDS_MOUNT", "").strip()
-        self._creds_mount_source = str(
-            creds_mount_source or configured_creds or host_gateway_creds_dir()
-        )

    def image_exists(self) -> bool:
        return run_docker(["docker", "image", "inspect", self.image_ref]).returncode == 0
@@ -139,34 +109,10 @@ class DockerGateway(Gateway):
    def _ensure_network(self) -> None:
        """Create the shared gateway network if it doesn't exist. Idempotent —
        a concurrent create loses harmlessly (the loser sees 'already exists').
-        The explicit subnet is required because bottle attribution pins source
-        IPs; Docker rejects static endpoint addresses on an auto-IPAM network."""
-        inspected = run_docker([
-            "docker", "network", "inspect",
-            "--format", f'{{{{index .Labels "{_GATEWAY_SUBNET_LABEL}"}}}}',
-            self.network,
-        ])
-        if inspected.returncode == 0:
-            marker = inspected.stdout.strip()
-            if marker in {"", self._subnet}:
-                return
-        if inspected.returncode == 0:
-            # Migrate the stale auto-IPAM network created by older releases.
-            # Removing the fixed gateway is safe here: this launch recreates it.
-            run_docker(["docker", "rm", "--force", self.name])
-            removed = run_docker(["docker", "network", "rm", self.network])
-            if removed.returncode != 0:
-                raise GatewayError(
-                    f"gateway network {self.network} needs explicit subnet "
-                    f"{self._subnet} but could not be replaced: "
-                    f"{removed.stderr.strip()}"
-                )
-        proc = run_docker([
-            "docker", "network", "create",
-            "--subnet", self._subnet,
-            "--label", f"{_GATEWAY_SUBNET_LABEL}={self._subnet}",
-            self.network,
-        ])
+        Docker picks the subnet; the launcher reads it back to allocate IPs."""
+        if run_docker(["docker", "network", "inspect", self.network]).returncode == 0:
+            return
+        proc = run_docker(["docker", "network", "create", self.network])
        if proc.returncode != 0 and "already exists" not in proc.stderr:
            raise GatewayError(
                f"gateway network {self.network} failed to create: {proc.stderr.strip()}"
@@ -197,9 +143,9 @@ class DockerGateway(Gateway):
        # Recreate when the running container's image is stale (a rebuild),
        # so source changes to the gateway's flat daemons take effect — not
        # just when the container is absent.
-        self._ensure_network()
        if self.is_running() and self._running_image_is_current():
            return
+        self._ensure_network()
        # Clear any stale (stopped OR outdated-image) container holding the
        # fixed name, then start fresh. `rm --force` on an absent name is a
        # tolerated no-op.
@@ -212,13 +158,7 @@ class DockerGateway(Gateway):
            # Persist the self-generated CA on the host so it survives both
            # container recreation AND docker volume pruning (agents trust it)
            # — see host_gateway_ca_dir / issue #450.
-            "--volume", f"{self._ca_mount_source}:{MITMPROXY_HOME}",
-            # Persist per-bottle git-gate state (bare repos + deploy creds) on
-            # the host so a gateway restart doesn't drop already-running bottles'
-            # repos — they would otherwise 404 on fetch/push (issue #512). Same
-            # host-bind-mount rationale as the CA.
-            "--volume", f"{self._git_mount_source}:/git",
-            "--volume", f"{self._creds_mount_source}:/git-gate/creds",
+            "--volume", f"{host_gateway_ca_dir()}:{MITMPROXY_HOME}",
            # No DB mount: the data plane (egress / supervise / git-gate) reaches
            # the supervise queue over the control-plane RPC and never opens
            # bot-bottle.db, so the gateway container gets no file handle on it
@@ -313,4 +253,4 @@ class DockerGateway(Gateway):
    def provisioning_transport(self) -> GatewayTransport:
        """The exec/cp transport git-gate provisioning stages per-bottle repos +
        deploy keys through (over the docker socket)."""
-        return DockerGatewayTransport(self.name)
+        return DockerGatewayTransport(self.name)
@@ -33,6 +33,7 @@ from .orchestrator import (
    ORCHESTRATOR_NAME,
    ORCHESTRATOR_NETWORK,
 )
+from ...paths import bot_bottle_root
 from ... import resources
 from ...gateway import (
    GATEWAY_IMAGE,
@@ -68,8 +69,6 @@ class DockerInfraService(InfraService):
        gateway_image: str = GATEWAY_IMAGE,
        repo_root: Path | None = None,
        host_root: Path | None = None,
-        root_mount_source: str | Path | None = None,
-        gateway_ca_mount_source: str | Path | None = None,
        orchestrator_name: str = ORCHESTRATOR_NAME,
        orchestrator_label: str = ORCHESTRATOR_LABEL,
        gateway_name: str = GATEWAY_NAME,
@@ -79,14 +78,10 @@ class DockerInfraService(InfraService):
        self.control_network = control_network
        self.orchestrator_image = orchestrator_image
        self.gateway_image = gateway_image
-        # Build context: the repo root in a checkout, a staged copy from the
-        # installed wheel otherwise (bot_bottle.resources).
+        # Build context / bind-mount source: the repo root in a checkout, a
+        # staged copy from the installed wheel otherwise (bot_bottle.resources).
        self._repo_root = repo_root if repo_root is not None else resources.build_root()
-        if host_root is not None and root_mount_source is not None:
-            raise ValueError("pass host_root or root_mount_source, not both")
-        self._host_root = host_root
-        self._root_mount_source = root_mount_source
-        self._gateway_ca_mount_source = gateway_ca_mount_source
+        self._host_root = host_root or bot_bottle_root()
        self._orchestrator_name = orchestrator_name
        self._orchestrator_label = orchestrator_label
        self._gateway_name = gateway_name
@@ -103,7 +98,6 @@ class DockerInfraService(InfraService):
            control_network=self.control_network,
            repo_root=self._repo_root,
            host_root=self._host_root,
-            root_mount_source=self._root_mount_source,
        )

    def gateway(self) -> DockerGateway:
@@ -118,7 +112,6 @@ class DockerInfraService(InfraService):
            network=self.network,
            control_network=self.control_network,
            build_context=self._repo_root,
-            ca_mount_source=self._gateway_ca_mount_source,
        )

    def ensure_running(
@@ -42,9 +42,13 @@ ORCHESTRATOR_IMAGE = os.environ.get(
 )
 ORCHESTRATOR_DOCKERFILE = "Dockerfile.orchestrator"
 # Baked as a container label so `ensure_running` can detect whether the running
-# orchestrator image was built from the current source.
+# orchestrator is executing the current bind-mounted source.
 ORCHESTRATOR_SOURCE_HASH_LABEL = "bot-bottle-orchestrator-source-hash"

+# The bind-mount path for the live control-plane source inside the container.
+# PYTHONPATH points here so a code change takes effect on the next launch
+# without an image rebuild.
+_SRC_IN_CONTAINER = "/bot-bottle-src"
 # Bot-bottle host-root bind-mount (DB + state) inside the orchestrator. The
 # control plane opens bot-bottle.db under here (via BOT_BOTTLE_ROOT ->
 # host_db_path()); it is the ONLY container with a handle on it (issue #469).
@@ -68,51 +72,23 @@ class DockerOrchestrator(Orchestrator):
        control_network: str = ORCHESTRATOR_NETWORK,
        repo_root: Path | None = None,
        host_root: Path | None = None,
-        root_mount_source: str | Path | None = None,
-        client_host: str | None = None,
-        client_network: str | None = None,
-        bind_host: str | None = None,
        dockerfile: str | None = ORCHESTRATOR_DOCKERFILE,
    ) -> None:
-        if host_root is not None and root_mount_source is not None:
-            raise ValueError("pass host_root or root_mount_source, not both")
        self.image_ref = image_ref
        self.name = name
        self.label = label
        self.port = port
        self.control_network = control_network
-        # Build context: the repo root in a checkout, a staged copy from the
-        # installed wheel otherwise (bot_bottle.resources).
+        # Build context / bind-mount source: the repo root in a checkout, a
+        # staged copy from the installed wheel otherwise (bot_bottle.resources).
        self._repo_root = repo_root if repo_root is not None else resources.build_root()
-        configured_root = os.environ.get("BOT_BOTTLE_DOCKER_ROOT_MOUNT", "").strip()
-        self._root_mount_source = str(
-            root_mount_source or configured_root or host_root or bot_bottle_root()
-        )
-        configured_network = os.environ.get(
-            "BOT_BOTTLE_DOCKER_CLIENT_NETWORK", ""
-        ).strip()
-        self._client_network = client_network or configured_network or None
-        configured_host = os.environ.get(
-            "BOT_BOTTLE_DOCKER_HOST_ADDRESS", ""
-        ).strip()
-        self._client_host = (
-            client_host or configured_host
-            or (self.name if self._client_network else "127.0.0.1")
-        )
-        # A socket-shared CI runner reaches published ports through its Docker
-        # network rather than its own loopback. Production stays bound to host
-        # loopback unless a caller explicitly selects another client.
-        self._bind_host = bind_host or (
-            "0.0.0.0"
-            if not self._client_network and self._client_host != "127.0.0.1"
-            else "127.0.0.1"
-        )
+        self._host_root = host_root or bot_bottle_root()
        self._dockerfile = dockerfile

    def url(self) -> str:
-        """Control-plane URL reachable by this Docker client."""
-        port = DEFAULT_PORT if self._client_network else self.port
-        return f"http://{self._client_host}:{port}"
+        """Host-side control-plane URL — the orchestrator's published loopback,
+        which the CLI reaches."""
+        return f"http://127.0.0.1:{self.port}"

    def gateway_url(self) -> str:
        """The URL the gateway's data plane resolves policy against — the
@@ -143,7 +119,8 @@ class DockerOrchestrator(Orchestrator):
        return self.name in proc.stdout.split()

    def _source_current(self, current_hash: str) -> bool:
-        """True iff the running orchestrator image matches current source."""
+        """True iff the running orchestrator was started from the current
+        bind-mounted source."""
        if not self.is_running():
            return False
        proc = run_docker([
@@ -205,19 +182,15 @@ class DockerOrchestrator(Orchestrator):
            # Control network only — agents are never on it, so they have no
            # route to the control plane (the L3 block, not just the JWT).
            "--network", self.control_network,
-            # Host CLI reaches the control plane here (loopback by default).
-            # Socket-shared CI joins the container directly to the job network;
-            # the host-side mapping remains loopback-only in that topology. The
+            # Host CLI reaches the control plane here (loopback only). The
            # orchestrator listens on the fixed DEFAULT_PORT inside the
            # container; self.port is the host-side published port.
-            "--publish", f"{self._bind_host}:{self.port}:{DEFAULT_PORT}",
-            # The image was rebuilt from `_repo_root` immediately before this
-            # launch. Running its baked package avoids a host-path bind mount,
-            # which is both more production-like and works with socket-shared
-            # CI where the daemon cannot see the job container's workspace.
+            "--publish", f"127.0.0.1:{self.port}:{DEFAULT_PORT}",
+            # Live control-plane source (code changes without an image rebuild).
+            "--volume", f"{self._repo_root}:{_SRC_IN_CONTAINER}:ro",
+            "--env", f"PYTHONPATH={_SRC_IN_CONTAINER}",
            # Orchestrator registry DB on the host (sole writer: control plane).
-            # `root_mount_source` may be a host path or a named Docker volume.
-            "--volume", f"{self._root_mount_source}:{_ROOT_IN_CONTAINER}",
+            "--volume", f"{self._host_root}:{_ROOT_IN_CONTAINER}",
            "--env", f"BOT_BOTTLE_ROOT={_ROOT_IN_CONTAINER}",
            # The signing key — held ONLY by the orchestrator (it verifies
            # tokens); the gateway gets the pre-minted `gateway` JWT, never the
@@ -232,15 +205,6 @@ class DockerOrchestrator(Orchestrator):
            raise OrchestratorStartError(
                f"orchestrator container failed to start: {proc.stderr.strip()}"
            )
-        if self._client_network:
-            proc = run_docker([
-                "docker", "network", "connect", self._client_network, self.name,
-            ])
-            if proc.returncode != 0:
-                raise OrchestratorStartError(
-                    f"orchestrator container failed to join client network "
-                    f"{self._client_network}: {proc.stderr.strip()}"
-                )

    def stop(self) -> None:
        """Remove the control-plane container (idempotent)."""
@@ -84,7 +84,7 @@ def _config(
    vcpus: int,
    mem_mib: int,
    guest_mac: str,
-    data_drives: tuple[Path, ...] = (),
+    data_drive: Path | None = None,
    extra_boot_args: str = "",
 ) -> dict[str, object]:
    drives: list[dict[str, object]] = [
@@ -95,15 +95,12 @@ def _config(
            "is_read_only": False,
        }
    ]
-    # Extra virtio-block devices — the infra VMs' persistent "volumes",
-    # host-side ext4 files that outlive the ephemeral rootfs across VM restarts.
-    # They appear to the guest as /dev/vdb, /dev/vdc, ... in list order (after
-    # the root /dev/vda), so callers must keep the order stable: the orchestrator
-    # attaches its registry (vdb); the gateway attaches its CA (vdb) then its
-    # git-gate state (vdc).
-    for i, data_drive in enumerate(data_drives):
+    # A second virtio-block device (guest /dev/vdb) — the infra VM's
+    # persistent registry "volume", a host-side ext4 file that outlives the
+    # ephemeral rootfs across VM restarts.
+    if data_drive is not None:
        drives.append({
-            "drive_id": f"data{i}",
+            "drive_id": "data",
            "path_on_host": str(data_drive),
            "is_root_device": False,
            "is_read_only": False,
@@ -141,7 +138,7 @@ def boot(
    mem_mib: int = 2048,
    guest_mac: str = "06:00:AC:10:00:02",
    detached: bool = False,
-    data_drives: tuple[Path, ...] = (),
+    data_drive: Path | None = None,
    extra_boot_args: str = "",
 ) -> VmHandle:
    """Write the config and launch the VMM. Returns once the process is
@@ -158,7 +155,7 @@ def boot(
        _config(
            rootfs=rootfs, tap=tap, guest_ip=guest_ip, host_ip=host_ip,
            pubkey=pubkey, vcpus=vcpus, mem_mib=mem_mib, guest_mac=guest_mac,
-            data_drives=data_drives, extra_boot_args=extra_boot_args,
+            data_drive=data_drive, extra_boot_args=extra_boot_args,
        ),
        indent=2,
    ))
@@ -19,7 +19,6 @@ singleton flock) is `FirecrackerInfraService` (`infra.py`).
 from __future__ import annotations

 import subprocess
-from pathlib import Path
 from urllib.parse import urlparse

 from ...gateway import (
@@ -28,7 +27,6 @@ from ...gateway import (
    GatewayError,
    GatewayTransport,
 )
-from ...log import die, info
 from .. import util as backend_util
 from . import infra_vm, netpool, util
 from .gateway_transport import FirecrackerGatewayTransport
@@ -51,26 +49,6 @@ _GUEST_GATEWAY_JWT_PATH = infra_vm._GUEST_GATEWAY_JWT_PATH
 # the gateway's TLS interception. Host-side only (SSH cat), so it lives here.
 _GATEWAY_CA_PATH = "/home/mitmproxy/.mitmproxy/mitmproxy-ca-cert.pem"

-# The gateway VM's persistent CA volume — a small ext4 file the gateway init
-# mounts at mitmproxy's confdir (see `infra_vm._GATEWAY_CA_MOUNT`) so the
-# self-generated CA SURVIVES a gateway-VM rebuild/restart. Without it the CA
-# lives only in the ephemeral per-boot rootfs, so every rebuild mints a fresh CA
-# that every already-running bottle distrusts, failing the TLS handshake (the
-# firecracker analogue of the docker fix's persistent CA bind-mount — issue
-# #450). Co-located with the orchestrator's registry volume under the infra dir,
-# which outlives the ephemeral rootfs. mitmproxy is tiny; 16M is ample.
-_CA_VOLUME_SIZE = "16M"
-
-# The gateway VM's persistent git-gate volume — a (sparse) ext4 file the gateway
-# init mounts, then bind-mounts onto /git + /git-gate/creds (see
-# `infra_vm._GATEWAY_GIT_MOUNT`), so per-bottle bare repos and deploy creds
-# SURVIVE a gateway-VM rebuild. Without it a restart drops every already-running
-# bottle's git-gate state and its agent 404s on fetch/push (same class as the CA
-# — issue #512). Bare repos hold upstream history, so this is sized far larger
-# than the CA volume; mke2fs leaves the file sparse, so the host only stores
-# blocks actually used.
-_GIT_VOLUME_SIZE = "8G"
-
 _CA_FETCH_TIMEOUT_SECONDS = 15.0


@@ -116,18 +94,11 @@ class FirecrackerGateway(Gateway):
                f"cannot resolve orchestrator guest IP from {self._orchestrator_url!r}"
            )
        # Boot on the gateway link from the gateway rootfs, then push the token
-        # the init waits for before starting the data plane. Two persistent
-        # volumes ride along, attached in a FIXED order the gateway init depends
-        # on: the CA volume as /dev/vdb (mounted at mitmproxy's confdir) and the
-        # git-gate volume as /dev/vdc (bind-mounted onto /git + /git-gate/creds).
-        # Both keep gateway-side state STABLE across rebuilds so already-running
-        # bottles keep working — TLS interception (issue #450) and git-gate fetch
-        # /push (issue #512) respectively.
+        # the init waits for before starting the data plane.
        vm = infra_vm.boot_vm(
            name=GATEWAY_NAME, slot=netpool.gw_slot(), run_dir=infra_vm._gw_dir(),
            role="gateway", mem_mib=_GW_MEM_MIB,
            extra_boot_args=f"bb_orch={orchestrator_guest_ip}",
-            data_drives=(self._ensure_ca_volume(), self._ensure_git_volume()),
        )
        infra_vm.push_secret(
            vm, self._gateway_token, _GUEST_GATEWAY_JWT_PATH,
@@ -145,46 +116,6 @@ class FirecrackerGateway(Gateway):
        infra_vm._kill_pidfile(infra_vm._gw_dir())
        infra_vm._pid_file(infra_vm._gw_dir()).unlink(missing_ok=True)

-    def _ensure_ca_volume(self) -> Path:
-        """Create the empty ext4 CA volume on first use; reuse it after.
-
-        A fresh (empty) volume makes mitmproxy generate a CA into it on first
-        boot; every later boot reuses the CA already on the volume — which is
-        what keeps the CA stable across gateway-VM rebuilds. The mirror of
-        `FirecrackerOrchestrator._ensure_registry_volume`."""
-        vol = infra_vm._gw_dir() / "gateway-ca.ext4"
-        if vol.exists():
-            return vol
-        info(f"creating gateway CA volume {vol} ({_CA_VOLUME_SIZE})")
-        proc = subprocess.run(
-            ["mke2fs", "-q", "-t", "ext4", "-F", str(vol), _CA_VOLUME_SIZE],
-            capture_output=True, text=True, check=False,
-        )
-        if proc.returncode != 0:
-            vol.unlink(missing_ok=True)
-            die(f"creating gateway CA volume failed: {proc.stderr.strip()}")
-        return vol
-
-    def _ensure_git_volume(self) -> Path:
-        """Create the empty ext4 git-gate volume on first use; reuse it after.
-
-        Empty on first boot (the gateway init lays out `git/` + `creds/` subdirs
-        and bind-mounts them); every later boot reuses whatever repos + creds the
-        volume already holds — which is what keeps git-gate state stable across a
-        gateway-VM rebuild (issue #512). Sibling of `_ensure_ca_volume`."""
-        vol = infra_vm._gw_dir() / "gateway-git.ext4"
-        if vol.exists():
-            return vol
-        info(f"creating gateway git-gate volume {vol} ({_GIT_VOLUME_SIZE})")
-        proc = subprocess.run(
-            ["mke2fs", "-q", "-t", "ext4", "-F", str(vol), _GIT_VOLUME_SIZE],
-            capture_output=True, text=True, check=False,
-        )
-        if proc.returncode != 0:
-            vol.unlink(missing_ok=True)
-            die(f"creating gateway git-gate volume failed: {proc.stderr.strip()}")
-        return vol
-
    def address(self) -> str:
        """The gateway VM's guest IP — the agent-facing target agent VMs'
        gateway-port traffic is DNAT'd to."""
@@ -53,25 +53,10 @@ from . import firecracker_vm, infra_artifact, netpool, util
 # tokens with the same key the host CLI signs with — the host token file stays
 # the single source of truth, never clobbered per-backend (issue #469 review).
 _GUEST_SIGNING_KEY_PATH = "/var/lib/bot-bottle/orchestrator-token"
-# The gateway VM's pre-minted `gateway` JWT path (rootfs, not /dev/vdb — the JWT
-# is re-pushed every boot, so it needn't persist). Pushed post-boot; the gateway
-# daemons present it to the orchestrator, and never see the key.
+# The gateway VM's pre-minted `gateway` JWT path (rootfs, not /dev/vdb — the
+# data plane has no registry volume and never opens the DB). Pushed post-boot;
+# the gateway daemons present it to the orchestrator, and never see the key.
 _GUEST_GATEWAY_JWT_PATH = "/var/lib/bot-bottle/gateway-jwt"
-# The gateway VM's persistent CA volume mount point — mitmproxy's confdir. The
-# gateway boots with a persistent /dev/vdb CA volume (see
-# `FirecrackerGateway._ensure_ca_volume`) mounted here so the self-generated CA
-# survives a gateway-VM rebuild; without it every rebuild mints a fresh CA that
-# already-running bottles distrust, breaking the TLS handshake (issue #450).
-_GATEWAY_CA_MOUNT = "/home/mitmproxy/.mitmproxy"
-# The gateway VM's persistent git-gate volume staging mount (/dev/vdc). The
-# gateway boots with this volume (see `FirecrackerGateway._ensure_git_volume`)
-# and the init bind-mounts its `git/` + `creds/` subdirs onto the load-bearing
-# `/git` and `/git-gate/creds` paths, so per-bottle bare repos + deploy creds
-# survive a gateway-VM rebuild; without it a restart drops every already-running
-# bottle's git-gate state and its agent 404s on fetch/push (issue #512).
-_GATEWAY_GIT_MOUNT = "/var/lib/bot-bottle-gitgate"
-_GATEWAY_GIT_REPO_ROOT = "/git"
-_GATEWAY_GIT_CREDS_DIR = "/git-gate/creds"

 # The two per-plane rootfs source images. The orchestrator VM boots a control
 # plane + buildah rootfs (Dockerfile.orchestrator.fc, FROM orchestrator); the
@@ -207,12 +192,11 @@ def boot_vm(
    run_dir: Path,
    role: str,
    mem_mib: int,
-    data_drives: tuple[Path, ...] = (),
+    data_drive: Path | None = None,
    extra_boot_args: str = "",
 ) -> InfraVm:
    """Boot the `role` infra VM from its per-plane rootfs on `slot`'s link.
-    Records the PID. `data_drives` are attached as /dev/vdb, /dev/vdc, ... in
-    order, so callers must keep the order stable (see `firecracker_vm._config`)."""
+    Records the PID."""
    if not netpool.tap_present(slot.iface):
        die(f"infra link {slot.iface} not present.\n"
            f"    ./cli.py backend setup --backend=firecracker")
@@ -234,7 +218,7 @@ def boot_vm(
        name=name, rootfs=rootfs, tap=slot.iface,
        guest_ip=slot.guest_ip, host_ip=slot.host_ip, pubkey=pubkey,
        run_dir=run_dir, mem_mib=mem_mib, detached=True,
-        data_drives=data_drives, extra_boot_args=boot_args,
+        data_drive=data_drive, extra_boot_args=boot_args,
    )
    _pid_file(run_dir).write_text(str(vm.process.pid))
    return InfraVm(guest_ip=slot.guest_ip, private_key=private_key, vm=vm)
@@ -464,24 +448,6 @@ def _gateway_init() -> str:
    bot-bottle.db (PRD 0070 / #469). If the JWT never arrives, REFUSE to start
    rather than run without auth."""
    return _init_head() + f"""
-# Persistent CA volume (second virtio-block device, /dev/vdb) mounted at
-# mitmproxy's confdir, so the self-generated mitmproxy CA survives gateway-VM
-# rebuilds (issue #450). On first boot the volume is empty and mitmproxy mints a
-# CA into it; every later boot reuses it. Must mount BEFORE the data plane (hence
-# mitmproxy) starts.
-mkdir -p {_GATEWAY_CA_MOUNT}
-mount -t ext4 /dev/vdb {_GATEWAY_CA_MOUNT} 2>/dev/null || true
-# Persistent git-gate volume (/dev/vdc): its git/ + creds/ subdirs are
-# bind-mounted onto the load-bearing /git and /git-gate/creds so per-bottle bare
-# repos + deploy creds survive a gateway-VM rebuild (issue #512). On first boot
-# the volume is empty; the subdirs are created here. Must mount BEFORE the data
-# plane (hence git-http) starts, and before any per-bottle provisioning writes.
-mkdir -p {_GATEWAY_GIT_MOUNT}
-mount -t ext4 /dev/vdc {_GATEWAY_GIT_MOUNT} 2>/dev/null || true
-mkdir -p {_GATEWAY_GIT_MOUNT}/git {_GATEWAY_GIT_MOUNT}/creds
-mkdir -p {_GATEWAY_GIT_REPO_ROOT} {_GATEWAY_GIT_CREDS_DIR}
-mount --bind {_GATEWAY_GIT_MOUNT}/git {_GATEWAY_GIT_REPO_ROOT} 2>/dev/null || true
-mount --bind {_GATEWAY_GIT_MOUNT}/creds {_GATEWAY_GIT_CREDS_DIR} 2>/dev/null || true
 ORCH=$(sed -n 's/.*bb_orch=\\([^ ]*\\).*/\\1/p' /proc/cmdline)
 GW_JWT=""
 i=0
@@ -104,7 +104,7 @@ class FirecrackerOrchestrator(Orchestrator):
        vm = infra_vm.boot_vm(
            name=ORCHESTRATOR_NAME, slot=netpool.orch_slot(),
            run_dir=infra_vm._orch_dir(), role="orchestrator", mem_mib=_ORCH_MEM_MIB,
-            data_drives=(self._ensure_registry_volume(),),
+            data_drive=self._ensure_registry_volume(),
        )
        # Push the host-canonical signing key (the init waits for it before
        # starting the control plane). It comes through the shared provisioning
@@ -252,27 +252,6 @@ cat > "$refs_file"

 zero=0000000000000000000000000000000000000000

-# Phase 0: reject Gitea AGit review refs before scanning or forwarding.
-# A push to refs/for/*, refs/draft/*, or refs/for-review/* asks Gitea to
-# open a pull request backed by a server-managed refs/pull/<n>/head rather
-# than an ordinary refs/heads/* branch. That breaks the git-gate workflow:
-# follow-up commits can't be pushed back through the branch, and Gitea
-# rejects later direct updates to the generated review ref. Fail the whole
-# push here (before any gitleaks scan or upstream forward) so the caller
-# pushes a real branch and opens the PR against it instead. Deletions
-# (new == zero) stay allowed so stale AGit refs can still be cleaned up.
-while IFS=' ' read -r old new ref; do
-  [ -z "$ref" ] && continue
-  [ "$new" = "$zero" ] && continue
-  case "$ref" in
-    refs/for/*|refs/draft/*|refs/for-review/*)
-      echo "git-gate: refusing AGit review ref $ref" >&2
-      echo "git-gate: push to refs/heads/<branch> and open a branch-backed pull request instead" >&2
-      exit 1
-      ;;
-  esac
-done < "$refs_file"
-
 supervise_gitleaks_allow() {
  log_opts=$1
  ref=$2
@@ -113,7 +113,7 @@ _MIGRATIONS = TableMigrations(
        # egress allowlist / routes / git config selected by source IP. The
        # multi-tenant gateway resolves it per request via `attribute`.
        "ALTER TABLE orchestrator_bottles ADD COLUMN policy TEXT NOT NULL DEFAULT ''",
-        # v4 — per-bottle encrypted egress secrets (PRD 0080).
+        # v4 — per-bottle encrypted egress secrets (PRD prd-new-secret-provider).
        # One row per env-var: key (env-var name) is plaintext for auditing;
        # value is the encrypted token string. The encryption key (ENV_VAR_SECRET)
        # lives only in the agent's environment — a row alone cannot recover the
@@ -1,4 +1,4 @@
-"""Symmetric encryption for per-bottle egress secrets (PRD 0080).
+"""Symmetric encryption for per-bottle egress secrets (PRD prd-new-secret-provider).

 Each agent receives a random ENV_VAR_SECRET at startup — passed as an env var,
 never logged or persisted. The host uses this key to encrypt each egress auth
@@ -53,15 +53,6 @@ ORCHESTRATOR_AUTH_JWT_ENV = "BOT_BOTTLE_ORCHESTRATOR_AUTH_JWT"
 # the shared gateway's TLS interception, so it must not rotate on restart. See
 # host_gateway_ca_dir() for why this is a host bind-mount, not a named volume.
 GATEWAY_CA_DIRNAME = "gateway-ca"
-# The host directories holding the gateway's persistent git-gate state — the
-# per-bottle bare repos (`gateway-git`) and deploy creds (`gateway-creds`).
-# Bind-mounted into the gateway container at /git and /git-gate/creds so they
-# survive container recreation; without it a gateway restart drops every
-# already-running bottle's git-gate state and its agent 404s on fetch/push
-# (issue #512). Host bind-mounts (not named volumes) for the same reason as the
-# CA dir — see host_gateway_ca_dir().
-GATEWAY_GIT_DIRNAME = "gateway-git"
-GATEWAY_CREDS_DIRNAME = "gateway-creds"


 def bot_bottle_root() -> Path:
@@ -106,27 +97,6 @@ def host_gateway_ca_dir() -> Path:
    return ca_dir


-def host_gateway_git_dir() -> Path:
-    """The directory holding the gateway's persistent per-bottle bare repos,
-    created if missing. Bind-mounted into the gateway container at /git so the
-    repos survive container recreation (issue #512). A host bind-mount under the
-    app-data root, never pruned — same rationale as host_gateway_ca_dir()."""
-    git_dir = bot_bottle_root() / GATEWAY_GIT_DIRNAME
-    git_dir.mkdir(parents=True, exist_ok=True)
-    return git_dir
-
-
-def host_gateway_creds_dir() -> Path:
-    """The directory holding the gateway's persistent per-bottle git-gate deploy
-    creds, created if missing. Bind-mounted into the gateway container at
-    /git-gate/creds so the creds survive container recreation (issue #512). A
-    host bind-mount under the app-data root — same rationale as
-    host_gateway_ca_dir()."""
-    creds_dir = bot_bottle_root() / GATEWAY_CREDS_DIRNAME
-    creds_dir.mkdir(parents=True, exist_ok=True)
-    return creds_dir
-
-
 def host_signing_key(filename: str) -> str:
    """A per-host signing key at `<root>/<filename>`, minted (256-bit, url-safe)
    and persisted 0600 on first use, then reused.
@@ -173,14 +143,10 @@ __all__ = [
    "ORCHESTRATOR_TOKEN_ENV",
    "ORCHESTRATOR_AUTH_JWT_ENV",
    "GATEWAY_CA_DIRNAME",
-    "GATEWAY_GIT_DIRNAME",
-    "GATEWAY_CREDS_DIRNAME",
    "bot_bottle_root",
    "host_db_path",
    "host_db_dir",
    "host_gateway_ca_dir",
-    "host_gateway_git_dir",
-    "host_gateway_creds_dir",
    "host_signing_key",
    "host_orchestrator_token",
 ]
@@ -7,7 +7,6 @@ picking the right document for what you're capturing.

 | Artifact | For |
 |---|---|
-| **Design workflow** (`docs/design-workflow.md`) | How discussion becomes canonical design, how dependencies are recorded, and when implementation may begin. |
 | **Glossary** (`docs/glossary.md`) | Canonical term definitions — what words mean in this project. |
 | **PRD** (`docs/prds/`) | A feature: what to build, scope, success criteria. |
 | **Research note** (`docs/research/`) | A landscape/tradeoff investigation. |
@@ -1,53 +1,50 @@
 # CI

-## Required pull-request gate
+The test workflow lives at [`.gitea/workflows/test.yml`](../.gitea/workflows/test.yml).
+It runs the unit suite plus one integration job per backend
+(`integration-docker`, `integration-firecracker`, `integration-macos`) on:

-[`.gitea/workflows/test.yml`](../.gitea/workflows/test.yml) runs the unit
-suite, Docker integration suite, combined coverage report, and diff-coverage
-gate when tested package/build inputs change on a pull request or on `main`.
+- every push to a branch with an open pull request, and
+- every push to `main`.

-The Docker job preflights the backend before discovery. Gitea's `act_runner`
-runs the job in a container with the host Docker socket, so the test process
-reaches control-plane siblings through the job's Docker network and uses named
-Docker volumes for orchestrator/CA state the host daemon must mount. The
-orchestrator runs the package baked into the image built from the checkout; it
-does not bind the job container's invisible workspace into a sibling container.
-Docker integration jobs share fixed singleton names, so required and manual
-runs use one non-cancelling concurrency group. The shared agent/gateway network
-has an explicit subnet, which Docker requires for the pinned source IPs used as
-the isolation/attribution key.
+`integration-macos` is the exception: it is **advisory**, running only on
+`workflow_dispatch` (manual dispatch), never on push or pull requests. It targets the
+Apple Container backend on a self-hosted macOS runner (label `macos`,
+registered in host mode — Apple Container can't run in a Linux container, so it
+can't reuse the `kvm` runner). A single non-redundant laptop must not be able
+to block a PR merge, so the job stays out of the `coverage` job's `needs` and
+its coverage never feeds the diff-coverage gate. Because the infra container is
+a singleton (`bot-bottle-mac-infra`), the job declares a `concurrency` group
+and tears the container down on exit; keep runner concurrency at 1. See the
+README "macOS Apple Container" CI note for runner provisioning.

-`scripts.unittest_gate` enforces the Docker job's contract: all 22 integration
-tests must execute and none may skip. This includes the real gateway-image,
-control-plane authentication, multitenant policy/token isolation,
-sandbox-escape, and orphan-network tests. Backend skip decorators remain useful
-for local runs, but the CI preflight plus execution-count gate prevents a
-missing backend or runner-topology regression from becoming a green job.
+Each integration job selects its backend via `BOT_BOTTLE_BACKEND` and
+runs a **preflight** (`./cli.py backend status --backend=<name>`) that
+prints a clear per-check readiness summary and fails the job when the
+backend is missing — so absent infrastructure is visible at the job level
+rather than hidden among per-test `unittest.skip` lines. The skip guards in
+[`tests/_backend.py`](../tests/_backend.py) gate on the same readiness
+check (`bot_bottle.backend.has_backend`): backend-agnostic tests use
+`skip_unless_selected_backend_available()` and run through whichever
+backend is selected (checking, e.g., Linux + `/dev/kvm` for Firecracker
+rather than unrelated Docker availability); Docker-implementation tests use
+`skip_unless_backend("docker")` and no-op under a non-Docker run.

-Combined unit + Docker coverage is informational globally. Two focused gates
-are enforced:
+A small subset of integration tests skip when running specifically
+under Gitea Actions (`GITEA_ACTIONS=true`), because `act_runner` runs
+the job inside a container with the host's `/var/run/docker.sock`
+mounted in. That topology breaks two assumptions those tests make:

- changed executable Python lines must be at least 90% covered; and
- the validated critical security/logic core must remain at least 90% covered.
+- networks created via the host daemon aren't always visible to a
+  same-process `docker network ls` call from inside the job container,
+  and
+- ports published by sibling containers land on the host's loopback,
+  not on the job container's `127.0.0.1` — so HTTP probes against
+  `http://127.0.0.1:<host_port>` from inside the job time out.

-## Privileged pre-release matrix
-
-[`.gitea/workflows/pre-release-test.yml`](../.gitea/workflows/pre-release-test.yml)
-is manually dispatched before a release. It repeats unit and Docker integration
-coverage, then runs:
-
- Firecracker integration on the self-hosted `kvm` runner; and
- advisory Apple Container integration on the self-hosted `macos` runner.
-
-These privileged host-mode runners never execute unreviewed pull-request code
-automatically. Firecracker coverage is combined in the manual pre-release
-report; macOS reports advisory coverage in its own job. The macOS infra
-container is a singleton, so its job uses a concurrency group and always tears
-the service down.
-
-## Scheduled canary
-
-[`.gitea/workflows/canaries.yml`](../.gitea/workflows/canaries.yml) runs weekly
-and on manual dispatch. It verifies the pinned gitleaks release URL, checksum,
-archive shape, and executable. The same unittest execution gate requires at
-least one executed canary and rejects skips.
+The affected tests (`test_orphan_cleanup.test_create_and_remove`,
+`test_gateway_image.TestGatewayImage`) still run
+locally where the test process and Docker daemon share a host.
+Making them work in CI is a follow-up: either re-write them to
+discover container IPs via `docker inspect`, or reconfigure the
+runner with host networking.
@@ -34,13 +34,12 @@ a regression (Goodhart's law).
 Coverage is **risk-weighted**, measured over the **combined unit +
 integration** suites, with three rules:

-1. **Critical modules must remain ≥ 90%.** The curated security/logic core
-   covers the host and gateway egress policy, manifest trust boundary,
-   git-gate enforcement, supervise protocol/server, YAML parser, and bottle
-   state. The concrete module list lives in `scripts/critical-modules.txt`;
-   `scripts/critical_modules.py` rejects stale or ambiguous entries before
-   Coverage.py can silently ignore them. These modules are unit-testable, so
-   CI enforces the aggregate minimum independently of diff coverage.
+1. **Critical modules target ≥ 90%.** The security/logic core —
+   `egress_addon{,_core}.py`, `dlp_detectors.py`, `egress.py`,
+   `manifest*.py`, `git_gate.py`, `git_http_backend.py`, `supervise.py`,
+   `yaml_subset.py`, `bottle_state.py` — is Docker-independent and
+   unit-testable, so it carries the high bar. We ratchet toward 90% as
+   these modules are touched; new gaps in them are not acceptable.

 2. **Subprocess/backend orchestration is covered by the integration
   suite, not omitted.** `scripts/coverage.sh` runs unit + integration
@@ -83,9 +82,6 @@ omit list.
  (critical-module standard + diff coverage) are Docker-independent.
 - "We're at N%" is now a curated figure; outsiders should read the
  policy, not just the badge.
- A rename or removal in the curated list fails CI. Updating the list is an
-  explicit review of where the security-critical behavior moved, not a way to
-  improve the percentage by omission.

 ## Links

@@ -1,13 +1,9 @@
-# ADR 0005: Keep tracker metadata on one tracker object
+# ADR 0005: Keep tracker metadata on issues

 - **Status:** Accepted
 - **Date:** 2026-07-18
 - **Deciders:** didericis

-> **Amended 2026-07-26.** A pull request may carry labels directly instead of
-> linking a tracking issue. When a PR does link an issue, the issue remains the
-> canonical owner of planning metadata and the reference is validated.
-
 ## Context

 Gitea exposes labels on both issues and pull requests. Applying the same labels
@@ -24,29 +20,19 @@ would make the issue history less truthful.

 ## Decision

-Issues are the canonical tracker records and own labels when a separate work
-item exists. Every issue has at least one label. An issue opened or left
-without labels receives `Status/Needs Triage` automatically until it is
-classified.
+Issues are the canonical tracker records and own labels. Every issue has at
+least one label. An issue opened or left without labels receives
+`Status/Needs Triage` automatically until it is classified.

-Every new pull request is tracked in exactly one of two mutually exclusive
-ways:
-
-1. It deliberately references at least one existing issue in its title or
-   description. Tracker metadata stays on that issue and the PR remains
-   unlabelled.
-2. It carries at least one label directly when a separate issue would add no
-   useful planning context.
-
-Issue references use one of these forms:
+Pull requests carry no labels. Every new PR deliberately references at least
+one existing issue in its title or description with one of these forms:

 - `Closes #123`, `Fixes #123`, or `Resolves #123` when merging completes it.
 - `Part of #123`, `Related to #123`, `Refs #123`, or `References #123` when it
  contributes without completing it.

-Gitea Actions enforces the exclusive either/or PR rule, validates any issue
-references, and repairs the empty issue-label state. Branch protection makes
-the PR policy check required.
+Gitea Actions enforces both PR rules as a status check and repairs the empty
+issue-label state. Branch protection makes the PR policy check required.

 The policy applies from 2026-07-18 onward. Existing issues may be labelled as
 they are encountered, but closed PRs are grandfathered: no retrospective
@@ -54,13 +40,9 @@ issues or PR labels are created solely to make history conform.

 ## Consequences

- Classification, priority, and workflow metadata have one source of truth for
-  each change: the linked issue when one exists, otherwise the PR.
- For issue-backed changes, the PR's issue link is the navigation path to its
-  planning metadata.
+- Classification, priority, and workflow metadata have one source of truth.
+- A PR's issue link is the navigation path to its planning metadata.
 - Multi-PR issues do not require copied or synchronized labels.
- Small standalone changes do not require a tracking issue created solely to
-  satisfy automation.
 - `Status/Needs Triage` is an intentional fallback, not a final
  classification.
 - Direct issue creation remains convenient; automation repairs a missing label
@@ -71,6 +53,5 @@ issues or PR labels are created solely to make history conform.
 ## Links

 - Issue #405.
- `.gitea/workflows/tracker-policy-pr.yml`.
- `.gitea/workflows/tracker-policy-issues.yml`.
+- `.gitea/workflows/tracker-policy.yml`.
 - `scripts/tracker_policy.py`.
@@ -1,218 +0,0 @@
-# Design workflow
-
-How bot-bottle turns discussion into canonical design and then into
-implementation without leaving the repository's architecture scattered across
-issue and review threads.
-
-The goal is not more documentation. The goal is one discoverable current answer
-for every load-bearing design question.
-
-## Sources of truth
-
-Design artifacts have different jobs:
-
-| Artifact | Authority |
-|---|---|
-| Decision records | Stable system-wide boundaries, policies, and invariants |
-| PRDs | The current design for a feature |
-| Research notes | Evidence and tradeoff analysis; informative, not normative |
-| Issues | Work tracking, open questions, and discussion |
-| Pull-request comments | Review history; never the final home of a design decision |
-
-When a discussion changes the design, update the relevant PRD or decision
-record before treating the discussion as resolved. A comment may explain why a
-decision changed, but future implementers must not need to reconstruct the
-decision from a thread.
-
-Avoid duplicating the same rule in several canonical documents. Prefer one
-canonical statement and links from dependent documents.
-
-## Choosing the canonical artifact
-
-Use a PRD when the decision describes a feature: its behavior, scope, success
-criteria, trust model, implementation slices, and tests.
-
-Use a decision record when the choice is broader than one feature or will
-constrain several future features. Examples include state ownership, credential
-boundaries, compatibility policy, and what the project does or does not claim
-as a security guarantee.
-
-Use a research note when the conclusion depends on comparing external systems,
-protocols, or approaches. Promote any resulting project decision into a PRD or
-decision record.
-
-## From discussion to implementation
-
-### 1. Open the design discussion
-
-An issue may start with incomplete requirements. Record:
-
- the problem and desired outcome;
- known security or compatibility constraints;
- the current owner of affected state and credentials;
- related PRDs, decisions, issues, and pull requests;
- open questions that would materially change the implementation.
-
-Do not disguise an unresolved trust-boundary or state-ownership decision as an
-implementation detail.
-
-### 2. Draft or update the canonical design
-
-Before substantial implementation, write the feature PRD and update any
-system-wide decision it changes.
-
-An active design should make these relationships visible near its top:
-
-```markdown
-Status: Draft | Active | Superseded | Retargeted
-Depends on: #...
-Supersedes: ...
-```
-
-Record dependencies only on the dependent document. Do not maintain reverse
-`Blocks` lists that can drift as dependent work changes.
-
-For security-sensitive work, state:
-
- the exact guarantee and explicit non-guarantees;
- trusted and untrusted components;
- who creates each identity or attribution field;
- who owns durable state;
- failure and recovery behavior;
- how the design is tested at its boundaries.
-
-### 3. Resolve review into the repository
-
-When review settles a design-changing question:
-
-1. Update the canonical document in the same pull request.
-2. Mark conflicting documents Superseded or Retargeted, or update them.
-3. Add or adjust dependency links.
-4. Leave a concise resolution comment linking to the canonical change.
-
-A useful resolution comment is:
-
-```text
-Resolution: <what was decided>
-Canonicalized in: <document/section/commit>
-Supersedes: <older statement, if any>
-Follow-up: <remaining implementation or question>
-```
-
-The resolution is incomplete until the repository reflects it.
-
-### 4. Check design readiness
-
-Implementation may begin when:
-
- the PRD's material trust, ownership, and compatibility questions are settled;
- dependencies and blockers are explicit;
- the design agrees with current architecture and decision records;
- superseded documents are marked or updated;
- success criteria and boundary tests are concrete;
- remaining open questions can be answered during implementation without
-  changing the feature's guarantee or component ownership.
-
-Small exploratory spikes may happen earlier. A spike proves feasibility; it does
-not establish a production contract or silently settle the design.
-
-### 5. Implement in ordered slices
-
-Prefer small, independently reviewable slices after the parent design is
-accepted. Record the dependency chain explicitly.
-
-Parallel work is safe when slices do not compete for the same unsettled
-interface or ownership boundary. If a foundational change will alter the
-transport, schema, state owner, or trust domain used by another slice, land the
-foundation first.
-
-An implementation pull request should identify:
-
- the PRD or decision it implements;
- the implementation chunk;
- its base and blockers;
- any design deviation discovered during implementation.
-
-If implementation reveals a load-bearing design change, pause that slice and
-update the canonical design. Do not let the code and review thread become an
-undocumented replacement for the PRD.
-
-## Dependency and staleness management
-
-### Dependency direction
-
-Write dependencies in terms of contracts, not chronology:
-
-```text
-credential provisioning contract
-  -> host-controller authentication
-    -> privileged host operations
-```
-
-If only part of a feature is blocked, say so. For example, a manifest parser may
-proceed while that feature's durable audit-storage chunk waits for the canonical
-audit schema.
-
-### Superseding documents
-
-Do not silently edit history to make an old design appear to have always said
-the new thing. Preserve the rationale, but make current status unmistakable:
-
-```markdown
-Status: Superseded
-Superseded by: <document>
-Reason: <one paragraph>
-```
-
-If part of a PRD remains valid, mark it Retargeted and identify which scope moved
-elsewhere.
-
-Add a short supersession note near the top explaining what changed, why the old
-design is no longer current, and where the current design lives. For a research
-note whose original analysis remains useful, preserve that analysis and append
-a dated addendum with the newer finding instead of rewriting the note as though
-it had always reached the new conclusion.
-
-### Architecture sweeps
-
-After a foundational change, do a targeted architecture sweep before building
-more features on it:
-
-1. Identify the concepts the change affects, such as `bot-bottle.db`, host
-   controller, orchestrator, audit ownership, or signing key.
-2. Search active PRDs, decisions, and open issues for those concepts.
-3. Update or supersede contradictory statements.
-4. Refresh dependency links and the current architecture summary.
-5. Confirm stacked implementation branches still have the correct base.
-
-This is a milestone activity, not a recurring documentation ceremony.
-
-## Pull-request checklist
-
-Use the relevant items in design and implementation pull requests:
-
- [ ] The canonical PRD or decision is linked.
- [ ] Design-changing review decisions are reflected in-repo.
- [ ] Dependencies and blockers are explicit.
- [ ] State, credential, and trust ownership agree with current architecture.
- [ ] Superseded or retargeted documents are marked.
- [ ] Security guarantees and non-guarantees are precise.
- [ ] Open questions do not change the promised guarantee or ownership model.
- [ ] Implementation deviations updated the canonical design.
-
-## Lightweight maintenance
-
-Automation should enforce document shape, not pretend to understand
-architecture. Useful checks include:
-
- active PRDs contain status and dependency metadata;
- superseded PRDs link to their replacement;
- referenced documents and issues exist;
- implementation pull requests identify their PRD and chunk;
- document filenames and lifecycle states follow repository conventions.
-
-Human review remains responsible for detecting conflicting guarantees or
-ownership claims.
-
-The durable rule is simple: **discussion discovers the decision; the repository
-records it; implementation follows it.**
@@ -4,11 +4,6 @@
 - **Author:** didericis
 - **Created:** 2026-05-26

-> **Superseded.** PRD 0049 removed the active-agents pane and agent-scoped
-> operator edit verbs when the dashboard was narrowed back to a proposal-only
-> supervise TUI. A future agent-management surface was deferred rather than
-> carried forward from this design. The design below is retained as history.
-
 ## Summary

 The dashboard today is proposal-centric: it lists every pending
@@ -4,11 +4,6 @@
 - **Author:** didericis
 - **Created:** 2026-05-26

-> **Superseded.** PRD 0049 removed start, re-attach, and stop actions from the
-> dashboard when it became the proposal-only supervise TUI. Bottle lifecycle
-> remains in the dedicated CLI commands; no dashboard replacement from this
-> design remains active. The design below is retained as history.
-
 ## Summary

 Today the dashboard is read-only: it surfaces pending proposals
@@ -4,11 +4,6 @@
 - **Author:** didericis
 - **Created:** 2026-05-26

-> **Superseded.** PRD 0049 removed agent handoff and tmux pane management when
-> the dashboard was reduced to the proposal-only supervise TUI. The split-pane
-> interaction described below has no active replacement and is retained only
-> as design history.
-
 ## Summary

 When the dashboard runs inside tmux, lay it out as the **left
@@ -7,13 +7,10 @@ document vs. a research note or a decision record).

 ## Naming and numbering

-New PRDs may use a `prd-new-<kebab-title>.md` placeholder name while the
-design is being drafted. Before merge, assign the next sequential number
-after the highest-numbered PRD on `main`, rename the file to
-`NNNN-<kebab-title>.md`, and update the title header. CI blocks merging
-while any `prd-new-*.md` placeholder remains. If concurrent PRs select the
-same number, the later PR must take the next available number before it
-merges. Numbers are never reused; gaps are fine.
+New PRDs use a `prd-new-<kebab-title>.md` placeholder name while the PR
+is open. On merge to `main` a CI workflow assigns the next sequential
+number (`0024-…`, `0025-…`), renames the file, and updates the title
+header. Numbers are never reused; gaps are fine.

 Once numbered, the filename stays fixed for the life of the doc.

@@ -29,7 +26,7 @@ The `Status:` line near the top tracks the PRD's lifecycle:
 ## Format

 ```markdown
-# PRD prd-new: <short title>    ← replace with the final number before merge
+# PRD prd-new: <short title>    ← placeholder; CI fills in the number on merge

 - **Status:** Draft
 - **Author:** <who>
@@ -1,4 +1,4 @@
-# PRD 0080: Encrypted at-rest egress secrets (SecretProvider, interim slice)
+# PRD prd-new: Encrypted at-rest egress secrets (SecretProvider, interim slice)

 - **Status:** Draft
 - **Author:** didericis
@@ -20,10 +20,10 @@ cd "$(dirname "$0")/.."

 PY="${PYTHON:-python3}"

-# Critical security/logic core held to the high bar by ADR 0004. The helper
-# fails before coverage when a curated path was renamed or removed; Coverage.py
-# itself would silently ignore that stale include and inflate the score.
-CRITICAL=$("$PY" scripts/critical_modules.py)
+# Critical security/logic core held to the high bar by ADR 0004. The list
+# lives in one place (scripts/critical-modules.txt) so this report and the
+# README "core coverage" badge can't drift; comma-join it for --include.
+CRITICAL=$(grep -vE '^[[:space:]]*(#|$)' scripts/critical-modules.txt | paste -sd, -)

 if [ "${1:-}" = "aggregate" ]; then
    # Aggregate mode: combine .coverage.* artifacts already in the workspace.
@@ -34,8 +34,8 @@ if [ "${1:-}" = "aggregate" ]; then
    "$PY" -m coverage report -m

    if [ "${2:-}" = "critical" ]; then
-        echo "== critical modules (ADR 0004 minimum: 90%) ==" >&2
-        "$PY" -m coverage report --include="$CRITICAL" --fail-under=90
+        echo "== critical modules (ADR 0004 target: 90%) ==" >&2
+        "$PY" -m coverage report --include="$CRITICAL"
    fi
    exit 0
 fi
@@ -55,6 +55,6 @@ echo "== combined report ==" >&2
 "$PY" -m coverage report -m

 if [ "${1:-}" = "critical" ]; then
-    echo "== critical modules (ADR 0004 minimum: 90%) ==" >&2
-    "$PY" -m coverage report --include="$CRITICAL" --fail-under=90
+    echo "== critical modules (ADR 0004 target: 90%) ==" >&2
+    "$PY" -m coverage report --include="$CRITICAL"
 fi
@@ -7,48 +7,19 @@
 # number that silently stops measuring a module is worse than no badge.
 #
 # One module path per line, relative to the repo root. Blank lines and
-# `#` comments are ignored. scripts/critical_modules.py rejects missing,
-# duplicate, non-Python, and out-of-repository entries before coverage runs.
-
-# Host-side egress planning and secret preparation.
-bot_bottle/egress/plan.py
-bot_bottle/egress/service.py
-
-# Gateway egress policy, matching, and DLP enforcement.
+# `#` comments are ignored.
 bot_bottle/gateway/egress/addon.py
 bot_bottle/gateway/egress/addon_core.py
-bot_bottle/gateway/egress/context.py
-bot_bottle/gateway/egress/dlp.py
-bot_bottle/gateway/egress/dlp_config.py
 bot_bottle/gateway/egress/dlp_detectors.py
-bot_bottle/gateway/egress/matching.py
-bot_bottle/gateway/egress/schema.py
-bot_bottle/gateway/egress/types.py
-
-# Manifest trust boundary and schema.
-bot_bottle/manifest/agent.py
-bot_bottle/manifest/bottle.py
-bot_bottle/manifest/egress.py
-bot_bottle/manifest/extends.py
-bot_bottle/manifest/git.py
-bot_bottle/manifest/index.py
-bot_bottle/manifest/loader.py
-bot_bottle/manifest/schema.py
-bot_bottle/manifest/util.py
-
-# Host-side and gateway-side git policy enforcement.
-bot_bottle/git_gate/host_key.py
-bot_bottle/git_gate/plan.py
-bot_bottle/git_gate/provision.py
-bot_bottle/git_gate/service.py
+bot_bottle/egress.py
+bot_bottle/manifest.py
+bot_bottle/manifest_egress.py
+bot_bottle/manifest_agent.py
+bot_bottle/manifest_schema.py
+bot_bottle/git_gate.py
 bot_bottle/gateway/git_gate/render.py
+bot_bottle/git_gate_provision.py
 bot_bottle/gateway/git_gate/http_backend.py
-
-# Supervise proposal protocol and data plane.
-bot_bottle/supervisor/plan.py
-bot_bottle/supervisor/types.py
-bot_bottle/gateway/supervisor/server.py
-
-# Shared parsers and state validation.
+bot_bottle/supervise.py
 bot_bottle/yaml_subset.py
 bot_bottle/bottle_state.py
@@ -1,101 +0,0 @@
-#!/usr/bin/env python3
-"""Validate and render the critical-module coverage manifest.
-
-Coverage.py silently ignores an ``--include`` path that does not exist.  That
-is useful for broad globs, but dangerous for bot-bottle's curated security
-core: a rename could otherwise improve the reported percentage by removing a
-module from the measurement.  Keep the validation in one small stdlib helper
-and make every coverage consumer call it.
-"""
-
-from __future__ import annotations
-
-import argparse
-import sys
-from pathlib import Path
-
-
-REPO_ROOT = Path(__file__).resolve().parents[1]
-DEFAULT_MANIFEST = REPO_ROOT / "scripts" / "critical-modules.txt"
-
-
-class CriticalModulesError(ValueError):
-    """The critical-module manifest is empty, ambiguous, or stale."""
-
-
-def load_critical_modules(manifest: Path, *, root: Path) -> list[str]:
-    """Return validated module paths relative to *root*.
-
-    Entries must be unique, concrete Python files inside the repository.
-    Globs are deliberately rejected by the file check: each rename must update
-    this explicit security review surface.
-    """
-
-    root = root.resolve()
-    try:
-        lines = manifest.read_text(encoding="utf-8").splitlines()
-    except OSError as exc:
-        raise CriticalModulesError(
-            f"cannot read critical-module manifest {manifest}: {exc}"
-        ) from exc
-
-    modules: list[str] = []
-    seen: set[str] = set()
-    errors: list[str] = []
-    for line_number, raw in enumerate(lines, start=1):
-        entry = raw.strip()
-        if not entry or entry.startswith("#"):
-            continue
-        path = Path(entry)
-        prefix = f"{manifest}:{line_number}: {entry!r}"
-        if path.is_absolute():
-            errors.append(f"{prefix} must be relative to the repository root")
-            continue
-        try:
-            resolved = (root / path).resolve()
-            resolved.relative_to(root)
-        except ValueError:
-            errors.append(f"{prefix} escapes the repository root")
-            continue
-        if entry in seen:
-            errors.append(f"{prefix} is duplicated")
-            continue
-        seen.add(entry)
-        if path.suffix != ".py":
-            errors.append(f"{prefix} is not a Python module")
-            continue
-        if not resolved.is_file():
-            errors.append(f"{prefix} does not exist")
-            continue
-        modules.append(path.as_posix())
-
-    if not modules and not errors:
-        errors.append(f"{manifest}: contains no critical modules")
-    if errors:
-        raise CriticalModulesError("\n".join(errors))
-    return modules
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser(
-        description="validate and print the critical coverage include list"
-    )
-    parser.add_argument("--manifest", type=Path, default=DEFAULT_MANIFEST)
-    parser.add_argument("--root", type=Path, default=REPO_ROOT)
-    parser.add_argument(
-        "--check", action="store_true",
-        help="validate only; do not print the comma-separated include list",
-    )
-    args = parser.parse_args(argv)
-    try:
-        modules = load_critical_modules(args.manifest, root=args.root)
-    except CriticalModulesError as exc:
-        print(f"critical-modules: {exc}", file=sys.stderr)
-        return 1
-    if not args.check:
-        print(",".join(modules))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -54,20 +54,18 @@ def check_pull_request(event: dict[str, Any], api: GiteaApi) -> list[str]:
    pull = event["pull_request"]
    errors: list[str] = []
    labels = pull.get("labels") or []
-    numbers = deliberate_issue_numbers(pull.get("title", ""), pull.get("body", ""))
-    if labels and numbers:
+    if labels:
        errors.append(
-            "PR must use exactly one tracking mode: remove PR labels when "
-            "linking an issue, or remove the issue reference when labels "
-            "belong on the PR."
+            "PRs must be unlabeled; put tracker metadata on the linked issue "
+            f"(found: {', '.join(label['name'] for label in labels)})."
        )
+
+    numbers = deliberate_issue_numbers(pull.get("title", ""), pull.get("body", ""))
    if not numbers:
-        if not labels:
-            errors.append(
-                "PR must either have a label or reference an issue with "
-                "Closes/Fixes/Resolves #N, Part of #N, Related to #N, "
-                "Refs #N, or References #N."
-            )
+        errors.append(
+            "PR must reference an issue with Closes/Fixes/Resolves #N, "
+            "Part of #N, Related to #N, Refs #N, or References #N."
+        )
        return errors

    real_issues = 0
@@ -1,67 +0,0 @@
-#!/usr/bin/env python3
-"""Run unittest discovery with explicit execution-count assurances.
-
-The standard unittest CLI exits successfully when a suite contains skipped
-tests. That is normally useful, but it let the Docker integration job stay
-green while its security-boundary classes were all skipped under act_runner.
-This wrapper keeps normal unittest output and adds opt-in minimum-executed and
-no-skip gates for jobs that promise a concrete integration surface.
-"""
-
-from __future__ import annotations
-
-import argparse
-import sys
-import unittest
-
-
-def assurance_errors(
-    *, tests_run: int, skipped: int, minimum_executed: int, fail_on_skip: bool
-) -> list[str]:
-    """Return human-readable assurance failures for a completed suite."""
-
-    executed = tests_run - skipped
-    errors: list[str] = []
-    if executed < minimum_executed:
-        errors.append(
-            f"executed {executed} test(s), below required minimum "
-            f"{minimum_executed} (discovered {tests_run}, skipped {skipped})"
-        )
-    if fail_on_skip and skipped:
-        errors.append(f"{skipped} test(s) skipped in a no-skip suite")
-    return errors
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser(
-        description="unittest discovery with execution-count assurance"
-    )
-    parser.add_argument("-s", "--start-directory", default=".")
-    parser.add_argument("-t", "--top-level-directory", default=None)
-    parser.add_argument("-p", "--pattern", default="test*.py")
-    parser.add_argument("--minimum-executed", type=int, default=0)
-    parser.add_argument("--fail-on-skip", action="store_true")
-    parser.add_argument("-v", "--verbose", action="store_true")
-    args = parser.parse_args(argv)
-
-    suite = unittest.defaultTestLoader.discover(
-        args.start_directory,
-        pattern=args.pattern,
-        top_level_dir=args.top_level_directory,
-    )
-    result = unittest.TextTestRunner(
-        verbosity=2 if args.verbose else 1,
-    ).run(suite)
-    failures = assurance_errors(
-        tests_run=result.testsRun,
-        skipped=len(result.skipped),
-        minimum_executed=args.minimum_executed,
-        fail_on_skip=args.fail_on_skip,
-    )
-    for failure in failures:
-        print(f"unittest-gate: {failure}", file=sys.stderr)
-    return 0 if result.wasSuccessful() and not failures else 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -20,11 +20,10 @@ tests/
    ...                             # many others; see unit/ directory
  integration/
    test_gateway_image.py
-    test_sandbox_escape.py
+    test_dry_run_plan.py
    test_orphan_cleanup.py
    ...
-  canaries/
-    test_gitleaks_release.py        # opt-in upstream artifact check
+  canaries/                         # opt-in; see below (currently empty)
 ```

 Classification falls out of the directory — no hand-maintained list to
@@ -44,27 +43,24 @@ Discovery is invoked with `-t .` (top-level dir = repo root) so the

 ## What the integration tests cover

+- `test_dry_run_plan.py` — `cli.py start --dry-run --format=json` emits
+  a structured plan that contains the resolved egress allowlist and
+  the bottle's runtime, and creates zero Docker resources.
 - `test_orphan_cleanup.py` — `network_remove` is idempotent against
  missing resources, so the EXIT trap can call it unconditionally.
 - `test_gateway_image.py` — builds Dockerfile.gateway and
  probes that gitleaks / mitmdump / supervise are all reachable
  inside the gateway image.
- `test_orchestrator_docker_auth.py` — drives the real control-plane
-  container and verifies role-scoped authentication.
- `test_multitenant_isolation.py` and `test_sandbox_escape.py` — exercise
-  token/allowlist separation and end-to-end escape attempts.

 ## Canaries

 `tests/canaries/` holds upstream-regression checks gated on
 `BOT_BOTTLE_RUN_CANARIES=1` and not part of the per-push suite.
-They're invoked by the scheduled `canaries` workflow. The gitleaks canary
-downloads the exact release archive pinned by `Dockerfile.gateway`, verifies
-its architecture-specific checksum, and executes the binary.
+They're invoked by the scheduled `canaries` workflow. Currently
+no canaries are defined.

 ```bash
-BOT_BOTTLE_RUN_CANARIES=1 python -m scripts.unittest_gate \
-  -t . -s tests/canaries -v --minimum-executed 1 --fail-on-skip
+BOT_BOTTLE_RUN_CANARIES=1 python -m unittest discover -t . -s tests/canaries -v
 ```

 ## What's NOT covered
@@ -1,85 +0,0 @@
-"""Canary: the pinned gitleaks release remains downloadable and executable.
-
-The gateway Dockerfile verifies this archive during an image build. Repeating
-the upstream check weekly keeps registry/release drift out of normal pull
-requests while proving that the pinned URL, architecture checksum, archive
-shape, and binary still agree.
-"""
-
-from __future__ import annotations
-
-import hashlib
-import os
-import platform
-import re
-import subprocess
-import tarfile
-import tempfile
-import unittest
-import urllib.request
-from pathlib import Path
-
-
-ROOT = Path(__file__).resolve().parents[2]
-DOCKERFILE = ROOT / "Dockerfile.gateway"
-
-
-def _docker_arg(text: str, name: str) -> str:
-    match = re.search(rf"^ARG {re.escape(name)}=(\S+)$", text, re.MULTILINE)
-    if match is None:
-        raise AssertionError(f"Dockerfile.gateway has no concrete ARG {name}")
-    return match.group(1)
-
-
-@unittest.skipUnless(
-    os.environ.get("BOT_BOTTLE_RUN_CANARIES") == "1",
-    "canary suite is opt-in; set BOT_BOTTLE_RUN_CANARIES=1 to run",
-)
-class TestGitleaksRelease(unittest.TestCase):
-    def test_pinned_archive_checksum_and_binary(self) -> None:
-        dockerfile = DOCKERFILE.read_text(encoding="utf-8")
-        version = _docker_arg(dockerfile, "GITLEAKS_VERSION")
-        machine = platform.machine().lower()
-        architectures = {
-            "x86_64": ("linux_x64", "GITLEAKS_SHA256_AMD64"),
-            "amd64": ("linux_x64", "GITLEAKS_SHA256_AMD64"),
-            "aarch64": ("linux_arm64", "GITLEAKS_SHA256_ARM64"),
-            "arm64": ("linux_arm64", "GITLEAKS_SHA256_ARM64"),
-        }
-        if machine not in architectures:
-            self.fail(f"unsupported canary runner architecture: {machine}")
-        asset, checksum_arg = architectures[machine]
-        expected_checksum = _docker_arg(dockerfile, checksum_arg)
-        url = (
-            "https://github.com/gitleaks/gitleaks/releases/download/"
-            f"v{version}/gitleaks_{version}_{asset}.tar.gz"
-        )
-
-        with tempfile.TemporaryDirectory(prefix="bot-bottle-gitleaks-canary.") as tmp:
-            archive = Path(tmp) / "gitleaks.tar.gz"
-            urllib.request.urlretrieve(url, archive)
-            self.assertEqual(
-                expected_checksum,
-                hashlib.sha256(archive.read_bytes()).hexdigest(),
-                "the pinned upstream archive no longer matches Dockerfile.gateway",
-            )
-            with tarfile.open(archive, "r:gz") as bundle:
-                member = bundle.getmember("gitleaks")
-                source = bundle.extractfile(member)
-                if source is None:
-                    self.fail("gitleaks archive member is not a regular file")
-                binary = Path(tmp) / "gitleaks"
-                binary.write_bytes(source.read())
-            binary.chmod(0o755)
-            result = subprocess.run(
-                [str(binary), "version"],
-                capture_output=True,
-                text=True,
-                check=False,
-            )
-            self.assertEqual(0, result.returncode, result.stderr)
-            self.assertIn(version, result.stdout + result.stderr)
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -14,7 +14,9 @@ the chunk-1 contract:
    expected "no daemons selected" line when the supervisor is
    pointed at an empty daemon set.

-Skips cleanly only when the selected Docker backend is unavailable.
+Skips cleanly when docker is unavailable, or under act_runner
+where the host bind-mount topology breaks multi-stage builds
+that pull large bases.
 """

 from __future__ import annotations
@@ -31,6 +33,12 @@ _DOCKERFILE = "Dockerfile.gateway"


@skip_unless_backend("docker")
+@unittest.skipIf(
+    os.environ.get("GITEA_ACTIONS") == "true",
+    "skipped under act_runner: multi-stage build pulls a 200+MB "
+    "mitmproxy base + two upstream gateway images; runner storage "
+    "+ time budget make this an interactive-only test",
+)
 class TestGatewayImage(unittest.TestCase):
    """Builds the image once for the class, then runs a few
    `docker run` probes against it."""
@@ -43,11 +51,10 @@ class TestGatewayImage(unittest.TestCase):
             "-f", _DOCKERFILE, "."],
            cwd=repo_root,
            stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
-            check=False,
        )
        if proc.returncode != 0:
-            raise AssertionError(
-                f"docker build failed; image probes cannot run.\n"
+            raise unittest.SkipTest(
+                f"docker build failed; skipping image probes.\n"
                f"{proc.stdout.decode('utf-8', errors='replace')[-2000:]}"
            )

@@ -56,16 +63,14 @@ class TestGatewayImage(unittest.TestCase):
        subprocess.run(
            ["docker", "image", "rm", "-f", _IMAGE],
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
-            check=False,
        )

    def _run_in_image(self, *cmd: str, timeout: float = 30.0) -> tuple[int, str]:
        proc = subprocess.run(
            ["docker", "run", "--rm", "--entrypoint", cmd[0], _IMAGE,
-            *cmd[1:]],
+             *cmd[1:]],
            stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
            timeout=timeout,
-            check=False,
        )
        return proc.returncode, proc.stdout.decode("utf-8", errors="replace")

@@ -86,9 +91,7 @@ class TestGatewayImage(unittest.TestCase):
        # Probe that the package imports resolve inside the image.
        rc, out = self._run_in_image(
            "python3", "-c",
-            "from bot_bottle.supervisor import types; "
-            "from bot_bottle.gateway.supervisor import server as supervise_server; "
-            "print('ok')",
+            "from bot_bottle.supervisor import types; from bot_bottle.gateway.supervisor import server as supervise_server; print('ok')",
        )
        self.assertEqual(0, rc, msg=out)
        self.assertIn("ok", out)
@@ -103,7 +106,6 @@ class TestGatewayImage(unittest.TestCase):
             _IMAGE],
            stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
            timeout=10.0,
-            check=False,
        )
        out = proc.stdout.decode("utf-8", errors="replace")
        self.assertEqual(0, proc.returncode, msg=out)
@@ -16,10 +16,11 @@ throwaway BOT_BOTTLE_ROOT for a clean registry and tears everything down.

 from __future__ import annotations

-import secrets
+import os
 import subprocess
-import time
+import tempfile
 import unittest
+from pathlib import Path

 from bot_bottle.backend.docker.consolidated_launch import (
    _network_cidr,
@@ -72,12 +73,19 @@ _PROBE_SRC = (


@skip_unless_backend("docker")
+@unittest.skipIf(
+    os.environ.get("GITEA_ACTIONS") == "true",
+    "skipped under act_runner: the orchestrator container bind-mounts the repo "
+    "path into a container on the socket-shared host daemon, which can't see the "
+    "runner's /workspace — same host-bind-mount constraint as the other "
+    "bottle-bringup integration tests",
+)
 class TestMultitenantIsolation(unittest.TestCase):
    def setUp(self) -> None:
-        # Named volume → a clean registry DB that is also visible to a
-        # socket-shared host daemon when the test process runs in act_runner.
-        self._root_volume = "bot-bottle-mtitest-root-" + secrets.token_hex(4)
-        self.svc = DockerInfraService(root_mount_source=self._root_volume)
+        self._tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self._tmp.cleanup)
+        # Throwaway root → a clean registry DB, independent of the host's.
+        self.svc = DockerInfraService(host_root=Path(self._tmp.name))
        self.addCleanup(self._teardown_docker)
        # ensure_running builds the bundle image (slow on a cold cache) and
        # brings up the shared network + gateway + orchestrator.
@@ -92,8 +100,13 @@ class TestMultitenantIsolation(unittest.TestCase):
        self.svc.stop()
        subprocess.run(["docker", "network", "rm", GATEWAY_NETWORK],
                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False)
+        # The orchestrator container wrote the registry DB as root into the
+        # throwaway root; chown it back so the (non-root) tempdir cleanup can
+        # remove it.
        subprocess.run(
-            ["docker", "volume", "rm", "--force", self._root_volume],
+            ["docker", "run", "--rm", "-v", f"{self._tmp.name}:/r",
+             "--entrypoint", "chown", GATEWAY_IMAGE, "-R",
+             f"{os.getuid()}:{os.getgid()}", "/r"],
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False)

    @staticmethod
@@ -119,61 +132,29 @@ class TestMultitenantIsolation(unittest.TestCase):
        taken = _network_container_ips(GATEWAY_NETWORK) + extra_taken
        return next_free_ip(_network_cidr(GATEWAY_NETWORK), taken)

-    def _probe(self, source_ip: str, identity_token: str, host: str) -> str:
-        deadline = time.monotonic() + 30
-        last = subprocess.CompletedProcess([], 1, "", "probe not attempted")
-        while time.monotonic() < deadline:
-            last = subprocess.run(
-                [
-                    "docker", "run", "--rm",
-                    "--network", GATEWAY_NETWORK, "--ip", source_ip,
-                    "--entrypoint", "python3", GATEWAY_IMAGE, "-c", _PROBE_SRC,
-                    f"http://bottle:{identity_token}@{self.gw_ip}:{EGRESS_PORT}",
-                    host,
-                ],
-                stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
-                check=False, timeout=90,
-            )
-            output = last.stdout.strip()
-            if last.returncode == 0 and output:
-                return output
-            time.sleep(0.25)
-        self.fail(
-            f"gateway probe did not become ready: "
-            f"exit={last.returncode}, stderr={last.stderr.strip()!r}"
+    def _probe(self, source_ip: str, host: str) -> str:
+        proc = subprocess.run(
+            ["docker", "run", "--rm", "--network", GATEWAY_NETWORK, "--ip", source_ip,
+             "--entrypoint", "python3", GATEWAY_IMAGE, "-c", _PROBE_SRC,
+             f"http://{self.gw_ip}:{EGRESS_PORT}", host],
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, timeout=90,
        )
+        return proc.stdout.strip()

    def test_two_bottles_share_gateway_with_isolated_tokens_and_allowlists(self) -> None:
        ip_a = self._free_ip([])
        ip_b = self._free_ip([ip_a])
-        bottle_a = self.client.register_bottle(
-            ip_a, policy=_POLICY_A, tokens={"EGRESS_TOKEN_0": _TOKEN_A}
-        )
-        bottle_b = self.client.register_bottle(
-            ip_b, policy=_POLICY_B, tokens={"EGRESS_TOKEN_0": _TOKEN_B}
-        )
+        self.client.register_bottle(ip_a, policy=_POLICY_A, tokens={"EGRESS_TOKEN_0": _TOKEN_A})
+        self.client.register_bottle(ip_b, policy=_POLICY_B, tokens={"EGRESS_TOKEN_0": _TOKEN_B})

        # Each bottle gets its OWN token injected on the shared route — no bleed.
-        self.assertEqual(
-            f"200 AUTH=Bearer {_TOKEN_A}",
-            self._probe(ip_a, bottle_a.identity_token, "echo-shared"),
-        )
-        self.assertEqual(
-            f"200 AUTH=Bearer {_TOKEN_B}",
-            self._probe(ip_b, bottle_b.identity_token, "echo-shared"),
-        )
+        self.assertEqual(f"200 AUTH=Bearer {_TOKEN_A}", self._probe(ip_a, "echo-shared"))
+        self.assertEqual(f"200 AUTH=Bearer {_TOKEN_B}", self._probe(ip_b, "echo-shared"))

        # Allowlist is per-bottle: echo-bonly is only in B's policy.
-        self.assertTrue(
-            self._probe(
-                ip_a, bottle_a.identity_token, "echo-bonly"
-            ).startswith("403"),  # fail-closed for A
-            "A reached a host outside its allowlist",
-        )
-        self.assertEqual(
-            "200 AUTH=NONE",
-            self._probe(ip_b, bottle_b.identity_token, "echo-bonly"),
-        )  # allowed, unauthed for B
+        self.assertTrue(self._probe(ip_a, "echo-bonly").startswith("403"),  # fail-closed for A
+                        "A reached a host outside its allowlist")
+        self.assertEqual("200 AUTH=NONE", self._probe(ip_b, "echo-bonly"))  # allowed, unauthed for B


 if __name__ == "__main__":
@@ -23,6 +23,7 @@ import secrets
 import subprocess
 import tempfile
 import unittest
+from pathlib import Path

 from bot_bottle.orchestrator_auth import ROLE_CLI, ROLE_GATEWAY, mint
 from bot_bottle.orchestrator.client import OrchestratorClient
@@ -37,6 +38,13 @@ _TEST_GATEWAY_IMAGE = "bot-bottle-gateway:itest"


@skip_unless_backend("docker")
+@unittest.skipIf(
+    os.environ.get("GITEA_ACTIONS") == "true",
+    "skipped under act_runner: the orchestrator container bind-mounts the repo "
+    "path into a container on the socket-shared host daemon, which can't see the "
+    "runner's /workspace — same host-bind-mount constraint as the other "
+    "bottle-bringup integration tests",
+)
 class TestDockerOrchestratorAuthIntegration(unittest.TestCase):
    @classmethod
    def setUpClass(cls) -> None:
@@ -66,10 +74,10 @@ class TestDockerOrchestratorAuthIntegration(unittest.TestCase):
        gateway_name = f"bot-bottle-gateway-itest-{suffix}"
        network = f"bot-bottle-net-itest-{suffix}"
        control_network = f"bot-bottle-ctrl-itest-{suffix}"
-        root_volume = f"bot-bottle-root-itest-{suffix}"
+        host_root = Path(cls._tmp.name)
        cls.addClassCleanup(
            cls._teardown_docker,
-            orchestrator_name, gateway_name, network, control_network, root_volume,
+            orchestrator_name, gateway_name, network, control_network, host_root,
        )

        cls.svc = DockerInfraService(
@@ -80,7 +88,7 @@ class TestDockerOrchestratorAuthIntegration(unittest.TestCase):
            orchestrator_image=_TEST_ORCHESTRATOR_IMAGE,
            gateway_image=_TEST_GATEWAY_IMAGE,
            port=20000 + secrets.randbelow(10000),
-            root_mount_source=root_volume,
+            host_root=host_root,
        )
        cls.svc.ensure_running()
        # The control plane now verifies role-scoped signed tokens, not the raw
@@ -92,7 +100,7 @@ class TestDockerOrchestratorAuthIntegration(unittest.TestCase):
    @staticmethod
    def _teardown_docker(
        orchestrator_name: str, gateway_name: str,
-        network: str, control_network: str, root_volume: str,
+        network: str, control_network: str, host_root: Path,
    ) -> None:
        for name in (gateway_name, orchestrator_name):
            subprocess.run(
@@ -104,8 +112,14 @@ class TestDockerOrchestratorAuthIntegration(unittest.TestCase):
                ["docker", "network", "rm", net],
                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False,
            )
+        # The orchestrator container (no USER directive) wrote the registry
+        # DB as root into the throwaway host_root; chown it back so the
+        # (non-root) tempdir cleanup can remove it. Same workaround
+        # test_multitenant_isolation.py uses for the identical bind mount.
        subprocess.run(
-            ["docker", "volume", "rm", "--force", root_volume],
+            ["docker", "run", "--rm", "-v", f"{host_root}:/r",
+             "--entrypoint", "chown", _TEST_ORCHESTRATOR_IMAGE, "-R",
+             f"{os.getuid()}:{os.getgid()}", "/r"],
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False,
        )

@@ -42,6 +42,11 @@ class TestOrphanCleanup(unittest.TestCase):
        # Returning True == idempotent success.
        self.assertTrue(network_remove(f"bot-bottle-net-{self.slug}-does-not-exist"))

+    @unittest.skipIf(
+        os.environ.get("GITEA_ACTIONS") == "true",
+        "skipped under act_runner: docker socket mount topology breaks "
+        "in-process visibility of networks created on the host daemon",
+    )
    def test_create_and_remove(self):
        self.internal_name = network_create_internal(self.slug)
        self.egress_name = network_create_egress(self.slug)
@@ -67,7 +67,26 @@ _DUMMY_HOST_KEY = (
 )


+# Backends whose CI runner is HOST-mode (self-hosted), so the test process
+# and the backend share a host. The containerized act_runner (docker on
+# ubuntu-latest) is the one that can't see the host bind mount egress_tls_init
+# uses and hides sibling-gateway network topology; host-mode runners
+# (firecracker/KVM, macos-container) don't have those constraints, so the test
+# runs there. Keep this in sync with the `runs-on` labels in
+# .gitea/workflows/test.yml.
+_HOST_MODE_CI_BACKENDS = frozenset({"firecracker", "macos-container"})
+
+
@skip_unless_selected_backend_available()
+@unittest.skipIf(
+    os.environ.get("GITEA_ACTIONS") == "true"
+    and os.environ.get("BOT_BOTTLE_BACKEND") not in _HOST_MODE_CI_BACKENDS,
+    "skipped under the containerized act_runner (docker on ubuntu-latest): "
+    "egress_tls_init uses a host bind mount the runner container can't "
+    "see, and the network topology hides sibling-gateway visibility — "
+    "these constraints don't apply on the self-hosted host-mode runners "
+    "(firecracker/KVM, macos-container)",
+)
 class TestSandboxEscape(unittest.TestCase):
    """End-to-end attacks against a real bottle. The bottle stays
    up for the whole class — bringup is ~10-30s, so per-test
@@ -170,7 +189,7 @@ class TestSandboxEscape(unittest.TestCase):
                missing.append(tool)
        if missing:
            cls._teardown_resources()
-            raise AssertionError(
+            raise unittest.SkipTest(
                f"agent missing required tools: {', '.join(missing)} — "
                f"add them to the backend's base image"
            )
@@ -1,101 +0,0 @@
-"""Tests for the fail-closed critical coverage manifest."""
-
-from __future__ import annotations
-
-import tempfile
-import unittest
-from contextlib import redirect_stderr, redirect_stdout
-from io import StringIO
-from pathlib import Path
-
-from scripts.critical_modules import (
-    DEFAULT_MANIFEST,
-    REPO_ROOT,
-    CriticalModulesError,
-    load_critical_modules,
-    main,
-)
-
-
-class TestCriticalModules(unittest.TestCase):
-    def test_repository_manifest_is_valid(self) -> None:
-        modules = load_critical_modules(DEFAULT_MANIFEST, root=REPO_ROOT)
-        self.assertGreater(len(modules), 20)
-        self.assertEqual(len(modules), len(set(modules)))
-
-    def test_missing_module_fails(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            root = Path(tmp)
-            manifest = root / "critical-modules.txt"
-            manifest.write_text("bot_bottle/renamed.py\n", encoding="utf-8")
-            with self.assertRaisesRegex(CriticalModulesError, "does not exist"):
-                load_critical_modules(manifest, root=root)
-
-    def test_duplicate_module_fails(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            root = Path(tmp)
-            module = root / "bot_bottle" / "core.py"
-            module.parent.mkdir()
-            module.write_text("", encoding="utf-8")
-            manifest = root / "critical-modules.txt"
-            manifest.write_text(
-                "bot_bottle/core.py\nbot_bottle/core.py\n", encoding="utf-8"
-            )
-            with self.assertRaisesRegex(CriticalModulesError, "duplicated"):
-                load_critical_modules(manifest, root=root)
-
-    def test_entry_cannot_escape_repository(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            root = Path(tmp)
-            manifest = root / "critical-modules.txt"
-            manifest.write_text("../outside.py\n", encoding="utf-8")
-            with self.assertRaisesRegex(CriticalModulesError, "escapes"):
-                load_critical_modules(manifest, root=root)
-
-    def test_invalid_entry_forms_are_reported_together(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            root = Path(tmp)
-            manifest = root / "critical-modules.txt"
-            manifest.write_text(
-                f"{root / 'absolute.py'}\nREADME.md\n",
-                encoding="utf-8",
-            )
-            with self.assertRaises(CriticalModulesError) as raised:
-                load_critical_modules(manifest, root=root)
-            self.assertIn("must be relative", str(raised.exception))
-            self.assertIn("is not a Python module", str(raised.exception))
-
-    def test_empty_manifest_fails(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            root = Path(tmp)
-            manifest = root / "critical-modules.txt"
-            manifest.write_text("# comments do not define modules\n", encoding="utf-8")
-            with self.assertRaisesRegex(CriticalModulesError, "contains no"):
-                load_critical_modules(manifest, root=root)
-
-    def test_unreadable_manifest_fails(self) -> None:
-        with tempfile.TemporaryDirectory() as tmp:
-            missing = Path(tmp) / "missing.txt"
-            with self.assertRaisesRegex(CriticalModulesError, "cannot read"):
-                load_critical_modules(missing, root=Path(tmp))
-
-    def test_main_prints_include_list_or_checks_silently(self) -> None:
-        output = StringIO()
-        with redirect_stdout(output):
-            self.assertEqual(0, main([]))
-        self.assertIn("bot_bottle/manifest/egress.py", output.getvalue())
-
-        output = StringIO()
-        with redirect_stdout(output):
-            self.assertEqual(0, main(["--check"]))
-        self.assertEqual("", output.getvalue())
-
-    def test_main_reports_manifest_error(self) -> None:
-        error = StringIO()
-        with redirect_stderr(error):
-            self.assertEqual(1, main(["--manifest", "/definitely/missing"]))
-        self.assertIn("critical-modules:", error.getvalue())
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -9,7 +9,6 @@ a freshly minted token."""
 from __future__ import annotations

 import unittest
-from pathlib import Path
 from unittest.mock import MagicMock, patch

 from bot_bottle.backend.docker.infra import (
@@ -68,21 +67,6 @@ class TestDockerInfraService(unittest.TestCase):
        self.assertTrue(any(GATEWAY_NAME in a for a in rms))
        self.assertTrue(any(ORCHESTRATOR_NAME in a for a in rms))

-    def test_named_mounts_propagate_to_both_planes(self) -> None:
-        svc = DockerInfraService(
-            root_mount_source="registry-volume",
-            gateway_ca_mount_source="ca-volume",
-        )
-        self.assertEqual("registry-volume", svc.orchestrator()._root_mount_source)
-        self.assertEqual("ca-volume", svc.gateway()._ca_mount_source)
-
-    def test_host_path_and_named_root_mount_are_mutually_exclusive(self) -> None:
-        with self.assertRaisesRegex(ValueError, "host_root or root_mount_source"):
-            DockerInfraService(
-                host_root=Path("/host/path"),
-                root_mount_source="registry-volume",
-            )
-

 if __name__ == "__main__":
    unittest.main()
@@ -4,7 +4,6 @@ from __future__ import annotations

 import unittest
 import urllib.error
-from pathlib import Path
 from unittest.mock import MagicMock, Mock, patch

 from bot_bottle.backend.docker.orchestrator import (
@@ -48,55 +47,6 @@ class TestDockerOrchestrator(unittest.TestCase):
    def test_url_is_host_loopback(self) -> None:
        self.assertEqual("http://127.0.0.1:8099", self.orch.url())

-    def test_socket_shared_client_uses_explicit_host_and_open_bind(self) -> None:
-        orch = DockerOrchestrator(
-            port=8099, client_host="172.17.0.1", root_mount_source="state-volume"
-        )
-        with patch(_TOKEN, return_value="k"), \
-                patch(_URLOPEN, side_effect=[urllib.error.URLError("down"), _health(200)]), \
-                patch(_RUN, return_value=_proc()) as run, patch(_SLEEP):
-            orch.ensure_running()
-        self.assertEqual("http://172.17.0.1:8099", orch.url())
-        argv = next(c.args[0] for c in run.call_args_list
-                    if c.args[0][:2] == ["docker", "run"])
-        self.assertEqual("0.0.0.0:8099:8099", argv[argv.index("--publish") + 1])
-        self.assertIn("state-volume:/bot-bottle-root", argv)
-
-    def test_host_path_and_named_root_mount_are_mutually_exclusive(self) -> None:
-        with self.assertRaisesRegex(ValueError, "host_root or root_mount_source"):
-            DockerOrchestrator(
-                host_root=Path("/host/path"),
-                root_mount_source="state-volume",
-            )
-
-    def test_socket_shared_job_network_uses_container_dns(self) -> None:
-        orch = DockerOrchestrator(
-            name="orchestrator-itest",
-            port=22001,
-            client_network="runner-job-network",
-            root_mount_source="state-volume",
-        )
-        with patch(_TOKEN, return_value="k"), \
-                patch(
-                    _URLOPEN,
-                    side_effect=[urllib.error.URLError("down"), _health(200)],
-                ), patch(_RUN, return_value=_proc()) as run, patch(_SLEEP):
-            orch.ensure_running()
-        self.assertEqual("http://orchestrator-itest:8099", orch.url())
-        calls = [call.args[0] for call in run.call_args_list]
-        self.assertIn(
-            [
-                "docker", "network", "connect",
-                "runner-job-network", "orchestrator-itest",
-            ],
-            calls,
-        )
-        argv = next(call for call in calls if call[:2] == ["docker", "run"])
-        self.assertEqual(
-            "127.0.0.1:22001:8099",
-            argv[argv.index("--publish") + 1],
-        )
-
    def test_gateway_url_is_the_container_dns_name(self) -> None:
        # The gateway reaches the orchestrator by name on the control network.
        self.assertEqual(f"http://{ORCHESTRATOR_NAME}:8099", self.orch.gateway_url())
@@ -160,8 +110,6 @@ class TestDockerOrchestrator(unittest.TestCase):
        # The lean control plane: no mitmproxy CA mount, no gateway daemons.
        self.assertFalse([a for a in argv if a.endswith(":/home/mitmproxy/.mitmproxy")])
        self.assertNotIn("BOT_BOTTLE_GATEWAY_DAEMONS", " ".join(argv))
-        self.assertNotIn("/bot-bottle-src", " ".join(argv))
-        self.assertNotIn("PYTHONPATH", " ".join(argv))
        # Orchestrator entrypoint args (image ENTRYPOINT is `-m bot_bottle.orchestrator`).
        self.assertIn("--broker", argv)
        self.assertIn("stub", argv)
@@ -404,19 +404,16 @@ class TestBootArgs(unittest.TestCase):
        self.assertEqual("bbfc0", cfg["network-interfaces"][0]["host_dev_name"])
        self.assertEqual(1, len(cfg["drives"]))  # no data drive by default

-    def test_config_adds_data_drives_in_order(self):
+    def test_config_adds_data_drive(self):
        cfg = cast(Any, firecracker_vm._config(
            rootfs=Path("/run/rootfs.ext4"), tap="bbfc0",
            guest_ip="100.64.0.1", host_ip="100.64.0.0", pubkey="k",
            vcpus=2, mem_mib=2048, guest_mac="06:00:AC:10:00:02",
-            data_drives=(Path("/run/ca.ext4"), Path("/run/git.ext4")),
+            data_drive=Path("/run/registry.ext4"),
        ))
-        # rootfs (vda) + two data drives, attached in list order so the guest
-        # sees them as /dev/vdb, /dev/vdc — an order callers depend on.
-        self.assertEqual(3, len(cfg["drives"]))
+        self.assertEqual(2, len(cfg["drives"]))
        self.assertFalse(cfg["drives"][1]["is_root_device"])
-        self.assertEqual("/run/ca.ext4", cfg["drives"][1]["path_on_host"])
-        self.assertEqual("/run/git.ext4", cfg["drives"][2]["path_on_host"])
+        self.assertEqual("/run/registry.ext4", cfg["drives"][1]["path_on_host"])


 class TestBottleExecClose(unittest.TestCase):
@@ -59,13 +59,7 @@ class TestFirecrackerGatewayConnect(unittest.TestCase):
    def test_boots_the_gateway_vm_and_seeds_the_token(self) -> None:
        gw = FirecrackerGateway()
        booted = infra_vm.InfraVm(guest_ip="10.243.255.3", private_key=Path("/k"))
-        ca_vol = Path("/gw/gateway-ca.ext4")
-        git_vol = Path("/gw/gateway-git.ext4")
        with patch.object(infra_vm, "boot_vm", return_value=booted) as boot, \
-                patch.object(FirecrackerGateway, "_ensure_ca_volume",
-                             return_value=ca_vol), \
-                patch.object(FirecrackerGateway, "_ensure_git_volume",
-                             return_value=git_vol), \
                patch.object(infra_vm, "push_secret") as push:
            gw.connect_to_orchestrator(_ORCH_URL, _TOKEN)
        # Booted on the gateway link with the gateway role; the orchestrator's
@@ -73,71 +67,12 @@ class TestFirecrackerGatewayConnect(unittest.TestCase):
        kw = boot.call_args.kwargs
        self.assertEqual("gateway", kw["role"])
        self.assertIn("bb_orch=10.243.255.1", kw["extra_boot_args"])
-        # The persistent volumes ride in a FIXED order — CA as /dev/vdb, git-gate
-        # as /dev/vdc — so both survive a gateway-VM rebuild (issues #450, #512).
-        self.assertEqual((ca_vol, git_vol), kw.get("data_drives"))
+        self.assertIsNone(kw.get("data_drive"))  # data plane never opens the DB
        # The host-minted token (never the key — #469) is pushed to the guest.
        push.assert_called_once()
        self.assertEqual(_TOKEN, push.call_args.args[1])


-class TestGatewayCaVolume(unittest.TestCase):
-    """The persistent CA volume that keeps the mitmproxy CA stable across a
-    gateway-VM rebuild (issue #450) — the mirror of the orchestrator's registry
-    volume."""
-
-    def test_reuses_existing_volume(self) -> None:
-        gw = FirecrackerGateway()
-        with tempfile.TemporaryDirectory() as td:
-            vol = Path(td) / "gateway-ca.ext4"
-            vol.write_bytes(b"")  # already present
-            with patch.object(infra_vm, "_gw_dir", return_value=Path(td)), \
-                    patch(f"{_GW}.subprocess.run") as run:
-                out = gw._ensure_ca_volume()
-            run.assert_not_called()  # no mke2fs when it exists — the CA survives
-            self.assertEqual(vol, out)
-
-    def test_creates_volume_when_missing(self) -> None:
-        gw = FirecrackerGateway()
-        with tempfile.TemporaryDirectory() as td:
-            with patch.object(infra_vm, "_gw_dir", return_value=Path(td)), \
-                    patch(f"{_GW}.subprocess.run",
-                          return_value=CompletedProcess([], 0)) as run:
-                out = gw._ensure_ca_volume()
-            argv = run.call_args.args[0]
-            self.assertIn("mke2fs", argv)
-            self.assertEqual(str(Path(td) / "gateway-ca.ext4"), out.__fspath__())
-            self.assertIn(str(out), argv)
-
-
-class TestGatewayGitVolume(unittest.TestCase):
-    """The persistent git-gate volume that keeps per-bottle bare repos + creds
-    stable across a gateway-VM rebuild (issue #512)."""
-
-    def test_reuses_existing_volume(self) -> None:
-        gw = FirecrackerGateway()
-        with tempfile.TemporaryDirectory() as td:
-            vol = Path(td) / "gateway-git.ext4"
-            vol.write_bytes(b"")  # already present
-            with patch.object(infra_vm, "_gw_dir", return_value=Path(td)), \
-                    patch(f"{_GW}.subprocess.run") as run:
-                out = gw._ensure_git_volume()
-            run.assert_not_called()  # no mke2fs when it exists — the repos survive
-            self.assertEqual(vol, out)
-
-    def test_creates_volume_when_missing(self) -> None:
-        gw = FirecrackerGateway()
-        with tempfile.TemporaryDirectory() as td:
-            with patch.object(infra_vm, "_gw_dir", return_value=Path(td)), \
-                    patch(f"{_GW}.subprocess.run",
-                          return_value=CompletedProcess([], 0)) as run:
-                out = gw._ensure_git_volume()
-            argv = run.call_args.args[0]
-            self.assertIn("mke2fs", argv)
-            self.assertEqual(str(Path(td) / "gateway-git.ext4"), out.__fspath__())
-            self.assertIn(str(out), argv)
-
-
 class TestFirecrackerGatewaySurface(unittest.TestCase):
    def test_is_running_reads_the_gateway_pidfile(self) -> None:
        gw = FirecrackerGateway()
@@ -61,23 +61,7 @@ class TestRoleInits(unittest.TestCase):
        init = infra_vm.role_init("gateway")
        self.assertNotIn("bb_role=", init)
        self.assertNotIn("bot_bottle.orchestrator", init)
-        # Persistent CA volume mounted at mitmproxy's confdir so the CA survives
-        # a gateway-VM rebuild (issue #450). Mounted BEFORE the data plane starts.
-        self.assertIn(f"mount -t ext4 /dev/vdb {infra_vm._GATEWAY_CA_MOUNT}", init)
-        self.assertLess(init.index("/dev/vdb"),
-                        init.index("bot_bottle.gateway.bootstrap"))
-        # Persistent git-gate volume (/dev/vdc) bind-mounted onto /git and
-        # /git-gate/creds so per-bottle repos + creds survive a rebuild (#512),
-        # also before the data plane (and any provisioning writes).
-        self.assertIn(f"mount -t ext4 /dev/vdc {infra_vm._GATEWAY_GIT_MOUNT}", init)
-        self.assertIn(
-            f"mount --bind {infra_vm._GATEWAY_GIT_MOUNT}/git "
-            f"{infra_vm._GATEWAY_GIT_REPO_ROOT}", init)
-        self.assertIn(
-            f"mount --bind {infra_vm._GATEWAY_GIT_MOUNT}/creds "
-            f"{infra_vm._GATEWAY_GIT_CREDS_DIR}", init)
-        self.assertLess(init.index("/dev/vdc"),
-                        init.index("bot_bottle.gateway.bootstrap"))
+        self.assertNotIn("/dev/vdb", init)  # no registry volume on the data plane
        self.assertIn("export PATH=", init)  # shared preamble
        self.assertIn("BOT_BOTTLE_GATEWAY_DAEMONS=egress,git-http,supervise", init)
        self.assertIn(f"cat {infra_vm._GUEST_GATEWAY_JWT_PATH}", init)  # host-minted JWT
@@ -52,7 +52,7 @@ class TestEnsureRunning(unittest.TestCase):
        kw = boot.call_args.kwargs
        self.assertEqual("orchestrator", kw["role"])
        self.assertEqual(4096, kw["mem_mib"])          # orchestrator keeps build headroom
-        self.assertEqual((Path("/reg"),), kw["data_drives"])  # DB volume on the CP
+        self.assertEqual(Path("/reg"), kw["data_drive"])  # DB volume on the CP
        # The host-canonical signing key is pushed to the guest signing-key path.
        self.assertEqual("host-key", push.call_args.args[1])
        self.assertEqual(infra_vm._GUEST_SIGNING_KEY_PATH, push.call_args.args[2])
@@ -206,75 +206,6 @@ class TestHookRender(unittest.TestCase):
        self.assertIn('set -- "$@" --push-option="$opt"', hook)
        self.assertIn('git push "$@" origin "$refspec"', hook)

-    def test_agit_review_refs_rejected_before_scan(self):
-        # Creating/updating refs/for/*, refs/draft/*, or refs/for-review/*
-        # opens a Gitea AGit pull request backed by a server-managed review
-        # ref instead of a normal branch, which the git-gate branch workflow
-        # can't push follow-ups to. The guard rejects those refs, and it runs
-        # in Phase 0 — before the gitleaks scan and the upstream forward.
-        hook = git_gate_render_hook()
-        self.assertIn(
-            "refs/for/*|refs/draft/*|refs/for-review/*", hook,
-        )
-        self.assertIn("refusing AGit review ref", hook)
-        self.assertIn("branch-backed pull request", hook)
-        guard = hook.index("refusing AGit review ref")
-        self.assertLess(
-            guard, hook.index("gitleaks scanning"),
-            "AGit guard must run before the gitleaks scan",
-        )
-        self.assertLess(
-            guard, hook.index("forwarding $ref to origin"),
-            "AGit guard must run before the upstream forward",
-        )
-
-    def test_agit_review_ref_deletion_still_allowed(self):
-        # Cleanup of a legacy AGit ref (new == zero) must not be blocked, so
-        # the reject is guarded by the same delete short-circuit the scan and
-        # forward phases use.
-        hook = git_gate_render_hook()
-        guard_block = hook[
-            hook.index("Phase 0"):hook.index("supervise_gitleaks_allow()")
-        ]
-        self.assertIn('[ "$new" = "$zero" ] && continue', guard_block)
-        self.assertIn("refs/for/*", guard_block)
-
-    def _run_hook_stdin(self, stdin: str):
-        # Execute the rendered hook far enough to exercise Phase 0. The guard
-        # touches only mktemp + read, so it rejects (or falls through) without
-        # a bare repo, gitleaks, or ssh — anything past Phase 0 fails for
-        # unrelated reasons, which is fine for the reject cases asserted here.
-        import subprocess
-        fd, path = tempfile.mkstemp(suffix=".sh")
-        try:
-            with os.fdopen(fd, "w") as f:
-                f.write(git_gate_render_hook())
-            return subprocess.run(
-                ["sh", path], input=stdin, capture_output=True, text=True,
-            )
-        finally:
-            os.unlink(path)
-
-    def test_agit_review_ref_create_is_rejected(self):
-        one = "1" * 40
-        for ref in ("refs/for/main", "refs/draft/main", "refs/for-review/main"):
-            with self.subTest(ref=ref):
-                result = self._run_hook_stdin(f"{'0' * 40} {one} {ref}\n")
-                self.assertEqual(1, result.returncode)
-                self.assertIn("refusing AGit review ref", result.stderr)
-                self.assertIn("branch-backed pull request", result.stderr)
-                # Rejected in Phase 0, before the gitleaks scan runs.
-                self.assertNotIn("gitleaks scanning", result.stderr)
-
-    def test_ordinary_branch_passes_agit_guard(self):
-        # A normal refs/heads push must fall through Phase 0 and reach the
-        # gitleaks scan (which then fails for lack of a real repo — proving
-        # only that the guard did not short-circuit it).
-        one = "1" * 40
-        result = self._run_hook_stdin(f"{'0' * 40} {one} refs/heads/main\n")
-        self.assertNotIn("refusing AGit review ref", result.stderr)
-        self.assertIn("gitleaks scanning", result.stderr)
-
    def test_inline_gitleaks_allow_routes_to_supervisor(self):
        hook = git_gate_render_hook()
        # First gitleaks runs normally; only if that passes does the
@@ -7,10 +7,7 @@ import unittest
 from pathlib import Path
 from unittest.mock import Mock, patch

-from bot_bottle.backend.docker.gateway import (
-    DEFAULT_GATEWAY_SUBNET,
-    DockerGateway,
-)
+from bot_bottle.backend.docker.gateway import DockerGateway
 from bot_bottle.gateway import (
    GATEWAY_CA_CERT,
    GATEWAY_NAME,
@@ -145,42 +142,6 @@ class TestDockerGateway(unittest.TestCase):
        # Data plane resolves policy against the orchestrator control plane.
        self.assertIn(f"BOT_BOTTLE_ORCHESTRATOR_URL={_ORCH_URL}", runs[0])

-    def test_named_ca_volume_supports_socket_shared_runner(self) -> None:
-        sc = DockerGateway(
-            "bot-bottle-gateway:latest", ca_mount_source="ci-ca-volume"
-        )
-
-        def fake(argv: list[str], **_kw: object) -> Mock:
-            return _proc(stdout="") if argv[:2] == ["docker", "ps"] else _proc()
-
-        with patch(_RUN_DOCKER, side_effect=fake) as run:
-            sc.connect_to_orchestrator(_ORCH_URL, _TOKEN)
-        argv = next(c.args[0] for c in run.call_args_list
-                    if c.args[0][:2] == ["docker", "run"])
-        self.assertIn(
-            "ci-ca-volume:/home/mitmproxy/.mitmproxy", argv
-        )
-
-    def test_persists_git_gate_state_across_recreation(self) -> None:
-        # Per-bottle bare repos + deploy creds are bind-mounted from the host so
-        # a gateway restart doesn't drop already-running bottles' git-gate state
-        # (issue #512). Named sources here stand in for CI's per-run volumes.
-        sc = DockerGateway(
-            "bot-bottle-gateway:latest",
-            git_mount_source="ci-git-volume",
-            creds_mount_source="ci-creds-volume",
-        )
-
-        def fake(argv: list[str], **_kw: object) -> Mock:
-            return _proc(stdout="") if argv[:2] == ["docker", "ps"] else _proc()
-
-        with patch(_RUN_DOCKER, side_effect=fake) as run:
-            sc.connect_to_orchestrator(_ORCH_URL, _TOKEN)
-        argv = next(c.args[0] for c in run.call_args_list
-                    if c.args[0][:2] == ["docker", "run"])
-        self.assertIn("ci-git-volume:/git", argv)
-        self.assertIn("ci-creds-volume:/git-gate/creds", argv)
-
    def test_connect_injects_the_pre_minted_gateway_token(self) -> None:
        # The gateway presents the token the orchestrator handed it — it never
        # mints (holds no signing key). The value rides the env (bare `--env
@@ -232,38 +193,7 @@ class TestDockerGateway(unittest.TestCase):
        with patch(_RUN_DOCKER, side_effect=fake):
            self.sc.connect_to_orchestrator(_ORCH_URL, _TOKEN)
        creates = [c for c in calls if c[:3] == ["docker", "network", "create"]]
-        self.assertEqual(
-            [[
-                "docker", "network", "create",
-                "--subnet", DEFAULT_GATEWAY_SUBNET,
-                "--label",
-                f"bot-bottle.gateway-subnet={DEFAULT_GATEWAY_SUBNET}",
-                self.sc.network,
-            ]],
-            creates,
-        )
-
-    def test_ensure_running_replaces_stale_auto_ipam_network(self) -> None:
-        calls: list[list[str]] = []
-
-        def fake(argv: list[str], **_kw: object) -> Mock:
-            calls.append(argv)
-            if argv[:2] == ["docker", "ps"]:
-                return _proc(stdout="")
-            if argv[:3] == ["docker", "network", "inspect"]:
-                return _proc(stdout="<no value>\n")
-            return _proc()
-
-        with patch(_RUN_DOCKER, side_effect=fake):
-            self.sc.connect_to_orchestrator(_ORCH_URL, _TOKEN)
-        self.assertIn(
-            ["docker", "rm", "--force", self.sc.name],
-            calls,
-        )
-        self.assertIn(
-            ["docker", "network", "rm", self.sc.network],
-            calls,
-        )
+        self.assertEqual([["docker", "network", "create", self.sc.network]], creates)

    def test_ca_cert_pem_reads_from_container(self) -> None:
        with patch(_RUN_DOCKER, return_value=_proc(stdout=_CA_PEM)) as m:
@@ -1,4 +1,4 @@
-"""Unit tests for per-bottle egress secret encryption (PRD 0080)."""
+"""Unit tests for per-bottle egress secret encryption (PRD prd-new-secret-provider)."""

 from __future__ import annotations

@@ -105,19 +105,11 @@ class TestOrchestrator(unittest.TestCase):

    def test_reprovision_rejects_missing_rows_and_wrong_key(self) -> None:
        self.assertFalse(self.orch.reprovision_from_secret("missing", new_env_var_secret()))
-        key = "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE"
-        wrong_key = "FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ"
-        # Pin the nonce so this is a deterministic wrong-key/decryption vector
-        # instead of a probabilistic assertion over random bytes.
-        with patch(
-            "bot_bottle.orchestrator.store.secret_store.secrets.token_bytes",
-            return_value=b"\0" * 16,
-        ):
-            rec = self.orch.launch_bottle(
-                "10.243.0.13", tokens={"K": "value"},
-                env_var_secret=key,
-            )
-        self.assertFalse(self.orch.reprovision_from_secret(rec.bottle_id, wrong_key))
+        rec = self.orch.launch_bottle(
+            "10.243.0.13", tokens={"K": "value"},
+            env_var_secret=new_env_var_secret(),
+        )
+        self.assertFalse(self.orch.reprovision_from_secret(rec.bottle_id, new_env_var_secret()))

    def test_set_policy_live_reload(self) -> None:
        rec = self.orch.launch_bottle("10.243.0.3")
@@ -27,41 +27,7 @@ class TestCheckPullRequest(unittest.TestCase):
        event = {"pull_request": {"title": "Change", "body": "Part of #12", "labels": []}}
        self.assertEqual(check_pull_request(event, api), [])

-    def test_accepts_labelled_pr_without_issue(self):
-        api = Mock()
-        event = {
-            "pull_request": {
-                "title": "Change",
-                "body": "",
-                "labels": [{"name": "Kind/Documentation"}],
-            }
-        }
-        self.assertEqual(check_pull_request(event, api), [])
-        api.request.assert_not_called()
-
-    def test_rejects_unlabelled_pr_without_issue(self):
-        api = Mock()
-        event = {"pull_request": {"title": "Change", "body": "", "labels": []}}
-        errors = check_pull_request(event, api)
-        self.assertEqual(len(errors), 1)
-        self.assertIn("either have a label or reference an issue", errors[0])
-        api.request.assert_not_called()
-
-    def test_rejects_labelled_pr_linked_to_real_issue(self):
-        api = Mock()
-        api.request.return_value = {"number": 12, "pull_request": None}
-        event = {
-            "pull_request": {
-                "title": "Change",
-                "body": "Closes #12",
-                "labels": [{"name": "Kind/Documentation"}],
-            }
-        }
-        errors = check_pull_request(event, api)
-        self.assertEqual(len(errors), 1)
-        self.assertIn("exactly one tracking mode", errors[0])
-
-    def test_still_validates_issue_reference_when_both_modes_are_used(self):
+    def test_rejects_labels_and_pr_reference(self):
        api = Mock()
        api.request.return_value = {"number": 12, "pull_request": {}}
        event = {
@@ -73,7 +39,7 @@ class TestCheckPullRequest(unittest.TestCase):
        }
        errors = check_pull_request(event, api)
        self.assertEqual(len(errors), 2)
-        self.assertIn("exactly one tracking mode", errors[0])
+        self.assertIn("unlabeled", errors[0])
        self.assertIn("not an issue", errors[1])


@@ -1,91 +0,0 @@
-"""Unit tests for CI's unittest execution-count gate."""
-
-from __future__ import annotations
-
-import unittest
-from contextlib import redirect_stderr
-from io import StringIO
-from unittest.mock import Mock, patch
-
-from scripts.unittest_gate import assurance_errors, main
-
-
-class TestAssuranceErrors(unittest.TestCase):
-    def test_accepts_suite_that_meets_minimum_without_skips(self) -> None:
-        self.assertEqual(
-            [],
-            assurance_errors(
-                tests_run=22, skipped=0, minimum_executed=22, fail_on_skip=True
-            ),
-        )
-
-    def test_rejects_green_suite_below_execution_minimum(self) -> None:
-        errors = assurance_errors(
-            tests_run=22, skipped=18, minimum_executed=22, fail_on_skip=False
-        )
-        self.assertEqual(1, len(errors))
-        self.assertIn("executed 4", errors[0])
-
-    def test_rejects_any_skip_when_required(self) -> None:
-        errors = assurance_errors(
-            tests_run=23, skipped=1, minimum_executed=22, fail_on_skip=True
-        )
-        self.assertEqual(["1 test(s) skipped in a no-skip suite"], errors)
-
-    def test_main_accepts_successful_assured_suite(self) -> None:
-        result = Mock(
-            testsRun=22,
-            skipped=[],
-            wasSuccessful=Mock(return_value=True),
-        )
-        runner = Mock()
-        runner.run.return_value = result
-        with patch(
-            "scripts.unittest_gate.unittest.defaultTestLoader.discover",
-            return_value=Mock(),
-        ) as discover, patch(
-            "scripts.unittest_gate.unittest.TextTestRunner",
-            return_value=runner,
-        ) as runner_type:
-            self.assertEqual(
-                0,
-                main([
-                    "-s", "tests/integration",
-                    "-t", ".",
-                    "-p", "test_*.py",
-                    "--minimum-executed", "22",
-                    "--fail-on-skip",
-                    "-v",
-                ]),
-            )
-        discover.assert_called_once_with(
-            "tests/integration", pattern="test_*.py", top_level_dir="."
-        )
-        runner_type.assert_called_once_with(verbosity=2)
-
-    def test_main_rejects_unsuccessful_underfilled_suite(self) -> None:
-        result = Mock(
-            testsRun=1,
-            skipped=[(Mock(), "not available")],
-            wasSuccessful=Mock(return_value=False),
-        )
-        runner = Mock()
-        runner.run.return_value = result
-        error = StringIO()
-        with patch(
-            "scripts.unittest_gate.unittest.defaultTestLoader.discover",
-            return_value=Mock(),
-        ), patch(
-            "scripts.unittest_gate.unittest.TextTestRunner",
-            return_value=runner,
-        ), redirect_stderr(error):
-            self.assertEqual(
-                1,
-                main(["--minimum-executed", "2", "--fail-on-skip"]),
-            )
-        self.assertIn("below required minimum", error.getvalue())
-        self.assertIn("skipped in a no-skip suite", error.getvalue())
-
-
-if __name__ == "__main__":
-    unittest.main()
Author	SHA1	Message	Date
didericis-codex	571ea4dbf0	chore: tighten upkeep boundaries and static checks tracker-policy-pr / check-pr (pull_request) Successful in 10s Details test / integration-docker (pull_request) Successful in 19s Details test / unit (pull_request) Successful in 53s Details test / coverage (pull_request) Successful in 16s Details	2026-07-26 06:42:34 +00:00
didericis-codex	b8893d4c0c	fix(diagnostics): make optional failures observable and safe	2026-07-26 06:42:34 +00:00
didericis-codex	9c3dd003af	refactor(backend): extract shared bottle preparation planner	2026-07-26 06:42:34 +00:00
didericis-codex	f081fdf7dd	refactor(egress): make addon core a compatibility facade	2026-07-26 06:42:34 +00:00
didericis-codex	14827bc151	refactor(egress): separate matching, DLP, and context concerns	2026-07-26 06:42:34 +00:00
didericis-codex	97bd7caa76	refactor: validate reconciliation inputs and neutralize CLI helpers	2026-07-26 06:42:34 +00:00