refactor(egress): separate matching, DLP, and context concerns

.gitea/workflows/canaries.yml

@@ -2,7 +2,7 @@
 # digest, etc.) without coupling every dev push to upstream registry
 # availability.
 #
-# Opt-in via BOT_BOTTLE_RUN_CANARIES=1 so the same files can be run
+# Opt-in via CLAUDE_BOTTLE_RUN_CANARIES=1 so the same files can be run
 # locally with the same gating.
 
 name: canaries
@@ -17,7 +17,7 @@ jobs:
   canaries:
     runs-on: ubuntu-latest
     env:
-      BOT_BOTTLE_RUN_CANARIES: "1"
+      CLAUDE_BOTTLE_RUN_CANARIES: "1"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -25,7 +25,4 @@ jobs:
       # No actions/setup-python: canaries are stdlib unittest on the image's
       # system Python 3.12 (older act_runner mishandles setup-python's PATH).
       - name: Run canaries
-        run: |
-          python3 -m scripts.unittest_gate \
-            -t . -s tests/canaries -v \
-            --minimum-executed 1 --fail-on-skip
+        run: python3 -m unittest discover -t . -s tests/canaries -v

.gitea/workflows/lint.yml

@@ -4,13 +4,6 @@ on:
   push:
     paths:
       - "**.py"
-      - "Dockerfile*"
-      - "bot_bottle/contrib/*/Dockerfile"
-      - "bot_bottle/contrib/*/package.json"
-      - "bot_bottle/contrib/*/package-lock.json"
-      - "bot_bottle/contrib/codex/codex-package_SHA256SUMS"
-      - "requirements.gateway.*"
-      - "image-build-args.json"
       - ".pylintrc"
       - ".gitea/workflows/lint.yml"
 
@@ -20,9 +13,6 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - name: Enforce immutable image inputs
-        run: python3 scripts/check_image_inputs.py
-
       # No actions/setup-python: the runner image already ships Python 3.12,
       # and older act_runner engines mishandle setup-python's PATH. Install
       # into the ephemeral job container's system Python — the pylint/pyright

.gitea/workflows/prd-number-check.yml

@@ -1,27 +0,0 @@
-name: prd-number-check
-
-on:
-  pull_request:
-    types: [opened, reopened, synchronize]
-    branches: [main]
-
-jobs:
-  require-numbered-prds:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Reject unnumbered PRDs
-        run: |
-          unnumbered=$(find docs/prds -maxdepth 1 -type f \
-            -name 'prd-new-*.md' -print | sort)
-
-          if [ -n "$unnumbered" ]; then
-            echo "::error::Assign every new PRD its final sequential number before merge."
-            echo "Unnumbered PRDs:"
-            echo "$unnumbered"
-            exit 1
-          fi
-
-          echo "All PRDs have final numbers."

.gitea/workflows/prd-number.yml

@@ -0,0 +1,122 @@
+# Assign sequential numbers to prd-new-*.md files on merge to main.
+#
+# When a PR merges to main and includes prd-new-*.md files this workflow:
+#   1. Finds the next available NNNN number by scanning existing PRDs.
+#   2. Renames each prd-new-*.md to NNNN-<slug>.md.
+#   3. Updates the title header (# PRD prd-new: → # PRD NNNN:).
+#   4. Flips Status: Draft → Active when the push touched files outside
+#      docs/prds/ anywhere in its commit range (i.e. the implementation
+#      shipped together with the PRD).
+#   5. Commits the renaming back to main.
+#
+# No-op if the working tree contains no prd-new-*.md files.
+#
+# NOTE: The workflow scans the working tree (not just HEAD~1..HEAD) because
+# PRs land as multi-commit pushes and the prd-new file is often added in an
+# earlier commit on the branch, not in the final squash/merge commit.
+
+name: prd-number
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'docs/prds/prd-new-*.md'
+
+jobs:
+  assign-numbers:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      # No actions/setup-python: the inline script is stdlib-only on the
+      # image's system Python 3.12 (older act_runner mishandles its PATH).
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Assign PRD numbers
+        run: |
+          python3 - <<'EOF'
+          import os
+          import re
+          import subprocess
+          import sys
+          from pathlib import Path
+
+          prds_dir = Path("docs/prds")
+
+          # Scan the working tree — prd-new files may have landed in any
+          # commit of a multi-commit push, not just HEAD.
+          new_prds = sorted(prds_dir.glob("prd-new-*.md"))
+
+          if not new_prds:
+              print("No prd-new-*.md files found — nothing to do.")
+              sys.exit(0)
+
+          # Determine whether non-PRD files were also changed anywhere in
+          # the push range (BEFORE_SHA → HEAD).  Falls back to HEAD~1 when
+          # the env var isn't set (e.g. local act runs).
+          before_sha = os.environ.get("GITHUB_EVENT_BEFORE", "HEAD~1")
+          all_changed = subprocess.run(
+              ["git", "diff", "--name-only", before_sha, "HEAD"],
+              capture_output=True, text=True, check=True,
+          ).stdout.splitlines()
+          non_prd_changed = any(
+              not f.startswith("docs/prds/") for f in all_changed
+          )
+
+          # Find next available number.
+          existing = sorted(
+              int(m.group(1))
+              for p in prds_dir.glob("*.md")
+              if (m := re.match(r"^(\d{4})-", p.name))
+          )
+          next_num = (max(existing) + 1) if existing else 1
+
+          for prd_path in sorted(new_prds):
+              slug = re.sub(r"^prd-new-", "", prd_path.stem)
+              new_name = f"{next_num:04d}-{slug}.md"
+              new_path = prds_dir / new_name
+              print(f"  {prd_path.name}  →  {new_name}")
+
+              content = prd_path.read_text()
+
+              # Update title header.
+              content = re.sub(
+                  r"^(#\s+PRD\s+)prd-new(:)",
+                  rf"\g<1>{next_num:04d}\2",
+                  content,
+                  count=1,
+                  flags=re.MULTILINE,
+              )
+
+              # Conditionally flip Status.
+              if non_prd_changed:
+                  content = re.sub(
+                      r"(\*\*Status:\*\*\s*)Draft",
+                      r"\g<1>Active",
+                      content,
+                      count=1,
+                  )
+
+              new_path.write_text(content)
+              subprocess.run(["git", "rm", str(prd_path)], check=True)
+              subprocess.run(["git", "add", str(new_path)], check=True)
+              next_num += 1
+
+          subprocess.run(
+              ["git", "commit", "-m", "ci(prd): assign sequential numbers to new PRDs"],
+              check=True,
+          )
+          subprocess.run(["git", "push"], check=True)
+          EOF

.gitea/workflows/pre-release-test.yml

@@ -1,363 +0,0 @@
-# Run the complete backend test suite before a release. This workflow is
-# intentionally manual because Firecracker and macOS use privileged,
-# self-hosted runners.
-#
-# The suite uses stdlib `unittest` discovery — no external Python
-# dependencies are required to execute it. Tests are split by directory:
-#
-#   tests/unit/         — pure unit tests; always run
-#   tests/integration/  — need a reachable backend; skip cleanly when
-#                         the backend isn't available on the runner
-#   tests/canaries/     — upstream regression canaries; run on a separate
-#                         schedule (see canaries.yml), not here
-#
-# Unit, Docker, and Firecracker run once under coverage and upload a small
-# .coverage.* artifact for the combined coverage job. macOS reports coverage
-# in place because it is an advisory host-mode runner.
-
-name: pre-release-test
-
-on:
-  workflow_dispatch:
-
-jobs:
-  unit:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      # No actions/setup-python: the runner image already ships Python 3.12,
-      # and older act_runner engines mishandle setup-python's PATH (coverage
-      # lands in one interpreter, `python3` resolves to another). Install
-      # straight into the ephemeral job container's system Python —
-      # --break-system-packages is safe because the container is disposable.
-      - name: Install dev requirements
-        run: python3 -m pip install --break-system-packages -r requirements-dev.txt
-
-      - name: Run unit tests with coverage
-        env:
-          COVERAGE_FILE: ${{ github.workspace }}/.coverage.unit
-        run: python3 -m coverage run -m unittest discover -t . -s tests/unit -v
-
-      - name: Report unit coverage
-        env:
-          COVERAGE_FILE: ${{ github.workspace }}/.coverage.unit
-        run: python3 -m coverage report -m
-
-      # upload-artifact@v3's glob skips dotfiles, so a bare `.coverage.unit`
-      # silently uploads nothing ("No files were found"). Stage it under a
-      # non-dot name; the coverage job renames it back before `coverage
-      # combine`. `cp` also fails loudly if coverage never wrote the file.
-      - name: Stage unit coverage for upload
-        run: cp .coverage.unit coverage-unit.dat
-
-      - name: Upload unit coverage artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: coverage-unit
-          path: coverage-unit.dat
-
-  integration-docker:
-    runs-on: ubuntu-latest
-    concurrency:
-      group: integration-docker-infra
-      cancel-in-progress: false
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      # No actions/setup-python (see the note in the `unit` job); the
-      # container's system Python 3.12 runs the stdlib test suite directly.
-      - name: Install coverage
-        run: python3 -m pip install --break-system-packages coverage
-
-      # Fail loudly if the backend this job promises isn't actually usable,
-      # rather than letting every test silently `unittest.skip` and the job
-      # go green on zero coverage. `backend status` prints a clear per-check
-      # summary (docker on PATH, daemon reachable) and exits non-zero when a
-      # prerequisite is missing — the same readiness check the skip guards
-      # gate on via `has_backend`.
-      - name: Preflight — Docker backend is ready
-        run: |
-          python3 --version
-          python3 cli.py backend status --backend=docker
-
-      - name: Run integration tests (docker) with coverage
-        env:
-          BOT_BOTTLE_BACKEND: docker
-          COVERAGE_FILE: ${{ github.workspace }}/.coverage.docker
-        run: |
-          set -euo pipefail
-          DOCKER_CLIENT_NETWORK=$(
-            docker inspect "$(hostname)" |
-              python3 -c 'import json,sys; n=json.load(sys.stdin)[0]["NetworkSettings"]["Networks"]; print(next(iter(n)))'
-          )
-          test -n "$DOCKER_CLIENT_NETWORK"
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          export NO_PROXY="*"
-          export no_proxy="*"
-          export BOT_BOTTLE_DOCKER_CLIENT_NETWORK="$DOCKER_CLIENT_NETWORK"
-          export BOT_BOTTLE_DOCKER_ROOT_MOUNT="bot-bottle-ci-root-$RUN_KEY"
-          export BOT_BOTTLE_DOCKER_CA_MOUNT="bot-bottle-ci-ca-$RUN_KEY"
-          python3 -m coverage run -m scripts.unittest_gate \
-            -t . -s tests/integration -v \
-            --minimum-executed 22 --fail-on-skip
-
-      - name: Clean Docker integration volumes
-        if: always()
-        run: |
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          docker volume rm --force \
-            "bot-bottle-ci-root-$RUN_KEY" \
-            "bot-bottle-ci-ca-$RUN_KEY" 2>/dev/null || true
-
-      # Non-dot name so upload-artifact's dotfile-skipping glob picks it up.
-      - name: Stage docker coverage for upload
-        run: cp .coverage.docker coverage-docker.dat
-
-      - name: Upload docker coverage artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: coverage-docker
-          path: coverage-docker.dat
-
-  # Integration tests against the Firecracker backend. Runs on a self-hosted
-  # KVM runner (label `kvm`) where /dev/kvm and the TAP/nft pool are available.
-  #
-  # Manual only: the privileged KVM runner does not execute proposed changes
-  # unattended.
-  #
-  # Runner prerequisites (provision once; see README "Firecracker on Linux"):
-  # `firecracker` on PATH, `/dev/kvm` accessible, cached kernel +
-  # static dropbear at /var/cache/bot-bottle-fc/dropbear, and the pool as a
-  # persistent systemd unit.
-  #
-  # The infra candidate is built here directly (no artifact download) to
-  # eliminate the ~70 s ubuntu-latest upload + ~83 s combined download that
-  # the old build-infra → integration-firecracker + coverage chain incurred.
-  integration-firecracker:
-    runs-on: [self-hosted, kvm]
-    if: github.event_name == 'workflow_dispatch'
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Preflight — Firecracker host is ready
-        run: |
-          command -v firecracker >/dev/null || {
-            echo "firecracker not on PATH — provision the runner (README: Firecracker on Linux)"; exit 1; }
-          test -e /dev/kvm || { echo "/dev/kvm missing — KVM not available on this runner"; exit 1; }
-          # `backend status` exits non-zero unless the TAP pool is up + no
-          # range overlap; it prints the exact `backend setup` fix.
-          python3 cli.py backend status --backend=firecracker
-
-      - name: Build infra candidate from this checkout
-        env:
-          BOT_BOTTLE_FC_DROPBEAR: /var/cache/bot-bottle-fc/dropbear
-        run: python3 -m bot_bottle.backend.firecracker.publish_infra --output infra-candidate --reuse-published
-
-      - name: Replace the persistent infra VM with the candidate
-        run: python3 -c 'from bot_bottle.backend.firecracker import infra_vm; infra_vm.stop()'
-
-      # No dev-requirements install: `coverage` is already provided by the
-      # self-hosted runner's Nix python env, and that env has no `pip`
-      # module to install into anyway.
-      - name: Run integration tests (firecracker) with coverage
-        env:
-          BOT_BOTTLE_BACKEND: firecracker
-          BOT_BOTTLE_INFRA_ARTIFACT_DIR: ${{ github.workspace }}/infra-candidate
-          COVERAGE_FILE: ${{ github.workspace }}/.coverage.firecracker
-        run: python3 -m coverage run -m unittest discover -t . -s tests/integration -v
-
-      - name: Stage firecracker coverage for upload
-        run: cp .coverage.firecracker coverage-firecracker.dat
-
-      - name: Upload firecracker coverage artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: coverage-firecracker
-          path: coverage-firecracker.dat
-
-      - name: Upload tested rootfs
-        uses: actions/upload-artifact@v3
-        with:
-          name: infra-candidate
-          path: infra-candidate/
-
-      - name: Upload dropbear for publish verification
-        uses: actions/upload-artifact@v3
-        with:
-          name: firecracker-inputs
-          path: /var/cache/bot-bottle-fc/dropbear
-
-  # Integration tests against the macOS Apple Container backend. Runs on a
-  # self-hosted macOS runner (label `macos`) registered in HOST mode — Apple
-  # Container needs the host `container` CLI + virtualization framework and
-  # cannot run inside a Linux container, so this cannot reuse the KVM runner.
-  #
-  # Advisory only: workflow_dispatch (manual) exclusively — never push or
-  # pull_request. A single non-redundant laptop that sleeps/roams must not run
-  # unattended on every push to main, let alone block a PR merge, so this job is
-  # deliberately NOT in the `coverage` job's `needs` and its coverage never
-  # feeds the diff-coverage gate. Dispatch-only also means no fork PR (or any
-  # push) ever executes on the host-mode runner.
-  #
-  # The infra container is a singleton (`bot-bottle-mac-infra`); the
-  # `concurrency` group serializes runs so two never collide on it (#425), and
-  # the always-run teardown removes it so a crashed run can't wedge the next.
-  #
-  # Runner prerequisites (provision once; see README "macOS Apple Container"):
-  # the `container` CLI on PATH with `container system status` running, and a
-  # Python >=3.11 with `coverage` importable on the launchd service PATH.
-  integration-macos:
-    runs-on: [self-hosted, macos]
-    if: github.event_name == 'workflow_dispatch'
-    concurrency:
-      group: integration-macos-infra
-      cancel-in-progress: false
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      # Fail loudly if the backend this job promises isn't actually usable,
-      # rather than letting every test silently `unittest.skip` and the job go
-      # green on zero coverage. `backend status` exits non-zero (and prints the
-      # per-check summary) when the `container` CLI or its system service is
-      # missing — the same readiness check the skip guards gate on.
-      - name: Preflight — Apple Container backend is ready
-        run: |
-          command -v container >/dev/null || {
-            echo "container CLI not on PATH — provision the runner (README: macOS Apple Container)"; exit 1; }
-          container system status || {
-            echo "container system service not running — run 'container system start'"; exit 1; }
-          python3 cli.py backend status --backend=macos-container
-
-      # `coverage` comes from the runner's provisioned Python (no pip install
-      # into the host interpreter). Advisory job: report coverage in-line for
-      # visibility but don't upload — it never feeds the combined gate.
-      - name: Run integration tests (macos-container) with coverage
-        env:
-          BOT_BOTTLE_BACKEND: macos-container
-          COVERAGE_FILE: ${{ github.workspace }}/.coverage.macos
-        run: python3 -m coverage run -m unittest discover -t . -s tests/integration -v
-
-      - name: Report macos coverage
-        env:
-          COVERAGE_FILE: ${{ github.workspace }}/.coverage.macos
-        run: python3 -m coverage report -m
-
-      # On failure, capture the infra containers' state and logs BEFORE the
-      # teardown below removes them — otherwise a control-plane crash is
-      # undiagnosable from CI, since `stop()` deletes the orchestrator (and its
-      # logs) on every run. Best-effort: never let the diagnostics themselves
-      # fail the job, and keep going if a container is already gone.
-      - name: Dump infra diagnostics (on failure)
-        if: failure()
-        run: |
-          set +e
-          echo "=== containers ==="
-          container ls -a | grep bot-bottle-mac || echo "(no bot-bottle-mac containers)"
-          echo "=== networks ==="
-          container network ls | grep bot-bottle-mac || echo "(no bot-bottle-mac networks)"
-          for c in bot-bottle-mac-orchestrator bot-bottle-mac-infra; do
-            echo "=== inspect $c ==="
-            container inspect "$c" || echo "($c not found)"
-            echo "=== logs $c ==="
-            container logs "$c" || echo "($c logs unavailable)"
-          done
-          exit 0
-
-      # Remove the singleton infra container so a crashed or cancelled run
-      # cannot leave `bot-bottle-mac-infra` wedged for the next job.
-      - name: Teardown infra singleton
-        if: always()
-        run: python3 -c 'from bot_bottle.backend.macos_container.infra import MacosInfraService; MacosInfraService().stop()'
-
-  # Combined coverage gate: aggregates .coverage.* artifacts uploaded by each
-  # test job, then runs the diff-coverage gate (new/changed lines >= 90%).
-  #
-  # Runs on ubuntu-latest — no KVM needed, no test reruns. Coverage files use
-  # relative_files = True (.coveragerc) so they combine cleanly across runners.
-  # Each test job sets COVERAGE_FILE to an absolute path so coverage.py writes
-  # to a known location that upload-artifact can find regardless of runner env.
-  #
-  coverage:
-    needs: [unit, integration-docker, integration-firecracker]
-    timeout-minutes: 15
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install coverage
-        run: python3 -m pip install --break-system-packages coverage
-
-      - name: Download unit coverage artifact
-        uses: actions/download-artifact@v3
-        with:
-          name: coverage-unit
-          path: ${{ github.workspace }}
-
-      - name: Download docker coverage artifact
-        uses: actions/download-artifact@v3
-        with:
-          name: coverage-docker
-          path: ${{ github.workspace }}
-
-      - name: Download firecracker coverage artifact
-        uses: actions/download-artifact@v3
-        with:
-          name: coverage-firecracker
-          path: ${{ github.workspace }}
-
-      # Rename the non-dot upload names back to the .coverage.* files that
-      # `coverage combine` discovers (see the staging steps in each test job).
-      - name: Reassemble coverage data files
-        run: |
-          mv coverage-unit.dat .coverage.unit
-          mv coverage-docker.dat .coverage.docker
-          mv coverage-firecracker.dat .coverage.firecracker
-
-      - name: Combined coverage (unit + integration, incl. firecracker)
-        run: PYTHON=python3 bash scripts/coverage.sh aggregate critical
-
-      - name: Diff-coverage gate (changed lines >= 90%)
-        run: |
-          git fetch --no-tags origin main:refs/remotes/origin/main
-          python3 scripts/diff_coverage.py --base origin/main --min 90
-
-  publish-infra:
-    needs:
-      - unit
-      - integration-docker
-      - integration-firecracker
-      - integration-macos
-      - coverage
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout the tested revision
-        uses: actions/checkout@v4
-
-      - name: Download the tested rootfs
-        uses: actions/download-artifact@v3
-        with:
-          name: infra-candidate
-          path: infra-candidate
-
-      # publish_infra re-derives the version from the checkout to confirm the
-      # bundle matches before uploading, and the version hashes the dropbear
-      # bytes. Download the same dropbear integration-firecracker used.
-      - name: Download the staged dropbear
-        uses: actions/download-artifact@v3
-        with:
-          name: firecracker-inputs
-          path: firecracker-inputs
-
-      - name: Publish the tested candidate
-        env:
-          BOT_BOTTLE_INFRA_ARTIFACT_TOKEN: ${{ secrets.BOT_BOTTLE_INFRA_ARTIFACT_TOKEN }}
-          BOT_BOTTLE_FC_DROPBEAR: ${{ github.workspace }}/firecracker-inputs/dropbear
-        run: python3 -m bot_bottle.backend.firecracker.publish_infra --publish-dir infra-candidate

.gitea/workflows/refresh-image-locks.yml

@@ -1,97 +0,0 @@
-# Manually refresh the committed package locks and the pinned Codex installer
-# checksum after deliberately changing a direct version in the source files.
-#
-# The job uploads the generated files for review; it never commits or pushes.
-
-name: refresh-image-locks
-
-on:
-  workflow_dispatch:
-  push:
-    paths:
-      - 'requirements.gateway.in'
-      - 'bot_bottle/contrib/claude/package.json'
-      - 'bot_bottle/contrib/pi/package.json'
-      - 'bot_bottle/contrib/codex/Dockerfile'
-      - 'image-build-args.json'
-      - '.gitea/workflows/refresh-image-locks.yml'
-
-permissions:
-  code: read
-
-jobs:
-  refresh:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Resolve image runtime versions
-        id: runtimes
-        run: |
-          python3 - <<'PY' >> "$GITHUB_OUTPUT"
-          import json
-          import re
-          inputs = json.load(open("image-build-args.json"))
-          for output, name in (
-              ("python-version", "PYTHON_BASE_IMAGE"),
-              ("node-version", "NODE_BASE_IMAGE"),
-          ):
-              match = re.search(r":(\d+\.\d+\.\d+)-", inputs[name])
-              if match is None:
-                  raise SystemExit(f"cannot resolve runtime version from {name}")
-              print(f"{output}={match.group(1)}")
-          PY
-
-      - name: Use the image Python version
-        uses: actions/setup-python@v5
-        with:
-          python-version: '${{ steps.runtimes.outputs.python-version }}'
-
-      - name: Use the image Node version
-        uses: actions/setup-node@v4
-        with:
-          node-version: '${{ steps.runtimes.outputs.node-version }}'
-
-      - name: Compile gateway Python lock
-        run: |
-          python3 -m venv /tmp/image-lock-tools
-          /tmp/image-lock-tools/bin/python -m pip install \
-            pip==25.2 \
-            pip-tools==7.5.1
-          /tmp/image-lock-tools/bin/python -m piptools compile \
-            --generate-hashes \
-            --output-file requirements.gateway.lock \
-            requirements.gateway.in
-
-      - name: Resolve provider npm locks
-        run: |
-          for provider in claude pi; do
-            (
-              cd "bot_bottle/contrib/$provider"
-              npm install --package-lock-only --ignore-scripts --no-audit --no-fund
-            )
-          done
-          python3 scripts/complete_npm_lock_integrity.py \
-            bot_bottle/contrib/claude/package-lock.json \
-            bot_bottle/contrib/pi/package-lock.json
-
-      - name: Refresh pinned Codex archive checksums
-        run: |
-          CODEX_VERSION=$(
-            sed -n 's/^ARG CODEX_VERSION=//p' bot_bottle/contrib/codex/Dockerfile
-          )
-          test -n "$CODEX_VERSION"
-          curl -fsSL \
-            "https://github.com/openai/codex/releases/download/rust-v${CODEX_VERSION}/codex-package_SHA256SUMS" \
-            -o bot_bottle/contrib/codex/codex-package_SHA256SUMS
-
-      - name: Upload refreshed inputs
-        uses: actions/upload-artifact@v3
-        with:
-          name: image-input-locks
-          path: |
-            requirements.gateway.lock
-            bot_bottle/contrib/claude/package-lock.json
-            bot_bottle/contrib/pi/package-lock.json
-            bot_bottle/contrib/codex/codex-package_SHA256SUMS

.gitea/workflows/test.yml

@@ -1,6 +1,21 @@
-# Run the automated test gate when package or runtime inputs change on a PR
-# or on push to main. Privileged self-hosted backends live in the manually
-# dispatched pre-release-test workflow.
+# Run the project's test suite when package or runtime inputs change on a PR
+# or on push to main.
+#
+# The suite uses stdlib `unittest` discovery — no external Python
+# dependencies are required to execute it. Tests are split by directory:
+#
+#   tests/unit/         — pure unit tests; always run
+#   tests/integration/  — need a reachable backend; skip cleanly when
+#                         the backend isn't available on the runner
+#   tests/canaries/     — upstream regression canaries; run on a separate
+#                         schedule (see canaries.yml), not here
+#
+# Each test job runs once under coverage and uploads a small .coverage.*
+# artifact. The `coverage` job combines them — no test reruns, no KVM
+# dependency on that job. For main-branch pushes only, the tested rootfs
+# and matching dropbear are uploaded so `publish-infra` can publish the
+# byte-identical artifact that was tested. PRs avoid the ~194 MB rootfs
+# transfer entirely.
 
 name: test
 
@@ -12,49 +27,32 @@ on:
       - 'bot_bottle/**'
       - 'tests/**/*.py'
       - 'cli.py'
-      - 'install.sh'
-      - 'setup.py'
-      - 'MANIFEST.in'
-      - 'flake.nix'
-      - 'nix/firecracker-netpool.nix'
       - 'scripts/coverage.sh'
       - 'scripts/critical-modules.txt'
-      - 'scripts/**/*.py'
+      - 'scripts/diff_coverage.py'
+      - 'scripts/tracker_policy.py'
       - 'scripts/firecracker-netpool.sh'
       - 'Dockerfile*'
-      - 'image-build-args.json'
       - 'pyproject.toml'
       - 'requirements-dev.txt'
-      - 'requirements.gateway.*'
       - '.coveragerc'
       - '.dockerignore'
-      - '.gitea/workflows/test.yml'
-      - '.gitea/workflows/refresh-image-locks.yml'
-      - '.gitea/workflows/pre-release-test.yml'
   pull_request:
     paths:
       - 'bot_bottle/**'
       - 'tests/**/*.py'
       - 'cli.py'
-      - 'install.sh'
-      - 'setup.py'
-      - 'MANIFEST.in'
-      - 'flake.nix'
-      - 'nix/firecracker-netpool.nix'
       - 'scripts/coverage.sh'
       - 'scripts/critical-modules.txt'
-      - 'scripts/**/*.py'
+      - 'scripts/diff_coverage.py'
+      - 'scripts/tracker_policy.py'
       - 'scripts/firecracker-netpool.sh'
       - 'Dockerfile*'
-      - 'image-build-args.json'
       - 'pyproject.toml'
       - 'requirements-dev.txt'
-      - 'requirements.gateway.*'
       - '.coveragerc'
       - '.dockerignore'
-      - '.gitea/workflows/test.yml'
-      - '.gitea/workflows/refresh-image-locks.yml'
-      - '.gitea/workflows/pre-release-test.yml'
+  workflow_dispatch:
 
 jobs:
   unit:
@@ -63,6 +61,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # No actions/setup-python: the runner image already ships Python 3.12,
+      # and older act_runner engines mishandle setup-python's PATH (coverage
+      # lands in one interpreter, `python3` resolves to another). Install
+      # straight into the ephemeral job container's system Python —
+      # --break-system-packages is safe because the container is disposable.
       - name: Install dev requirements
         run: python3 -m pip install --break-system-packages -r requirements-dev.txt
 
@@ -76,6 +79,10 @@ jobs:
           COVERAGE_FILE: ${{ github.workspace }}/.coverage.unit
         run: python3 -m coverage report -m
 
+      # upload-artifact@v3's glob skips dotfiles, so a bare `.coverage.unit`
+      # silently uploads nothing ("No files were found"). Stage it under a
+      # non-dot name; the coverage job renames it back before `coverage
+      # combine`. `cp` also fails loudly if coverage never wrote the file.
       - name: Stage unit coverage for upload
         run: cp .coverage.unit coverage-unit.dat
 
@@ -87,67 +94,33 @@ jobs:
 
   integration-docker:
     runs-on: ubuntu-latest
-    concurrency:
-      group: integration-docker-infra
-      cancel-in-progress: false
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # No actions/setup-python (see the note in the `unit` job); the
+      # container's system Python 3.12 runs the stdlib test suite directly.
       - name: Install coverage
         run: python3 -m pip install --break-system-packages coverage
 
+      # Fail loudly if the backend this job promises isn't actually usable,
+      # rather than letting every test silently `unittest.skip` and the job
+      # go green on zero coverage. `backend status` prints a clear per-check
+      # summary (docker on PATH, daemon reachable) and exits non-zero when a
+      # prerequisite is missing — the same readiness check the skip guards
+      # gate on via `has_backend`.
       - name: Preflight — Docker backend is ready
         run: |
           python3 --version
           python3 cli.py backend status --backend=docker
 
-      - name: Preflight — clear any leftover poisoned gateway network
-        run: |
-          # The gateway network has a fixed name and persists across jobs on
-          # this shared runner. A pre-fix or concurrent launch can leave it with
-          # a malformed IPv6 subnet that trips docker's own ParseAddr in
-          # `network inspect` (see PR #515); the code now self-heals it, but the
-          # heal can't run if `network inspect` is what's broken on some daemon
-          # versions. Drop the network here so this run recreates it IPv4-only.
-          # Remove the attached gateway container first (else `network rm` fails
-          # on active endpoints); both are recreated by ensure_running. Harmless
-          # when absent.
-          docker rm --force bot-bottle-orch-gateway 2>/dev/null || true
-          docker network rm bot-bottle-gateway 2>/dev/null || true
-
       - name: Run integration tests (docker) with coverage
         env:
           BOT_BOTTLE_BACKEND: docker
           COVERAGE_FILE: ${{ github.workspace }}/.coverage.docker
-        run: |
-          set -euo pipefail
-          # act_runner executes this job in a container while sharing the host
-          # Docker socket. Attach control-plane siblings to the job's network,
-          # and use named volumes for state the host daemon must mount.
-          DOCKER_CLIENT_NETWORK=$(
-            docker inspect "$(hostname)" |
-              python3 -c 'import json,sys; n=json.load(sys.stdin)[0]["NetworkSettings"]["Networks"]; print(next(iter(n)))'
-          )
-          test -n "$DOCKER_CLIENT_NETWORK"
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          export NO_PROXY="*"
-          export no_proxy="*"
-          export BOT_BOTTLE_DOCKER_CLIENT_NETWORK="$DOCKER_CLIENT_NETWORK"
-          export BOT_BOTTLE_DOCKER_ROOT_MOUNT="bot-bottle-ci-root-$RUN_KEY"
-          export BOT_BOTTLE_DOCKER_CA_MOUNT="bot-bottle-ci-ca-$RUN_KEY"
-          python3 -m coverage run -m scripts.unittest_gate \
-            -t . -s tests/integration -v \
-            --minimum-executed 22 --fail-on-skip
-
-      - name: Clean Docker integration volumes
-        if: always()
-        run: |
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          docker volume rm --force \
-            "bot-bottle-ci-root-$RUN_KEY" \
-            "bot-bottle-ci-ca-$RUN_KEY" 2>/dev/null || true
+        run: python3 -m coverage run -m unittest discover -t . -s tests/integration -v
 
+      # Non-dot name so upload-artifact's dotfile-skipping glob picks it up.
       - name: Stage docker coverage for upload
         run: cp .coverage.docker coverage-docker.dat
 
@@ -157,118 +130,190 @@ jobs:
           name: coverage-docker
           path: coverage-docker.dat
 
-  image-input-builds:
-    runs-on: ubuntu-latest
+  # Integration tests against the Firecracker backend. Runs on a self-hosted
+  # KVM runner (label `kvm`) where /dev/kvm and the TAP/nft pool are available.
+  #
+  # Restricted to same-repo PRs, push to main, and workflow_dispatch — fork
+  # PRs don't execute untrusted code on the privileged runner.
+  #
+  # Runner prerequisites (provision once; see README "Firecracker on Linux"):
+  # `firecracker` on PATH, `/dev/kvm` accessible, cached kernel +
+  # static dropbear at /var/cache/bot-bottle-fc/dropbear, and the pool as a
+  # persistent systemd unit.
+  #
+  # The infra candidate is built here directly (no artifact download) to
+  # eliminate the ~70 s ubuntu-latest upload + ~83 s combined download that
+  # the old build-infra → integration-firecracker + coverage chain incurred.
+  # For main-branch pushes the tested rootfs and matching dropbear are
+  # uploaded so publish-infra can publish the byte-identical artifact; PRs
+  # skip those uploads entirely.
+  integration-firecracker:
+    runs-on: [self-hosted, kvm]
+    if: >-
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' &&
+       github.event.pull_request.head.repo.full_name == github.repository)
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Verify shared bases cover supported architectures
+      - name: Preflight — Firecracker host is ready
         run: |
-          set -euo pipefail
-          python_ref=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["PYTHON_BASE_IMAGE"])')
-          node_ref=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["NODE_BASE_IMAGE"])')
-          docker_cli_ref=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["DOCKER_CLI_BASE_IMAGE"])')
-          test -n "$python_ref"
-          test -n "$node_ref"
-          test -n "$docker_cli_ref"
-          for ref in "$python_ref" "$node_ref" "$docker_cli_ref"; do
-            docker buildx imagetools inspect --raw "$ref" |
-              python3 -c '
-          import json
-          import sys
-          manifest = json.load(sys.stdin)
-          platforms = {
-              (item["platform"]["os"], item["platform"]["architecture"])
-              for item in manifest["manifests"]
-              if item.get("platform", {}).get("os") != "unknown"
-          }
-          required = {("linux", "amd64"), ("linux", "arm64")}
-          missing = required - platforms
-          if missing:
-              raise SystemExit(f"base manifest lacks supported platforms: {missing}")
-          '
+          command -v firecracker >/dev/null || {
+            echo "firecracker not on PATH — provision the runner (README: Firecracker on Linux)"; exit 1; }
+          test -e /dev/kvm || { echo "/dev/kvm missing — KVM not available on this runner"; exit 1; }
+          # `backend status` exits non-zero unless the TAP pool is up + no
+          # range overlap; it prints the exact `backend setup` fix.
+          python3 cli.py backend status --backend=firecracker
+
+      - name: Build infra candidate from this checkout
+        env:
+          BOT_BOTTLE_FC_DROPBEAR: /var/cache/bot-bottle-fc/dropbear
+        run: python3 -m bot_bottle.backend.firecracker.publish_infra --output infra-candidate --reuse-published
+
+      - name: Replace the persistent infra VM with the candidate
+        run: python3 -c 'from bot_bottle.backend.firecracker import infra_vm; infra_vm.stop()'
+
+      # No dev-requirements install: `coverage` is already provided by the
+      # self-hosted runner's Nix python env, and that env has no `pip`
+      # module to install into anyway.
+      - name: Run integration tests (firecracker) with coverage
+        env:
+          BOT_BOTTLE_BACKEND: firecracker
+          BOT_BOTTLE_INFRA_ARTIFACT_DIR: ${{ github.workspace }}/infra-candidate
+          COVERAGE_FILE: ${{ github.workspace }}/.coverage.firecracker
+        run: python3 -m coverage run -m unittest discover -t . -s tests/integration -v
+
+      # Non-dot name so upload-artifact's dotfile-skipping glob picks it up.
+      - name: Stage firecracker coverage for upload
+        run: cp .coverage.firecracker coverage-firecracker.dat
+
+      - name: Upload firecracker coverage artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: coverage-firecracker
+          path: coverage-firecracker.dat
+
+      # Only upload the large rootfs artifact on main-branch pushes;
+      # PRs avoid the ~194 MB transfer. publish-infra only runs on main
+      # and downloads these to publish the byte-identical tested rootfs.
+      - name: Upload tested rootfs (main branch only)
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v3
+        with:
+          name: infra-candidate
+          path: infra-candidate/
+
+      - name: Upload dropbear for publish verification (main branch only)
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v3
+        with:
+          name: firecracker-inputs
+          path: /var/cache/bot-bottle-fc/dropbear
+
+  # Integration tests against the macOS Apple Container backend. Runs on a
+  # self-hosted macOS runner (label `macos`) registered in HOST mode — Apple
+  # Container needs the host `container` CLI + virtualization framework and
+  # cannot run inside a Linux container, so this cannot reuse the KVM runner.
+  #
+  # Advisory only: workflow_dispatch (manual) exclusively — never push or
+  # pull_request. A single non-redundant laptop that sleeps/roams must not run
+  # unattended on every push to main, let alone block a PR merge, so this job is
+  # deliberately NOT in the `coverage` job's `needs` and its coverage never
+  # feeds the diff-coverage gate. Dispatch-only also means no fork PR (or any
+  # push) ever executes on the host-mode runner.
+  #
+  # The infra container is a singleton (`bot-bottle-mac-infra`); the
+  # `concurrency` group serializes runs so two never collide on it (#425), and
+  # the always-run teardown removes it so a crashed run can't wedge the next.
+  #
+  # Runner prerequisites (provision once; see README "macOS Apple Container"):
+  # the `container` CLI on PATH with `container system status` running, and a
+  # Python >=3.11 with `coverage` importable on the launchd service PATH.
+  integration-macos:
+    runs-on: [self-hosted, macos]
+    if: github.event_name == 'workflow_dispatch'
+    concurrency:
+      group: integration-macos-infra
+      cancel-in-progress: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Fail loudly if the backend this job promises isn't actually usable,
+      # rather than letting every test silently `unittest.skip` and the job go
+      # green on zero coverage. `backend status` exits non-zero (and prints the
+      # per-check summary) when the `container` CLI or its system service is
+      # missing — the same readiness check the skip guards gate on.
+      - name: Preflight — Apple Container backend is ready
+        run: |
+          command -v container >/dev/null || {
+            echo "container CLI not on PATH — provision the runner (README: macOS Apple Container)"; exit 1; }
+          container system status || {
+            echo "container system service not running — run 'container system start'"; exit 1; }
+          python3 cli.py backend status --backend=macos-container
+
+      # `coverage` comes from the runner's provisioned Python (no pip install
+      # into the host interpreter). Advisory job: report coverage in-line for
+      # visibility but don't upload — it never feeds the combined gate.
+      - name: Run integration tests (macos-container) with coverage
+        env:
+          BOT_BOTTLE_BACKEND: macos-container
+          COVERAGE_FILE: ${{ github.workspace }}/.coverage.macos
+        run: python3 -m coverage run -m unittest discover -t . -s tests/integration -v
+
+      - name: Report macos coverage
+        env:
+          COVERAGE_FILE: ${{ github.workspace }}/.coverage.macos
+        run: python3 -m coverage report -m
+
+      # On failure, capture the infra containers' state and logs BEFORE the
+      # teardown below removes them — otherwise a control-plane crash is
+      # undiagnosable from CI, since `stop()` deletes the orchestrator (and its
+      # logs) on every run. Best-effort: never let the diagnostics themselves
+      # fail the job, and keep going if a container is already gone.
+      - name: Dump infra diagnostics (on failure)
+        if: failure()
+        run: |
+          set +e
+          echo "=== containers ==="
+          container ls -a | grep bot-bottle-mac || echo "(no bot-bottle-mac containers)"
+          echo "=== networks ==="
+          container network ls | grep bot-bottle-mac || echo "(no bot-bottle-mac networks)"
+          for c in bot-bottle-mac-orchestrator bot-bottle-mac-infra; do
+            echo "=== inspect $c ==="
+            container inspect "$c" || echo "($c not found)"
+            echo "=== logs $c ==="
+            container logs "$c" || echo "($c logs unavailable)"
           done
+          exit 0
 
-      - name: Verify Codex archives for all supported architectures
-        run: |
-          set -euo pipefail
-          codex_version=$(
-            sed -n 's/^ARG CODEX_VERSION=//p' bot_bottle/contrib/codex/Dockerfile
-          )
-          test -n "$codex_version"
-          tmp=$(mktemp -d)
-          trap 'rm -rf "$tmp"' EXIT
-          for target in \
-            aarch64-unknown-linux-musl \
-            x86_64-unknown-linux-musl
-          do
-            asset="codex-package-${target}.tar.gz"
-            expected=$(
-              awk -v asset="$asset" '$2 == asset { print $1 }' \
-                bot_bottle/contrib/codex/codex-package_SHA256SUMS
-            )
-            test -n "$expected"
-            curl -fsSL \
-              "https://github.com/openai/codex/releases/download/rust-v${codex_version}/${asset}" \
-              -o "$tmp/$asset"
-            echo "$expected  $tmp/$asset" | sha256sum -c -
-            tar -tzf "$tmp/$asset" > "$tmp/$asset.contents"
-            grep -Fx 'bin/codex' "$tmp/$asset.contents"
-            grep -Fx 'bin/codex-code-mode-host' "$tmp/$asset.contents"
-            grep -Fx 'codex-package.json' "$tmp/$asset.contents"
-          done
-
-      - name: Build and smoke-test all supported images
-        run: |
-          set -euo pipefail
-          suffix="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-image-inputs}}"
-          orchestrator="bot-bottle-orchestrator-inputs:${suffix}"
-          gateway="bot-bottle-gateway-inputs:${suffix}"
-          orchestrator_fc="bot-bottle-orchestrator-fc-inputs:${suffix}"
-          claude="bot-bottle-claude-inputs:${suffix}"
-          codex="bot-bottle-codex-inputs:${suffix}"
-          pi="bot-bottle-pi-inputs:${suffix}"
-          python_base=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["PYTHON_BASE_IMAGE"])')
-          node_base=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["NODE_BASE_IMAGE"])')
-
-          docker build --build-arg "PYTHON_BASE_IMAGE=$python_base" \
-            -t "$orchestrator" -f Dockerfile.orchestrator .
-          orchestrator_id=$(docker image inspect --format '{{.Id}}' "$orchestrator")
-          case "$orchestrator_id" in sha256:*) ;; *) exit 1 ;; esac
-          orchestrator_base="bot-bottle-orchestrator-inputs:sha256-${orchestrator_id#sha256:}"
-          docker image tag "$orchestrator_id" "$orchestrator_base"
-          test "$(
-            docker image inspect --format '{{.Id}}' "$orchestrator_base"
-          )" = "$orchestrator_id"
-          docker build --build-arg "PYTHON_BASE_IMAGE=$python_base" \
-            -t "$gateway" -f Dockerfile.gateway .
-          docker build \
-            --build-arg "ORCHESTRATOR_BASE_IMAGE=$orchestrator_base" \
-            -t "$orchestrator_fc" -f Dockerfile.orchestrator.fc .
-          docker build --build-arg "NODE_BASE_IMAGE=$node_base" \
-            -t "$claude" -f bot_bottle/contrib/claude/Dockerfile .
-          docker build --build-arg "NODE_BASE_IMAGE=$node_base" \
-            -t "$codex" -f bot_bottle/contrib/codex/Dockerfile .
-          docker build --build-arg "NODE_BASE_IMAGE=$node_base" \
-            -t "$pi" -f bot_bottle/contrib/pi/Dockerfile .
-
-          docker run --rm --entrypoint python3 "$orchestrator" -c \
-            'import bot_bottle.orchestrator'
-          docker run --rm --entrypoint mitmdump "$gateway" --version
-          docker run --rm "$claude" claude --version
-          docker run --rm "$codex" codex --version
-          docker run --rm "$pi" pi --version
+      # Remove the singleton infra container so a crashed or cancelled run
+      # cannot leave `bot-bottle-mac-infra` wedged for the next job.
+      - name: Teardown infra singleton
+        if: always()
+        run: python3 -c 'from bot_bottle.backend.macos_container.infra import MacosInfraService; MacosInfraService().stop()'
 
+  # Combined coverage gate: aggregates .coverage.* artifacts uploaded by each
+  # test job, then runs the diff-coverage gate (new/changed lines >= 90%).
+  #
+  # Runs on ubuntu-latest — no KVM needed, no test reruns. Coverage files use
+  # relative_files = True (.coveragerc) so they combine cleanly across runners.
+  # Each test job sets COVERAGE_FILE to an absolute path so coverage.py writes
+  # to a known location that upload-artifact can find regardless of runner env.
+  #
+  # Restricted to the same events as integration-firecracker: it depends on
+  # that job's coverage artifact and skips for fork PRs alongside it.
   coverage:
-    needs: [unit, integration-docker]
+    needs: [unit, integration-docker, integration-firecracker]
     timeout-minutes: 15
     runs-on: ubuntu-latest
+    if: >-
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' &&
+       github.event.pull_request.head.repo.full_name == github.repository)
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -290,15 +335,55 @@ jobs:
           name: coverage-docker
           path: ${{ github.workspace }}
 
+      - name: Download firecracker coverage artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: coverage-firecracker
+          path: ${{ github.workspace }}
+
+      # Rename the non-dot upload names back to the .coverage.* files that
+      # `coverage combine` discovers (see the staging steps in each test job).
       - name: Reassemble coverage data files
         run: |
           mv coverage-unit.dat .coverage.unit
           mv coverage-docker.dat .coverage.docker
+          mv coverage-firecracker.dat .coverage.firecracker
 
-      - name: Combined coverage (unit + docker integration)
+      - name: Combined coverage (unit + integration, incl. firecracker)
         run: PYTHON=python3 bash scripts/coverage.sh aggregate critical
 
-      - name: Diff-coverage gate (changed lines >= 80%)
+      - name: Diff-coverage gate (changed lines >= 90%)
         run: |
           git fetch --no-tags origin main:refs/remotes/origin/main
-          python3 scripts/diff_coverage.py --base origin/main --min 80
+          python3 scripts/diff_coverage.py --base origin/main --min 90
+
+  publish-infra:
+    needs: [unit, integration-docker, integration-firecracker, coverage]
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    steps:
+      - name: Checkout the tested revision
+        uses: actions/checkout@v4
+
+      - name: Download the tested rootfs
+        uses: actions/download-artifact@v3
+        with:
+          name: infra-candidate
+          path: infra-candidate
+
+      # publish_infra re-derives the version from the checkout to confirm the
+      # bundle matches before uploading, and the version hashes the dropbear
+      # bytes. Download the SAME dropbear integration-firecracker used, or
+      # the recheck computes a "<missing>"-dropbear version and rejects the
+      # candidate.
+      - name: Download the staged dropbear (matches build's version)
+        uses: actions/download-artifact@v3
+        with:
+          name: firecracker-inputs
+          path: firecracker-inputs
+
+      - name: Publish the tested candidate
+        env:
+          BOT_BOTTLE_INFRA_ARTIFACT_TOKEN: ${{ secrets.BOT_BOTTLE_INFRA_ARTIFACT_TOKEN }}
+          BOT_BOTTLE_FC_DROPBEAR: ${{ github.workspace }}/firecracker-inputs/dropbear
+        run: python3 -m bot_bottle.backend.firecracker.publish_infra --publish-dir infra-candidate

.gitea/workflows/update-badges.yml

@@ -33,28 +33,19 @@ jobs:
       - name: Run coverage and extract percentage
         id: coverage
         run: |
-          set -euo pipefail
-          # Never publish a badge from a failed or partial test run.
-          python3 -m coverage run -m unittest discover -t . -s tests/unit
-          REPORT=$(python3 -m coverage report)
-          printf '%s\n' "$REPORT"
-          PERCENT=$(printf '%s\n' "$REPORT" | awk '$1 == "TOTAL" {gsub("%", "", $NF); print $NF}')
-          test -n "$PERCENT"
+          python3 -m coverage run -m unittest discover -t . -s tests/unit > /dev/null 2>&1 || true
+          PERCENT=$(python3 -m coverage report 2>/dev/null | grep '^TOTAL' | grep -oP '\d+(?=%)' | tail -1)
           echo "percent=$PERCENT" >> $GITHUB_OUTPUT
           echo "Coverage: $PERCENT%"
 
       - name: Extract core (critical-module) coverage percentage
         id: core_coverage
         run: |
-          set -euo pipefail
           # Reuses the .coverage data from the previous step. The core list is
-          # validated single source of truth. Fail if a listed path disappeared
-          # or if the measured core falls below ADR 0004's 90% minimum.
-          INCLUDE=$(python3 scripts/critical_modules.py)
-          REPORT=$(python3 -m coverage report --include="$INCLUDE" --fail-under=90)
-          printf '%s\n' "$REPORT"
-          PERCENT=$(printf '%s\n' "$REPORT" | awk '$1 == "TOTAL" {gsub("%", "", $NF); print $NF}')
-          test -n "$PERCENT"
+          # the single source of truth in scripts/critical-modules.txt; every
+          # core module is unit-tested, so the unit-only run is accurate for it.
+          INCLUDE=$(grep -vE '^[[:space:]]*(#|$)' scripts/critical-modules.txt | paste -sd, -)
+          PERCENT=$(python3 -m coverage report --include="$INCLUDE" 2>/dev/null | grep '^TOTAL' | grep -oP '\d+(?=%)' | tail -1)
           echo "percent=$PERCENT" >> $GITHUB_OUTPUT
           echo "Core coverage: $PERCENT%"
 

AGENTS.md

@@ -44,10 +44,10 @@ backend remains available with `BOT_BOTTLE_BACKEND=docker` or
 
 - Three kinds of doc, each with its own conventions in-folder; see
   `docs/README.md` for when to write which:
-  - **PRDs** (`docs/prds/`) — one feature per file. A draft may initially
-    use `prd-new-<kebab>.md`, but its author must assign the next
-    sequential number before merge; CI rejects unnumbered PRDs. A
-    `Status:` line tracks lifecycle: Draft → Active (shipped to `main`) →
+  - **PRDs** (`docs/prds/`) — one feature per file. While a PR is open
+    the file is named `prd-new-<kebab>.md`; CI assigns a sequential
+    number on merge to `main` and renames it. A `Status:` line tracks
+    lifecycle: Draft → Active (shipped to `main`) →
     Superseded/Retargeted. Format in `docs/prds/README.md`.
   - **Research notes** (`docs/research/`) — opinionated investigations;
     unnumbered kebab-case, freeform and verdict-first. See

Dockerfile.gateway

@@ -36,23 +36,11 @@
 #   9420  git-gate smart HTTP (VM-backend agent-facing transport)
 #   9100  supervise (MCP HTTP)
 
-# Based on an exact `python:3.12.13-slim-trixie` multi-architecture manifest
-# rather than the
+# Based on `python:3.12-slim` (Debian trixie) rather than the
 # `mitmproxy/mitmproxy` image (Debian bookworm), matching the trixie base the
 # orchestrator image needs for buildah (Dockerfile.orchestrator.fc). mitmproxy
 # is pip-installed to the same effect as the upstream image.
-ARG PYTHON_BASE_IMAGE
-FROM ${PYTHON_BASE_IMAGE}
-
-# Freeze apt's package universe as well as the base filesystem. Without a
-# snapshot, the same Dockerfile resolves different package versions over time.
-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
+FROM python:3.12-slim
 
 # Runtime system deps:
 #   git supplies the `git daemon` subcommand (no separate package)
@@ -60,19 +48,16 @@ RUN sed -i \
 #   openssh-client supplies the upstream SSH transport the
 #     pre-receive hook uses to forward accepted refs.
 #   ca-certificates is needed for mitmdump upstream TLS.
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
  && apt-get install -y --no-install-recommends \
       git openssh-client ca-certificates \
  && rm -rf /var/lib/apt/lists/*
 
 # mitmdump (the egress data plane). The upstream mitmproxy image baked
-# this in; on the plain python base we install a fully resolved lock whose
-# distributions are all hash-verified. Its CA dir is set explicitly via
-# `--set confdir=` in
+# this in; on the plain python base we pip-install the same pinned
+# version. Its CA dir is set explicitly via `--set confdir=` in
 # egress-entrypoint.sh, so it doesn't depend on a `mitmproxy` home user.
-COPY requirements.gateway.lock /tmp/requirements.gateway.lock
-RUN pip install --no-cache-dir --require-hashes \
-      -r /tmp/requirements.gateway.lock
+RUN pip install --no-cache-dir mitmproxy==11.1.3
 
 # gitleaks (the pre-receive hook's secret scanner). Installed from its
 # official release, pinned by version + SHA256 and verified — rather than

Dockerfile.orchestrator

@@ -9,24 +9,19 @@
 #     Keeping the content in one place means future orchestrator deps (e.g.
 #     iroh) are added here once, not duplicated per backend.
 #
-# It stays deliberately lean: only the pinned FastAPI/Uvicorn control-plane
-# stack is installed here — none of the gateway's mitmproxy/git/gitleaks
-# (that's Dockerfile.gateway) and no buildah (that's firecracker-only).
+# It stays deliberately lean: the control plane is **stdlib-only** today, so
+# no third-party payload — none of the gateway's mitmproxy/git/gitleaks
+# (that's Dockerfile.gateway) and no buildah (that's the firecracker
+# builder, and lives only in Dockerfile.orchestrator.fc). Keeping the
+# secret-dense control plane on a minimal dependency surface is the point
+# (PRD 0070's "secret concentration").
 #
-# Shares an exact multi-architecture Python/trixie manifest with the gateway
-# image. The version-qualified tag keeps the human-readable upstream version;
-# the digest makes the bytes immutable.
+# Shares the trixie `python:3.12-slim` base with the gateway image.
 
-ARG PYTHON_BASE_IMAGE
-FROM ${PYTHON_BASE_IMAGE}
+FROM python:3.12-slim
 
 WORKDIR /app
 
-COPY requirements.orchestrator.lock /tmp/requirements.orchestrator.lock
-RUN pip install --no-cache-dir --require-hashes \
-        -r /tmp/requirements.orchestrator.lock \
-    && rm /tmp/requirements.orchestrator.lock
-
 # The orchestrator content. Baked so the image is self-contained (runs from
 # a built image, no runtime bind-mount); the docker backend may still
 # bind-mount /app for dev live-reload, which simply overlays this copy.

Dockerfile.orchestrator.fc

@@ -12,21 +12,10 @@
 # bare microVM (no fuse-overlayfs / overlay module / subuid maps). The trixie
 # base (from Dockerfile.orchestrator's python:3.12-slim) carries buildah 1.39,
 # which parses the Dockerfile heredocs agent images use (bookworm's 1.28 can't).
-# Matches image_builder. There is deliberately no default: the build coordinator
-# passes the exact local image ID returned by `docker image inspect`, so this
-# stage cannot silently resolve a stale `:latest` tag.
-ARG ORCHESTRATOR_BASE_IMAGE
-FROM ${ORCHESTRATOR_BASE_IMAGE}
+# Matches image_builder.
+FROM bot-bottle-orchestrator:latest
 
-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
-
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
  && apt-get install -y --no-install-recommends \
       buildah crun netavark aardvark-dns \
  && rm -rf /var/lib/apt/lists/*

MANIFEST.in

@@ -4,8 +4,5 @@
 include Dockerfile.gateway
 include Dockerfile.orchestrator
 include Dockerfile.orchestrator.fc
-include image-build-args.json
-include requirements.gateway.in
-include requirements.gateway.lock
 include nix/firecracker-netpool.nix
 include scripts/firecracker-netpool.sh

README.md

@@ -5,7 +5,7 @@
 # bot-bottle
 
 [![test](https://gitea.dideric.is/didericis/bot-bottle/actions/workflows/test.yml/badge.svg?branch=main)](https://gitea.dideric.is/didericis/bot-bottle/actions?workflow=test.yml)
-[![coverage](https://img.shields.io/badge/coverage-84%25-brightgreen)](https://coverage.readthedocs.io/)
+[![coverage](https://img.shields.io/badge/coverage-83%25-brightgreen)](https://coverage.readthedocs.io/)
 [![core coverage](https://img.shields.io/badge/core%20coverage-94%25-brightgreen)](https://gitea.dideric.is/didericis/bot-bottle/src/branch/main/docs/decisions/0004-coverage-policy.md)
 
 **Problem:** Developer wants to run a coding agent without supervision, but they don't want a prompt injected or misbehaving agent wrecking their environment or exfiltrating sensitive data.
@@ -15,7 +15,7 @@
 ## Features
 
 - **Per-bottle egress allowlist** — TLS-bumped HTTP/HTTPS chokepoint with a per-manifest host allowlist; per-route path/method/header `matches` filtering; outbound DLP scanning for known tokens and secrets, inbound DLP scanning for prompt-injection attempts; DoH and arbitrary hosts blocked by default.
-- **Per-route token-match policy** — each egress route picks what happens when the outbound DLP catches a token via `dlp.outbound_on_match`: `supervise` (default) holds the request and surfaces it in `bot-bottle supervise` for approval (an approved value is remembered for the life of the proxy); `redact` scrubs the value and forwards; `block` is a hard `403`. Cuts false-positive friction without weakening default-deny.
+- **Per-route token-match policy** — each egress route picks what happens when the outbound DLP catches a token via `dlp.outbound_on_match`: `supervise` (default) holds the request and surfaces it in `./cli.py supervise` for approval (an approved value is remembered for the life of the proxy); `redact` scrubs the value and forwards; `block` is a hard `403`. Cuts false-positive friction without weakening default-deny.
 - **Tokens the agent never sees** — host secrets live in a gateway; the agent dials `http://gateway:9099/<path>` and the proxy strips inbound `Authorization` and injects the real token before forwarding. `printenv` in the agent shows proxy URLs only.
 - **Gitleaks-scanned push (git-gate)** — `bottle.git` remotes route through a per-bottle `git daemon` that gitleaks-scans incoming refs pre-receive and forwards clean refs upstream over SSH. The agent never holds the upstream credential.
 - **Manifest-scoped skills + secrets** — each bottle declares its skills, env, git identity, remotes, and egress routes; unknown keys die at load.
@@ -39,7 +39,7 @@ On the legacy Docker backend, the same logical bottle is two containers per agen
 The Docker topology looks like this:
 
 ```
-                            host  ( bot-bottle )
+                            host  ( ./cli.py )
                                   │
                           starts  │  stops
                                   ▼
@@ -71,25 +71,11 @@ When the agent exits, `cli.py` tears down every gateway and both networks; nothi
 
 ## Quickstart
 
-```sh
-curl -fsSL https://gitea.dideric.is/didericis/bot-bottle/raw/branch/main/install.sh | sh
-```
+On compatible macOS hosts, the default backend requires Apple's `container` CLI and does not require Docker. The Firecracker backend (Linux) requires Docker on the host for the gateway plus the `firecracker` binary and KVM. The legacy Docker backend requires Docker. Claude bottles also need a long-lived Claude Code OAuth token (`claude setup-token`) exported as `BOT_BOTTLE_CLAUDE_OAUTH_TOKEN`.
 
-The installer is a bootstrapper: it finds a suitable Python, installs bot-bottle with `pipx` (falling back to `pip --user`), creates `~/.bot-bottle`, and runs `bot-bottle doctor`. It is idempotent and never uses `sudo`. Python-native users can skip it entirely with `pipx install bot-bottle` or `uv tool install bot-bottle`.
+Use `BOT_BOTTLE_BACKEND=docker ./cli.py start <agent>` on hosts where neither Apple Container nor KVM is available and Docker is the desired backend.
 
-### Requirements
-
-**Python ≥ 3.11**, and this is the one that trips people up on macOS: the `python3` Apple ships at `/usr/bin/python3` is **3.9.6**, which is too old. Bare `python3` resolves to that stub far more often than people expect. `path_helper` builds a login shell's `PATH` from `/etc/paths` and then appends `/etc/paths.d/*`, and `/usr/bin` sits in the former — so even when `/opt/homebrew/bin` *is* on the `PATH` (via `/etc/paths.d/homebrew`), it comes after `/usr/bin` and loses. Prepending a newer Python is something your shell profile does, and a fresh account, a launchd job, or a CI runner has no such profile. So the installer looks past bare `python3` before giving up: it tries `python3`, then the versioned `python3.11`–`python3.14` names, then `/opt/homebrew/bin`, `/usr/local/bin`, `~/.local/bin`, and python.org framework builds — and tells you which one it picked when it isn't the obvious one. Point it somewhere specific with `BOT_BOTTLE_PYTHON=/path/to/python3`.
-
-**No `pipx` required.** If `pipx` is present the installer uses it and stays out of the way. If it isn't, bot-bottle installs into a private venv at `~/.bot-bottle/venv` (override with `BOT_BOTTLE_VENV`) and symlinks the entry point into `~/.local/bin`. There is deliberately no `pip install --user` path: Homebrew, python.org and Debian/Ubuntu interpreters are all externally managed (PEP 668), which blocks `--user` outright — so on a Mac it is never the fallback it appears to be. A venv is exempt from PEP 668, and `venv` is stdlib, so unlike `pipx` there is nothing to bootstrap first.
-
-**`git`**, because the default install spec is a `git+` URL. Set `BOT_BOTTLE_INSTALL_SPEC` to a wheel path or index name to avoid it.
-
-**A backend**, which the installer deliberately does *not* install for you — `doctor` reports what's missing afterwards. On compatible macOS hosts, the default backend requires Apple's `container` CLI and does not require Docker. The Firecracker backend (Linux) requires Docker on the host for the gateway plus the `firecracker` binary and KVM. The legacy Docker backend requires Docker. Claude bottles also need a long-lived Claude Code OAuth token (`claude setup-token`) exported as `BOT_BOTTLE_CLAUDE_OAUTH_TOKEN`.
-
-Use `BOT_BOTTLE_BACKEND=docker bot-bottle start <agent>` on hosts where neither Apple Container nor KVM is available and Docker is the desired backend.
-
-> **CI (macOS Apple Container):** the advisory `integration-macos` job in `.gitea/workflows/pre-release-test.yml` runs only on manual dispatch. It targets a self-hosted host-mode runner labelled `macos`; Apple Container cannot run inside the Linux pull-request runner. Provision an Apple Silicon host with the `container` CLI running and Python ≥ 3.11 plus `coverage` on the launchd service's explicit `PATH`. The infra container is a singleton (`bot-bottle-mac-infra`), so keep runner concurrency at 1. Its coverage is reported separately and never feeds the required pull-request gate.
+> **CI (macOS Apple Container):** the `integration-macos` job (`.gitea/workflows/test.yml`) runs the integration suite against `BOT_BOTTLE_BACKEND=macos-container` on a self-hosted macOS runner labelled `macos`, because Apple Container needs the host virtualization framework and cannot run in a Linux container (so it can't reuse the `kvm` runner). Provision an Apple Silicon host with the `container` CLI on `PATH` and `container system status` running, then register the runner in **host mode** (not docker mode) with the `macos` label — `brew install gitea-runner` (the `act_runner` rename). Give it a Python ≥ 3.11 with `coverage` importable on the launchd service's `PATH` (a launchd service doesn't inherit your shell profile, so pin `node` and the Python env explicitly). The job is **advisory** — `workflow_dispatch` (manual) only, never triggered by push or PR — since a single laptop that sleeps/roams must not block merges or churn on every push to main; its coverage doesn't feed the gate. The infra container is a singleton (`bot-bottle-mac-infra`), so keep runner concurrency at 1.
 
 ### Containers inside a bottle
 
@@ -180,18 +166,18 @@ On Linux, a KVM-capable host defaults to the Firecracker backend. It needs:
 - **`/dev/kvm`** present and accessible. Load `kvm-intel` or `kvm-amd` (and enable virtualization in BIOS/firmware). The invoking user must be in the `kvm` group: `sudo usermod -aG kvm "$USER"` then re-login. bot-bottle preflights this and reports exactly what's missing.
 - **`firecracker`** on `PATH`: grab a release from <https://github.com/firecracker-microvm/firecracker/releases>. Start flows print this pointer when the binary is missing.
 - **Docker** for the gateway and image build.
-- **A one-time privileged network setup** — the per-bottle TAP pool plus the fail-closed `nftables` isolation table. Run `bot-bottle backend setup --backend=firecracker` for the host-appropriate config (a NixOS module, a `sudo` script elsewhere); `bot-bottle backend status --backend=firecracker` reports what's present, including whether the pool range collides with an existing route. The pool defaults to `10.243.0.0/16` (an obscure RFC-1918 block that dodges docker/libvirt/LAN and, deliberately, Tailscale's `100.64.0.0/10` CGNAT range); override with `BOT_BOTTLE_FC_IP_BASE` if it clashes on your host.
+- **A one-time privileged network setup** — the per-bottle TAP pool plus the fail-closed `nftables` isolation table. Run `./cli.py backend setup --backend=firecracker` for the host-appropriate config (a NixOS module, a `sudo` script elsewhere); `./cli.py backend status --backend=firecracker` reports what's present, including whether the pool range collides with an existing route. The pool defaults to `10.243.0.0/16` (an obscure RFC-1918 block that dodges docker/libvirt/LAN and, deliberately, Tailscale's `100.64.0.0/10` CGNAT range); override with `BOT_BOTTLE_FC_IP_BASE` if it clashes on your host.
 
 ```sh
-BOT_BOTTLE_BACKEND=firecracker bot-bottle start <agent>
+BOT_BOTTLE_BACKEND=firecracker ./cli.py start <agent>
 ```
 
 > **NixOS:** enable `virtualisation.docker`, ensure the KVM module is loaded (`boot.kernelModules = [ "kvm-intel" ];` or `kvm-amd`), and add your user to the `kvm` and `docker` groups. For the network pool, consume the flake module — `imports = [ inputs.bot-bottle.nixosModules.firecracker-netpool ]; services.bot-bottle-firecracker = { enable = true; owner = "you"; };` — then `nixos-rebuild switch` (imperative nft/TAP rules don't survive a rebuild; channel users can `imports = [ <bot-bottle>/nix/firecracker-netpool.nix ]`). `firecracker` isn't in nixpkgs by default as a user binary — install the release binary (pin the version) and put it on `PATH`.
 
-> **CI:** Firecracker integration runs in the manually dispatched `.gitea/workflows/pre-release-test.yml` on a self-hosted runner labelled `kvm`; privileged KVM hosts never execute unreviewed PR code automatically. Provision it like a normal Firecracker host: `firecracker` on `PATH`, `/dev/kvm`, the cached guest kernel and static dropbear, and the persistent TAP/nft pool. The required pull-request workflow runs unit plus the complete Docker integration suite on `ubuntu-latest`; see `docs/ci.md`.
+> **CI:** the coverage gate (`.gitea/workflows/test.yml` → `coverage` job) runs on a self-hosted runner labelled `kvm`, because the Firecracker backend's VM/SSH orchestration is exercised only by the integration suite, which needs `/dev/kvm` + the provisioned pool (a container runner would skip it and read as uncovered). Provision that runner exactly like a normal Firecracker host — `firecracker` on `PATH`, `/dev/kvm`, the cached guest kernel + static dropbear, and the pool installed as the persistent systemd unit — then register it with the `kvm` label. A Docker-capable hosted job builds the candidate once; KVM tests boot those exact bytes, and a successful main run publishes them. The unit/lint jobs still run on `ubuntu-latest`.
 
 ```sh
-bot-bottle start <agent>   # builds the image on first run, drops you into claude
+./cli.py start <agent>   # builds the image on first run, drops you into claude
 ```
 
 ## Manifest
@@ -267,7 +253,7 @@ You help maintain Gitea-hosted projects.
 | `dlp.outbound_on_match` | no | What to do when an outbound token is detected: `supervise` (default for manifest routes — hold for operator approval), `redact` (scrub the value and forward), or `block` (hard 403). Agent-provider routes (e.g. `api.anthropic.com`) default to `redact`. |
 | `git.fetch` | no | `true` permits smart HTTP clone/fetch (`git-upload-pack`) for this host. Push (`git-receive-pack`) remains blocked. |
 
-When an outbound DLP detector matches a token, the route's `dlp.outbound_on_match` policy decides what happens. Under the default `supervise`, the proxy queues an `egress-token-allow` proposal for the operator's `bot-bottle supervise` TUI and holds the request open until it is answered (or `EGRESS_TOKEN_ALLOW_TIMEOUT_SECONDS`, default 300s, elapses — after which it fails closed). The operator never sees the raw token, only the host, method, path, and a redacted snippet; approving adds the value to an in-memory safelist for the life of the egress proxy. Under `redact`, the matched value is scrubbed from the body, headers, and path and the request is forwarded (failing closed if a match lands somewhere unredactable, like the hostname). Under `block` it stays a hard `403`. Structural blocks (CRLF injection) and not-in-allowlist host blocks are always hard `403`s regardless of policy.
+When an outbound DLP detector matches a token, the route's `dlp.outbound_on_match` policy decides what happens. Under the default `supervise`, the proxy queues an `egress-token-allow` proposal for the operator's `./cli.py supervise` TUI and holds the request open until it is answered (or `EGRESS_TOKEN_ALLOW_TIMEOUT_SECONDS`, default 300s, elapses — after which it fails closed). The operator never sees the raw token, only the host, method, path, and a redacted snippet; approving adds the value to an in-memory safelist for the life of the egress proxy. Under `redact`, the matched value is scrubbed from the body, headers, and path and the request is forwarded (failing closed if a match lands somewhere unredactable, like the hostname). Under `block` it stays a hard `403`. Structural blocks (CRLF injection) and not-in-allowlist host blocks are always hard `403`s regardless of policy.
 
 More examples in `examples/`. Full design lives under `docs/prds/`; the trust-boundary rationale is in `docs/prds/0011-per-file-md-manifest.md`.
 

bot_bottle/agent_provider.py

@@ -226,7 +226,7 @@ class AgentProvider(ABC):
         initial task in a non-interactive (headless) session.
 
         Called only when ``--prompt`` is passed to
-        ``bot-bottle start --headless``; the returned args are appended
+        ``./cli.py start --headless``; the returned args are appended
         after the provider's ``bypass_args`` and ``startup_args``."""
 
     def provision_ca(self, bottle: "Bottle", plan: "BottlePlan") -> None:

bot_bottle/backend/__init__.py

@@ -30,7 +30,6 @@ if TYPE_CHECKING:
         BottleImages,
         BottlePlan,
         BottleSpec,
-        EnumerationError,
         ExecResult,
     )
     from .selection import (
@@ -60,7 +59,6 @@ _LAZY_MODULES: dict[str, str] = {
     "BottleImages": "base",
     "BottleBackend": "base",
     "BackendStatus": "base",
-    "EnumerationError": "base",
     "get_bottle_backend": "selection",
     "known_backend_names": "selection",
     "has_backend": "selection",
@@ -102,7 +100,6 @@ __all__ = [
     "BottlePlan",
     "BottleSpec",
     "ExecResult",
-    "EnumerationError",
     "CommitCancelled",
     "Freezer",
     "get_freezer",

bot_bottle/backend/base.py

@@ -21,23 +21,20 @@ from abc import ABC, abstractmethod
 from contextlib import AbstractContextManager, contextmanager
 from dataclasses import dataclass
 from pathlib import Path
-from typing import TYPE_CHECKING, Generator, Generic, Sequence, TypeVar
+from typing import Generator, Generic, Sequence, TypeVar
 
-from ..agent_provider import AgentProvisionPlan, get_provider
+from ..agent_provider import AgentProvisionPlan, get_provider, build_agent_provision_plan
 from ..egress import EgressPlan
 from ..git_gate import GitGatePlan
 from ..log import die, info
 from ..util import expand_tilde
 from ..manifest import Manifest, ManifestIndex
 from ..supervisor.plan import SupervisePlan
-from ..env import ResolvedEnv
+from ..env import resolve_env, ResolvedEnv
 from ..workspace import WorkspacePlan, workspace_plan
 from .print_util import print_multi, visible_agent_env_names
 from .util import host_skill_dir
 
-if TYPE_CHECKING:
-    from .gateway_attach import GatewayAttachResources
-
 
 class BackendStatus(enum.IntEnum):
     """Return codes for BottleBackend.status(). READY == 0 so callsites
@@ -45,10 +42,6 @@ class BackendStatus(enum.IntEnum):
     READY = 0
 
 
-class EnumerationError(RuntimeError):
-    """A backend could not produce an authoritative live-resource snapshot."""
-
-
 @dataclass(frozen=True)
 class BottleSpec:
     """CLI-supplied intent. Backend-agnostic — each backend's prepare
@@ -175,10 +168,6 @@ class BottleCleanupPlan(ABC):
         """True iff there is nothing to clean up; the CLI uses this to
         short-circuit before showing the y/N."""
 
-    @abstractmethod
-    def intersect(self, current: "BottleCleanupPlan") -> "BottleCleanupPlan":
-        """Resources both displayed to the operator and currently removable."""
-
 
 @dataclass(frozen=True)
 class ExecResult:
@@ -273,17 +262,6 @@ class Bottle(ABC):
 
 PlanT = TypeVar("PlanT", bound=BottlePlan)
 CleanupT = TypeVar("CleanupT", bound=BottleCleanupPlan)
-# The backend-specific handle for one running bottle the reconcile attaches to
-# the gateway (a run dir for firecracker, a container name for docker/macOS).
-# Registry-style callers that don't care about the handle bind it to `Any`
-# (`BottleBackend[Any, Any, Any]`).
-AttachTargetT = TypeVar("AttachTargetT")
-
-
-class InfraLaunchError(RuntimeError):
-    """A per-host infra (gateway + orchestrator) launch/reconcile step could not
-    complete. Shared across backends so the base backend can raise + catch one
-    type; each backend's ``infra_launch`` module re-exports it."""
 
 
 @dataclass(frozen=True)
@@ -298,7 +276,7 @@ class BottleImages:
     sidecar: str | Path = ""
 
 
-class BottleBackend(ABC, Generic[PlanT, CleanupT, AttachTargetT]):
+class BottleBackend(ABC, Generic[PlanT, CleanupT]):
     """Abstract base for selectable bottle backends. Concrete subclasses
     (e.g. DockerBottleBackend) own their own prepare/launch impls.
     Parameterized over the backend's concrete plan + cleanup-plan types
@@ -318,18 +296,82 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT, AttachTargetT]):
         backend-specific resolution (names, scratch files, etc.). The
         validation step is enforced here so a future backend cannot
         accidentally skip it. No remote/runtime resources are created."""
-        from .preparation import BottlePreparationPlanner
-        prepared = BottlePreparationPlanner(self).prepare(spec)
+        from .resolve_common import (
+            merge_provision_env_vars,
+            mint_slug,
+            prepare_agent_state_dir,
+            prepare_egress,
+            prepare_git_gate,
+            prepare_supervise,
+            reject_nested_containers,
+            resolve_manifest_dockerfile,
+            write_launch_metadata,
+        )
+
+        manifest = self._validate(spec)
+
+        if not self.supports_nested_containers:
+            reject_nested_containers(self.name, manifest)
+
+        self._preflight()
+
+        from ..git_gate import GitGate
+        manifest = GitGate().preflight_host_keys(
+            manifest,
+            headless=spec.headless,
+            home_md=spec.manifest.home_md,
+        )
+
+        manifest_bottle = manifest.bottle
+        manifest_agent_provider = manifest_bottle.agent_provider
+        agent_provider = get_provider(manifest_agent_provider.template)
+        resolved_env = resolve_env(manifest)
+        workspace = workspace_plan(spec, guest_home=agent_provider.guest_home)
+
+        slug = mint_slug(spec)
+        write_launch_metadata(slug, spec, compose_project="", backend=self.name)
+
+        # Manifest may override the Dockerfile per-bottle; otherwise fall
+        # back to the provider plugin's bundled Dockerfile (next to its
+        # agent_provider.py module).
+        if manifest_agent_provider.dockerfile:
+            agent_dockerfile_path = resolve_manifest_dockerfile(
+                manifest_agent_provider.dockerfile, spec,
+            )
+        else:
+            agent_dockerfile_path = str(agent_provider.dockerfile)
+
+        agent_dir, prompt_file = prepare_agent_state_dir(slug, manifest)
+
+        agent_provision_plan = build_agent_provision_plan(
+            template=manifest_agent_provider.template,
+            dockerfile=agent_dockerfile_path,
+            state_dir=agent_dir,
+            instance_name=f"bot-bottle-{slug}",
+            prompt_file=prompt_file,
+            guest_env=self._build_guest_env(resolved_env),
+            forward_host_credentials=manifest_agent_provider.forward_host_credentials,
+            auth_token=manifest_agent_provider.auth_token,
+            host_env=dict(os.environ),
+            trusted_project_path=workspace.workdir,
+            label=spec.label,
+            color=spec.color,
+            provider_settings=manifest_agent_provider.settings,
+        )
+        agent_provision_plan = merge_provision_env_vars(agent_provision_plan)
+        egress_plan = prepare_egress(manifest_bottle, slug, agent_provision_plan)
+        supervise_plan = prepare_supervise(manifest_bottle, slug)
+        git_gate_plan = prepare_git_gate(manifest_bottle, slug)
 
         return self._resolve_plan(
             spec,
-            manifest=prepared.manifest,
-            slug=prepared.slug,
-            resolved_env=prepared.resolved_env,
-            agent_provision_plan=prepared.agent_provision_plan,
-            egress_plan=prepared.egress_plan,
-            supervise_plan=prepared.supervise_plan,
-            git_gate_plan=prepared.git_gate_plan,
+            manifest=manifest,
+            slug=slug,
+            resolved_env=resolved_env,
+            agent_provision_plan=agent_provision_plan,
+            egress_plan=egress_plan,
+            supervise_plan=supervise_plan,
+            git_gate_plan=git_gate_plan,
             stage_dir=stage_dir,
         )
 
@@ -526,31 +568,6 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT, AttachTargetT]):
         compose ls`; firecracker cross-references its running gateway
         containers against per-bottle metadata."""
 
-    def attach_bottled_agents_to_gateway(self) -> None:
-        """Reconcile every running bottle against the freshly-(re)booted gateway
-        on the cold-boot bring-up path (PRD 0081). The shared flow + fail-hard
-        policy live in `gateway_attach`; backends override only the three
-        primitives below (ADR 0006)."""
-        from .gateway_attach import reconcile_running_bottles
-        reconcile_running_bottles(self)
-
-    @abstractmethod
-    def _gateway_attach_resources(self) -> "GatewayAttachResources":
-        """Gather what every bottle needs to (re)attach to the current gateway
-        (the CA now). Raises if the gateway isn't reachable (aborts reconcile)."""
-
-    @abstractmethod
-    def _running_bottles(self) -> Sequence[AttachTargetT]:
-        """The live bottles as backend handles for `_attach_bottle_to_gateway`.
-        Raises if the live set can't be determined (fail hard, no partial set)."""
-
-    @abstractmethod
-    def _attach_bottle_to_gateway(
-        self, bottle: AttachTargetT, resources: "GatewayAttachResources",
-    ) -> None:
-        """(Re)attach one bottle to the current gateway (SSH / `exec`+`cp`).
-        Raises `InfraLaunchError` naming the bottle on failure."""
-
     @classmethod
     @abstractmethod
     def is_available(cls) -> bool:
@@ -570,7 +587,7 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT, AttachTargetT]):
         host-appropriate config or commands. Prints to stdout/stderr and
         returns a shell exit code (0 = nothing to report / success). A
         backend that needs no host setup prints a short note and returns
-        0. Invoked generically by `bot-bottle backend setup [--backend=…]`
+        0. Invoked generically by `./cli.py backend setup [--backend=…]`
         so operators can provision any backend without a
         backend-specific command. Classmethod (like `is_available`) —
         it's a host query, not per-bottle state."""
@@ -587,14 +604,14 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT, AttachTargetT]):
         stderr. When quiet=True returns the status code silently —
         useful for cheap programmatic checks.
 
-        Invoked by `bot-bottle backend status [--backend=…]` (quiet=False)
+        Invoked by `./cli.py backend status [--backend=…]` (quiet=False)
         and by is_backend_ready() (caller-controlled)."""
 
     @classmethod
     @abstractmethod
     def teardown(cls) -> int:
         """Undo `setup()` — the inverse operation, surfaced as
-        `bot-bottle backend teardown [--backend=…]` (uninstall). Symmetric
+        `./cli.py backend teardown [--backend=…]` (uninstall). Symmetric
         with setup: where setup is advisory (prints the privileged
         commands / declarative config to apply), teardown prints the
         commands / config change to remove the host prerequisites. A

bot_bottle/backend/cleanup_control.py

@@ -1,60 +0,0 @@
-"""Shared destructive-cleanup execution and failure accounting."""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-from collections.abc import Sequence
-from pathlib import Path
-
-
-class CleanupError(RuntimeError):
-    """One or more approved cleanup mutations did not complete."""
-
-
-class CleanupFailures:
-    """Attempt every approved mutation, then fail with complete diagnostics."""
-
-    def __init__(self) -> None:
-        self._messages: list[str] = []
-
-    def run(self, argv: Sequence[str], description: str) -> None:
-        raw_timeout = os.environ.get(
-            "BOT_BOTTLE_CLEANUP_COMMAND_TIMEOUT_SECONDS", "120",
-        )
-        try:
-            timeout = float(raw_timeout)
-        except ValueError:
-            timeout = 120.0
-        try:
-            result = subprocess.run(
-                list(argv), capture_output=True, text=True, check=False,
-                timeout=max(timeout, 1.0),
-            )
-        except (OSError, subprocess.SubprocessError) as exc:
-            self._messages.append(f"{description}: {exc}")
-            return
-        if result.returncode != 0:
-            detail = (result.stderr or result.stdout).strip()
-            self._messages.append(
-                f"{description}: {detail or f'exit {result.returncode}'}"
-            )
-
-    def remove_tree(self, path: Path, description: str) -> None:
-        try:
-            shutil.rmtree(path)
-        except FileNotFoundError:
-            return
-        except OSError as exc:
-            self._messages.append(f"{description}: {exc}")
-
-    def record(self, message: str) -> None:
-        self._messages.append(message)
-
-    def raise_if_any(self) -> None:
-        if self._messages:
-            raise CleanupError("; ".join(self._messages))
-
-
-__all__ = ["CleanupError", "CleanupFailures"]

bot_bottle/backend/docker/backend.py

@@ -23,7 +23,7 @@ import shutil
 import io
 from contextlib import contextmanager, redirect_stderr
 from pathlib import Path
-from typing import TYPE_CHECKING, Generator, Sequence
+from typing import Generator, Sequence
 
 from ...supervisor.types import SUPERVISE_HOSTNAME, SUPERVISE_PORT
 from ...agent_provider import AgentProvisionPlan
@@ -33,7 +33,6 @@ from ...git_gate import GitGatePlan
 from ...supervisor.plan import SupervisePlan
 from ...manifest import Manifest
 from .. import ActiveAgent, BottleBackend, BottleImages, BottleSpec
-from ..gateway_attach import GatewayAttachResources
 from . import cleanup as _cleanup
 from . import enumerate as _enumerate
 from . import launch as _launch
@@ -41,27 +40,12 @@ from . import resolve_plan as _resolve_plan
 from .bottle import DockerBottle
 from .bottle_cleanup_plan import DockerBottleCleanupPlan
 from .bottle_plan import DockerBottlePlan
-
-if TYPE_CHECKING:
-    from .infra import DockerInfraService
-
-
-class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanupPlan", str]):
+class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanupPlan"]):
     """Docker backend implementation. Selected by BOT_BOTTLE_BACKEND
     when set to `docker`; retained as a legacy/example backend."""
 
     name = "docker"
 
-    def __init__(self, *, infra: "DockerInfraService | None" = None) -> None:
-        # The infra service whose gateway just cold-booted, passed in on the
-        # bring-up reconcile path (PRD 0081) so `_gateway_attach_resources`
-        # reads THAT gateway's CA rather than a fresh default-named service —
-        # otherwise a non-default instance (an isolated integration test's
-        # `-itest-` gateway) reads the default `bot-bottle-orch-gateway`, which
-        # doesn't exist for it (#519 review). None for ordinary construction:
-        # falls back to the per-host default singleton.
-        self._infra = infra
-
     @classmethod
     def is_available(cls) -> bool:
         """`docker` on PATH is sufficient; we don't probe `docker info`
@@ -156,22 +140,3 @@ class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanup
 
     def enumerate_active(self) -> Sequence[ActiveAgent]:
         return _enumerate.enumerate_active()
-
-    def _gateway_attach_resources(self) -> GatewayAttachResources:
-        from .infra import DockerInfraService
-        infra = self._infra if self._infra is not None else DockerInfraService()
-        return GatewayAttachResources(ca_pem=infra.gateway().ca_cert_pem())
-
-    def _running_bottles(self) -> Sequence[str]:
-        from .infra import DockerInfraService
-        from .infra_launch import running_agent_containers
-        infra = self._infra if self._infra is not None else DockerInfraService()
-        return running_agent_containers(
-            network=infra.network, gateway_name=infra.gateway().name,
-        )
-
-    def _attach_bottle_to_gateway(
-        self, bottle: str, resources: GatewayAttachResources,
-    ) -> None:
-        from .infra_launch import push_ca_to_container
-        push_ca_to_container(bottle, resources.ca_pem)

bot_bottle/backend/docker/bottle_cleanup_plan.py

@@ -46,22 +46,6 @@ class DockerBottleCleanupPlan(BottleCleanupPlan):
             and not self.orphan_state_dirs
         )
 
-    def intersect(self, current: BottleCleanupPlan) -> "DockerBottleCleanupPlan":
-        if not isinstance(current, DockerBottleCleanupPlan):
-            raise TypeError("cleanup plans must have the same backend type")
-        return DockerBottleCleanupPlan(
-            projects=tuple(x for x in self.projects if x in current.projects),
-            stray_containers=tuple(
-                x for x in self.stray_containers if x in current.stray_containers
-            ),
-            stray_networks=tuple(
-                x for x in self.stray_networks if x in current.stray_networks
-            ),
-            orphan_state_dirs=tuple(
-                x for x in self.orphan_state_dirs if x in current.orphan_state_dirs
-            ),
-        )
-
     def print(self) -> None:
         print(file=sys.stderr)
         for name in self.projects:

bot_bottle/backend/docker/cleanup.py

@@ -23,12 +23,11 @@ Active-agent enumeration lives in `backend/docker/enumerate.py`.
 
 from __future__ import annotations
 
+import shutil
 import subprocess
 
 from ...paths import bot_bottle_root
-from ...log import info
-from .. import EnumerationError
-from ..cleanup_control import CleanupFailures
+from ...log import info, warn
 from . import util as docker_mod
 from .bottle_cleanup_plan import DockerBottleCleanupPlan
 from ...bottle_state import bottle_state_dir, is_preserved
@@ -37,17 +36,15 @@ from .compose import COMPOSE_PROJECT_PREFIX, list_compose_projects
 
 def _list_prefixed_containers() -> list[str]:
     """All bot-bottle-prefixed containers, running or stopped."""
-    try:
-        result = subprocess.run(
-            ["docker", "ps", "-a",
-             "--filter", f"name=^{COMPOSE_PROJECT_PREFIX}",
-             "--format", "{{.Names}}\t{{.Label \"com.docker.compose.project\"}}"],
-            capture_output=True, text=True, check=False,
-        )
-    except OSError as exc:
-        raise EnumerationError(f"docker ps failed: {exc}") from exc
+    result = subprocess.run(
+        ["docker", "ps", "-a",
+         "--filter", f"name=^{COMPOSE_PROJECT_PREFIX}",
+         "--format", "{{.Names}}\t{{.Label \"com.docker.compose.project\"}}"],
+        capture_output=True, text=True, check=False,
+    )
     if result.returncode != 0:
-        raise EnumerationError(f"docker ps failed: {result.stderr.strip()}")
+        warn(f"docker ps failed: {result.stderr.strip()}")
+        return []
     out: list[str] = []
     for line in (result.stdout or "").splitlines():
         if not line:
@@ -66,19 +63,15 @@ def _list_prefixed_networks() -> list[str]:
     to a compose project. Compose-managed networks have a
     `com.docker.compose.project` label; bare ones (from pre-compose
     code paths) don't."""
-    try:
-        result = subprocess.run(
-            ["docker", "network", "ls",
-             "--filter", f"name={COMPOSE_PROJECT_PREFIX}",
-             "--format", "{{.Name}}\t{{.Label \"com.docker.compose.project\"}}"],
-            capture_output=True, text=True, check=False,
-        )
-    except OSError as exc:
-        raise EnumerationError(f"docker network ls failed: {exc}") from exc
+    result = subprocess.run(
+        ["docker", "network", "ls",
+         "--filter", f"name={COMPOSE_PROJECT_PREFIX}",
+         "--format", "{{.Name}}\t{{.Label \"com.docker.compose.project\"}}"],
+        capture_output=True, text=True, check=False,
+    )
     if result.returncode != 0:
-        raise EnumerationError(
-            f"docker network ls failed: {result.stderr.strip()}"
-        )
+        warn(f"docker network ls failed: {result.stderr.strip()}")
+        return []
     out: list[str] = []
     for line in (result.stdout or "").splitlines():
         if not line:
@@ -127,10 +120,7 @@ def prepare_cleanup() -> DockerBottleCleanupPlan:
     `enumerate_active_agents()` so the orphan-state-dir bucket
     doesn't include slugs whose non-docker bottle is still up."""
     docker_mod.require_docker()
-    projects = list_compose_projects(
-        warn_on_error=False,
-        raise_on_error=True,
-    )
+    projects = list_compose_projects()
     project_set = set(projects)
     # Late import to avoid a circular at module-load time —
     # the backend package's __init__ imports this module.
@@ -150,30 +140,40 @@ def cleanup(plan: DockerBottleCleanupPlan) -> None:
     """Remove everything in the plan. Projects first (whose `compose
     down` reaps their containers + networks atomically), then stray
     legacy resources, then orphan state dirs."""
-    failures = CleanupFailures()
     for project in plan.projects:
         info(f"docker compose down  ({project})")
-        failures.run(
+        result = subprocess.run(
             ["docker", "compose", "-p", project, "down", "--volumes"],
-            f"docker compose down failed for {project}",
+            capture_output=True, text=True, check=False,
         )
+        if result.returncode != 0:
+            warn(
+                f"compose down failed for {project}: "
+                f"{result.stderr.strip()}"
+            )
 
     for name in plan.stray_containers:
         info(f"removing stray container {name}")
-        failures.run(
+        subprocess.run(
             ["docker", "rm", "-f", name],
-            f"removing stray container {name}",
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
         )
 
     for name in plan.stray_networks:
         info(f"removing stray network {name}")
-        failures.run(
+        subprocess.run(
             ["docker", "network", "rm", name],
-            f"removing stray network {name}",
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
         )
 
     for identity in plan.orphan_state_dirs:
         path = bottle_state_dir(identity)
         info(f"removing orphan state dir {path}")
-        failures.remove_tree(path, f"removing orphan state dir {path}")
-    failures.raise_if_any()
+        try:
+            shutil.rmtree(path, ignore_errors=True)
+        except OSError as e:
+            warn(f"failed to remove {path}: {e}")

bot_bottle/backend/docker/compose.py

@@ -16,7 +16,6 @@ from pathlib import Path
 from typing import Any
 
 from ...log import die, warn
-from ..base import EnumerationError
 
 
 # --- Lifecycle helpers (PRD 0018 chunk 3) ----------------------------------
@@ -53,20 +52,19 @@ def slug_from_compose_project(project: str) -> str:
 
 
 def list_compose_projects(
-    *,
-    include_stopped: bool = True,
-    warn_on_error: bool = True,
-    raise_on_error: bool = False,
+    *, include_stopped: bool = True, warn_on_error: bool = True,
 ) -> list[str]:
     """All compose project names starting with `bot-bottle-`.
     `include_stopped=True` (default) runs `docker compose ls --all`
     so exited projects appear too; pass False to get only projects
     with at least one running container.
 
-    Best-effort callers get ``[]`` on Docker errors or malformed output.
-    Enumeration callers pass ``raise_on_error=True`` so a failed query is not
-    reported as an authoritative empty result.
-    """
+    Returns [] on docker daemon errors or malformed output rather
+    than raising — callers should treat the empty list as "no
+    projects discoverable", not "no projects exist". `warn_on_error`
+    stays true for explicit operator commands like cleanup, but active
+    discovery paths set it false so dashboard refreshes don't spam
+    stderr while Docker Desktop is stopped."""
     argv = ["docker", "compose", "ls", "--format", "json"]
     if include_stopped:
         argv.insert(3, "--all")
@@ -74,30 +72,19 @@ def list_compose_projects(
         result = subprocess.run(
             argv, capture_output=True, text=True, check=False,
         )
-    except OSError as exc:
-        # Not only "not found": docker on PATH but not executable by this
-        # user raises PermissionError. Either way the query never ran, so an
-        # enumeration caller must not read the empty result as authoritative.
-        if raise_on_error:
-            raise EnumerationError(
-                f"docker compose ls failed: docker unavailable ({exc})"
-            ) from exc
+    except FileNotFoundError:
+        # docker binary not on PATH — same shape as a daemon-down
+        # error from the caller's POV: no projects discoverable.
         return []
     if result.returncode != 0:
-        message = f"docker compose ls failed: {result.stderr.strip()}"
-        if raise_on_error:
-            raise EnumerationError(message)
         if warn_on_error:
-            warn(message)
+            warn(f"docker compose ls failed: {result.stderr.strip()}")
         return []
     try:
         projects = json.loads(result.stdout or "[]")
     except json.JSONDecodeError as e:
-        message = f"docker compose ls returned malformed JSON: {e}"
-        if raise_on_error:
-            raise EnumerationError(message) from e
         if warn_on_error:
-            warn(message)
+            warn(f"docker compose ls returned malformed JSON: {e}")
         return []
     names: list[str] = []
     for p in projects:
@@ -110,10 +97,7 @@ def list_compose_projects(
 
 
 def list_active_slugs(
-    *,
-    include_stopped: bool = False,
-    warn_on_error: bool = True,
-    raise_on_error: bool = False,
+    *, include_stopped: bool = False, warn_on_error: bool = True,
 ) -> list[str]:
     """Slugs (project name minus prefix) of currently-running
     bottles. Used by the dashboard's operator-edit verbs to choose
@@ -124,7 +108,6 @@ def list_active_slugs(
             for p in list_compose_projects(
                 include_stopped=include_stopped,
                 warn_on_error=warn_on_error,
-                raise_on_error=raise_on_error,
             )
         ) if slug
     )

bot_bottle/backend/docker/consolidated_launch.py

@@ -13,7 +13,6 @@ orchestrator-facing wiring so that sequence stays testable in isolation.
 
 from __future__ import annotations
 
-import tempfile
 from dataclasses import dataclass
 
 from ... import log
@@ -25,13 +24,15 @@ from ...gateway import GATEWAY_NETWORK
 from .infra import INFRA_NAME, DockerInfraService
 from ...orchestrator.store.secret_store import ENV_VAR_SECRET_NAME
 from ...orchestrator.reprovision import reprovision_bottles
-from ..base import InfraLaunchError
 from ..provision_bottle import deprovision_bottle, provision_bottle
-from ..util import AGENT_CA_PATH
 from .gateway_transport import DockerGatewayTransport
 from .gateway_net import next_free_ip
 
 
+class ConsolidatedLaunchError(RuntimeError):
+    """The consolidated register/provision sequence could not complete."""
+
+
 @dataclass(frozen=True)
 class LaunchContext:
     """What the agent container needs to join the shared gateway."""
@@ -53,7 +54,7 @@ def _network_cidr(network: str) -> str:
     ])
     cidr = proc.stdout.strip()
     if proc.returncode != 0 or not cidr:
-        raise InfraLaunchError(
+        raise ConsolidatedLaunchError(
             f"gateway network {network} has no subnet: {proc.stderr.strip()}"
         )
     return cidr
@@ -67,75 +68,12 @@ def _network_container_ips(network: str) -> list[str]:
         "docker", "network", "inspect", "--format",
         "{{range .Containers}}{{.IPv4Address}} {{end}}", network,
     ])
-    if proc.returncode != 0:
-        detail = proc.stderr.strip() or f"exit {proc.returncode}"
-        raise InfraLaunchError(
-            f"could not inspect addresses on gateway network {network}: {detail}"
-        )
     ips: list[str] = []
     for entry in proc.stdout.split():
         ips.append(entry.split("/", 1)[0])
     return ips
 
 
-def running_agent_containers(
-    network: str = GATEWAY_NETWORK, gateway_name: str = INFRA_NAME,
-) -> list[str]:
-    """Every running agent container on the gateway `network` (the gateway
-    itself excluded) — the bottles the bring-up reconcile attaches to the fresh
-    gateway (PRD 0081). Raises `OSError` if `docker` can't be run (fail hard: a
-    reconcile that can't list its bottles must not look like "no bottles")."""
-    proc = run_docker([
-        "docker", "network", "inspect", "--format",
-        "{{range .Containers}}{{.Name}}\n{{end}}", network,
-    ])
-    if proc.returncode != 0:
-        detail = proc.stderr.strip() or f"exit {proc.returncode}"
-        raise InfraLaunchError(
-            f"could not enumerate bottles on gateway network {network}: {detail}"
-        )
-    return [
-        name for name in (line.strip() for line in proc.stdout.splitlines())
-        if name and name != gateway_name
-    ]
-
-
-def push_ca_to_container(container: str, ca_pem: str) -> None:
-    """(Re)attach one running agent container to the current gateway: replace
-    its trusted gateway CA with `ca_pem` and rebuild its trust store via
-    `docker cp` + `docker exec` (PRD 0081). Unconditional install — there is one
-    gateway, so no fingerprint match is needed.
-
-    Fail hard: raises `InfraLaunchError` (naming the container) on any failure —
-    the base reconcile aggregates and surfaces it rather than leaving the agent
-    silently unable to reach the gateway."""
-    mkdir = run_docker(
-        ["docker", "exec", container, "mkdir", "-p",
-         "/usr/local/share/ca-certificates"]
-    )
-    if mkdir.returncode != 0:
-        raise InfraLaunchError(
-            f"CA push to {container} failed (mkdir): {mkdir.stderr.strip()}"
-        )
-    with tempfile.NamedTemporaryFile("w", suffix=".crt") as tmp:
-        tmp.write(ca_pem)
-        tmp.flush()
-        cp = run_docker(["docker", "cp", tmp.name, f"{container}:{AGENT_CA_PATH}"])
-    if cp.returncode != 0:
-        raise InfraLaunchError(
-            f"CA push to {container} failed (cp): {cp.stderr.strip()}"
-        )
-    ex = run_docker(
-        ["docker", "exec", container, "sh", "-c",
-         f"chmod 644 {AGENT_CA_PATH} && update-ca-certificates"]
-    )
-    if ex.returncode != 0:
-        raise InfraLaunchError(
-            f"CA push to {container} failed (update-ca-certificates): "
-            f"{ex.stderr.strip()}"
-        )
-
-
 def _reprovision_running_bottles(
     orchestrator_url: str,
     network: str = GATEWAY_NETWORK,
@@ -242,8 +180,6 @@ def deprovision_consolidated(
 __all__ = [
     "LaunchContext",
     "launch_consolidated",
-    "running_agent_containers",
-    "push_ca_to_container",
     "deprovision_consolidated",
-    "InfraLaunchError",
+    "ConsolidatedLaunchError",
 ]

bot_bottle/backend/docker/enumerate.py

@@ -1,8 +1,9 @@
 """Active-agent enumeration for the docker backend.
 
 Returns `ActiveAgent` records the CLI `active` command and the
-dashboard agents pane consume. Docker query failures raise rather
-than masquerading as an authoritative empty result.
+dashboard agents pane consume. Empty when docker isn't reachable
+— gated by `has_backend('docker')` at the cross-backend caller
+so this module trusts that docker is available when called.
 
 The parser (`_parse_services_by_project`) is exposed for direct
 unit testing; the docker `docker ps` invocation is in
@@ -12,18 +13,17 @@ from __future__ import annotations
 
 import subprocess
 
-from .. import ActiveAgent, EnumerationError
+from .. import ActiveAgent
 from ...bottle_state import read_metadata
 from .compose import compose_project_name, list_active_slugs
 
 
 def enumerate_active() -> list[ActiveAgent]:
-    """All currently-running docker-backed agents."""
-    slugs = list_active_slugs(
-        include_stopped=False,
-        warn_on_error=False,
-        raise_on_error=True,
-    )
+    """All currently-running docker-backed agents. Caller is
+    responsible for gating on `has_backend('docker')` if it
+    matters; if docker is missing the `docker ps` call below
+    returns an empty list silently."""
+    slugs = list_active_slugs(include_stopped=False, warn_on_error=False)
     if not slugs:
         return []
     services_by_project = _query_services_by_project()
@@ -74,9 +74,8 @@ def _query_services_by_project() -> dict[str, set[str]]:
             ],
             capture_output=True, text=True, check=False,
         )
-    except OSError as exc:
-        # Missing, or on PATH but not executable by this user (PermissionError).
-        raise EnumerationError(f"docker ps failed: docker unavailable ({exc})") from exc
+    except FileNotFoundError:
+        return {}
     if r.returncode != 0:
-        raise EnumerationError(f"docker ps failed: {r.stderr.strip()}")
+        return {}
     return _parse_services_by_project(r.stdout or "")

bot_bottle/backend/docker/gateway.py

@@ -17,10 +17,6 @@ from ...gateway import (
   DEFAULT_CA_TIMEOUT_SECONDS, CA_POLL_SECONDS, GATEWAY_CA_CERT, GatewayError
 )
 
-DEFAULT_GATEWAY_SUBNET = "10.242.255.0/24"
-_GATEWAY_SUBNET_LABEL = "bot-bottle.gateway-subnet"
-
-
 class DockerGateway(Gateway):
     """The consolidated gateway as a single, fixed-name Docker container.
 
@@ -39,8 +35,6 @@ class DockerGateway(Gateway):
         build_context: Path | None = None,
         dockerfile: str | None = GATEWAY_DOCKERFILE,
         host_port_bindings: tuple[int, ...] = (),
-        ca_mount_source: str | Path | None = None,
-        subnet: str | None = None,
     ) -> None:
         self.image_ref = image_ref
         self.name = name
@@ -65,15 +59,6 @@ class DockerGateway(Gateway):
         # backend's dev-harness gateway so VMs can reach it via their TAP link;
         # Docker's DNAT + the nft `ct status dnat accept` rule handle the rest.
         self._host_port_bindings = host_port_bindings
-        self._subnet = (
-            subnet
-            or os.environ.get("BOT_BOTTLE_DOCKER_GATEWAY_SUBNET", "").strip()
-            or DEFAULT_GATEWAY_SUBNET
-        )
-        configured_ca = os.environ.get("BOT_BOTTLE_DOCKER_CA_MOUNT", "").strip()
-        self._ca_mount_source = str(
-            ca_mount_source or configured_ca or host_gateway_ca_dir()
-        )
 
     def image_exists(self) -> bool:
         return run_docker(["docker", "image", "inspect", self.image_ref]).returncode == 0
@@ -96,11 +81,6 @@ class DockerGateway(Gateway):
                 str(context)]
         if os.environ.get("BOT_BOTTLE_NO_CACHE"):
             argv.insert(2, "--no-cache")
-        for name, value in resources.image_build_args(
-            self._dockerfile,
-            context=context,
-        ).items():
-            argv[-1:-1] = ["--build-arg", f"{name}={value}"]
         proc = run_docker(argv)
         if proc.returncode != 0:
             raise GatewayError(f"gateway image build failed: {proc.stderr.strip()}")
@@ -129,78 +109,16 @@ class DockerGateway(Gateway):
     def _ensure_network(self) -> None:
         """Create the shared gateway network if it doesn't exist. Idempotent —
         a concurrent create loses harmlessly (the loser sees 'already exists').
-        The explicit subnet is required because bottle attribution pins source
-        IPs; Docker rejects static endpoint addresses on an auto-IPAM network."""
-        inspected = run_docker([
-            "docker", "network", "inspect",
-            "--format", f'{{{{index .Labels "{_GATEWAY_SUBNET_LABEL}"}}}}',
-            self.network,
-        ])
-        if inspected.returncode == 0:
-            marker = inspected.stdout.strip()
-            if marker in {"", self._subnet}:
-                return
-            # Inspectable but mislabelled: the stale auto-IPAM network created
-            # by older releases. Replace it below.
-            stale = True
-        else:
-            # inspect failed. Classify by stderr — do NOT assume "not absent"
-            # implies "poisoned": a transient daemon/API error, permission
-            # failure, timeout, or bad context also fails here, and destroying
-            # the shared gateway on that guess would tear the network out from
-            # under every live bottle.
-            err = inspected.stderr.lower()
-            if "no such network" in err or "not found" in err:
-                # Absent: nothing to replace — create it below.
-                stale = False
-            elif "parseaddr" in err:
-                # Present but poisoned. A daemon that default-enables IPv6
-                # attaches an fdd0::/64 subnet whose `::1/64` gateway trips
-                # docker's own netip.ParseAddr in `network inspect`/`ls`, so the
-                # command exits non-zero with that signature. A fixed release
-                # never *creates* such a network, but one can survive on a
-                # shared host from an older or concurrent launch — and
-                # `--ipv6=false` alone can't heal it, since the create below only
-                # no-ops on "already exists". Force-replace it so later reads
-                # (e.g. `_network_cidr` pinning a source IP) stop failing.
-                stale = True
-            else:
-                # Unrecognized failure: no evidence the network is malformed.
-                # Surface it rather than mutate shared state on a guess.
-                raise GatewayError(
-                    f"gateway network {self.network} could not be inspected: "
-                    f"{inspected.stderr.strip()}"
-                )
-        if stale:
-            # Migrate the stale/poisoned network. Removing the fixed gateway is
-            # safe here: this launch recreates it.
-            run_docker(["docker", "rm", "--force", self.name])
-            removed = run_docker(["docker", "network", "rm", self.network])
-            if removed.returncode != 0 and "no such network" not in removed.stderr.lower():
-                raise GatewayError(
-                    f"gateway network {self.network} needs explicit subnet "
-                    f"{self._subnet} but could not be replaced: "
-                    f"{removed.stderr.strip()}"
-                )
-        proc = run_docker([
-            "docker", "network", "create",
-            # bot-bottle attribution pins IPv4 source IPs; it has no IPv6
-            # support. Disable IPv6 explicitly so a daemon that default-enables
-            # it (default-address-pools) can't attach an fdd0::/64 subnet — a
-            # malformed `::1/64` gateway address then trips docker's own
-            # ParseAddr in `network inspect`/`ls`, which poisons every launch
-            # that reads this network's subnet.
-            "--ipv6=false",
-            "--subnet", self._subnet,
-            "--label", f"{_GATEWAY_SUBNET_LABEL}={self._subnet}",
-            self.network,
-        ])
+        Docker picks the subnet; the launcher reads it back to allocate IPs."""
+        if run_docker(["docker", "network", "inspect", self.network]).returncode == 0:
+            return
+        proc = run_docker(["docker", "network", "create", self.network])
         if proc.returncode != 0 and "already exists" not in proc.stderr:
             raise GatewayError(
                 f"gateway network {self.network} failed to create: {proc.stderr.strip()}"
             )
 
-    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> bool:
+    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> None:
         # Bind to this orchestrator (PRD 0070): stash the URL its daemons resolve
         # policy against + the pre-minted `gateway` token they present, then bring
         # the container up. The gateway never mints, so it holds no signing key —
@@ -225,9 +143,9 @@ class DockerGateway(Gateway):
         # Recreate when the running container's image is stale (a rebuild),
         # so source changes to the gateway's flat daemons take effect — not
         # just when the container is absent.
-        self._ensure_network()
         if self.is_running() and self._running_image_is_current():
-            return False
+            return
+        self._ensure_network()
         # Clear any stale (stopped OR outdated-image) container holding the
         # fixed name, then start fresh. `rm --force` on an absent name is a
         # tolerated no-op.
@@ -240,7 +158,7 @@ class DockerGateway(Gateway):
             # Persist the self-generated CA on the host so it survives both
             # container recreation AND docker volume pruning (agents trust it)
             # — see host_gateway_ca_dir / issue #450.
-            "--volume", f"{self._ca_mount_source}:{MITMPROXY_HOME}",
+            "--volume", f"{host_gateway_ca_dir()}:{MITMPROXY_HOME}",
             # No DB mount: the data plane (egress / supervise / git-gate) reaches
             # the supervise queue over the control-plane RPC and never opens
             # bot-bottle.db, so the gateway container gets no file handle on it
@@ -271,9 +189,6 @@ class DockerGateway(Gateway):
         # pre-connect window (they retry /resolve per request).
         if self._control_network:
             self._connect_control_network()
-        # (Re)created a fresh container — signal a cold boot so the caller
-        # reconciles running bottles against it (PRD 0081).
-        return True
 
     def _connect_control_network(self) -> None:
         """Ensure the `--internal` control network exists and attach the gateway
@@ -338,4 +253,4 @@ class DockerGateway(Gateway):
     def provisioning_transport(self) -> GatewayTransport:
         """The exec/cp transport git-gate provisioning stages per-bottle repos +
         deploy keys through (over the docker socket)."""
-        return DockerGatewayTransport(self.name)
+        return DockerGatewayTransport(self.name)

bot_bottle/backend/docker/infra.py

@@ -33,6 +33,7 @@ from .orchestrator import (
     ORCHESTRATOR_NAME,
     ORCHESTRATOR_NETWORK,
 )
+from ...paths import bot_bottle_root
 from ... import resources
 from ...gateway import (
     GATEWAY_IMAGE,
@@ -68,8 +69,6 @@ class DockerInfraService(InfraService):
         gateway_image: str = GATEWAY_IMAGE,
         repo_root: Path | None = None,
         host_root: Path | None = None,
-        root_mount_source: str | Path | None = None,
-        gateway_ca_mount_source: str | Path | None = None,
         orchestrator_name: str = ORCHESTRATOR_NAME,
         orchestrator_label: str = ORCHESTRATOR_LABEL,
         gateway_name: str = GATEWAY_NAME,
@@ -79,14 +78,10 @@ class DockerInfraService(InfraService):
         self.control_network = control_network
         self.orchestrator_image = orchestrator_image
         self.gateway_image = gateway_image
-        # Build context: the repo root in a checkout, a staged copy from the
-        # installed wheel otherwise (bot_bottle.resources).
+        # Build context / bind-mount source: the repo root in a checkout, a
+        # staged copy from the installed wheel otherwise (bot_bottle.resources).
         self._repo_root = repo_root if repo_root is not None else resources.build_root()
-        if host_root is not None and root_mount_source is not None:
-            raise ValueError("pass host_root or root_mount_source, not both")
-        self._host_root = host_root
-        self._root_mount_source = root_mount_source
-        self._gateway_ca_mount_source = gateway_ca_mount_source
+        self._host_root = host_root or bot_bottle_root()
         self._orchestrator_name = orchestrator_name
         self._orchestrator_label = orchestrator_label
         self._gateway_name = gateway_name
@@ -103,7 +98,6 @@ class DockerInfraService(InfraService):
             control_network=self.control_network,
             repo_root=self._repo_root,
             host_root=self._host_root,
-            root_mount_source=self._root_mount_source,
         )
 
     def gateway(self) -> DockerGateway:
@@ -118,7 +112,6 @@ class DockerInfraService(InfraService):
             network=self.network,
             control_network=self.control_network,
             build_context=self._repo_root,
-            ca_mount_source=self._gateway_ca_mount_source,
         )
 
     def ensure_running(
@@ -142,16 +135,9 @@ class DockerInfraService(InfraService):
         # mints the role-scoped `gateway` JWT here and hands it to the gateway,
         # which never sees the key (#469). `connect_to_orchestrator` is
         # idempotent.
-        cold_booted = gateway.connect_to_orchestrator(
+        gateway.connect_to_orchestrator(
             orchestrator.gateway_url(), orchestrator.mint_gateway_token(),
         )
-        # A (re)created gateway container minted/mounted its CA afresh and lost
-        # every bottle's per-bottle state; reconcile the already-running bottles
-        # against it (PRD 0081). Skipped when a healthy current gateway was left
-        # untouched — no cold boot, nothing to reconcile.
-        if cold_booted:
-            from .backend import DockerBottleBackend
-            DockerBottleBackend(infra=self).attach_bottled_agents_to_gateway()
         return orchestrator.url()
 
     def stop(self) -> None:

bot_bottle/backend/docker/launch.py

@@ -61,7 +61,7 @@ from .compose import (
 )
 from .consolidated_compose import consolidated_agent_compose
 from ...orchestrator.store.config_store import resolve_teardown_timeout
-from .infra_launch import launch_consolidated, deprovision_consolidated
+from .consolidated_launch import launch_consolidated, deprovision_consolidated
 from .infra import INFRA_NAME
 from .gateway import DockerGateway
 from ... import resources

bot_bottle/backend/docker/orchestrator.py

@@ -42,9 +42,13 @@ ORCHESTRATOR_IMAGE = os.environ.get(
 )
 ORCHESTRATOR_DOCKERFILE = "Dockerfile.orchestrator"
 # Baked as a container label so `ensure_running` can detect whether the running
-# orchestrator image was built from the current source.
+# orchestrator is executing the current bind-mounted source.
 ORCHESTRATOR_SOURCE_HASH_LABEL = "bot-bottle-orchestrator-source-hash"
 
+# The bind-mount path for the live control-plane source inside the container.
+# PYTHONPATH points here so a code change takes effect on the next launch
+# without an image rebuild.
+_SRC_IN_CONTAINER = "/bot-bottle-src"
 # Bot-bottle host-root bind-mount (DB + state) inside the orchestrator. The
 # control plane opens bot-bottle.db under here (via BOT_BOTTLE_ROOT ->
 # host_db_path()); it is the ONLY container with a handle on it (issue #469).
@@ -68,51 +72,23 @@ class DockerOrchestrator(Orchestrator):
         control_network: str = ORCHESTRATOR_NETWORK,
         repo_root: Path | None = None,
         host_root: Path | None = None,
-        root_mount_source: str | Path | None = None,
-        client_host: str | None = None,
-        client_network: str | None = None,
-        bind_host: str | None = None,
         dockerfile: str | None = ORCHESTRATOR_DOCKERFILE,
     ) -> None:
-        if host_root is not None and root_mount_source is not None:
-            raise ValueError("pass host_root or root_mount_source, not both")
         self.image_ref = image_ref
         self.name = name
         self.label = label
         self.port = port
         self.control_network = control_network
-        # Build context: the repo root in a checkout, a staged copy from the
-        # installed wheel otherwise (bot_bottle.resources).
+        # Build context / bind-mount source: the repo root in a checkout, a
+        # staged copy from the installed wheel otherwise (bot_bottle.resources).
         self._repo_root = repo_root if repo_root is not None else resources.build_root()
-        configured_root = os.environ.get("BOT_BOTTLE_DOCKER_ROOT_MOUNT", "").strip()
-        self._root_mount_source = str(
-            root_mount_source or configured_root or host_root or bot_bottle_root()
-        )
-        configured_network = os.environ.get(
-            "BOT_BOTTLE_DOCKER_CLIENT_NETWORK", ""
-        ).strip()
-        self._client_network = client_network or configured_network or None
-        configured_host = os.environ.get(
-            "BOT_BOTTLE_DOCKER_HOST_ADDRESS", ""
-        ).strip()
-        self._client_host = (
-            client_host or configured_host
-            or (self.name if self._client_network else "127.0.0.1")
-        )
-        # A socket-shared CI runner reaches published ports through its Docker
-        # network rather than its own loopback. Production stays bound to host
-        # loopback unless a caller explicitly selects another client.
-        self._bind_host = bind_host or (
-            "0.0.0.0"
-            if not self._client_network and self._client_host != "127.0.0.1"
-            else "127.0.0.1"
-        )
+        self._host_root = host_root or bot_bottle_root()
         self._dockerfile = dockerfile
 
     def url(self) -> str:
-        """Control-plane URL reachable by this Docker client."""
-        port = DEFAULT_PORT if self._client_network else self.port
-        return f"http://{self._client_host}:{port}"
+        """Host-side control-plane URL — the orchestrator's published loopback,
+        which the CLI reaches."""
+        return f"http://127.0.0.1:{self.port}"
 
     def gateway_url(self) -> str:
         """The URL the gateway's data plane resolves policy against — the
@@ -131,11 +107,6 @@ class DockerOrchestrator(Orchestrator):
                 str(self._repo_root)]
         if os.environ.get("BOT_BOTTLE_NO_CACHE"):
             argv.insert(2, "--no-cache")
-        for name, value in resources.image_build_args(
-            self._dockerfile,
-            context=self._repo_root,
-        ).items():
-            argv[-1:-1] = ["--build-arg", f"{name}={value}"]
         proc = run_docker(argv)
         if proc.returncode != 0:
             raise GatewayError(
@@ -148,7 +119,8 @@ class DockerOrchestrator(Orchestrator):
         return self.name in proc.stdout.split()
 
     def _source_current(self, current_hash: str) -> bool:
-        """True iff the running orchestrator image matches current source."""
+        """True iff the running orchestrator was started from the current
+        bind-mounted source."""
         if not self.is_running():
             return False
         proc = run_docker([
@@ -210,19 +182,15 @@ class DockerOrchestrator(Orchestrator):
             # Control network only — agents are never on it, so they have no
             # route to the control plane (the L3 block, not just the JWT).
             "--network", self.control_network,
-            # Host CLI reaches the control plane here (loopback by default).
-            # Socket-shared CI joins the container directly to the job network;
-            # the host-side mapping remains loopback-only in that topology. The
+            # Host CLI reaches the control plane here (loopback only). The
             # orchestrator listens on the fixed DEFAULT_PORT inside the
             # container; self.port is the host-side published port.
-            "--publish", f"{self._bind_host}:{self.port}:{DEFAULT_PORT}",
-            # The image was rebuilt from `_repo_root` immediately before this
-            # launch. Running its baked package avoids a host-path bind mount,
-            # which is both more production-like and works with socket-shared
-            # CI where the daemon cannot see the job container's workspace.
+            "--publish", f"127.0.0.1:{self.port}:{DEFAULT_PORT}",
+            # Live control-plane source (code changes without an image rebuild).
+            "--volume", f"{self._repo_root}:{_SRC_IN_CONTAINER}:ro",
+            "--env", f"PYTHONPATH={_SRC_IN_CONTAINER}",
             # Orchestrator registry DB on the host (sole writer: control plane).
-            # `root_mount_source` may be a host path or a named Docker volume.
-            "--volume", f"{self._root_mount_source}:{_ROOT_IN_CONTAINER}",
+            "--volume", f"{self._host_root}:{_ROOT_IN_CONTAINER}",
             "--env", f"BOT_BOTTLE_ROOT={_ROOT_IN_CONTAINER}",
             # The signing key — held ONLY by the orchestrator (it verifies
             # tokens); the gateway gets the pre-minted `gateway` JWT, never the
@@ -237,15 +205,6 @@ class DockerOrchestrator(Orchestrator):
             raise OrchestratorStartError(
                 f"orchestrator container failed to start: {proc.stderr.strip()}"
             )
-        if self._client_network:
-            proc = run_docker([
-                "docker", "network", "connect", self._client_network, self.name,
-            ])
-            if proc.returncode != 0:
-                raise OrchestratorStartError(
-                    f"orchestrator container failed to join client network "
-                    f"{self._client_network}: {proc.stderr.strip()}"
-                )
 
     def stop(self) -> None:
         """Remove the control-plane container (idempotent)."""

bot_bottle/backend/docker/setup.py

@@ -8,7 +8,7 @@ pointer, and `status()` reports whether docker is usable.
 This is intentionally minimal; a richer version (daemon config checks,
 gVisor/runsc install guidance, rootless-docker hints) is tracked
 separately. Reached via `DockerBottleBackend.setup` / `.status`, which
-the generic `bot-bottle backend {setup,status}` dispatches to.
+the generic `./cli.py backend {setup,status}` dispatches to.
 """
 
 from __future__ import annotations
@@ -69,7 +69,7 @@ def teardown() -> int:
     sys.stderr.write(
         "Docker backend: nothing to undo — it provisions no privileged host "
         "state (networks and the gateway are per-launch and are "
-        "removed by `bot-bottle cleanup`). Docker itself is left installed.\n"
+        "removed by `./cli.py cleanup`). Docker itself is left installed.\n"
     )
     return 0
 
@@ -89,5 +89,5 @@ def status() -> int:
     runsc = _docker_on_path() and _util.runsc_available()
     sys.stderr.write(f"gVisor runsc runtime: {'registered' if runsc else 'not registered (optional)'}\n")
     if not ok:
-        sys.stderr.write("\nRun: bot-bottle backend setup --backend=docker\n")
+        sys.stderr.write("\nRun: ./cli.py backend setup --backend=docker\n")
     return 0 if ok else 1

bot_bottle/backend/docker/util.py

@@ -10,14 +10,8 @@ import shutil
 import subprocess
 from typing import Iterator
 
-from ... import resources
 from ...log import die, info
-from ...util import slugify as _slugify
-
-
-def slugify(name: str) -> str:
-    """Compatibility wrapper; new generic callers import ``bot_bottle.util``."""
-    return _slugify(name)
+from ...util import slugify
 
 
 def run_docker(
@@ -120,13 +114,7 @@ def docker_cp(src: str, dest: str) -> None:
             f"{(result.stderr or '').strip() or '<no stderr>'}")
 
 
-def build_image(
-    ref: str,
-    context: str,
-    *,
-    dockerfile: str = "",
-    build_args: dict[str, str] | None = None,
-) -> None:
+def build_image(ref: str, context: str, *, dockerfile: str = "") -> None:
     """Invokes `docker build` every call. Layer cache makes no-change
     rebuilds cheap; running every time means Dockerfile edits land
     without manual `docker rmi`.
@@ -146,61 +134,10 @@ def build_image(
         args.append("--no-cache")
     if dockerfile:
         args.extend(["-f", dockerfile])
-    effective_build_args = resources.image_build_args(
-        dockerfile,
-        context=context,
-    ) if dockerfile else {}
-    effective_build_args.update(build_args or {})
-    for name, value in effective_build_args.items():
-        args.extend(["--build-arg", f"{name}={value}"])
     args.append(context)
     subprocess.run(args, check=True)
 
 
-def image_id(ref: str) -> str:
-    """Return the exact content-addressed ID for a local image.
-
-    This is used when one locally built image is another Dockerfile's base:
-    passing the ID prevents a mutable tag from being resolved between builds.
-    """
-    result = run_docker(["docker", "image", "inspect", "--format", "{{.Id}}", ref])
-    image = result.stdout.strip()
-    if result.returncode != 0 or not image.startswith("sha256:"):
-        detail = (result.stderr or result.stdout or "").strip()
-        die(f"could not resolve exact image ID for {ref!r}: {detail or '<no detail>'}")
-    return image
-
-
-def pinned_local_image_ref(ref: str) -> str:
-    """Give a local image a content-derived tag and verify the tag resolves
-    back to the same image ID.
-
-    BuildKit treats a bare ``sha256:...`` ID in ``FROM`` as a registry
-    repository name. A tag whose complete suffix is the local image ID remains
-    resolvable by BuildKit, while the post-tag inspection keeps the handoff
-    fail-closed.
-    """
-    image = image_id(ref)
-    digest = image.removeprefix("sha256:")
-    if len(digest) != 64 or any(char not in "0123456789abcdef" for char in digest):
-        die(f"could not derive a local base tag from invalid image ID {image!r}")
-
-    repository = ref.split("@", 1)[0]
-    last_slash = repository.rfind("/")
-    last_colon = repository.rfind(":")
-    if last_colon > last_slash:
-        repository = repository[:last_colon]
-    pinned_ref = f"{repository}:sha256-{digest}"
-
-    result = run_docker(["docker", "image", "tag", image, pinned_ref])
-    if result.returncode != 0:
-        detail = (result.stderr or result.stdout or "").strip()
-        die(f"could not tag exact local image {image}: {detail or '<no detail>'}")
-    if image_id(pinned_ref) != image:
-        die(f"content-derived local tag {pinned_ref!r} did not resolve to {image}")
-    return pinned_ref
-
-
 def verify_agent_image(image: str, argv: tuple[str, ...]) -> None:
     """Run `argv` inside a throwaway container of a freshly built agent
     image and die loudly if it fails, instead of shipping an image

bot_bottle/backend/egress_apply.py

@@ -11,8 +11,7 @@ from pathlib import Path
 
 from ..bottle_state import egress_state_dir
 from ..egress import EGRESS_ROUTES_FILENAME
-from ..gateway.egress.schema import load_config
-from ..gateway.egress.types import LOG_OFF
+from ..gateway.egress.addon_core import LOG_OFF, load_config
 
 
 class EgressApplyError(RuntimeError):

bot_bottle/backend/firecracker/backend.py

@@ -20,7 +20,6 @@ from ...git_gate import GitGatePlan
 from ...manifest import Manifest
 from ...supervisor.plan import SupervisePlan
 from .. import ActiveAgent, BottleBackend, BottleImages, BottleSpec
-from ..gateway_attach import GatewayAttachResources
 from . import cleanup as _cleanup
 from . import enumerate as _enumerate
 from . import launch as _launch
@@ -32,7 +31,7 @@ from .bottle_plan import FirecrackerBottlePlan
 
 
 class FirecrackerBottleBackend(
-    BottleBackend["FirecrackerBottlePlan", "FirecrackerBottleCleanupPlan", "Path"]
+    BottleBackend["FirecrackerBottlePlan", "FirecrackerBottleCleanupPlan"]
 ):
     name = "firecracker"
 
@@ -120,19 +119,6 @@ class FirecrackerBottleBackend(
     def enumerate_active(self) -> Sequence[ActiveAgent]:
         return _enumerate.enumerate_active()
 
-    def _gateway_attach_resources(self) -> GatewayAttachResources:
-        from .gateway import FirecrackerGateway
-        return GatewayAttachResources(ca_pem=FirecrackerGateway().ca_cert_pem())
-
-    def _running_bottles(self) -> Sequence[Path]:
-        return _cleanup.live_run_dirs()
-
-    def _attach_bottle_to_gateway(
-        self, bottle: Path, resources: GatewayAttachResources,
-    ) -> None:
-        from .infra_launch import attach_ca_to_agent_vm
-        attach_ca_to_agent_vm(bottle, resources.ca_pem)
-
     def supervise_mcp_url(self, plan: FirecrackerBottlePlan) -> str:
         return plan.agent_supervise_url
 

bot_bottle/backend/firecracker/bottle_cleanup_plan.py

@@ -27,11 +27,3 @@ class FirecrackerBottleCleanupPlan(BottleCleanupPlan):
     @property
     def empty(self) -> bool:
         return not (self.vm_pids or self.run_dirs)
-
-    def intersect(self, current: BottleCleanupPlan) -> "FirecrackerBottleCleanupPlan":
-        if not isinstance(current, FirecrackerBottleCleanupPlan):
-            raise TypeError("cleanup plans must have the same backend type")
-        return FirecrackerBottleCleanupPlan(
-            vm_pids=tuple(x for x in self.vm_pids if x in current.vm_pids),
-            run_dirs=tuple(x for x in self.run_dirs if x in current.run_dirs),
-        )

bot_bottle/backend/firecracker/cleanup.py

@@ -11,9 +11,10 @@ Reaps *orphans* only — resources with no live VM behind them:
     — a VMM left lingering after its dir was removed.
 
 A run dir with a *live* firecracker process is a running bottle and is
-left strictly alone: it is neither killed nor removed. Active-agent
-enumeration uses this same process snapshot, so cleanup and generic
-backend consumers agree about which bottles are running.
+left strictly alone: it is neither killed nor removed. (The backend's
+`enumerate_active` registry is still a stub — #354 — so a live process
+is the only reliable "this bottle is in use" signal we have. Once the
+registry lands, registry-orphaned-but-running VMs can be reaped too.)
 
 TAP slots free themselves (the flock drops when the launcher exits), so
 there is nothing to reclaim there.
@@ -21,16 +22,14 @@ there is nothing to reclaim there.
 
 from __future__ import annotations
 
-from collections.abc import Sequence
 import os
+import shutil
 import signal
 import subprocess
 from pathlib import Path
 
 from ...log import info
-from .. import EnumerationError
-from ..cleanup_control import CleanupError, CleanupFailures
-from . import lifecycle_lock, util
+from . import util
 from .bottle_cleanup_plan import FirecrackerBottleCleanupPlan
 
 
@@ -38,7 +37,7 @@ def _run_root() -> Path:
     return util.cache_dir() / "run"
 
 
-def _run_dir_of(args: Sequence[str], run_root: Path) -> Path | None:
+def _run_dir_of(cmd: str, run_root: Path) -> Path | None:
     """The bottle run dir a firecracker cmdline belongs to, or None.
 
     A bottle VM is launched with `--config-file <run_root>/<slug>/config.json`,
@@ -46,35 +45,15 @@ def _run_dir_of(args: Sequence[str], run_root: Path) -> Path | None:
     the run root. Anything else (a builder VM, the infra VM elsewhere) is
     not ours to reap here.
     """
-    for i, arg in enumerate(args):
-        if arg == "--config-file" and i + 1 < len(args):
-            parent = Path(args[i + 1]).parent
+    toks = cmd.split()
+    for i, tok in enumerate(toks):
+        if tok == "--config-file" and i + 1 < len(toks):
+            parent = Path(toks[i + 1]).parent
             if parent.parent == run_root:
                 return parent
     return None
 
 
-def _decode_cmdline(raw: bytes) -> tuple[str, ...]:
-    """Decode Linux's NUL-delimited argv without losing embedded spaces."""
-    return tuple(
-        value.decode(errors="surrogateescape")
-        for value in raw.split(b"\0") if value
-    )
-
-
-def _process_args(pid: int) -> tuple[str, ...] | None:
-    """Read one process's lossless argv, or None when it exited meanwhile."""
-    try:
-        raw = Path(f"/proc/{pid}/cmdline").read_bytes()
-    except FileNotFoundError:
-        return None
-    except OSError as exc:
-        raise EnumerationError(
-            f"could not inspect Firecracker pid {pid}: {exc}"
-        ) from exc
-    return _decode_cmdline(raw)
-
-
 def _scan_processes(run_root: Path) -> tuple[set[str], list[int]]:
     """Inspect running firecracker VMs under ``run_root``.
 
@@ -83,34 +62,23 @@ def _scan_processes(run_root: Path) -> tuple[set[str], list[int]]:
       * ``orphan_pids`` — firecracker pids whose run dir no longer exists
         (a lingering VMM to kill).
     """
-    try:
-        result = subprocess.run(
-            ["pgrep", "firecracker"],
-            capture_output=True, text=True, check=False,
-        )
-    except OSError as exc:
-        raise EnumerationError(
-            f"could not enumerate Firecracker processes: {exc}"
-        ) from exc
-    if result.returncode == 1:
-        # pgrep's documented "no processes matched" result.
-        return set(), []
+    result = subprocess.run(
+        ["pgrep", "-a", "firecracker"],
+        capture_output=True, text=True, check=False,
+    )
     if result.returncode != 0:
-        detail = (result.stderr or "").strip() or f"exit {result.returncode}"
-        raise EnumerationError(
-            f"could not enumerate Firecracker processes: {detail}"
-        )
+        return set(), []
     live: set[str] = set()
     orphan_pids: list[int] = []
     for line in result.stdout.splitlines():
+        parts = line.split(None, 1)
+        if len(parts) != 2:
+            continue
         try:
-            pid = int(line.strip())
+            pid = int(parts[0])
         except ValueError:
             continue
-        args = _process_args(pid)
-        if args is None:
-            continue
-        run_dir = _run_dir_of(args, run_root)
+        run_dir = _run_dir_of(parts[1], run_root)
         if run_dir is None:
             continue
         if run_dir.is_dir():
@@ -146,54 +114,12 @@ def prepare_cleanup() -> FirecrackerBottleCleanupPlan:
 
 
 def cleanup(plan: FirecrackerBottleCleanupPlan) -> None:
-    """Revalidate the preview under the launch lock, then remove its survivors."""
-    with lifecycle_lock.hold():
-        fresh = prepare_cleanup()
-        approved_pids = set(plan.vm_pids).intersection(fresh.vm_pids)
-        approved_dirs = set(plan.run_dirs).intersection(fresh.run_dirs)
-        failures = CleanupFailures()
-        for pid in sorted(approved_pids):
-            try:
-                _terminate_orphan(pid, _run_root())
-            except CleanupError as exc:
-                failures.record(str(exc))
-        for path in sorted(approved_dirs):
-            info(f"rm -rf {path}")
-            failures.remove_tree(Path(path), f"removing Firecracker run dir {path}")
-        failures.raise_if_any()
-
-
-def _terminate_orphan(pid: int, run_root: Path) -> None:
-    """Signal exactly the process identity that still owns an orphan config."""
-    try:
-        pidfd = os.pidfd_open(pid)
-    except ProcessLookupError:
-        return
-    except OSError as exc:
-        raise EnumerationError(
-            f"could not pin Firecracker pid {pid} for cleanup: {exc}"
-        ) from exc
-    try:
-        try:
-            raw = Path(f"/proc/{pid}/cmdline").read_bytes()
-        except FileNotFoundError:
-            return
-        except OSError as exc:
-            raise EnumerationError(
-                f"could not revalidate Firecracker pid {pid}: {exc}"
-            ) from exc
-        args = _decode_cmdline(raw)
-        run_dir = _run_dir_of(args, run_root)
-        if run_dir is None or run_dir.is_dir():
-            return
+    for pid in plan.vm_pids:
         info(f"kill firecracker VM pid {pid}")
         try:
-            signal.pidfd_send_signal(pidfd, signal.SIGTERM)
+            os.kill(pid, signal.SIGTERM)
         except ProcessLookupError:
-            return
-        except OSError as exc:
-            raise CleanupError(
-                f"could not signal Firecracker pid {pid}: {exc}"
-            ) from exc
-    finally:
-        os.close(pidfd)
+            pass
+    for path in plan.run_dirs:
+        info(f"rm -rf {path}")
+        shutil.rmtree(path, ignore_errors=True)

bot_bottle/backend/firecracker/consolidated_launch.py

@@ -40,9 +40,7 @@ from ...orchestrator.lifecycle import (
 )
 from ...orchestrator.reprovision import reprovision_bottles
 from ...orchestrator.store.secret_store import ENV_VAR_SECRET_NAME
-from ..base import InfraLaunchError
 from ..provision_bottle import deprovision_bottle, provision_bottle
-from ..util import AGENT_CA_PATH
 from . import cleanup, util
 from .gateway import FirecrackerGateway
 from .infra import FirecrackerInfraService
@@ -50,6 +48,10 @@ from .infra import FirecrackerInfraService
 _ENV_VAR_SECRET_PATH = "/run/bot-bottle/env-var-secret"
 
 
+class ConsolidatedLaunchError(RuntimeError):
+    """The consolidated register/provision sequence could not complete."""
+
+
 @dataclass(frozen=True)
 class LaunchContext:
     """What the Firecracker launch needs from the consolidated sequence."""
@@ -81,48 +83,12 @@ def persist_env_var_secret(private_key: Path, guest_ip: str, secret: str) -> Non
         input=secret, capture_output=True, text=True, check=False,
     )
     if proc.returncode != 0:
-        raise InfraLaunchError(
+        raise ConsolidatedLaunchError(
             f"failed to persist {ENV_VAR_SECRET_NAME} in agent VM: "
             f"{proc.stderr.strip() or '<no stderr>'}"
         )
 
 
-def attach_ca_to_agent_vm(run_dir: Path, ca_pem: str) -> None:
-    """(Re)attach one running agent VM (identified by its `run_dir`) to the
-    current gateway: replace its trusted gateway CA with `ca_pem` and rebuild
-    its trust store over SSH (PRD 0081). Unconditional install — there is one
-    gateway, so no fingerprint match is needed. Bare-pipe input keeps the cert
-    off argv.
-
-    Fail hard: raises `InfraLaunchError` (naming the bottle) if the run dir is
-    malformed or the push fails — the base reconcile aggregates and surfaces it
-    rather than leaving the agent silently unable to reach the gateway."""
-    guest_ip = _guest_ip_from_config(run_dir / "config.json")
-    private_key = run_dir / "bottle_id_ed25519"
-    if not guest_ip or not private_key.is_file():
-        raise InfraLaunchError(
-            f"{run_dir.name}: cannot resolve guest IP / SSH key to attach it "
-            f"to the gateway"
-        )
-    install = (
-        "umask 022; mkdir -p /usr/local/share/ca-certificates && "
-        f"cat > {AGENT_CA_PATH} && chmod 644 {AGENT_CA_PATH} && "
-        "update-ca-certificates"
-    )
-    try:
-        proc = subprocess.run(
-            util.ssh_base_argv(private_key, guest_ip) + [install],
-            input=ca_pem, capture_output=True, text=True, check=False,
-        )
-    except OSError as exc:
-        raise InfraLaunchError(f"{run_dir.name} ({guest_ip}): CA push failed: {exc}") from exc
-    if proc.returncode != 0:
-        raise InfraLaunchError(
-            f"{run_dir.name} ({guest_ip}): CA push failed: "
-            f"{proc.stderr.strip() or '<no stderr>'}"
-        )
-
-
 def _reprovision_running_bottles(client: OrchestratorClient) -> None:
     """Read keys from live agent VMs and restore the restarted gateway."""
     try:
@@ -195,8 +161,7 @@ def deprovision_consolidated(
 __all__ = [
     "LaunchContext",
     "launch_consolidated",
-    "attach_ca_to_agent_vm",
     "deprovision_consolidated",
-    "InfraLaunchError",
+    "ConsolidatedLaunchError",
     "OrchestratorStartError",
 ]

bot_bottle/backend/firecracker/enumerate.py

@@ -1,32 +1,14 @@
 """Active-agent enumeration for the Firecracker backend.
 
-Running bottles are the Firecracker processes whose ``--config-file`` points
-at an existing per-bottle run directory. The same authoritative process scan
-protects cleanup from deleting live VMs; operational scan failures propagate
-as ``EnumerationError`` instead of masquerading as an empty host.
+The backend is disabled during the companion-container removal (#385) — it can't
+launch bottles, so there are none to enumerate. Real enumeration returns
+with the backend's consolidated relaunch (#354).
 """
 
 from __future__ import annotations
 
-from ...bottle_state import read_metadata
 from .. import ActiveAgent
-from .cleanup import live_run_dirs
 
 
 def enumerate_active() -> list[ActiveAgent]:
-    out: list[ActiveAgent] = []
-    for run_dir in live_run_dirs():
-        slug = run_dir.name
-        metadata = read_metadata(slug)
-        out.append(ActiveAgent(
-            backend_name="firecracker",
-            slug=slug,
-            agent_name=metadata.agent_name if metadata else "?",
-            started_at=metadata.started_at if metadata else "",
-            # Firecracker uses the shared gateway, so there are no
-            # per-bottle gateway service containers to report.
-            services=(),
-            label=metadata.label if metadata else "",
-            color=metadata.color if metadata else "",
-        ))
-    return out
+    return []

bot_bottle/backend/firecracker/gateway.py

@@ -69,17 +69,13 @@ class FirecrackerGateway(Gateway):
         self._orchestrator_url = ""
         self._gateway_token = ""
 
-    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> bool:
+    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> None:
         """Boot the gateway VM on its link resolving policy against
         `orchestrator_url`, then seed `gateway_token` over SSH. The orchestrator's
         guest IP is parsed from the URL and passed on the cmdline (`bb_orch=`), so
         the baked init stays IP-independent. Boot the orchestrator first — the
         gateway daemons reach it at startup. The gateway never mints, so it holds
-        no signing key, only this token (#469).
-
-        Always returns True: the firecracker gateway VM is booted fresh here
-        (this runs only on the infra cold-boot path), so it is always a cold
-        boot that minted a new CA — the caller reconciles running bottles."""
+        no signing key, only this token (#469)."""
         self._orchestrator_url = orchestrator_url
         self._gateway_token = gateway_token
         if not self._orchestrator_url:
@@ -109,7 +105,6 @@ class FirecrackerGateway(Gateway):
             "the gateway JWT to the gateway VM (its data plane will not start)",
         )
         self._vm = vm
-        return True
 
     def is_running(self) -> bool:
         return infra_vm._pidfile_alive(infra_vm._gw_dir())

bot_bottle/backend/firecracker/image_builder.py

@@ -19,14 +19,12 @@ from __future__ import annotations
 import fcntl
 import hashlib
 import os
-import shlex
 import shutil
 import subprocess
 from contextlib import contextmanager
 from pathlib import Path
 from typing import Generator
 
-from ... import resources
 from ...log import die, info
 from . import util
 from .infra import FirecrackerInfraService
@@ -57,11 +55,6 @@ def _rootfs_digest(dockerfile: Path) -> str:
     h = hashlib.sha256()
     h.update(_dockerfile_hash(dockerfile).encode())
     h.update(b"\0")
-    for name, value in resources.image_build_args(dockerfile).items():
-        h.update(name.encode())
-        h.update(b"=")
-        h.update(value.encode())
-        h.update(b"\0")
     h.update(util._GUEST_INIT.encode())
     return h.hexdigest()[:16]
 
@@ -154,13 +147,7 @@ def _build_in_infra(
         if prep.returncode != 0:
             die(f"preparing build dir in the infra VM failed: {prep.stderr.strip()}")
         _send_dockerfile(key, ip, dockerfile, ctx)
-        _buildah_build(
-            key,
-            ip,
-            ctx,
-            tag,
-            resources.image_build_args(dockerfile),
-        )
+        _buildah_build(key, ip, ctx, tag)
         _smoke_test(key, ip, tag, smoke_ctr, smoke_test)
         _stream_rootfs(key, ip, tag, export_ctr, base)
     finally:
@@ -197,26 +184,15 @@ def _send_dockerfile(private_key: Path, guest_ip: str, dockerfile: Path, ctx: st
             f"{proc.stderr.decode(errors='replace').strip()}")
 
 
-def _buildah_build(
-    private_key: Path,
-    guest_ip: str,
-    ctx: str,
-    tag: str,
-    build_args: dict[str, str],
-) -> None:
+def _buildah_build(private_key: Path, guest_ip: str, ctx: str, tag: str) -> None:
     # Stream buildah's step-by-step output straight to our stderr (like the
     # docker backend's `docker build`), so a long first build (base pull +
     # apt/npm installs) shows live progress instead of a silent wait. The
     # remote stderr is where buildah writes its `STEP i/n` lines.
     info(f"buildah build {tag} in the infra VM (streaming output)")
-    arg_flags = " ".join(
-        f"--build-arg {shlex.quote(f'{name}={value}')}"
-        for name, value in build_args.items()
-    )
     rc = _ssh_streamed(
         private_key, guest_ip,
-        f"buildah build {_BUILD_FLAGS} {arg_flags} "
-        f"-t {tag} -f {ctx}/Dockerfile {ctx}/ctx",
+        f"buildah build {_BUILD_FLAGS} -t {tag} -f {ctx}/Dockerfile {ctx}/ctx",
         timeout=_BUILD_TIMEOUT_SECONDS,
     )
     if rc != 0:

bot_bottle/backend/firecracker/infra.py

@@ -67,17 +67,9 @@ class FirecrackerInfraService(InfraService):
             # holds the signing key) mints the role-scoped `gateway` JWT for the
             # gateway, which never sees the key (#469).
             orchestrator.ensure_running(startup_timeout=startup_timeout)
-            cold_booted = self.gateway().connect_to_orchestrator(
+            self.gateway().connect_to_orchestrator(
                 orchestrator.gateway_url(), orchestrator.mint_gateway_token())
             infra_vm.record_booted_version(want)
-            # The fresh gateway rootfs minted a new CA and lost every bottle's
-            # git-gate/token state; reconcile the already-running bottles against
-            # it so a gateway rebuild doesn't silently break their egress
-            # (PRD 0081). Cold-boot only — the adopt fast-paths above never reach
-            # here, so a healthy current gateway is left untouched.
-            if cold_booted:
-                from .backend import FirecrackerBottleBackend
-                FirecrackerBottleBackend().attach_bottled_agents_to_gateway()
             return url
 
     def stop(self) -> None:

bot_bottle/backend/firecracker/infra_artifact.py

@@ -41,8 +41,6 @@ from ... import resources
 from ...log import die, info
 from . import util
 
-ARTIFACT_HTTP_TIMEOUT_SECONDS = 30.0
-
 # Bump if the on-disk artifact *format* changes (compression, layout) so a new
 # scheme can't collide with a cached/published artifact of the old one.
 _ARTIFACT_FORMAT = "1"
@@ -51,18 +49,9 @@ _ARTIFACT_FORMAT = "1"
 # from its own generic package; the Dockerfiles baked into each differ (only the
 # orchestrator rootfs carries buildah), so the versions are hashed separately.
 ROLES = ("orchestrator", "gateway")
-_BUILD_INPUTS = {
-    "orchestrator": (
-        "image-build-args.json",
-        "Dockerfile.orchestrator",
-        "Dockerfile.orchestrator.fc",
-        "requirements.orchestrator.lock",
-    ),
-    "gateway": (
-        "image-build-args.json",
-        "Dockerfile.gateway",
-        "requirements.gateway.lock",
-    ),
+_DOCKERFILES = {
+    "orchestrator": ("Dockerfile.orchestrator", "Dockerfile.orchestrator.fc"),
+    "gateway": ("Dockerfile.gateway",),
 }
 
 _DEFAULT_BASE = "https://gitea.dideric.is"
@@ -112,7 +101,7 @@ def infra_artifact_version(
         h.update(str(path.relative_to(repo_root)).encode())
         h.update(b"\0")
         h.update(path.read_bytes())
-    for name in _BUILD_INPUTS[role]:
+    for name in _DOCKERFILES[role]:
         h.update(name.encode())
         h.update(b"\0")
         h.update((repo_root / name).read_bytes())
@@ -166,9 +155,7 @@ def _download(url: str, dest: Path) -> None:
     """Stream `url` to `dest` (atomic via a `.part` sibling)."""
     tmp = dest.with_suffix(dest.suffix + ".part")
     try:
-        with urllib.request.urlopen(
-            _open(url), timeout=ARTIFACT_HTTP_TIMEOUT_SECONDS,
-        ) as resp, open(tmp, "wb") as out:
+        with urllib.request.urlopen(_open(url)) as resp, open(tmp, "wb") as out:
             shutil.copyfileobj(resp, out, _CHUNK)
     except urllib.error.HTTPError as e:
         tmp.unlink(missing_ok=True)

bot_bottle/backend/firecracker/infra_vm.py

@@ -133,15 +133,10 @@ def build_infra_images_with_docker() -> None:
     root = str(resources.build_root())
     docker_mod.build_image(
         _ORCHESTRATOR_IMAGE, root, dockerfile="Dockerfile.orchestrator")
-    orchestrator_base = docker_mod.pinned_local_image_ref(_ORCHESTRATOR_IMAGE)
     docker_mod.build_image(
         _GATEWAY_IMAGE, root, dockerfile="Dockerfile.gateway")
     docker_mod.build_image(
-        _ORCHESTRATOR_FC_IMAGE,
-        root,
-        dockerfile="Dockerfile.orchestrator.fc",
-        build_args={"ORCHESTRATOR_BASE_IMAGE": orchestrator_base},
-    )
+        _ORCHESTRATOR_FC_IMAGE, root, dockerfile="Dockerfile.orchestrator.fc")
 
 
 def build_rootfs_dir(role: str) -> Path:
@@ -204,7 +199,7 @@ def boot_vm(
     Records the PID."""
     if not netpool.tap_present(slot.iface):
         die(f"infra link {slot.iface} not present.\n"
-            f"    bot-bottle backend setup --backend=firecracker")
+            f"    ./cli.py backend setup --backend=firecracker")
 
     run_dir.mkdir(parents=True, exist_ok=True)
     rootfs = run_dir / "rootfs.ext4"

bot_bottle/backend/firecracker/isolation_probe.py

@@ -108,7 +108,7 @@ def verify_isolation(private_key: Path, guest_ip: str) -> None:
         die(f"ISOLATION FAILURE: the VM reached the host canary "
             f"{canary_ip}:{canary_port}. The egress boundary is not in "
             f"force — refusing to run the agent (fail-closed). Verify the "
-            f"nft table with: bot-bottle backend setup --backend=firecracker")
+            f"nft table with: ./cli.py backend setup --backend=firecracker")
     if result.returncode == 2:
         die("isolation probe inconclusive: the guest has no python3/bash/nc "
             "to run the connectivity test. Refusing to continue "

bot_bottle/backend/firecracker/launch.py

@@ -46,12 +46,12 @@ from ...log import die, info, warn
 from ...supervisor.types import SUPERVISE_PORT
 from ..docker.egress import EGRESS_PORT
 from ..util import AGENT_CA_BUNDLE, AGENT_CA_PATH
-from . import firecracker_vm, image_builder, isolation_probe, lifecycle_lock, netpool, util
+from . import firecracker_vm, image_builder, isolation_probe, netpool, util
 from .bottle import FirecrackerBottle
 from .bottle_plan import FirecrackerBottlePlan
 from ...orchestrator.store.config_store import resolve_teardown_timeout
 from ...orchestrator.store.secret_store import ENV_VAR_SECRET_NAME
-from .infra_launch import (
+from .consolidated_launch import (
     launch_consolidated,
     persist_env_var_secret,
     deprovision_consolidated,
@@ -164,29 +164,25 @@ def launch(
         )
 
         # Step 6: build the per-bottle rootfs + SSH key, then boot.
-        # Cleanup takes the same lock while refreshing its process snapshot.
-        # Hold it until the VMM exists so a newly-created run dir can never be
-        # mistaken for an orphan in the build-before-boot window.
-        with lifecycle_lock.hold():
-            run_dir = util.cache_dir() / "run" / plan.slug
-            run_dir.mkdir(parents=True, exist_ok=True)
-            # Remove the run dir on teardown so the per-bottle rootfs.ext4 (~1G)
-            # doesn't leak. Registered before vm.terminate below so it runs
-            # *after* it (ExitStack is LIFO).
-            stack.callback(lambda: shutil.rmtree(run_dir, ignore_errors=True))
-            rootfs = run_dir / "rootfs.ext4"
-            util.build_rootfs_ext4(agent_base, rootfs)
-            private_key, pubkey = util.generate_keypair(run_dir)
+        run_dir = util.cache_dir() / "run" / plan.slug
+        run_dir.mkdir(parents=True, exist_ok=True)
+        # Remove the run dir on teardown so the per-bottle rootfs.ext4 (~1G)
+        # doesn't leak. Registered before vm.terminate below so it runs *after*
+        # it (ExitStack is LIFO): the VM is gone before we rm its rootfs.
+        stack.callback(lambda: shutil.rmtree(run_dir, ignore_errors=True))
+        rootfs = run_dir / "rootfs.ext4"
+        util.build_rootfs_ext4(agent_base, rootfs)
+        private_key, pubkey = util.generate_keypair(run_dir)
 
-            vm = firecracker_vm.boot(
-                name=plan.container_name,
-                rootfs=rootfs,
-                tap=slot.iface,
-                guest_ip=slot.guest_ip,
-                host_ip=slot.host_ip,
-                pubkey=pubkey,
-                run_dir=run_dir,
-            )
+        vm = firecracker_vm.boot(
+            name=plan.container_name,
+            rootfs=rootfs,
+            tap=slot.iface,
+            guest_ip=slot.guest_ip,
+            host_ip=slot.host_ip,
+            pubkey=pubkey,
+            run_dir=run_dir,
+        )
         stack.callback(vm.terminate)
         firecracker_vm.wait_for_ssh(vm, private_key)
         persist_env_var_secret(private_key, slot.guest_ip, ctx.env_var_secret)

bot_bottle/backend/firecracker/lifecycle_lock.py

@@ -1,30 +0,0 @@
-"""Serialize Firecracker run-directory creation with orphan cleanup."""
-
-from __future__ import annotations
-
-import fcntl
-from contextlib import contextmanager
-from pathlib import Path
-from typing import Generator
-
-from . import util
-
-
-def _lock_path() -> Path:
-    return util.cache_dir() / "run.lifecycle.lock"
-
-
-@contextmanager
-def hold() -> Generator[None]:
-    """Exclude cleanup while a launch directory lacks a visible VMM."""
-    path = _lock_path()
-    path.parent.mkdir(parents=True, exist_ok=True)
-    with path.open("a", encoding="utf-8") as handle:
-        fcntl.flock(handle, fcntl.LOCK_EX)
-        try:
-            yield
-        finally:
-            fcntl.flock(handle, fcntl.LOCK_UN)
-
-
-__all__ = ["hold"]

bot_bottle/backend/firecracker/netpool.py

@@ -3,7 +3,7 @@ config renderers (shell command + NixOS module) shown to operators.
 
 The Firecracker backend needs a privileged one-time network setup:
 a pool of point-to-point TAP devices (owned by the invoking user, so
-`bot-bottle start` never needs root) and a dedicated nftables table that
+`./cli.py start` never needs root) and a dedicated nftables table that
 isolates every VM. The pool parameters live in exactly one place —
 `netpool.defaults.env`, a plain KEY=VALUE file next to this module —
 and every consumer reads *that*: this module (below), the shell script
@@ -177,20 +177,14 @@ def gw_slot() -> Slot:
 # --- fail-closed verification ---------------------------------------
 
 def _run_ok(argv: list[str]) -> bool:
-    """Run a probe command, treating an unavailable binary as failure
+    """Run a probe command, treating a missing binary as failure
     (rather than crashing) so callers can stay fail-closed."""
     try:
         return subprocess.run(
             argv, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
             check=False,
         ).returncode == 0
-    except OSError:
-        # Not only "missing". A name on PATH that isn't executable by this
-        # user raises PermissionError, and CPython reports that EACCES in
-        # preference to the ENOENT from the other PATH entries — which is
-        # how `doctor` came to die with a traceback on a fresh macOS
-        # account. Any OSError means the probe couldn't run, which for a
-        # fail-closed check is indistinguishable from "not present".
+    except FileNotFoundError:
         return False
 
 
@@ -250,9 +244,7 @@ def overlapping_routes() -> list[RouteConflict]:
             ["ip", "-json", "route", "show", "table", "all"],
             capture_output=True, text=True, check=False,
         )
-    except OSError:
-        # Missing, or present-but-not-executable for this user; either way
-        # there are no routes we can enumerate. See _run_ok.
+    except FileNotFoundError:
         return []
     if proc.returncode != 0 or not proc.stdout.strip():
         return []
@@ -315,11 +307,11 @@ def allocate(slug: str) -> tuple[Slot, IO[str]]:
         return s, handle
     die(f"Firecracker TAP pool exhausted ({pool_size()} slots, all in "
         f"use). Stop a running bottle or raise BOT_BOTTLE_FC_POOL_SIZE "
-        f"and re-run `bot-bottle backend setup --backend=firecracker`.")
+        f"and re-run `./cli.py backend setup --backend=firecracker`.")
     raise AssertionError("unreachable")
 
 
-# --- config renderers (shown by `bot-bottle backend setup`) -----------
+# --- config renderers (shown by `./cli.py backend setup`) -----------
 
 # The persistent unit is the portable install: the same systemd oneshot
 # on every systemd distro (Debian/Ubuntu/Fedora/RHEL/Arch/…).

bot_bottle/backend/firecracker/publish_infra.py

@@ -34,7 +34,6 @@ from pathlib import Path
 from . import infra_artifact, infra_vm, util
 
 _CHUNK = 1 << 20
-_REGISTRY_HTTP_TIMEOUT_SECONDS = 30.0
 
 _GZ_NAME = "rootfs.ext4.gz"
 _SHA_NAME = "rootfs.ext4.gz.sha256"
@@ -92,9 +91,7 @@ def _put(url: str, body: "bytes | Path", token: str) -> None:
         req.add_header("Authorization", f"token {token}")
     req.add_header("Content-Type", "application/octet-stream")
     try:
-        with urllib.request.urlopen(
-            req, timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ) as resp:
+        with urllib.request.urlopen(req) as resp:
             print(f"  uploaded {url} (HTTP {resp.status})")
     except urllib.error.HTTPError as e:
         if e.code == 409:
@@ -115,9 +112,7 @@ def _delete(url: str, token: str) -> None:
     if token:
         req.add_header("Authorization", f"token {token}")
     try:
-        with urllib.request.urlopen(
-            req, timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ):
+        with urllib.request.urlopen(req):
             pass
     except urllib.error.HTTPError as e:
         if e.code != 404:
@@ -156,10 +151,7 @@ def _try_download_published(role: str, role_dir: Path) -> str | None:
     version = _role_version(role)
     sha_url = infra_artifact.artifact_url(version, _SHA_NAME, role=role)
     try:
-        with urllib.request.urlopen(
-            infra_artifact._open(sha_url),
-            timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ):
+        with urllib.request.urlopen(infra_artifact._open(sha_url)):
             pass
     except urllib.error.HTTPError as e:
         if e.code == 404:
@@ -203,10 +195,7 @@ def _publish_bundle(role: str, role_dir: Path, token: str) -> str:
     # present, a re-publish is a no-op. Otherwise clear any partial upload left
     # by an interrupted prior attempt and upload the complete set.
     try:
-        with urllib.request.urlopen(
-            infra_artifact._open(sha_url),
-            timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ) as resp:
+        with urllib.request.urlopen(infra_artifact._open(sha_url)) as resp:
             remote_sha = resp.read().decode("utf-8").split()[0].strip().lower()
     except urllib.error.HTTPError as e:
         if e.code != 404:

bot_bottle/backend/firecracker/setup.py

@@ -8,7 +8,7 @@ bundled setup script. `status()` reports what's present, including
 whether the pool range collides with an existing route.
 
 Called through `FirecrackerBottleBackend.setup` / `.status`, which the
-generic `bot-bottle backend {setup,status}` command dispatches to.
+generic `./cli.py backend {setup,status}` command dispatches to.
 """
 
 from __future__ import annotations
@@ -34,7 +34,7 @@ _UNIT_PATH = Path("/etc/systemd/system") / netpool.SYSTEMD_UNIT
 
 def _owner() -> str:
     # Under `sudo`, USER is root but SUDO_USER is the real invoker — the
-    # TAPs must be owned by them so `bot-bottle start` stays rootless.
+    # TAPs must be owned by them so `./cli.py start` stays rootless.
     return os.environ.get("SUDO_USER") or os.environ.get("USER") or "youruser"
 
 
@@ -161,7 +161,7 @@ def _setup_systemd() -> None:
         if rc == 0:
             sys.stderr.write(
                 f"Installed and started {netpool.SYSTEMD_UNIT}. Verify with "
-                f"`bot-bottle backend status --backend=firecracker`.\n"
+                f"`./cli.py backend status --backend=firecracker`.\n"
             )
         else:
             sys.stderr.write(
@@ -181,7 +181,7 @@ def _setup_systemd() -> None:
     )
     sys.stderr.write(
         f"\n(Or re-run this as root to install it directly: "
-        f"sudo bot-bottle backend setup --backend=firecracker)\n"
+        f"sudo ./cli.py backend setup --backend=firecracker)\n"
     )
 
 
@@ -334,7 +334,7 @@ def status() -> int:
         sys.stderr.write(f"range overlap: none (base {netpool.ip_base()})\n")
     _report_persistence()
     if not ok:
-        sys.stderr.write("\nRun: bot-bottle backend setup --backend=firecracker\n")
+        sys.stderr.write("\nRun: ./cli.py backend setup --backend=firecracker\n")
     return 0 if ok else 1
 
 

bot_bottle/backend/firecracker/util.py

@@ -9,7 +9,7 @@ generation.
 
 The privileged network setup (TAP pool + nft table) is a one-time
 operator step — see `netpool.py`, `scripts/firecracker-netpool.sh`,
-and `bot-bottle backend setup --backend=firecracker`.
+and `./cli.py backend setup --backend=firecracker`.
 """
 
 from __future__ import annotations
@@ -132,18 +132,18 @@ def _require_network_pool() -> None:
              f"{netpool.pool_size()} slots) overlaps existing routes: "
              f"{detail}. This can shadow or be shadowed by that route; "
              f"set BOT_BOTTLE_FC_IP_BASE to a free range and re-run "
-             f"bot-bottle backend setup --backend=firecracker.")
+             f"./cli.py backend setup --backend=firecracker.")
     missing = netpool.missing_taps()
     if missing:
         die(f"network pool incomplete — missing TAP devices: "
-            f"{', '.join(missing)}.\n    bot-bottle backend setup --backend=firecracker")
+            f"{', '.join(missing)}.\n    ./cli.py backend setup --backend=firecracker")
     if shutil.which("nft") is not None and not netpool.nft_table_present():
         # nft is queryable and says the table is absent — that's a
         # definite, catchable misconfiguration; fail early.
         warn(f"isolation table `inet {netpool.NFT_TABLE}` not found via nft. "
              "If this is a permissions issue it will be re-checked "
              "empirically after boot; otherwise run: "
-             "bot-bottle backend setup --backend=firecracker")
+             "./cli.py backend setup --backend=firecracker")
 
 
 # --- rootfs pipeline (rootless) -------------------------------------

bot_bottle/backend/freeze.py

@@ -43,7 +43,7 @@ class Freezer(ABC):
 
         Calls _freeze for the backend-specific snapshot, then writes the
         committed image reference to per-bottle state and marks the bottle
-        preserved so the next `bot-bottle resume` boots from the snapshot.
+        preserved so the next `./cli.py resume` boots from the snapshot.
 
         Raises CommitCancelled if the user declines an interactive
         confirmation prompt (e.g. the macos-container stop prompt).
@@ -51,7 +51,7 @@ class Freezer(ABC):
         image_ref = self._freeze(agent)
         write_committed_image(agent.slug, image_ref)
         mark_preserved(agent.slug)
-        info(f"to resume from this snapshot: bot-bottle resume {agent.slug}")
+        info(f"to resume from this snapshot: ./cli.py resume {agent.slug}")
         self._export_hint(agent.slug, image_ref)
 
     @abstractmethod

bot_bottle/backend/gateway_attach.py

@@ -1,54 +0,0 @@
-"""The shared gateway-attach reconcile flow (PRD 0081).
-
-`BottleBackend.attach_bottled_agents_to_gateway()` delegates here so every
-backend reconciles running bottles against a freshly-booted gateway *the same
-way* — the control flow + fail-hard policy live in one place and backends
-override only the primitives (see ADR 0006). Kept out of `backend/base.py` so
-the backend contract module stays lean (the base.py size guardrail).
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import TYPE_CHECKING, Any
-
-from .base import InfraLaunchError
-
-if TYPE_CHECKING:
-    from .base import BottleBackend
-
-
-@dataclass(frozen=True)
-class GatewayAttachResources:
-    """Everything a running bottle needs to (re)attach to the current gateway on
-    a cold boot (PRD 0081). Gathered once per reconcile and handed to every
-    bottle. The CA now; egress secrets and git-gate state join as the reconcile
-    grows (#516)."""
-
-    ca_pem: str
-
-
-def reconcile_running_bottles(backend: "BottleBackend[Any, Any, Any]") -> None:
-    """Reconcile every already-running bottle against the freshly-(re)booted
-    gateway: gather the attach resources once, then attach every live bottle.
-
-    Fail hard, never skip: a bottle that silently can't reach the fresh gateway
-    (its egress just starts failing TLS) is worse than a loud bring-up failure,
-    so any attach failure aborts bring-up. Every bottle is attempted first and
-    the failures are raised together, so one bring-up surfaces the full blast
-    radius rather than one bottle at a time."""
-    resources = backend._gateway_attach_resources()
-    failures: list[str] = []
-    for bottle in backend._running_bottles():
-        try:
-            backend._attach_bottle_to_gateway(bottle, resources)
-        except InfraLaunchError as exc:
-            failures.append(str(exc))
-    if failures:
-        raise InfraLaunchError(
-            f"could not attach {len(failures)} running bottle(s) to the "
-            f"freshly-booted gateway:\n  " + "\n  ".join(failures)
-        )
-
-
-__all__ = ["GatewayAttachResources", "reconcile_running_bottles"]

bot_bottle/backend/macos_container/backend.py

@@ -14,7 +14,6 @@ from ...git_gate import GitGatePlan
 from ...supervisor.plan import SupervisePlan
 from ...manifest import Manifest
 from .. import ActiveAgent, BottleBackend, BottleImages, BottleSpec
-from ..gateway_attach import GatewayAttachResources
 from . import cleanup as _cleanup
 from . import enumerate as _enumerate
 from . import launch as _launch
@@ -26,7 +25,7 @@ from .bottle_plan import MacosContainerBottlePlan
 
 
 class MacosContainerBottleBackend(
-    BottleBackend["MacosContainerBottlePlan", "MacosContainerBottleCleanupPlan", str]
+    BottleBackend["MacosContainerBottlePlan", "MacosContainerBottleCleanupPlan"]
 ):
     """Apple Container backend. Selected by
     `BOT_BOTTLE_BACKEND=macos-container` or
@@ -118,19 +117,5 @@ class MacosContainerBottleBackend(
     def enumerate_active(self) -> Sequence[ActiveAgent]:
         return _enumerate.enumerate_active()
 
-    def _gateway_attach_resources(self) -> GatewayAttachResources:
-        from .infra import MacosInfraService
-        return GatewayAttachResources(ca_pem=MacosInfraService().ca_cert_pem())
-
-    def _running_bottles(self) -> Sequence[str]:
-        from .infra_launch import running_agent_containers
-        return running_agent_containers()
-
-    def _attach_bottle_to_gateway(
-        self, bottle: str, resources: GatewayAttachResources,
-    ) -> None:
-        from .infra_launch import push_ca_to_container
-        push_ca_to_container(bottle, resources.ca_pem)
-
     def supervise_mcp_url(self, plan: MacosContainerBottlePlan) -> str:
         return plan.agent_supervise_url

bot_bottle/backend/macos_container/bottle_cleanup_plan.py

@@ -25,11 +25,3 @@ class MacosContainerBottleCleanupPlan(BottleCleanupPlan):
     @property
     def empty(self) -> bool:
         return not self.containers and not self.networks
-
-    def intersect(self, current: BottleCleanupPlan) -> "MacosContainerBottleCleanupPlan":
-        if not isinstance(current, MacosContainerBottleCleanupPlan):
-            raise TypeError("cleanup plans must have the same backend type")
-        return MacosContainerBottleCleanupPlan(
-            containers=tuple(x for x in self.containers if x in current.containers),
-            networks=tuple(x for x in self.networks if x in current.networks),
-        )

bot_bottle/backend/macos_container/cleanup.py

@@ -4,9 +4,7 @@ from __future__ import annotations
 
 import subprocess
 
-from .. import EnumerationError
-from ..cleanup_control import CleanupFailures
-from ...log import info
+from ...log import info, warn
 from . import util as container_mod
 from .bottle_cleanup_plan import MacosContainerBottleCleanupPlan
 
@@ -21,8 +19,8 @@ def _list_prefixed_containers() -> list[str]:
         check=False,
     )
     if result.returncode != 0:
-        detail = result.stderr.strip() or f"exit {result.returncode}"
-        raise EnumerationError(f"container list failed: {detail}")
+        warn(f"container list failed: {result.stderr.strip()}")
+        return []
     return sorted(
         name for name in (line.strip() for line in result.stdout.splitlines())
         if name.startswith(_PREFIX)
@@ -37,8 +35,7 @@ def _list_prefixed_networks() -> list[str]:
         check=False,
     )
     if result.returncode != 0:
-        detail = result.stderr.strip() or f"exit {result.returncode}"
-        raise EnumerationError(f"container network list failed: {detail}")
+        return []
     return sorted(
         name for name in (line.strip() for line in result.stdout.splitlines())
         if name.startswith(_PREFIX)
@@ -54,17 +51,19 @@ def prepare_cleanup() -> MacosContainerBottleCleanupPlan:
 
 
 def cleanup(plan: MacosContainerBottleCleanupPlan) -> None:
-    failures = CleanupFailures()
     for name in plan.containers:
         info(f"container delete --force {name}")
-        failures.run(
+        subprocess.run(
             ["container", "delete", "--force", name],
-            f"deleting container {name}",
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
         )
     for name in plan.networks:
         info(f"container network delete {name}")
-        failures.run(
+        subprocess.run(
             ["container", "network", "delete", name],
-            f"deleting network {name}",
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
         )
-    failures.raise_if_any()

bot_bottle/backend/macos_container/consolidated_launch.py

@@ -34,7 +34,6 @@ every real command arrives through `container exec`.
 
 from __future__ import annotations
 
-import tempfile
 from dataclasses import dataclass
 
 from ...egress import EgressPlan
@@ -43,9 +42,7 @@ from ...log import info
 from ...orchestrator.client import OrchestratorClient, OrchestratorClientError
 from ...orchestrator.reprovision import reprovision_bottles
 from ...orchestrator.store.secret_store import ENV_VAR_SECRET_NAME
-from ..base import InfraLaunchError
 from ..provision_bottle import deprovision_bottle, provision_bottle
-from ..util import AGENT_CA_PATH
 from . import util as container_mod
 from .enumerate import CONTAINER_NAME_PREFIX, EnumerationError, enumerate_active
 from .gateway import GATEWAY_NETWORK
@@ -53,6 +50,10 @@ from .gateway_transport import MacosGatewayTransport
 from .infra import MacosInfraService, OrchestratorStartError
 
 
+class ConsolidatedLaunchError(RuntimeError):
+    """The consolidated register/provision sequence could not complete."""
+
+
 @dataclass(frozen=True)
 class GatewayEndpoint:
     """What the agent `container run` needs to reach the shared gateway.
@@ -97,52 +98,6 @@ def ensure_gateway(
     return endpoint
 
 
-def running_agent_containers() -> list[str]:
-    """Every running agent container's name — the bottles the bring-up reconcile
-    attaches to the fresh gateway (PRD 0081). Raises `EnumerationError` if the
-    live set can't be determined (fail hard rather than reconcile a partial
-    set)."""
-    return [f"{CONTAINER_NAME_PREFIX}{agent.slug}" for agent in enumerate_active()]
-
-
-def push_ca_to_container(name: str, ca_pem: str) -> None:
-    """(Re)attach one running agent container to the current gateway: replace
-    its trusted gateway CA with `ca_pem` and rebuild its trust store via
-    `container cp` + `container exec` (PRD 0081). Unconditional install — there
-    is one gateway, so no fingerprint match is needed.
-
-    Fail hard: raises `InfraLaunchError` (naming the container) on any failure —
-    the base reconcile aggregates and surfaces it rather than leaving the agent
-    silently unable to reach the gateway."""
-    mkdir = container_mod.run_container_argv(
-        ["container", "exec", name, "mkdir", "-p",
-         "/usr/local/share/ca-certificates"]
-    )
-    if mkdir.returncode != 0:
-        raise InfraLaunchError(
-            f"CA push to {name} failed (mkdir): {(mkdir.stderr or '').strip()}"
-        )
-    with tempfile.NamedTemporaryFile("w", suffix=".crt") as tmp:
-        tmp.write(ca_pem)
-        tmp.flush()
-        cp = container_mod.run_container_argv(
-            ["container", "cp", tmp.name, f"{name}:{AGENT_CA_PATH}"]
-        )
-    if cp.returncode != 0:
-        raise InfraLaunchError(
-            f"CA push to {name} failed (cp): {(cp.stderr or '').strip()}"
-        )
-    ex = container_mod.run_container_argv(
-        ["container", "exec", name, "sh", "-c",
-         f"chmod 644 {AGENT_CA_PATH} && update-ca-certificates"]
-    )
-    if ex.returncode != 0:
-        raise InfraLaunchError(
-            f"CA push to {name} failed (update-ca-certificates): "
-            f"{(ex.stderr or '').strip()}"
-        )
-
-
 def _reprovision_running_bottles(endpoint: GatewayEndpoint) -> None:
     """Recover keys from live Apple containers and restore gateway tokens."""
     try:
@@ -245,12 +200,10 @@ __all__ = [
     "GatewayEndpoint",
     "LaunchContext",
     "ensure_gateway",
-    "running_agent_containers",
-    "push_ca_to_container",
     "live_source_ips",
     "register_agent",
     "deprovision_consolidated",
-    "InfraLaunchError",
+    "ConsolidatedLaunchError",
     "OrchestratorStartError",
     "GATEWAY_NETWORK",
 ]

bot_bottle/backend/macos_container/enumerate.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import subprocess
 
 from ...bottle_state import read_metadata
-from .. import ActiveAgent, EnumerationError
+from .. import ActiveAgent
 from .infra import INFRA_NAME, ORCHESTRATOR_NAME
 
 # The name every agent container carries: `bot-bottle-<slug>`. Exported
@@ -20,18 +20,17 @@ CONTAINER_NAME_PREFIX = "bot-bottle-"
 _INFRA_NAMES = frozenset({INFRA_NAME, ORCHESTRATOR_NAME})
 
 
+class EnumerationError(RuntimeError):
+    """container list failed; the resulting live set is not authoritative."""
+
+
 def enumerate_active() -> list[ActiveAgent]:
-    try:
-        result = subprocess.run(
-            ["container", "list", "--quiet"],
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-    except FileNotFoundError as exc:
-        raise EnumerationError(
-            "container list failed: container CLI not found"
-        ) from exc
+    result = subprocess.run(
+        ["container", "list", "--quiet"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
     if result.returncode != 0:
         raise EnumerationError(
             f"container list failed: "

bot_bottle/backend/macos_container/gateway.py

@@ -104,15 +104,11 @@ class MacosGateway(Gateway):
         container_mod.build_image(
             self.image_ref, str(self._repo_root), dockerfile="Dockerfile.gateway")
 
-    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> bool:
+    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> None:
         """Bind the gateway to this orchestrator and (re)start it, dual-homed on
         the agent + control networks, resolving policy against `orchestrator_url`
         (the orchestrator's control-network address — Apple has no container
-        DNS) and presenting `gateway_token`.
-
-        Always returns True: this recreates the gateway container unconditionally
-        (a cold boot), so the caller reconciles running bottles against it
-        (PRD 0081)."""
+        DNS) and presenting `gateway_token`."""
         self._orchestrator_url = orchestrator_url
         self._gateway_token = gateway_token
         # Fail closed on a missing policy source or token: the resolver-only data
@@ -160,7 +156,6 @@ class MacosGateway(Gateway):
                 f"gateway container failed to start: "
                 f"{(result.stderr or '').strip() or '<no stderr>'}"
             )
-        return True
 
     def is_running(self) -> bool:
         return container_mod.container_is_running(self.name)

bot_bottle/backend/macos_container/infra.py

@@ -138,15 +138,7 @@ class MacosInfraService(InfraService):
         # `gateway` JWT and hands it to the gateway, which never sees the key
         # (#469).
         url = orchestrator.url()
-        cold_booted = gateway.connect_to_orchestrator(
-            url, orchestrator.mint_gateway_token())
-        # A (re)created gateway container minted/mounted its CA afresh and lost
-        # every bottle's per-bottle state; reconcile the already-running bottles
-        # against it (PRD 0081). Skipped when a healthy current gateway was left
-        # untouched — no cold boot, nothing to reconcile.
-        if cold_booted:
-            from .backend import MacosContainerBottleBackend
-            MacosContainerBottleBackend().attach_bottled_agents_to_gateway()
+        gateway.connect_to_orchestrator(url, orchestrator.mint_gateway_token())
         return url
 
     def ca_cert_pem(self, *, timeout: float = DEFAULT_CA_TIMEOUT_SECONDS) -> str:

bot_bottle/backend/macos_container/launch.py

@@ -5,7 +5,7 @@ proxies egress through the one per-host gateway, replacing the per-bottle
 companion container removed in #385.
 
 The order differs from docker's, forced by Apple Container 1.0.0 having no
-`--ip` (see `infra_launch`): the agent is started *before* it is
+`--ip` (see `consolidated_launch`): the agent is started *before* it is
 registered, because its DHCP-assigned address — the attribution key — does not
 exist until then.
 
@@ -64,7 +64,7 @@ from . import nested_containers as nested_containers_mod
 from .bottle_plan import MacosContainerBottlePlan
 from ...orchestrator.store.config_store import resolve_teardown_timeout
 from ...orchestrator.store.secret_store import ENV_VAR_SECRET_NAME, new_env_var_secret
-from .infra_launch import (
+from .consolidated_launch import (
     GatewayEndpoint,
     ensure_gateway,
     register_agent,
@@ -107,8 +107,7 @@ def _layer_nested_containers(
     """
     if not plan.nested_containers:
         return agent_image
-    pinned_base = container_mod.pinned_local_image_ref(agent_image)
-    derived = f"{pinned_base}{nested_containers_mod.IMAGE_SUFFIX}"
+    derived = f"{agent_image}{nested_containers_mod.IMAGE_SUFFIX}"
     if plan.spec.image_policy == "cached":
         if not container_mod.image_exists(derived):
             die(
@@ -117,10 +116,7 @@ def _layer_nested_containers(
             )
         info(f"using cached nested-container image {derived!r}")
         return derived
-    return nested_containers_mod.build_image(
-        pinned_base,
-        container_mod.build_image,
-    )
+    return nested_containers_mod.build_image(agent_image, container_mod.build_image)
 
 
 @contextmanager

bot_bottle/backend/macos_container/nested_containers.py

@@ -55,7 +55,7 @@ _GUEST_DEVICES = ("/dev/fuse", "/dev/net/tun")
 
 
 def build_image(
-    pinned_base: str,
+    base_image: str,
     build: Callable[..., None],
 ) -> str:
     """Layer the nested-container tooling onto an already-built agent image.
@@ -66,15 +66,14 @@ def build_image(
     # TODO(#394): replace this hand-rolled Dockerfile with a docker-layer
     # abstraction once that infrastructure exists.
     """
-    image = f"{pinned_base}{IMAGE_SUFFIX}"
+    image = f"{base_image}{IMAGE_SUFFIX}"
     init_script = Path(__file__).with_name("nested-containers-init.sh")
     with tempfile.TemporaryDirectory(prefix="bot-bottle-nested-containers.") as tmp:
         context = Path(tmp)
         shutil.copy2(init_script, context / "nested-containers-init.sh")
         (context / "Dockerfile").write_text(
-            "ARG DOCKER_CLI_BASE_IMAGE\n"
-            "FROM ${DOCKER_CLI_BASE_IMAGE} AS docker_cli\n"
-            f"FROM {pinned_base}\n"
+            "FROM docker:28-cli AS docker_cli\n"
+            f"FROM {base_image}\n"
             "USER root\n"
             "COPY --from=docker_cli /usr/local/bin/docker /usr/local/bin/docker\n"
             "COPY --from=docker_cli /usr/local/libexec/docker/cli-plugins/"

bot_bottle/backend/macos_container/setup.py

@@ -5,7 +5,7 @@ Like Docker, this backend needs no privileged network-pool provisioning
 running. `setup()` points at the install/`container system start` steps;
 `status()` reports readiness. Reached via
 `MacosContainerBottleBackend.setup` / `.status`, dispatched from the
-generic `bot-bottle backend {setup,status}`.
+generic `./cli.py backend {setup,status}`.
 """
 
 from __future__ import annotations
@@ -75,5 +75,5 @@ def status() -> int:
         if not _service_running():
             ok = False
     if not ok:
-        sys.stderr.write("\nRun: bot-bottle backend setup --backend=macos-container\n")
+        sys.stderr.write("\nRun: ./cli.py backend setup --backend=macos-container\n")
     return 0 if ok else 1

bot_bottle/backend/macos_container/util.py

@@ -13,7 +13,6 @@ import time
 from datetime import datetime, timezone
 from typing import Iterable
 
-from ... import resources
 from ...log import die, info
 
 
@@ -61,13 +60,7 @@ def dns_server() -> str:
     return _host_ipv4_dns() or _DEFAULT_DNS
 
 
-def build_image(
-    ref: str,
-    context: str,
-    *,
-    dockerfile: str = "",
-    build_args: dict[str, str] | None = None,
-) -> None:
+def build_image(ref: str, context: str, *, dockerfile: str = "") -> None:
     """Build an OCI image with Apple's BuildKit-backed `container build`.
 
     Set `BOT_BOTTLE_NO_CACHE=1` (the `start --no-cache` flag) to force
@@ -90,13 +83,6 @@ def build_image(
         if not os.path.isabs(dockerfile):
             dockerfile = os.path.join(context, dockerfile)
         args.extend(["-f", dockerfile])
-    effective_build_args = resources.image_build_args(
-        dockerfile,
-        context=context,
-    ) if dockerfile else {}
-    effective_build_args.update(build_args or {})
-    for name, value in effective_build_args.items():
-        args.extend(["--build-arg", f"{name}={value}"])
     args.append(context)
     subprocess.run(args, check=True)
 
@@ -682,47 +668,6 @@ def image_id(ref: str) -> str:
     raise AssertionError("unreachable")
 
 
-def pinned_local_image_ref(ref: str) -> str:
-    """Tag a local image with its complete content ID for a stable ``FROM``.
-
-    Agent images are immediately used as bases for the optional
-    nested-containers layer. A content-derived tag prevents another concurrent
-    build from moving the provider's ordinary ``:latest`` tag between those
-    two builds.
-
-    Unlike Docker, `container image tag` only accepts ``image-name[:tag]`` as
-    its source and rejects a bare image ID ("cannot specify 64 byte hex string
-    as reference"), so the mutable ``ref`` is what gets tagged here. The
-    post-tag inspection below is what keeps that fail-closed: if ``ref`` moved
-    between the two commands, the new tag will not resolve to the ID this call
-    derived its name from.
-    """
-    image = image_id(ref)
-    digest = image.removeprefix("sha256:")
-    if len(digest) != 64 or any(char not in "0123456789abcdef" for char in digest):
-        die(f"could not derive a local base tag from invalid image ID {image!r}")
-    repository = ref.split("@", 1)[0]
-    last_slash = repository.rfind("/")
-    last_colon = repository.rfind(":")
-    if last_colon > last_slash:
-        repository = repository[:last_colon]
-    pinned_ref = f"{repository}:sha256-{digest}"
-    result = subprocess.run(
-        [_CONTAINER, "image", "tag", ref, pinned_ref],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        die(
-            f"could not tag exact local image {image} via {ref!r}: "
-            f"{(result.stderr or result.stdout or '').strip() or '<no detail>'}"
-        )
-    if image_id(pinned_ref) != image:
-        die(f"content-derived local tag {pinned_ref!r} did not resolve to {image}")
-    return pinned_ref
-
-
 def image_created_at(ref: str) -> datetime | None:
     """Return the image creation timestamp as an aware UTC datetime, or None
     when the field is absent or unparseable (e.g. FROM-scratch images, images

bot_bottle/backend/preparation.py

@@ -1,124 +0,0 @@
-"""Backend-neutral preparation planner.
-
-This module owns the shared transformation from a CLI ``BottleSpec`` to the
-typed inputs consumed by a concrete backend's ``_resolve_plan``. Backend
-classes retain only their validation/preflight/env hooks and their
-backend-specific final resolution.
-"""
-
-from __future__ import annotations
-
-import os
-from dataclasses import dataclass
-from typing import TYPE_CHECKING, Protocol
-
-from ..agent_provider import AgentProvisionPlan, build_agent_provision_plan, get_provider
-from ..egress import EgressPlan
-from ..env import ResolvedEnv, resolve_env
-from ..git_gate import GitGate, GitGatePlan
-from ..manifest import Manifest
-from ..supervisor.plan import SupervisePlan
-from ..workspace import workspace_plan
-from .resolve_common import (
-    merge_provision_env_vars,
-    mint_slug,
-    prepare_agent_state_dir,
-    prepare_egress,
-    prepare_git_gate,
-    prepare_supervise,
-    reject_nested_containers,
-    resolve_manifest_dockerfile,
-    write_launch_metadata,
-)
-
-if TYPE_CHECKING:
-    from .base import BottleSpec
-
-
-class PreparationBackend(Protocol):
-    """Backend hooks needed by the shared planner."""
-
-    name: str
-    supports_nested_containers: bool
-
-    def _validate(self, spec: BottleSpec) -> Manifest: ...
-    def _preflight(self) -> None: ...
-    def _build_guest_env(self, resolved_env: ResolvedEnv) -> dict[str, str]: ...
-
-
-@dataclass(frozen=True)
-class PreparedBottle:
-    """Typed, backend-neutral result of shared launch preparation."""
-
-    manifest: Manifest
-    slug: str
-    resolved_env: ResolvedEnv
-    agent_provision_plan: AgentProvisionPlan
-    egress_plan: EgressPlan
-    git_gate_plan: GitGatePlan
-    supervise_plan: SupervisePlan | None
-
-
-class BottlePreparationPlanner:
-    """Run the common, side-effect-limited part of bottle preparation."""
-
-    def __init__(self, backend: PreparationBackend) -> None:
-        self._backend = backend
-
-    def prepare(self, spec: BottleSpec) -> PreparedBottle:
-        backend = self._backend
-        # These are deliberately protected backend hooks: only this shared
-        # planner orchestrates them, while concrete backends provide the
-        # implementation.
-        manifest = backend._validate(spec)  # pylint: disable=protected-access
-        if not backend.supports_nested_containers:
-            reject_nested_containers(backend.name, manifest)
-
-        backend._preflight()  # pylint: disable=protected-access
-        manifest = GitGate().preflight_host_keys(
-            manifest,
-            headless=spec.headless,
-            home_md=spec.manifest.home_md,
-        )
-
-        bottle = manifest.bottle
-        provider_config = bottle.agent_provider
-        provider = get_provider(provider_config.template)
-        resolved_env = resolve_env(manifest)
-        workspace = workspace_plan(spec, guest_home=provider.guest_home)
-        slug = mint_slug(spec)
-        write_launch_metadata(slug, spec, compose_project="", backend=backend.name)
-
-        dockerfile = (
-            resolve_manifest_dockerfile(provider_config.dockerfile, spec)
-            if provider_config.dockerfile
-            else str(provider.dockerfile)
-        )
-        agent_dir, prompt_file = prepare_agent_state_dir(slug, manifest)
-        provision = build_agent_provision_plan(
-            template=provider_config.template,
-            dockerfile=dockerfile,
-            state_dir=agent_dir,
-            instance_name=f"bot-bottle-{slug}",
-            prompt_file=prompt_file,
-            guest_env=backend._build_guest_env(  # pylint: disable=protected-access
-                resolved_env
-            ),
-            forward_host_credentials=provider_config.forward_host_credentials,
-            auth_token=provider_config.auth_token,
-            host_env=dict(os.environ),
-            trusted_project_path=workspace.workdir,
-            label=spec.label,
-            color=spec.color,
-            provider_settings=provider_config.settings,
-        )
-        provision = merge_provision_env_vars(provision)
-        return PreparedBottle(
-            manifest=manifest,
-            slug=slug,
-            resolved_env=resolved_env,
-            agent_provision_plan=provision,
-            egress_plan=prepare_egress(bottle, slug, provision),
-            git_gate_plan=prepare_git_gate(bottle, slug),
-            supervise_plan=prepare_supervise(bottle, slug),
-        )

bot_bottle/backend/provision_bottle.py

@@ -2,7 +2,7 @@
 
 Register a bottle with the orchestrator and provision its git-gate state into
 the shared gateway (`provision_bottle`), and the inverse teardown
-(`deprovision_bottle`). Backend-neutral — each backend's infra_launch
+(`deprovision_bottle`). Backend-neutral — each backend's consolidated_launch
 drives these through its own `GatewayTransport` rather than re-implementing
 them. The git-gate half of the work lives in `provision_gateway`.
 """

bot_bottle/backend/provision_gateway.py

@@ -63,23 +63,12 @@ def provision_git_gate(
     transport.exec(["chmod", "+x", "/etc/git-gate/access-hook"])
     creds = _creds_dir(bottle_id)
     transport.exec(["mkdir", "-p", creds])
-    transport.exec(["chmod", "700", creds])
-    credential_paths: list[str] = []
     for u in plan.upstreams:
         if u.identity_file:
-            key_path = f"{creds}/{u.name}-key"
-            transport.cp_into(u.identity_file, key_path)
-            credential_paths.append(key_path)
+            transport.cp_into(u.identity_file, f"{creds}/{u.name}-key")
         known_hosts = str(u.known_hosts_file)
         if known_hosts and known_hosts != ".":
-            known_hosts_path = f"{creds}/{u.name}-known_hosts"
-            transport.cp_into(known_hosts, known_hosts_path)
-            credential_paths.append(known_hosts_path)
-    # Copy-mode behavior differs across Docker, Apple Container, and SSH.
-    # Apply the security contract inside the gateway so every backend produces
-    # the same private credential namespace.
-    if credential_paths:
-        transport.exec(["chmod", "600", *credential_paths])
+            transport.cp_into(known_hosts, f"{creds}/{u.name}-known_hosts")
     # Init the bare repos + per-repo credential config for this namespace.
     script = git_gate_render_provision(bottle_id, plan.upstreams)
     transport.exec(["sh", "-c", script])

bot_bottle/backend/selection.py

@@ -26,10 +26,10 @@ from .base import ActiveAgent, BackendStatus, BottleBackend
 # Tests may replace _backends with a {name: fake} dict via patch.object;
 # _get_backends() returns the current module-level value as-is when it
 # is not None, so test fakes take effect without triggering real imports.
-_backends: dict[str, BottleBackend[Any, Any, Any]] | None = None
+_backends: dict[str, BottleBackend[Any, Any]] | None = None
 
 
-def _get_backends() -> dict[str, BottleBackend[Any, Any, Any]]:
+def _get_backends() -> dict[str, BottleBackend[Any, Any]]:
     """Return the registry of all backend instances, loading lazily on first call."""
     global _backends  # pylint: disable=global-statement
     if _backends is None:
@@ -48,7 +48,7 @@ def get_bottle_backend(
     name: str | None = None,
     *,
     prompt: bool = True,
-) -> BottleBackend[Any, Any, Any]:
+) -> BottleBackend[Any, Any]:
     """Resolve the bottle backend.
 
     `name` precedence:
@@ -86,7 +86,7 @@ def _print_vm_install_instructions() -> None:
         info("Then start the service:  container system start")
     else:
         info("Install Firecracker: https://github.com/firecracker-microvm/firecracker/releases")
-        info("Configure the host:  bot-bottle backend setup")
+        info("Configure the host:  ./cli.py backend setup")
 
 
 def _auto_select_backend(prompt: bool = True) -> str:

bot_bottle/cli/commands/backend.py

@@ -1,9 +1,9 @@
 """`backend` CLI command — generic host setup/status across backends.
 
-`bot-bottle backend setup    [--backend=NAME]` provisions (or points at how
+`./cli.py backend setup    [--backend=NAME]` provisions (or points at how
 to provision) the chosen backend's one-time host prerequisites.
-`bot-bottle backend status   [--backend=NAME]` reports readiness.
-`bot-bottle backend teardown [--backend=NAME]` undoes setup (uninstall).
+`./cli.py backend status   [--backend=NAME]` reports readiness.
+`./cli.py backend teardown [--backend=NAME]` undoes setup (uninstall).
 
 All dispatch to the backend's `setup()` / `status()` / `teardown()`
 classmethods, so there are no backend-specific commands — swapping

bot_bottle/cli/commands/cleanup.py

@@ -1,7 +1,7 @@
 """cleanup: stop and remove all orphaned bot-bottle resources.
 
 Walks every registered backend (docker, firecracker, macos-container)
-so a single `bot-bottle cleanup` reaps every backend's leftovers — a
+so a single `./cli.py cleanup` reaps every backend's leftovers — a
 firecracker bottle's VM processes and run dirs won't survive a
 docker-only cleanup pass (issue addressed alongside #77).
 
@@ -22,7 +22,6 @@ from __future__ import annotations
 import sys
 
 from ...backend import get_bottle_backend, has_backend, known_backend_names
-from ...backend.cleanup_control import CleanupError
 from ...log import info
 from ...util import read_tty_line
 
@@ -53,20 +52,10 @@ def cmd_cleanup(_argv: list[str]) -> int:
         info("cleanup: skipped")
         return 0
 
-    # Confirmation authorizes a fresh authoritative snapshot, not blind use of
-    # identities that may have changed while the operator reviewed the preview.
-    failures: list[str] = []
-    for name, backend, displayed in prepared:
-        current = backend.prepare_cleanup()
-        approved = displayed.intersect(current)
-        if approved.empty:
+    for name, backend, plan in prepared:
+        if plan.empty:
             continue
-        try:
-            backend.cleanup(approved)
-        except CleanupError as exc:
-            failures.append(f"{name}: {exc}")
-    if failures:
-        raise CleanupError("cleanup incomplete: " + "; ".join(failures))
+        backend.cleanup(plan)
     info("cleanup: done")
     return 0
 

bot_bottle/cli/commands/commit.py

@@ -4,7 +4,7 @@ Docker bottles are committed to a local Docker image. Macos-container
 bottles are exported and rebuilt as a local Apple Container image.
 Firecracker bottles stream the guest rootfs out over SSH and rebuild a
 local Docker image. The resulting reference is stored in per-bottle
-state so the next `bot-bottle resume <slug>` boots from the snapshot
+state so the next `./cli.py resume <slug>` boots from the snapshot
 instead of rebuilding from the Dockerfile.
 """
 
@@ -37,7 +37,7 @@ def cmd_commit(argv: list[str]) -> int:
     if slug is None:
         active = enumerate_active_agents()
         if not active:
-            die("no active bottles; start one with `bot-bottle start`")
+            die("no active bottles; start one with `./cli.py start`")
         choices = [a.slug for a in active]
         slug = tui.filter_select(choices, title="Select bottle to commit")
         if slug is None:

bot_bottle/cli/commands/resume.py

@@ -8,7 +8,7 @@ override and transcript snapshot under the same state dir.
 
 Use case: an interrupted or preserved bottle needs to be relaunched;
 the operator runs
-    bot-bottle resume <identity>
+    ./cli.py resume <identity>
 to bring up the replacement from the recorded state.
 """
 

bot_bottle/cli/commands/start.py

@@ -203,19 +203,19 @@ def _start_headless(
     if not os.isatty(stdin_fd):
         die(
             "--headless requires a PTY on stdin; run via:\n"
-            "  script -q /dev/null bot-bottle start ..."
+            "  script -q /dev/null ./cli.py start ..."
         )
 
     agent_name = args.name
     if not agent_name:
-        die("--headless requires an agent name: bot-bottle start <agent> --headless")
+        die("--headless requires an agent name: ./cli.py start <agent> --headless")
     manifest.require_agent(agent_name)  # raises ManifestError if unknown
 
     prompt = args.prompt
     if not prompt:
         die(
             "--headless requires --prompt: "
-            "bot-bottle start <agent> --headless --prompt 'Do the thing'"
+            "./cli.py start <agent> --headless --prompt 'Do the thing'"
         )
 
     if args.bottle:
@@ -319,9 +319,9 @@ def attach_agent(
 
     `resume=True` adds `--continue` so claude picks up its most
     recent session non-interactively (no session-picker prompt).
-    First-attach paths (`bot-bottle start`) leave it False.
+    First-attach paths (`./cli.py start`) leave it False.
 
-    Used as the inner step of `bot-bottle start`."""
+    Used as the inner step of `./cli.py start`."""
     runtime = runtime_for(agent_provider_template)
     info(
         f"attaching interactive {agent_provider_template} session "
@@ -354,7 +354,7 @@ def settle_state(identity: str) -> None:
     if not identity:
         return
     if is_preserved(identity):
-        info(f"to resume this bottle: bot-bottle resume {identity}")
+        info(f"to resume this bottle: ./cli.py resume {identity}")
         return
     cleanup_state(identity)
 

bot_bottle/cli/commands/supervise.py

@@ -110,7 +110,7 @@ def discover_pending() -> list[QueuedProposal]:
 def _approval_status(qp: QueuedProposal, verb: str) -> str:
     """Status-line text after a successful approval."""
     base = f"{verb} {qp.proposal.tool} for [{qp.label}]"
-    return f"{base}; resume: bot-bottle resume {qp.label}"
+    return f"{base}; resume: ./cli.py resume {qp.label}"
 
 
 def _detail_lines(
@@ -368,7 +368,7 @@ def _main_loop(stdscr: "curses._CursesWindow") -> None:  # type: ignore  # pragm
         elif key in (curses.KEY_UP, ord("k")):
             selected = max(selected - 1, 0)
         elif key in (curses.KEY_ENTER, 10, 13):
-            status_line = _detail_view(stdscr, qp, green_attr=green_attr)
+            _detail_view(stdscr, qp, green_attr=green_attr)
         elif key == ord("a"):
             try:
                 status_line = _approve_from_tui(stdscr, qp)
@@ -456,7 +456,7 @@ def _detail_view(
     qp: QueuedProposal,
     *,
     green_attr: int = 0,
-) -> str:  # pragma: no cover
+) -> None:  # pragma: no cover
     """Render the full proposal. Scrollable. Press q to return."""
     lines = _detail_lines(qp, green_attr=green_attr)
     offset = 0
@@ -473,7 +473,7 @@ def _detail_view(
         stdscr.refresh()
         key = stdscr.getch()
         if key in (ord("q"), 27):
-            return ""
+            return
         if key in (curses.KEY_DOWN, ord("j")):
             offset = min(offset + 1, max(0, len(lines) - 1))
         elif key in (curses.KEY_UP, ord("k")):
@@ -484,34 +484,31 @@ def _detail_view(
             offset = max(0, len(lines) - 1)
         elif key == ord("a"):
             try:
-                return _approve_from_tui(stdscr, qp)
-            except ApplyError as exc:
-                return f"apply failed: {exc}"
+                _approve_from_tui(stdscr, qp)
+            except ApplyError:
+                pass
+            return
         elif key == ord("m"):
             if qp.proposal.tool in _REPORT_ONLY_TOOLS:
-                return f"modify unavailable for {qp.proposal.tool}"
+                return
             edited = _modify(stdscr, qp)
-            if edited is None:
-                return "modify aborted (no change)"
-            try:
-                return _approve_from_tui(
-                    stdscr, qp, final_file=edited,
-                    notes="operator modified before approving",
-                )
-            except ApplyError as exc:
-                return f"apply failed: {exc}"
+            if edited is not None:
+                try:
+                    _approve_from_tui(
+                        stdscr, qp, final_file=edited,
+                        notes="operator modified before approving",
+                    )
+                except ApplyError:
+                    pass
+            return
         elif key == ord("r"):
             reason = _prompt(stdscr, "reject reason: ")
             if reason:
                 reject(qp, reason=reason)
-                return f"rejected {qp.proposal.tool} for [{qp.label}]"
-            return "reject aborted (empty reason)"
+            return
 
 
-def _modify(
-    stdscr: "curses._CursesWindow",  # type: ignore
-    qp: QueuedProposal,
-) -> str | None:  # pragma: no cover
+def _modify(stdscr: "curses._CursesWindow", qp: QueuedProposal) -> str | None:  # type: ignore  # pragma: no cover
     """Suspend curses, open $EDITOR on the proposed file, return edited content."""
     suffix = _suffix_for_tool(qp.proposal.tool)
     curses.endwin()

bot_bottle/cli/tui.py

@@ -16,8 +16,6 @@ import os
 import sys
 from typing import Any, Optional
 
-from ..log import debug
-
 
 def filter_multiselect(
     items: list[str],
@@ -44,11 +42,7 @@ def filter_multiselect(
 
     try:
         tty_fd = open(tty_path, "r+b", buffering=0)
-    except OSError as exc:
-        debug(
-            "multi-select unavailable; treating it as cancellation",
-            context={"error_type": type(exc).__name__, "tty": tty_path},
-        )
+    except OSError:
         return None
 
     try:
@@ -79,11 +73,7 @@ def filter_select(
 
     try:
         tty_fd = open(tty_path, "r+b", buffering=0)
-    except OSError as exc:
-        debug(
-            "filter-select unavailable; treating it as cancellation",
-            context={"error_type": type(exc).__name__, "tty": tty_path},
-        )
+    except OSError:
         return None
 
     try:
@@ -139,11 +129,7 @@ def _run_picker(items: list[str], *, title: str, tty_fd: int) -> Optional[str]:
             curses.nocbreak()
             curses.echo()
             curses.endwin()
-    except Exception as exc:  # noqa: W0718 — curses can raise many error types
-        debug(
-            "filter-select display failed; treating it as cancellation",
-            context={"error_type": type(exc).__name__},
-        )
+    except Exception:  # noqa: W0718 — curses can raise many error types
         return None
     finally:
         sys.__stdin__ = orig_stdin    # type: ignore[assignment]
@@ -306,11 +292,7 @@ def _run_multiselect(
             curses.nocbreak()
             curses.echo()
             curses.endwin()
-    except Exception as exc:  # noqa: W0718
-        debug(
-            "multi-select display failed; treating it as cancellation",
-            context={"error_type": type(exc).__name__},
-        )
+    except Exception:  # noqa: W0718
         return None
     finally:
         sys.__stdin__ = orig_stdin    # type: ignore[assignment]
@@ -576,21 +558,13 @@ def name_color_modal(
     """
     try:
         tty_fd = open(tty_path, "r+b", buffering=0)  # pylint: disable=consider-using-with
-    except OSError as exc:
-        debug(
-            "name/color picker unavailable; using defaults",
-            context={"error_type": type(exc).__name__, "tty": tty_path},
-        )
+    except OSError:
         return default_label, ""
 
     try:
         fd_dup = os.dup(tty_fd.fileno())
         return _run_name_color(default_label, tty_fd=fd_dup, disclaimer=disclaimer)
-    except Exception as exc:  # noqa: BLE001  # pylint: disable=broad-exception-caught
-        debug(
-            "name/color picker failed; using defaults",
-            context={"error_type": type(exc).__name__},
-        )
+    except Exception:  # noqa: BLE001  # pylint: disable=broad-exception-caught
         return default_label, ""
     finally:
         tty_fd.close()

bot_bottle/contrib/claude/Dockerfile

@@ -8,17 +8,9 @@
 # Layer ordering is deliberate: the npm install lives in its own layer so
 # changes to the rest of the repo (or to the CMD) don't bust it.
 
-# Version-qualified Node LTS, pinned to its multi-architecture manifest.
-ARG NODE_BASE_IMAGE
-FROM ${NODE_BASE_IMAGE}
-
-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
+# Current Node LTS; slim variant keeps the image small while still
+# providing apt-get for any future additions.
+FROM node:22-trixie-slim
 
 # Install runtime system deps. claude-code shells out to git for several
 # features (status checks, commits, PR creation) — without git in the
@@ -28,7 +20,7 @@ RUN sed -i \
 # HTTPS_PROXY-aware tool (curl itself, plus anything that shells out
 # to it) works against egress's bumped TLS without the agent needing
 # local DNS.
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
   && apt-get install -y --no-install-recommends \
   git \
   ca-certificates \
@@ -43,17 +35,15 @@ RUN apt-get -o Acquire::Check-Valid-Until=false update \
 # (claude-code is a Node CLI), but is convenient for the agent to
 # shell out to for ad-hoc scripts. Kept on its own layer so it can
 # be moved to a downstream image if the base ever needs to shrink.
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
   && apt-get install -y --no-install-recommends python3 python3-pip python3-venv \
   && rm -rf /var/lib/apt/lists/*
 
-# Install from the committed npm lock. `npm ci` verifies every registry
-# artifact against its lockfile integrity and refuses dependency drift.
-COPY bot_bottle/contrib/claude/package.json \
-     bot_bottle/contrib/claude/package-lock.json /opt/claude/
-RUN cd /opt/claude \
-  && npm ci --omit=dev --no-fund --no-audit \
-  && ln -s /opt/claude/node_modules/.bin/claude /usr/local/bin/claude \
+# Install claude-code globally. Pinned to the version verified in the v1
+# build (`claude --version` returns 2.1.126). Bump deliberately when
+# rolling forward; an unpinned install would mean rebuilds silently pick
+# up new behavior.
+RUN npm install -g --no-fund --no-audit @anthropic-ai/claude-code@2.1.172 \
   && npm cache clean --force
 
 # Git reads both ~/.gitconfig and ~/.config/git/config. Keep its XDG config

bot_bottle/contrib/claude/package-lock.json

@@ -1,140 +0,0 @@
-{
-  "name": "bot-bottle-claude-image",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "bot-bottle-claude-image",
-      "dependencies": {
-        "@anthropic-ai/claude-code": "2.1.172"
-      }
-    },
-    "node_modules/@anthropic-ai/claude-code": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-2.1.172.tgz",
-      "integrity": "sha512-SfwC+5fQcmNbvvm+1vLiZbfUxt0PQz9lbXapj9+FI+XY/2e+3zgteBM4JFEXBjULZj1DtZXHmKtAROUrMM9GZg==",
-      "hasInstallScript": true,
-      "license": "SEE LICENSE IN README.md",
-      "bin": {
-        "claude": "bin/claude.exe"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      },
-      "optionalDependencies": {
-        "@anthropic-ai/claude-code-darwin-arm64": "2.1.172",
-        "@anthropic-ai/claude-code-darwin-x64": "2.1.172",
-        "@anthropic-ai/claude-code-linux-arm64": "2.1.172",
-        "@anthropic-ai/claude-code-linux-arm64-musl": "2.1.172",
-        "@anthropic-ai/claude-code-linux-x64": "2.1.172",
-        "@anthropic-ai/claude-code-linux-x64-musl": "2.1.172",
-        "@anthropic-ai/claude-code-win32-arm64": "2.1.172",
-        "@anthropic-ai/claude-code-win32-x64": "2.1.172"
-      }
-    },
-    "node_modules/@anthropic-ai/claude-code-darwin-arm64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-darwin-arm64/-/claude-code-darwin-arm64-2.1.172.tgz",
-      "integrity": "sha512-pBRgDo8PAgbt2aE4oc6ZrKdOa/Ax36RAduhLCaI8NWD3a0RDb5mETzQciQLwnuenk0bs27vIRh9Yg1jAYG/0+A==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-darwin-x64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-darwin-x64/-/claude-code-darwin-x64-2.1.172.tgz",
-      "integrity": "sha512-vSgibgeCyvCFiLJSXu/sgcd3L/tUjSiS/tfS9rJLXUjElw8satMJhA5pqPUiBmKMflOWKMufbZgzXvLx+OhvFw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-linux-arm64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-arm64/-/claude-code-linux-arm64-2.1.172.tgz",
-      "integrity": "sha512-Ql7AbyaXnlA6NwDUaQGO7ZZis21rMjYjbKzpksMCvY35CmsJqanYgbYSn/rE83u/tZpKo+NqOv+bWEDSzsZ02w==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-linux-arm64-musl": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-arm64-musl/-/claude-code-linux-arm64-musl-2.1.172.tgz",
-      "integrity": "sha512-Pa9mGGmp8QCRC2j1cgcWRRkwsK1x4bPsS3CcLRd936Op0k5et62tD3qIYhUPQOIxeuxe9Tt/y7lX1cx7JTDxyA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-linux-x64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-x64/-/claude-code-linux-x64-2.1.172.tgz",
-      "integrity": "sha512-RYCY9EHkmtoAlwBKcWRzGIhuus+GM2CIVCfU81cTQAwDcCHunoBeFn3NqAcFV1VKb4dk9TRarAmQcWMKJrpPig==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-linux-x64-musl": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-x64-musl/-/claude-code-linux-x64-musl-2.1.172.tgz",
-      "integrity": "sha512-1NflAnV/MqIlD4rzlGDVsJgGK2xJ2ldVd5pkcbu7PsDJBW5dzKYVa4PmD0715K8Yiji8jQovh/nhIo6gYyTfVQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-win32-arm64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-win32-arm64/-/claude-code-win32-arm64-2.1.172.tgz",
-      "integrity": "sha512-Gj8mIbHDDSGWnoriqB1Jt1uH6cvNBFDQBtIYarCcv0fs+QGCEP6qm2GIaKqxAbwkUaLT0sCW/7+ukvkNdSltuQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-win32-x64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-win32-x64/-/claude-code-win32-x64-2.1.172.tgz",
-      "integrity": "sha512-OkheFwagiCEKaO2Sb0j3JTO1NrcR3zTlFik/AN+yQPefhUIGP6vHQDbBG5ksuFe+Dyd9s+P95OUh8WDhccb+Ng==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    }
-  }
-}

bot_bottle/contrib/claude/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "bot-bottle-claude-image",
-  "private": true,
-  "dependencies": {
-    "@anthropic-ai/claude-code": "2.1.172"
-  }
-}

bot_bottle/contrib/codex/Dockerfile

@@ -3,22 +3,9 @@
 # Mirrors the default Claude image shape: Node LTS, git/network tooling,
 # non-root node user, and the provider CLI installed for that user.
 
-ARG NODE_BASE_IMAGE
-FROM ${NODE_BASE_IMAGE}
+FROM node:22-trixie-slim
 
-# Remote-control requires the standalone package layout. Keep this exact release
-# in sync with the committed upstream archive checksums.
-ARG CODEX_VERSION=0.145.0
-
-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
-
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
   && apt-get install -y --no-install-recommends \
   git \
   ca-certificates \
@@ -32,7 +19,7 @@ RUN apt-get -o Acquire::Check-Valid-Until=false update \
 # (codex is a Node CLI), but is convenient for the agent to shell
 # out to for ad-hoc scripts. Kept on its own layer so it can be
 # moved to a downstream image if the base ever needs to shrink.
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
   && apt-get install -y --no-install-recommends python3 python3-pip python3-venv \
   && rm -rf /var/lib/apt/lists/*
 
@@ -43,29 +30,10 @@ WORKDIR /home/node
 
 ENV PATH="/home/node/.local/bin:${PATH}"
 
-# Install the exact standalone release archive selected by the target
-# architecture. The checksum list is copied from the immutable upstream release
-# and committed so a rebuild cannot silently accept changed release bytes.
-COPY --chown=node:node bot_bottle/contrib/codex/codex-package_SHA256SUMS /tmp/codex-package_SHA256SUMS
-RUN case "$(dpkg --print-architecture)" in \
-      amd64) codex_target=x86_64-unknown-linux-musl ;; \
-      arm64) codex_target=aarch64-unknown-linux-musl ;; \
-      *) echo "unsupported Codex architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
-    esac \
-  && codex_asset="codex-package-${codex_target}.tar.gz" \
-  && codex_sha256="$(awk -v asset="${codex_asset}" '$2 == asset { print $1 }' /tmp/codex-package_SHA256SUMS)" \
-  && test -n "${codex_sha256}" \
-  && curl -fsSL \
-      "https://github.com/openai/codex/releases/download/rust-v${CODEX_VERSION}/${codex_asset}" \
-      -o "/tmp/${codex_asset}" \
-  && echo "${codex_sha256}  /tmp/${codex_asset}" | sha256sum -c - \
-  && codex_release="/home/node/.codex/packages/standalone/releases/${CODEX_VERSION}-${codex_target}" \
-  && mkdir -p "${codex_release}" /home/node/.local/bin \
-  && tar -xzf "/tmp/${codex_asset}" -C "${codex_release}" \
-  && ln -s bin/codex "${codex_release}/codex" \
-  && ln -s "${codex_release}" /home/node/.codex/packages/standalone/current \
-  && ln -s /home/node/.codex/packages/standalone/current/bin/codex /home/node/.local/bin/codex \
-  && rm "/tmp/${codex_asset}" \
-  && test "$(codex --version)" = "codex-cli ${CODEX_VERSION}"
+# Remote-control support requires the standalone Codex install layout
+# under ~/.codex/packages/standalone/current. The npm package can run
+# the TUI, but remote-control commands expect this installer-owned path.
+RUN mkdir -p /home/node/.codex \
+  && curl -fsSL https://chatgpt.com/codex/install.sh | sh
 
 CMD ["codex"]

bot_bottle/contrib/codex/codex-package_SHA256SUMS

@@ -1,2 +0,0 @@
-54f79a05aba6f9abf8ef988abcae8bf2fcefba20beb549b4ff2b3acdb2cb6f54  codex-package-aarch64-unknown-linux-musl.tar.gz
-71a28d362c96ac9829bf8203a2c71be451aeb726adb843167fdaf0eae8fe7dd9  codex-package-x86_64-unknown-linux-musl.tar.gz

bot_bottle/contrib/pi/Dockerfile

@@ -2,18 +2,9 @@
 #
 # Node LTS, git/network tooling, and the Pi coding-agent CLI installed globally.
 
-ARG NODE_BASE_IMAGE
-FROM ${NODE_BASE_IMAGE}
+FROM node:22-trixie-slim
 
-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
-
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
   && apt-get install -y --no-install-recommends \
   git \
   ca-certificates \
@@ -24,10 +15,13 @@ RUN apt-get -o Acquire::Check-Valid-Until=false update \
   && ln -s /usr/bin/fdfind /usr/local/bin/fd \
   && rm -rf /var/lib/apt/lists/*
 
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
   && apt-get install -y --no-install-recommends python3 python3-pip python3-venv \
   && rm -rf /var/lib/apt/lists/*
 
+RUN npm install -g --ignore-scripts --no-fund --no-audit @earendil-works/pi-coding-agent \
+  && npm cache clean --force
+
 RUN install -d -o node -g node -m 755 /home/node/.config /home/node/.config/git \
   && mkdir -p /home/node/.pi/agent \
   /home/node/.pi/context-mode/sessions \
@@ -40,15 +34,10 @@ RUN install -d -o node -g node -m 755 /home/node/.config /home/node/.config/git
 USER node
 WORKDIR /home/node
 
-# Pi discovers npm packages from its agent directory. Installing the CLI and
-# extensions together from the committed lock makes all direct and transitive
-# package versions deterministic, with npm integrity verification.
-COPY --chown=node:node bot_bottle/contrib/pi/package.json \
-     bot_bottle/contrib/pi/package-lock.json /home/node/.pi/agent/
-RUN cd /home/node/.pi/agent \
-  && npm ci --omit=dev --no-fund --no-audit \
-  && npm cache clean --force
-
-ENV PATH="/home/node/.pi/agent/node_modules/.bin:${PATH}"
+RUN pi install npm:@harms-haus/pi-cwd \
+  && pi install npm:pi-web-access \
+  && pi install npm:context-mode \
+  && pi install npm:pi-subagents \
+  && pi install npm:pi-mcp-adapter
 
 CMD ["pi"]

bot_bottle/contrib/pi/package.json

@@ -1,15 +0,0 @@
-{
-  "name": "bot-bottle-pi-image",
-  "private": true,
-  "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.81.1",
-    "@earendil-works/pi-agent-core": "0.81.1",
-    "@earendil-works/pi-ai": "0.81.1",
-    "@earendil-works/pi-tui": "0.81.1",
-    "@harms-haus/pi-cwd": "1.0.0",
-    "context-mode": "1.0.169",
-    "pi-mcp-adapter": "2.11.0",
-    "pi-subagents": "0.35.1",
-    "pi-web-access": "0.13.0"
-  }
-}

bot_bottle/egress/plan.py

@@ -11,7 +11,7 @@ from __future__ import annotations
 from dataclasses import dataclass
 from pathlib import Path
 
-from ..gateway.egress.types import Route
+from ..gateway.egress.addon_core import Route
 
 
 @dataclass(frozen=True)
@@ -19,7 +19,7 @@ class EgressRoute(Route):
     """Host-side extension of the addon's `Route`.
 
     Inherits `host`, `matches`, `auth_scheme`, and `token_env`
-    from the gateway's wire `Route` — those are the fields that cross the
+    from `egress_addon_core.Route` — those are the fields that cross the
     YAML wire into the gateway. The fields below are host-only and
     are never serialised to the addon.
 

bot_bottle/egress/service.py

@@ -14,8 +14,8 @@ import secrets
 from pathlib import Path
 from typing import TYPE_CHECKING
 
-from ..gateway.egress.dlp_config import ON_MATCH_REDACT
-from ..gateway.egress.types import (
+from ..gateway.egress.addon_core import (
+    ON_MATCH_REDACT,
     HeaderMatch as CoreHeaderMatch,
     MatchEntry as CoreMatchEntry,
     PathMatch as CorePathMatch,

bot_bottle/gateway/__init__.py

@@ -122,18 +122,12 @@ class Gateway(abc.ABC):
         return
 
     @abc.abstractmethod
-    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> bool:
+    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> None:
         """Bind the gateway to this orchestrator and bring it up: store the URL +
         the pre-minted `gateway` token as instance state, then (re)start the
         gateway unit carrying the mitmproxy CA + that token, resolving policy
         against `orchestrator_url`. Idempotent — a healthy, current gateway on
-        the same binding is left alone; a changed binding reconciles it.
-
-        Returns True when the gateway was actually (re)brought up (a cold boot,
-        so its mitmproxy minted a fresh CA and lost its per-bottle state), False
-        when a healthy current gateway was left untouched. The bring-up flow
-        uses this as the cold-boot signal that gates the running-bottle
-        reconcile (`attach_bottled_agents_to_gateway`, PRD 0081)."""
+        the same binding is left alone; a changed binding reconciles it."""
 
     @abc.abstractmethod
     def is_running(self) -> bool:

bot_bottle/gateway/bootstrap.py

@@ -136,18 +136,10 @@ def _pump(name: str, stream: IO[bytes]) -> None:
     """Read lines from `stream`, prefix with `[name]`, write to
     stdout. Runs in its own thread per child; daemon=True so a
     blocked read doesn't keep the process alive after main exits."""
-    try:
-        for raw in iter(stream.readline, b""):
-            line = raw.decode("utf-8", errors="replace").rstrip("\n")
-            sys.stdout.write(f"[{name}] {line}\n")
-            sys.stdout.flush()
-    except (OSError, ValueError) as exc:
-        # The manager closes a dead child's pipe after wait() and before a
-        # restart. A pump can be between readline calls at that exact moment;
-        # closed-stream errors are normal completion, not uncaught thread
-        # failures. Preserve genuinely unexpected I/O diagnostics.
-        if not stream.closed:
-            _log(f"{name} output pump stopped: {type(exc).__name__}: {exc}")
+    for raw in iter(stream.readline, b""):
+        line = raw.decode("utf-8", errors="replace").rstrip("\n")
+        sys.stdout.write(f"[{name}] {line}\n")
+        sys.stdout.flush()
 
 
 def _spawn(spec: _DaemonSpec) -> subprocess.Popen[bytes]:

bot_bottle/gateway/bounded_http.py

@@ -1,137 +0,0 @@
-"""Shared resource boundaries for gateway stdlib HTTP services."""
-
-from __future__ import annotations
-
-import http.server
-import io
-import socket
-import threading
-import time
-from dataclasses import dataclass
-from typing import Any, Protocol
-
-
-class Readable(Protocol):
-    def read(self, size: int = -1, /) -> bytes: ...
-
-
-class Writable(Protocol):
-    def write(self, data: bytes, /) -> object: ...
-
-
-@dataclass(frozen=True)
-class BodyReadError(Exception):
-    status: int
-    message: str
-
-
-def read_declared_body(
-    stream: Readable,
-    connection: socket.socket,
-    raw_length: str | None,
-    *,
-    maximum: int,
-    timeout_seconds: float,
-    require_length: bool,
-) -> bytes:
-    """Validate and read exactly one declared body under a read deadline."""
-    output = io.BytesIO()
-    copy_declared_body(
-        stream, output, connection, raw_length, maximum=maximum,
-        timeout_seconds=timeout_seconds, require_length=require_length,
-    )
-    return output.getvalue()
-
-
-def copy_declared_body(
-    stream: Readable,
-    output: Writable,
-    connection: socket.socket,
-    raw_length: str | None,
-    *,
-    maximum: int,
-    timeout_seconds: float,
-    require_length: bool,
-) -> int:
-    """Copy one declared body to a sink without retaining it in memory."""
-    if raw_length is None:
-        if require_length:
-            raise BodyReadError(411, "Content-Length required")
-        raw_length = "0"
-    try:
-        length = int(raw_length)
-    except ValueError as exc:
-        raise BodyReadError(400, "invalid Content-Length") from exc
-    if length < 0:
-        raise BodyReadError(400, "invalid Content-Length")
-    if length > maximum:
-        raise BodyReadError(413, "request body too large")
-    previous_timeout = connection.gettimeout()
-    deadline = time.monotonic() + timeout_seconds
-    remaining = length
-    try:
-        while remaining:
-            timeout = deadline - time.monotonic()
-            if timeout <= 0:
-                raise BodyReadError(408, "request body read timed out")
-            connection.settimeout(timeout)
-            chunk = stream.read(min(remaining, 64 * 1024))
-            if not chunk:
-                raise BodyReadError(400, "incomplete request body")
-            output.write(chunk)
-            remaining -= len(chunk)
-    except TimeoutError as exc:
-        raise BodyReadError(408, "request body read timed out") from exc
-    finally:
-        connection.settimeout(previous_timeout)
-    return length
-
-
-class BoundedThreadingHTTPServer(http.server.ThreadingHTTPServer):
-    """ThreadingHTTPServer with a hard cap on in-flight request threads."""
-
-    daemon_threads = True
-
-    def __init__(  # pylint: disable=consider-using-with
-        self, *args, max_workers: int = 32, **kwargs,  # type: ignore[no-untyped-def]
-    ):
-        if max_workers < 1:
-            raise ValueError("max_workers must be positive")
-        self._request_slots = threading.BoundedSemaphore(max_workers)
-        super().__init__(*args, **kwargs)
-
-    def process_request(
-        self, request: Any, client_address: Any,
-    ) -> None:
-        if not self._request_slots.acquire(  # pylint: disable=consider-using-with
-            blocking=False,
-        ):
-            try:
-                request.sendall(
-                    b"HTTP/1.1 503 Service Unavailable\r\n"
-                    b"Content-Length: 0\r\nConnection: close\r\n\r\n"
-                )
-            finally:
-                self.shutdown_request(request)
-            return
-        try:
-            super().process_request(request, client_address)
-        except BaseException:
-            self._request_slots.release()
-            raise
-
-    def process_request_thread(
-        self, request: Any, client_address: Any,
-    ) -> None:
-        try:
-            super().process_request_thread(request, client_address)
-        finally:
-            self._request_slots.release()
-
-
-__all__ = [
-    "BodyReadError",
-    "BoundedThreadingHTTPServer",
-    "copy_declared_body",
-    "read_declared_body",
-]

bot_bottle/gateway/egress/addon.py

@@ -16,36 +16,34 @@ import typing
 from mitmproxy import http  # type: ignore[import-not-found]  # pylint: disable=import-error
 
 from bot_bottle.constants import IDENTITY_HEADER
-from bot_bottle.gateway.egress.dlp_detectors import redact_tokens
-from bot_bottle.gateway.egress.dlp_config import (
+from bot_bottle.gateway.egress.dlp_detectors import redact_tokens, strip_crlf
+from bot_bottle.gateway.egress.addon_core import (
+    LOG_BLOCKS,
+    LOG_FULL,
     DEFAULT_OUTBOUND_ON_MATCH,
     ON_MATCH_BLOCK,
     ON_MATCH_REDACT,
+    Config,
+    Route,
+    ScanResult,
+    route_to_yaml_dict,
 )
 from bot_bottle.gateway.egress.context import resolve_client_context
 from bot_bottle.gateway.egress.dlp import (
     build_inbound_scan_text,
+    build_outbound_scan_text,
     build_token_allow_payload,
+    outbound_scan_headers,
     scan_inbound,
     scan_outbound,
 )
-from bot_bottle.gateway.egress.outbound_pipeline import redact_request, scan_request
 from bot_bottle.gateway.egress.matching import (
     decide,
+    decide_git_fetch,
+    is_git_fetch_request,
+    is_git_push_request,
     match_route,
 )
-from bot_bottle.gateway.egress.request_pipeline import (
-    evaluate_route_policy,
-    git_block_reason,
-)
-from bot_bottle.gateway.egress.schema import route_to_yaml_dict
-from bot_bottle.gateway.egress.types import (
-    LOG_BLOCKS,
-    LOG_FULL,
-    Config,
-    Route,
-    ScanResult,
-)
 from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver
 from bot_bottle.supervisor.types import (
     STATUS_APPROVED,
@@ -389,9 +387,19 @@ class EgressAddon:
         self._passthrough_conns.discard(conn_id)
 
     async def request(self, flow: http.HTTPFlow) -> None:
-        config, slug, env = self._request_context(flow)
         request_path, _, query = flow.request.path.partition("?")
 
+        # Reuse the context stashed by http_connect for HTTPS flows (one
+        # orchestrator round-trip per connection). Plain-HTTP flows have no
+        # prior CONNECT stash, so resolve now and stash for response/websocket.
+        meta = getattr(flow, "metadata", None)
+        if isinstance(meta, dict) and _FLOW_CTX_KEY in meta:
+            config, slug, env = meta[_FLOW_CTX_KEY]
+            self._request_token(flow)  # strip identity headers; token already resolved
+        else:
+            config, slug, env = self._resolve_flow(flow)
+            self._stash_flow_ctx(flow, config, slug, env)
+
         # Introspection ("_egress.local/allowlist") reports the calling bottle's
         # own resolved routes — served after resolution so it reflects this
         # bottle's policy, not a stale global.
@@ -412,66 +420,56 @@ class EgressAddon:
             # the path/query the git checks below rely on.
             request_path, _, query = flow.request.path.partition("?")
 
-        if not self._allow_git_request(flow, config, request_path, query):
+        if is_git_push_request(request_path, query):
+            self._block(
+                flow,
+                "egress: git push over HTTPS is not supported; "
+                "use the bottle.git SSH path (gitleaks-scanned by "
+                "git-gate's pre-receive hook).",
+                ctx=self._req_ctx(flow),
+            )
             return
 
-        self._apply_route_policy(flow, config, route, request_path, env)
+        if is_git_fetch_request(request_path, query):
+            git_decision = decide_git_fetch(
+                config.routes, flow.request.pretty_host,
+            )
+            if git_decision.action == "block":
+                self._block(
+                    flow,
+                    git_decision.reason,
+                    ctx=self._req_ctx(flow),
+                )
+                return
 
-    def _request_context(
-        self, flow: http.HTTPFlow,
-    ) -> tuple[Config, str, "typing.Mapping[str, str]"]:
-        """Resolve one bottle context, reusing the HTTPS CONNECT snapshot."""
-        meta = getattr(flow, "metadata", None)
-        if isinstance(meta, dict) and _FLOW_CTX_KEY in meta:
-            config, slug, env = meta[_FLOW_CTX_KEY]
-            self._request_token(flow)
-            return config, slug, env
-        config, slug, env = self._resolve_flow(flow)
-        self._stash_flow_ctx(flow, config, slug, env)
-        return config, slug, env
-
-    def _allow_git_request(
-        self, flow: http.HTTPFlow, config: Config,
-        request_path: str, query: str,
-    ) -> bool:
-        """Apply the HTTPS Git push/fetch boundary before general routing."""
-        reason = git_block_reason(
-            config.routes, flow.request.pretty_host, request_path, query,
-        )
-        if not reason:
-            return True
-        self._block(flow, reason, ctx=self._req_ctx(flow))
-        return False
-
-    def _apply_route_policy(
-        self, flow: http.HTTPFlow, config: Config, route: Route | None,
-        request_path: str, env: "typing.Mapping[str, str]",
-    ) -> None:
-        """Strip agent auth, evaluate the route, then inject gateway auth."""
         # Strip agent-set Authorization after DLP scan so smuggled tokens
         # are caught above; the route may inject gateway-owned auth below.
         # Routes with preserve_auth=True pass the header through as-is so the
         # agent's own credentials (e.g. registry bearer tokens) reach the upstream.
-        result = evaluate_route_policy(
-            config,
-            route,
-            host=flow.request.pretty_host,
-            request_path=request_path,
-            method=flow.request.method,
-            headers=dict(flow.request.headers),
-            env=env,
-        )
-        if result.strip_authorization:
+        if route is None or not route.preserve_auth:
             flow.request.headers.pop("authorization", None)
 
-        if result.block_reason:
-            self._block(flow, result.block_reason, ctx=self._req_ctx(flow))
+        # Build headers mapping for match evaluation
+        req_headers = {k.lower(): v for k, v in flow.request.headers.items()}
+
+        decision = decide(
+            config.routes,
+            flow.request.pretty_host,
+            request_path,
+            env,
+            request_method=flow.request.method,
+            request_headers=req_headers,
+            deny_reason=config.deny_reason,
+        )
+
+        if decision.action == "block":
+            self._block(flow, decision.reason, ctx=self._req_ctx(flow))
             return
 
-        if result.inject_authorization is not None:
-            flow.request.headers["authorization"] = result.inject_authorization
+        if decision.inject_authorization is not None:
+            flow.request.headers["authorization"] = decision.inject_authorization
 
-        if result.log_request:
+        if config.log >= LOG_FULL:
             self._log_request(flow, env)
 
     def _block_dlp(self, flow: http.HTTPFlow, result: ScanResult) -> None:
@@ -495,12 +493,20 @@ class EgressAddon:
         Loops so the supervise policy can re-scan after each approval — a
         second, un-approved token in the same request is still caught."""
         while True:
-            request_path, _, _ = flow.request.path.partition("?")
-            result = scan_request(
-                flow.request,
-                route,
-                env,
-                safe_tokens=self._safe_tokens_for(slug),
+            request_path, _, query = flow.request.path.partition("?")
+            body = flow.request.get_text(strict=False) or ""
+            headers = outbound_scan_headers(route, dict(flow.request.headers))
+            scan_text = build_outbound_scan_text(
+                flow.request.pretty_host, request_path, query, headers, body,
+            )
+            # CRLF is scanned only over the request line + headers, never the
+            # body (see scan_outbound) — a body is not an injection vector.
+            crlf_text = build_outbound_scan_text(
+                flow.request.pretty_host, request_path, query, headers, "",
+            )
+            result = scan_outbound(
+                route, scan_text, env,
+                safe_tokens=self._safe_tokens_for(slug), crlf_text=crlf_text,
             )
             if result is None or result.severity != "block":
                 return True
@@ -510,7 +516,7 @@ class EgressAddon:
             # redact scrubs every detection (tokens and structural CRLF) and
             # forwards; it fails closed only if a match survives the scrub.
             if policy == ON_MATCH_REDACT:
-                if redact_request(flow.request, route, env):
+                if self._redact_outbound(flow, route, env):
                     if self._flow_log(flow) >= LOG_BLOCKS:
                         sys.stderr.write(json.dumps({
                             "event": "egress_redacted",
@@ -543,6 +549,41 @@ class EgressAddon:
                 return False  # _supervise_token_block wrote the 403 response
             # loop: the approved value is now in safe_tokens; re-scan.
 
+    def _redact_outbound(
+        self, flow: http.HTTPFlow, route: Route, env: "typing.Mapping[str, str]",
+    ) -> bool:
+        """Scrub detected tokens (and CRLF injection sequences) from the mutable
+        request surfaces (body, headers, path/query) and re-scan. `env` is the
+        per-bottle env overlay. Returns True if the request is now clean; False
+        if a block-severity match remains on a surface redaction cannot rewrite
+        (the hostname) so the caller fails closed."""
+        body = flow.request.get_text(strict=False)
+        if body:
+            redacted_body = redact_tokens(body, env=env)
+            if redacted_body != body:
+                flow.request.text = redacted_body
+        for name, value in list(flow.request.headers.items()):
+            if name.lower() == "host":
+                continue  # routing-critical; never a legitimate token
+            redacted = strip_crlf(redact_tokens(value, env=env))
+            if redacted != value:
+                flow.request.headers[name] = redacted
+        redacted_path = strip_crlf(redact_tokens(flow.request.path, env=env))
+        if redacted_path != flow.request.path:
+            flow.request.path = redacted_path
+
+        request_path, _, query = flow.request.path.partition("?")
+        new_body = flow.request.get_text(strict=False) or ""
+        headers = outbound_scan_headers(route, dict(flow.request.headers))
+        scan_text = build_outbound_scan_text(
+            flow.request.pretty_host, request_path, query, headers, new_body,
+        )
+        crlf_text = build_outbound_scan_text(
+            flow.request.pretty_host, request_path, query, headers, "",
+        )
+        result = scan_outbound(route, scan_text, env, crlf_text=crlf_text)
+        return result is None or result.severity != "block"
+
     async def _supervise_token_block(
         self,
         flow: http.HTTPFlow,

bot_bottle/gateway/egress/addon_core.py

@@ -1,27 +1,24 @@
-"""Compatibility exports for the egress addon's pure logic.
+"""Pure logic for the egress mitmproxy addon (PRD 0017, PRD 0053).
 
-New code imports the focused `types`, `schema`, `context`, `matching`,
-and `dlp` modules directly. This facade preserves the historical public
-surface for downstream callers while keeping implementation concerns separate.
-"""
+Split out of `egress_addon.py` so the host's unit tests can
+exercise the parse + decision functions without depending on the
+`mitmproxy` package. The companion module wraps these with the
+`mitmproxy.http.HTTPFlow` API and is loaded inside the gateway
+container.
 
-from .context import (
-    DENY_RESOLVER_ERROR,
-    DENY_UNATTRIBUTED,
-    DENY_UNPARSEABLE,
-    ContextResolverLike,
-    PolicyResolverLike,
-    resolve_client_config,
-    resolve_client_context,
-)
-from .dlp import (
-    build_inbound_scan_text,
-    build_outbound_scan_text,
-    build_token_allow_payload,
-    outbound_scan_headers,
-    scan_inbound,
-    scan_outbound,
-)
+Imports: stdlib + sibling package modules (`yaml_subset`,
+`egress_dlp_config`). Available in the gateway via the installed
+`bot_bottle` package (see `Dockerfile.gateway`)."""
+
+from __future__ import annotations
+
+import re
+import typing
+
+from ...yaml_subset import YamlSubsetError, parse_yaml_subset
+
+# DLP detector-config parsing lives in a sibling module. Re-exported below
+# so existing `from egress_addon_core import ON_MATCH_*` callers keep working.
 from .dlp_config import (
     DEFAULT_OUTBOUND_ON_MATCH,
     INBOUND_DETECTOR_NAMES,
@@ -32,19 +29,13 @@ from .dlp_config import (
     OUTBOUND_ON_MATCH_VALUES,
     parse_inspect_block,
 )
-from .matching import (
-    decide,
-    decide_git_fetch,
-    evaluate_matches,
-    is_git_fetch_request,
-    is_git_push_request,
-    match_route,
-)
-from .schema import load_config, parse_config, parse_routes, route_to_yaml_dict
 from .types import (
+    HEADER_MATCH_TYPES,
     LOG_BLOCKS,
     LOG_FULL,
     LOG_OFF,
+    PATH_MATCH_TYPES,
+    VALID_METHODS,
     Config,
     Decision,
     HeaderMatch,
@@ -54,19 +45,834 @@ from .types import (
     ScanResult,
 )
 
+
+# ---------------------------------------------------------------------------
+# Parsing
+# ---------------------------------------------------------------------------
+
+def _parse_path_match(idx: int, j: int, raw: object) -> PathMatch:
+    label = f"route[{idx}] matches paths[{j}]"
+    if not isinstance(raw, dict):
+        raise ValueError(f"{label}: must be an object")
+    raw_dict: dict[str, object] = typing.cast(dict[str, object], raw)
+    ptype = raw_dict.get("type", "prefix")
+    if not isinstance(ptype, str) or ptype not in PATH_MATCH_TYPES:
+        raise ValueError(
+            f"{label}: 'type' must be one of {', '.join(PATH_MATCH_TYPES)} "
+            f"(got {ptype!r})"
+        )
+    value = raw_dict.get("value")
+    if not isinstance(value, str) or not value:
+        raise ValueError(f"{label}: 'value' must be a non-empty string")
+    if ptype in ("exact", "prefix") and not value.startswith("/"):
+        raise ValueError(
+            f"{label}: value {value!r} must start with '/' for "
+            f"type {ptype!r}"
+        )
+    compiled: re.Pattern[str] | None = None
+    if ptype == "regex":
+        try:
+            compiled = re.compile(value)
+        except re.error as e:
+            raise ValueError(
+                f"{label}: regex {value!r} failed to compile: {e}"
+            ) from e
+    for k in raw_dict:
+        if k not in ("type", "value"):
+            raise ValueError(f"{label}: unknown key {k!r}")
+    return PathMatch(type=ptype, value=value, compiled=compiled)
+
+
+def _parse_header_match(idx: int, j: int, raw: object) -> HeaderMatch:
+    label = f"route[{idx}] matches headers[{j}]"
+    if not isinstance(raw, dict):
+        raise ValueError(f"{label}: must be an object")
+    raw_dict: dict[str, object] = typing.cast(dict[str, object], raw)
+    name = raw_dict.get("name")
+    if not isinstance(name, str) or not name:
+        raise ValueError(f"{label}: 'name' must be a non-empty string")
+    value = raw_dict.get("value")
+    if not isinstance(value, str):
+        raise ValueError(f"{label}: 'value' must be a string")
+    htype = raw_dict.get("type", "exact")
+    if not isinstance(htype, str) or htype not in HEADER_MATCH_TYPES:
+        raise ValueError(
+            f"{label}: 'type' must be one of {', '.join(HEADER_MATCH_TYPES)} "
+            f"(got {htype!r})"
+        )
+    compiled: re.Pattern[str] | None = None
+    if htype == "regex":
+        try:
+            compiled = re.compile(value)
+        except re.error as e:
+            raise ValueError(
+                f"{label}: regex {value!r} failed to compile: {e}"
+            ) from e
+    for k in raw_dict:
+        if k not in ("name", "value", "type"):
+            raise ValueError(f"{label}: unknown key {k!r}")
+    return HeaderMatch(name=name, value=value, type=htype, compiled=compiled)
+
+
+def _parse_match_entry(idx: int, k: int, raw: object) -> MatchEntry:
+    label = f"route[{idx}] matches[{k}]"
+    if not isinstance(raw, dict):
+        raise ValueError(f"{label}: must be an object")
+    raw_dict: dict[str, object] = typing.cast(dict[str, object], raw)
+
+    paths: tuple[PathMatch, ...] = ()
+    paths_raw = raw_dict.get("paths")
+    if paths_raw is not None:
+        if not isinstance(paths_raw, list):
+            raise ValueError(f"{label}: 'paths' must be a list")
+        paths_list = typing.cast(list[object], paths_raw)
+        paths = tuple(_parse_path_match(idx, j, p) for j, p in enumerate(paths_list))
+
+    methods: tuple[str, ...] = ()
+    methods_raw = raw_dict.get("methods")
+    if methods_raw is not None:
+        if not isinstance(methods_raw, list):
+            raise ValueError(f"{label}: 'methods' must be a list")
+        methods_list = typing.cast(list[object], methods_raw)
+        normalised: list[str] = []
+        for j, m in enumerate(methods_list):
+            if not isinstance(m, str):
+                raise ValueError(f"{label}: methods[{j}] must be a string")
+            upper = m.upper()
+            if upper not in VALID_METHODS:
+                raise ValueError(
+                    f"{label}: methods[{j}] {m!r} is not a valid HTTP method"
+                )
+            normalised.append(upper)
+        methods = tuple(normalised)
+
+    headers: tuple[HeaderMatch, ...] = ()
+    headers_raw = raw_dict.get("headers")
+    if headers_raw is not None:
+        if not isinstance(headers_raw, list):
+            raise ValueError(f"{label}: 'headers' must be a list")
+        headers_list = typing.cast(list[object], headers_raw)
+        headers = tuple(
+            _parse_header_match(idx, j, h) for j, h in enumerate(headers_list)
+        )
+
+    for key in raw_dict:
+        if key not in ("paths", "methods", "headers"):
+            raise ValueError(f"{label}: unknown key {key!r}")
+
+    return MatchEntry(paths=paths, methods=methods, headers=headers)
+
+
+def parse_routes(payload: object) -> tuple[Route, ...]:
+    if not isinstance(payload, dict):
+        raise ValueError("routes payload: top-level must be an object")
+    payload_dict: dict[str, object] = typing.cast(dict[str, object], payload)
+    raw: object = payload_dict.get("routes")
+    if not isinstance(raw, list):
+        raise ValueError("routes payload: 'routes' must be a list")
+    raw_list: list[object] = typing.cast(list[object], raw)
+    out: list[Route] = []
+    for i, r in enumerate(raw_list):
+        out.append(_parse_one(i, r))
+    return tuple(out)
+
+
+def _parse_one(idx: int, raw: object) -> Route:
+    label = f"route[{idx}]"
+    if not isinstance(raw, dict):
+        raise ValueError(f"{label}: must be an object (got {type(raw).__name__})")
+    raw_dict: dict[str, object] = typing.cast(dict[str, object], raw)
+    host: object = raw_dict.get("host")
+    if not isinstance(host, str) or not host:
+        raise ValueError(f"{label}: 'host' must be a non-empty string")
+    legacy_flat = "inspect" not in raw_dict
+    inspect_raw = raw_dict.get("inspect", {})
+    if inspect_raw is False:
+        inspect = False
+        settings: dict[str, object] = {}
+    elif isinstance(inspect_raw, dict):
+        inspect = True
+        settings = (
+            {k: v for k, v in raw_dict.items() if k != "host"}
+            if legacy_flat
+            else typing.cast(dict[str, object], inspect_raw)
+        )
+        legacy_dlp = settings.pop("dlp", None)
+        if isinstance(legacy_dlp, dict):
+            settings.update(typing.cast(dict[str, object], legacy_dlp))
+        elif legacy_dlp is not None:
+            raise ValueError(
+                f"{label} ({host}): legacy 'dlp' must be an object"
+            )
+    else:
+        raise ValueError(f"{label} ({host}): 'inspect' must be false or an object")
+
+    # matches
+    matches: tuple[MatchEntry, ...] = ()
+    matches_raw = settings.get("matches")
+    if matches_raw is not None:
+        if not isinstance(matches_raw, list):
+            raise ValueError(f"{label} ({host}): 'matches' must be a list")
+        matches_list = typing.cast(list[object], matches_raw)
+        matches = tuple(
+            _parse_match_entry(idx, k, m) for k, m in enumerate(matches_list)
+        )
+
+    # auth (unchanged wire format)
+    auth_scheme: object = settings.get("auth_scheme", "")
+    token_env: object = settings.get("token_env", "")
+    if not isinstance(auth_scheme, str):
+        raise ValueError(f"{label} ({host}): 'auth_scheme' must be a string")
+    if not isinstance(token_env, str):
+        raise ValueError(f"{label} ({host}): 'token_env' must be a string")
+    if bool(auth_scheme) != bool(token_env):
+        raise ValueError(
+            f"{label} ({host}): 'auth_scheme' and 'token_env' must be both "
+            f"set or both empty (got auth_scheme={auth_scheme!r}, "
+            f"token_env={token_env!r})"
+        )
+
+    # git-over-HTTPS policy
+    git_fetch = False
+    git_raw = settings.get("git")
+    if git_raw is not None:
+        if not isinstance(git_raw, dict):
+            raise ValueError(f"{label} ({host}): 'git' must be an object")
+        git_dict: dict[str, object] = typing.cast(dict[str, object], git_raw)
+        fetch_raw = git_dict.get("fetch", False)
+        if fetch_raw is True or fetch_raw is False:
+            git_fetch = fetch_raw
+        else:
+            raise ValueError(f"{label} ({host}): 'git.fetch' must be a boolean")
+        for k in git_dict:
+            if k != "fetch":
+                raise ValueError(
+                    f"{label} ({host}): git has unknown key {k!r}; "
+                    "accepted key is 'fetch'"
+                )
+
+    # dlp detectors
+    outbound_detectors, inbound_detectors, outbound_on_match = parse_inspect_block(
+        idx, host, settings,
+    )
+
+    preserve_auth_raw = settings.get("preserve_auth", False)
+    if preserve_auth_raw is not True and preserve_auth_raw is not False:
+        raise ValueError(
+            f"{label} ({host}): 'preserve_auth' must be a boolean"
+        )
+    preserve_auth: bool = preserve_auth_raw
+
+    for k in settings:
+        if k not in (
+            "matches", "auth_scheme", "token_env", "git", "preserve_auth",
+            "outbound_detectors", "inbound_detectors", "outbound_on_match",
+        ):
+            raise ValueError(
+                f"{label} ({host}): inspect has unknown key {k!r}"
+            )
+    for k in raw_dict:
+        if not legacy_flat and k not in ("host", "inspect"):
+            raise ValueError(
+                f"{label} ({host}): unknown key {k!r}; accepted keys "
+                f"are 'host' and 'inspect'"
+            )
+
+    return Route(
+        host=host,
+        matches=matches,
+        auth_scheme=auth_scheme,
+        token_env=token_env,
+        git_fetch=git_fetch,
+        outbound_detectors=outbound_detectors,
+        inbound_detectors=inbound_detectors,
+        outbound_on_match=outbound_on_match,
+        preserve_auth=preserve_auth,
+        inspect=inspect,
+    )
+
+
+def _path_match_to_dict(pm: PathMatch) -> dict[str, object]:
+    d: dict[str, object] = {"value": pm.value}
+    if pm.type != "prefix":
+        d["type"] = pm.type
+    return d
+
+
+def _header_match_to_dict(hm: HeaderMatch) -> dict[str, object]:
+    d: dict[str, object] = {"name": hm.name, "value": hm.value}
+    if hm.type != "exact":
+        d["type"] = hm.type
+    return d
+
+
+def _match_entry_to_dict(me: MatchEntry) -> dict[str, object]:
+    d: dict[str, object] = {}
+    if me.paths:
+        d["paths"] = [_path_match_to_dict(p) for p in me.paths]
+    if me.methods:
+        d["methods"] = list(me.methods)
+    if me.headers:
+        d["headers"] = [_header_match_to_dict(h) for h in me.headers]
+    return d
+
+
+def route_to_yaml_dict(r: Route) -> dict[str, object]:
+    """Serialize a Route to YAML-schema-compatible dict.
+
+    Uses the same field names the YAML parser accepts, so the output
+    can be round-tripped directly into an `allow` or `egress-block`
+    proposal without translation. Fields that are empty/default are
+    omitted so the agent doesn't copy irrelevant keys."""
+    d: dict[str, object] = {"host": r.host}
+    if not r.inspect:
+        d["inspect"] = False
+        return d
+    inspected: dict[str, object] = {}
+    if r.auth_scheme:
+        inspected["auth_scheme"] = r.auth_scheme
+        inspected["token_env"] = r.token_env
+    if r.matches:
+        inspected["matches"] = [_match_entry_to_dict(m) for m in r.matches]
+    if r.git_fetch:
+        inspected["git"] = {"fetch": True}
+    if r.outbound_detectors is not None:
+        inspected["outbound_detectors"] = list(r.outbound_detectors)
+    if r.inbound_detectors is not None:
+        inspected["inbound_detectors"] = list(r.inbound_detectors)
+    if r.outbound_on_match:
+        inspected["outbound_on_match"] = r.outbound_on_match
+    if r.preserve_auth:
+        inspected["preserve_auth"] = True
+    if inspected:
+        d["inspect"] = inspected
+    return d
+
+
+def parse_config(payload: object) -> "Config":
+    """Parse a full egress config payload (top-level log level + routes)."""
+    if not isinstance(payload, dict):
+        raise ValueError("routes payload: top-level must be an object")
+    payload_dict: dict[str, object] = typing.cast(dict[str, object], payload)
+
+    log_raw: object = payload_dict.get("log", LOG_OFF)
+    if log_raw is True or log_raw is False or not isinstance(log_raw, int) \
+            or log_raw not in (LOG_OFF, LOG_BLOCKS, LOG_FULL):
+        raise ValueError(
+            f"routes payload: 'log' must be {LOG_OFF}, {LOG_BLOCKS}, or {LOG_FULL}"
+        )
+
+    routes = parse_routes(payload)
+    return Config(routes=routes, log=log_raw)
+
+
+def load_config(text: str) -> "Config":
+    """Parse YAML text → Config (routes + log flag)."""
+    try:
+        payload = parse_yaml_subset(text)
+    except YamlSubsetError as e:
+        raise ValueError(f"routes payload: invalid YAML: {e}") from e
+    return parse_config(payload)
+
+
+class PolicyResolverLike(typing.Protocol):
+    """The bit of `policy_resolver.PolicyResolver` this module needs — kept a
+    Protocol so egress_addon_core stays free of that import."""
+
+    def resolve(self, source_ip: str, identity_token: str = ...) -> "str | None":
+        ...
+
+
+# Deny-all explanations. Each names the *actual* failure so an operator isn't
+# sent looking for a missing egress route when the bottle never had a policy
+# to begin with — the failure mode that made a bricked registration read like
+# a misconfigured allowlist.
+DENY_UNATTRIBUTED = (
+    "egress: this request was not attributed to any bottle, so no egress "
+    "policy applies and every host is denied. Either the bottle's registry "
+    "row is missing/ambiguous (torn down, or another bottle claimed its "
+    "source IP), or the request carried no matching identity token — check "
+    "that the caller's proxy URL includes it. This is not an allowlist problem."
+)
+DENY_UNPARSEABLE = (
+    "egress: this bottle's egress policy could not be parsed, so it is being "
+    "treated as deny-all. Fix the bottle's egress.routes; every host is denied "
+    "until it loads."
+)
+DENY_RESOLVER_ERROR = (
+    "egress: the orchestrator could not be reached to resolve this bottle's "
+    "egress policy, so every host is denied (fail-closed). Check that the "
+    "control plane is up; this is not an allowlist problem."
+)
+
+
+def _config_from_policy(policy: "str | None") -> "Config":
+    """Parse a resolved policy blob into a Config, fail-closed: None / empty /
+    unparseable all become a deny-all Config (no routes → every request
+    blocked). Each deny-all carries the reason it is one, so the block message
+    names the real fault instead of blaming the allowlist."""
+    if not policy:
+        return Config(routes=(), deny_reason=DENY_UNATTRIBUTED)
+    try:
+        return load_config(policy)
+    except ValueError:
+        return Config(routes=(), deny_reason=DENY_UNPARSEABLE)
+
+
+def resolve_client_config(
+    resolver: PolicyResolverLike, client_ip: str, identity_token: str = ""
+) -> "Config":
+    """The calling client's egress Config, resolved from the orchestrator via
+    `resolver` and parsed — **fail-closed**. An unattributed client (None), a
+    resolver error, or an unparseable policy all yield a deny-all Config (no
+    routes → every request blocked). A compromised, absent, or confused
+    orchestrator must never *widen* a bottle's egress."""
+    try:
+        policy = resolver.resolve(client_ip, identity_token)
+    except Exception:  # noqa: BLE001  # pylint: disable=broad-exception-caught
+        return Config(routes=(), deny_reason=DENY_RESOLVER_ERROR)
+    return _config_from_policy(policy)
+
+
+class ContextResolverLike(typing.Protocol):
+    """The bit of `policy_resolver.PolicyResolver` `resolve_client_context`
+    needs — one round-trip returning policy, bottle id, and auth tokens."""
+
+    def resolve_policy_and_bottle_id(
+        self, source_ip: str, identity_token: str = ...,
+    ) -> "tuple[str | None, str | None, dict[str, str]]":
+        ...
+
+
+def resolve_client_context(
+    resolver: ContextResolverLike, client_ip: str, identity_token: str = "",
+) -> "tuple[Config, str, dict[str, str]]":
+    """The calling client's `(Config, bottle_id, tokens)` in one round-trip —
+    **fail-closed**. The Config follows `resolve_client_config`'s deny-all
+    rules; the bottle id is `""` whenever unattributed or the orchestrator
+    errored (caller treats as "supervise unavailable", never another bottle's
+    queue); `tokens` are the per-bottle upstream auth values the addon injects.
+    One `/resolve` keys the egress policy, the supervise queue + safelist, and
+    auth injection."""
+    try:
+        policy, bottle_id, tokens = resolver.resolve_policy_and_bottle_id(
+            client_ip, identity_token,
+        )
+    except Exception:  # noqa: BLE001  # pylint: disable=broad-exception-caught
+        return Config(routes=(), deny_reason=DENY_RESOLVER_ERROR), "", {}
+    return _config_from_policy(policy), (bottle_id or ""), tokens
+
+
+# ---------------------------------------------------------------------------
+# Match evaluation
+# ---------------------------------------------------------------------------
+
+def _path_matches(pm: PathMatch, request_path: str) -> bool:
+    if pm.type == "exact":
+        return request_path == pm.value
+    if pm.type == "prefix":
+        if request_path == pm.value:
+            return True
+        if not pm.value.endswith("/"):
+            return request_path.startswith(pm.value + "/")
+        return request_path.startswith(pm.value)
+    if pm.type == "regex" and pm.compiled is not None:
+        return pm.compiled.search(request_path) is not None
+    return False
+
+
+def _entry_matches(
+    entry: MatchEntry,
+    request_path: str,
+    request_method: str,
+    request_headers: typing.Mapping[str, str],
+) -> bool:
+    """All predicates within a MatchEntry are ANDed."""
+    if entry.paths:
+        if not any(_path_matches(pm, request_path) for pm in entry.paths):
+            return False
+    if entry.methods:
+        if request_method.upper() not in entry.methods:
+            return False
+    if entry.headers:
+        for hm in entry.headers:
+            header_val = request_headers.get(hm.name.lower())
+            if header_val is None:
+                return False
+            if hm.type == "exact":
+                if header_val != hm.value:
+                    return False
+            elif hm.type == "regex" and hm.compiled is not None:
+                if not hm.compiled.search(header_val):
+                    return False
+    return True
+
+
+def evaluate_matches(
+    route: Route,
+    request_path: str,
+    request_method: str = "GET",
+    request_headers: typing.Mapping[str, str] | None = None,
+) -> bool:
+    """Return True if the request matches this route's match entries.
+    Empty matches tuple means all requests match (bare-pass route)."""
+    if not route.matches:
+        return True
+    hdrs: typing.Mapping[str, str] = request_headers or {}
+    return any(
+        _entry_matches(entry, request_path, request_method, hdrs)
+        for entry in route.matches
+    )
+
+
+# ---------------------------------------------------------------------------
+# Git push detection (unchanged)
+# ---------------------------------------------------------------------------
+
+def is_git_push_request(path: str, query: str) -> bool:
+    if path.endswith("/git-receive-pack"):
+        return True
+    if path.endswith("/info/refs"):
+        for pair in query.split("&"):
+            k, _, v = pair.partition("=")
+            if k == "service" and v == "git-receive-pack":
+                return True
+    return False
+
+
+def is_git_fetch_request(path: str, query: str) -> bool:
+    if path.endswith("/git-upload-pack"):
+        return True
+    if path.endswith("/info/refs"):
+        for pair in query.split("&"):
+            k, _, v = pair.partition("=")
+            if k == "service" and v == "git-upload-pack":
+                return True
+    return False
+
+
+# ---------------------------------------------------------------------------
+# Route lookup + decision
+# ---------------------------------------------------------------------------
+
+def match_route(
+    routes: typing.Sequence[Route],
+    request_host: str,
+) -> Route | None:
+    target = request_host.lower()
+    for r in routes:
+        if r.host.lower() == target:
+            return r
+    return None
+
+
+def decide(
+    routes: typing.Sequence[Route],
+    request_host: str,
+    request_path: str,
+    environ: typing.Mapping[str, str],
+    *,
+    request_method: str = "GET",
+    request_headers: typing.Mapping[str, str] | None = None,
+    deny_reason: str = "",
+) -> Decision:
+    """`deny_reason` is `Config.deny_reason`: when the deny-all came from a
+    missing/unparseable policy rather than the bottle's own allowlist, report
+    that instead of implying a route is merely absent."""
+    route = match_route(routes, request_host)
+    if route is None:
+        return Decision(
+            action="block",
+            reason=deny_reason or (
+                f"egress: host {request_host!r} is not in the "
+                f"bottle's egress.routes allowlist. Declare a "
+                f"route for it or remove the request."
+            ),
+        )
+
+    if not evaluate_matches(route, request_path, request_method, request_headers):
+        return Decision(
+            action="block",
+            reason=(
+                f"egress: request {request_method} {request_path!r} "
+                f"does not match any entry in matches for "
+                f"{route.host!r}"
+            ),
+        )
+
+    if route.auth_scheme and route.token_env:
+        token = environ.get(route.token_env, "")
+        if not token:
+            return Decision(
+                action="block",
+                reason=(
+                    f"egress: route for {route.host!r} declared auth "
+                    f"but env var {route.token_env!r} is unset"
+                ),
+            )
+        return Decision(
+            action="forward",
+            inject_authorization=f"{route.auth_scheme} {token}",
+        )
+
+    return Decision(action="forward")
+
+
+def decide_git_fetch(
+    routes: typing.Sequence[Route],
+    request_host: str,
+) -> Decision:
+    route = match_route(routes, request_host)
+    if route is not None and route.git_fetch:
+        return Decision(action="forward")
+    return Decision(
+        action="block",
+        reason=(
+            "egress: git fetch/clone over HTTPS is not allowed by default; "
+            "use git-gate for declared repos or set "
+            "egress.routes[].git.fetch=true for explicit read-only "
+            "HTTPS Git access."
+        ),
+    )
+
+
+# ---------------------------------------------------------------------------
+# DLP scan dispatch (PRD 0053)
+# ---------------------------------------------------------------------------
+
+def build_outbound_scan_text(
+    host: str,
+    path: str,
+    query: str,
+    headers: typing.Mapping[str, str],
+    body: str,
+) -> str:
+    """Assemble all outbound request surfaces into one string for DLP scanning.
+
+    Covers hostname (DNS tunnelling), path, query params, all headers, body.
+    """
+    parts: list[str] = [host, path]
+    if query:
+        parts.append(query)
+    for name, value in headers.items():
+        parts.append(f"{name}: {value}")
+    if body:
+        parts.append(body)
+    return "\n".join(parts)
+
+
+def outbound_scan_headers(
+    route: Route,
+    headers: typing.Mapping[str, str],
+) -> dict[str, str]:
+    """Return request headers that should be included in outbound DLP.
+
+    Routes that inject gateway-owned auth always strip the agent's
+    Authorization header before forwarding. Scanning that header first
+    creates false positives for provider clients that insist on sending
+    their own bearer-shaped placeholder, while still not changing what
+    reaches the upstream.
+    """
+    out: dict[str, str] = {}
+    skip_auth = bool(route.auth_scheme and route.token_env)
+    for name, value in headers.items():
+        if skip_auth and name.lower() == "authorization":
+            continue
+        out[name] = value
+    return out
+
+
+def build_inbound_scan_text(
+    headers: typing.Mapping[str, str],
+    body: str,
+) -> str:
+    """Assemble inbound response surfaces into one string for DLP scanning.
+
+    Covers all response headers plus body.
+    """
+    parts: list[str] = []
+    for name, value in headers.items():
+        parts.append(f"{name}: {value}")
+    if body:
+        parts.append(body)
+    return "\n".join(parts)
+
+
+def _detector_enabled(
+    configured: tuple[str, ...] | None,
+    name: str,
+) -> bool:
+    """Check if a named detector is enabled for a route direction.
+    None means all enabled; empty tuple means all disabled."""
+    if configured is None:
+        return True
+    return name in configured
+
+
+def scan_outbound(
+    route: Route,
+    body: str | bytes,
+    environ: typing.Mapping[str, str],
+    *,
+    safe_tokens: typing.AbstractSet[str] | None = None,
+    crlf_text: str | None = None,
+) -> ScanResult | None:
+    if not route.inspect:
+        return None
+    # Lazy import to avoid circular deps and keep dlp_detectors optional
+    # at import time (the gateway copies it flat alongside this file).
+    try:
+        from dlp_detectors import (  # type: ignore[import-not-found]
+            scan_crlf_injection,
+            scan_entropy,
+            scan_known_secrets,
+            scan_token_patterns,
+        )
+    except ImportError:  # pragma: no cover - host-side path
+        from .dlp_detectors import (  # type: ignore[import-not-found]
+            scan_crlf_injection,
+            scan_entropy,
+            scan_known_secrets,
+            scan_token_patterns,
+        )
+
+    # Binary bodies: latin-1 is a bijective byte↔codepoint mapping that
+    # preserves every byte value, so ASCII-range secret strings remain
+    # findable by str.find / regex.  Prefer strict UTF-8 for valid text bodies.
+    if isinstance(body, bytes):
+        try:
+            text = body.decode("utf-8")
+        except UnicodeDecodeError:
+            text = body.decode("latin-1")
+    else:
+        text = body
+
+    # CRLF injection is only an attack in the request line + headers, never the
+    # body: an HTTP body is delimited by Content-Length, so CRLF bytes there
+    # cannot split the request. Scanning the body produces false positives on
+    # legitimate form-encoded / multi-line content. Callers pass the
+    # body-excluded surfaces as `crlf_text`; `None` falls back to the full text
+    # for backward-compatible callers (host-side tests, websocket frames).
+    crlf_target = text if crlf_text is None else crlf_text
+    result = scan_crlf_injection(crlf_target)
+    if result is not None:
+        return result
+
+    if _detector_enabled(route.outbound_detectors, "token_patterns"):
+        result = scan_token_patterns(text, location="body", safe_tokens=safe_tokens)
+        if result is not None:
+            return result
+
+    if _detector_enabled(route.outbound_detectors, "known_secrets"):
+        # BOT_BOTTLE_SENSITIVE_PREFIXES lets operators add extra env prefixes
+        # beyond EGRESS_TOKEN_* without changing the manifest schema.
+        extra_raw = environ.get("BOT_BOTTLE_SENSITIVE_PREFIXES", "")
+        extra = tuple(p for p in extra_raw.split(",") if p)
+        sensitive_prefixes = ("EGRESS_TOKEN_",) + extra
+        result = scan_known_secrets(
+            text, location="body", env=environ,
+            sensitive_prefixes=sensitive_prefixes, safe_tokens=safe_tokens,
+        )
+        if result is not None:
+            return result
+
+    # Entropy scanning requires explicit opt-in: it is NOT part of the
+    # default "all detectors" set because it produces false positives on
+    # legitimate base64 / binary payloads.  Routes must list "entropy" in
+    # dlp.outbound_detectors to enable it.
+    if (
+        route.outbound_detectors is not None
+        and "entropy" in route.outbound_detectors
+    ):
+        result = scan_entropy(text, location="body")
+        if result is not None:
+            return result
+
+    return None
+
+
+def build_token_allow_payload(
+    host: str,
+    method: str,
+    path: str,
+    result: ScanResult,
+) -> str:
+    """Render the human-readable supervisor proposal body for an outbound
+    token block (PRD 0062). Carries the host/method/path, the detector
+    reason, and the redacted context snippet — never the raw token value."""
+    lines = [
+        "egress blocked an outbound request carrying a detected token",
+        f"host: {host}",
+        f"method: {method}",
+        f"path: {path}",
+        f"detector: {result.reason}",
+    ]
+    if result.context:
+        lines.append(f"context: {result.context}")
+    return "\n".join(lines) + "\n"
+
+
+def scan_inbound(
+    route: Route,
+    body: str | bytes,
+) -> ScanResult | None:
+    if not route.inspect:
+        return None
+    try:
+        from dlp_detectors import scan_naive_injection  # type: ignore[import-not-found]
+    except ImportError:  # pragma: no cover - host-side path
+        from .dlp_detectors import scan_naive_injection  # type: ignore[import-not-found]
+
+    text = body if isinstance(body, str) else body.decode("utf-8", errors="replace")
+
+    if _detector_enabled(route.inbound_detectors, "naive_injection_detection"):
+        result = scan_naive_injection(text)
+        if result is not None:
+            return result
+
+    return None
+
+
 __all__ = [
-    "LOG_BLOCKS", "LOG_FULL", "LOG_OFF",
-    "ON_MATCH_BLOCK", "ON_MATCH_REDACT", "ON_MATCH_SUPERVISE",
-    "OUTBOUND_ON_MATCH_VALUES", "DEFAULT_OUTBOUND_ON_MATCH",
-    "OUTBOUND_DETECTOR_NAMES", "INBOUND_DETECTOR_NAMES",
-    "Config", "Decision", "HeaderMatch", "MatchEntry", "PathMatch", "Route",
-    "ScanResult", "PolicyResolverLike", "ContextResolverLike",
-    "DENY_UNATTRIBUTED", "DENY_UNPARSEABLE", "DENY_RESOLVER_ERROR",
-    "build_inbound_scan_text", "build_outbound_scan_text",
-    "build_token_allow_payload", "decide", "decide_git_fetch",
-    "evaluate_matches", "is_git_push_request", "is_git_fetch_request",
-    "load_config", "match_route", "outbound_scan_headers", "parse_config",
-    "parse_inspect_block", "parse_routes", "resolve_client_config",
-    "resolve_client_context", "route_to_yaml_dict", "scan_inbound",
+    "LOG_BLOCKS",
+    "route_to_yaml_dict",
+    "LOG_FULL",
+    "LOG_OFF",
+    "ON_MATCH_BLOCK",
+    "ON_MATCH_REDACT",
+    "ON_MATCH_SUPERVISE",
+    "OUTBOUND_ON_MATCH_VALUES",
+    "DEFAULT_OUTBOUND_ON_MATCH",
+    "OUTBOUND_DETECTOR_NAMES",
+    "INBOUND_DETECTOR_NAMES",
+    "parse_inspect_block",
+    "Config",
+    "Decision",
+    "HeaderMatch",
+    "MatchEntry",
+    "PathMatch",
+    "Route",
+    "ScanResult",
+    "build_inbound_scan_text",
+    "build_outbound_scan_text",
+    "build_token_allow_payload",
+    "decide",
+    "decide_git_fetch",
+    "evaluate_matches",
+    "is_git_push_request",
+    "is_git_fetch_request",
+    "load_config",
+    "DENY_UNATTRIBUTED",
+    "DENY_UNPARSEABLE",
+    "DENY_RESOLVER_ERROR",
+    "resolve_client_config",
+    "resolve_client_context",
+    "PolicyResolverLike",
+    "ContextResolverLike",
+    "match_route",
+    "outbound_scan_headers",
+    "parse_config",
+    "parse_routes",
+    "scan_inbound",
     "scan_outbound",
 ]

bot_bottle/gateway/egress/context.py

@@ -4,7 +4,6 @@ from __future__ import annotations
 
 import typing
 
-from ...log import debug
 from .types import Config
 
 
@@ -39,7 +38,7 @@ class ContextResolverLike(typing.Protocol):
 
 def _config_from_policy(policy: str | None) -> Config:
     # Local import keeps schema parsing independent of resolver protocols.
-    from .schema import load_config
+    from .addon_core import load_config
     if not policy:
         return Config(routes=(), deny_reason=DENY_UNATTRIBUTED)
     try:
@@ -53,11 +52,7 @@ def resolve_client_config(
 ) -> Config:
     try:
         policy = resolver.resolve(client_ip, identity_token)
-    except Exception as exc:  # noqa: BLE001 - a policy lookup failure must deny
-        debug(
-            "egress policy resolution failed; applying deny-all",
-            context={"error_type": type(exc).__name__},
-        )
+    except Exception:  # noqa: BLE001 - a policy lookup failure must deny
         return Config(routes=(), deny_reason=DENY_RESOLVER_ERROR)
     return _config_from_policy(policy)
 
@@ -68,10 +63,6 @@ def resolve_client_context(
     try:
         policy, bottle_id, tokens = resolver.resolve_policy_and_bottle_id(
             client_ip, identity_token)
-    except Exception as exc:  # noqa: BLE001 - a policy lookup failure must deny
-        debug(
-            "egress context resolution failed; applying deny-all",
-            context={"error_type": type(exc).__name__},
-        )
+    except Exception:  # noqa: BLE001 - a policy lookup failure must deny
         return Config(routes=(), deny_reason=DENY_RESOLVER_ERROR), "", {}
     return _config_from_policy(policy), (bottle_id or ""), tokens

bot_bottle/gateway/egress/dlp_detectors.py

@@ -19,7 +19,7 @@ from math import log2
 from collections import Counter
 from urllib.parse import quote as url_quote
 
-from .types import ScanResult
+from .addon_core import ScanResult
 
 
 # ---------------------------------------------------------------------------

bot_bottle/gateway/egress/matching.py

@@ -16,11 +16,7 @@ def _path_matches(pm: PathMatch, request_path: str) -> bool:
         if not pm.value.endswith("/"):
             return request_path.startswith(pm.value + "/")
         return request_path.startswith(pm.value)
-    return (
-        pm.type == "regex"
-        and pm.compiled is not None
-        and pm.compiled.search(request_path) is not None
-    )
+    return pm.type == "regex" and pm.compiled is not None and pm.compiled.search(request_path) is not None
 
 
 def _entry_matches(

bot_bottle/gateway/egress/outbound_pipeline.py

@@ -1,83 +0,0 @@
-"""Outbound DLP request scanning and redaction for the egress pipeline."""
-
-from __future__ import annotations
-
-from typing import ItemsView, Mapping, Protocol
-
-from .dlp import (
-    build_outbound_scan_text,
-    outbound_scan_headers,
-    scan_outbound,
-)
-from .dlp_detectors import redact_tokens, strip_crlf
-from .types import Route, ScanResult
-
-
-class MutableHeaders(Protocol):
-    def items(self) -> ItemsView[str, str]: ...
-    def __getitem__(self, name: str, /) -> str: ...
-    def __setitem__(self, name: str, value: str, /) -> None: ...
-
-
-class MutableRequest(Protocol):
-    pretty_host: str
-    path: str
-    headers: MutableHeaders
-    text: str
-
-    def get_text(self, strict: bool = False) -> str | None: ...
-
-
-def scan_request(
-    request: MutableRequest,
-    route: Route,
-    env: Mapping[str, str],
-    *,
-    safe_tokens: set[str] | None = None,
-) -> ScanResult | None:
-    """Scan all mutable outbound request surfaces in their canonical order."""
-    request_path, _, query = request.path.partition("?")
-    headers = outbound_scan_headers(route, dict(request.headers.items()))
-    body = request.get_text(strict=False) or ""
-    scan_text = build_outbound_scan_text(
-        request.pretty_host, request_path, query, headers, body,
-    )
-    # Bodies cannot alter HTTP framing, so CRLF detection is deliberately
-    # restricted to the request line and headers.
-    crlf_text = build_outbound_scan_text(
-        request.pretty_host, request_path, query, headers, "",
-    )
-    return scan_outbound(
-        route,
-        scan_text,
-        env,
-        safe_tokens=safe_tokens,
-        crlf_text=crlf_text,
-    )
-
-
-def redact_request(
-    request: MutableRequest,
-    route: Route,
-    env: Mapping[str, str],
-) -> bool:
-    """Redact mutable request surfaces and return whether the result is clean."""
-    body = request.get_text(strict=False)
-    if body:
-        redacted_body = redact_tokens(body, env=env)
-        if redacted_body != body:
-            request.text = redacted_body
-    for name, value in list(request.headers.items()):
-        if name.lower() == "host":
-            continue
-        redacted = strip_crlf(redact_tokens(value, env=env))
-        if redacted != value:
-            request.headers[name] = redacted
-    redacted_path = strip_crlf(redact_tokens(request.path, env=env))
-    if redacted_path != request.path:
-        request.path = redacted_path
-    result = scan_request(request, route, env)
-    return result is None or result.severity != "block"
-
-
-__all__ = ["MutableRequest", "redact_request", "scan_request"]

bot_bottle/gateway/egress/request_pipeline.py

@@ -1,92 +0,0 @@
-"""Framework-neutral request policy stages for the egress adapter.
-
-The mitmproxy addon owns flow mutation and response construction. This module
-owns the ordered Git and route-policy decisions so those rules remain directly
-testable without a live proxy flow.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Mapping, Sequence
-
-from .matching import (
-    decide,
-    decide_git_fetch,
-    is_git_fetch_request,
-    is_git_push_request,
-)
-from .types import LOG_FULL, Config, Route
-
-GIT_PUSH_BLOCK_REASON = (
-    "egress: git push over HTTPS is not supported; "
-    "use the bottle.git SSH path (gitleaks-scanned by "
-    "git-gate's pre-receive hook)."
-)
-
-
-@dataclass(frozen=True)
-class RoutePolicyResult:
-    """The flow mutations and outcome produced by general route policy."""
-
-    block_reason: str = ""
-    strip_authorization: bool = False
-    inject_authorization: str | None = None
-    log_request: bool = False
-
-
-def git_block_reason(
-    routes: Sequence[Route],
-    host: str,
-    request_path: str,
-    query: str,
-) -> str:
-    """Return the HTTPS Git policy denial, or ``""`` when allowed."""
-    if is_git_push_request(request_path, query):
-        return GIT_PUSH_BLOCK_REASON
-    if not is_git_fetch_request(request_path, query):
-        return ""
-    decision = decide_git_fetch(routes, host)
-    return decision.reason if decision.action == "block" else ""
-
-
-def evaluate_route_policy(
-    config: Config,
-    route: Route | None,
-    *,
-    host: str,
-    request_path: str,
-    method: str,
-    headers: Mapping[str, str],
-    env: Mapping[str, str],
-) -> RoutePolicyResult:
-    """Evaluate authorization stripping, matching, injection, and logging."""
-    strip_authorization = route is None or not route.preserve_auth
-    effective_headers = {
-        name.lower(): value
-        for name, value in headers.items()
-        if not (strip_authorization and name.lower() == "authorization")
-    }
-    decision = decide(
-        config.routes,
-        host,
-        request_path,
-        env,
-        request_method=method,
-        request_headers=effective_headers,
-        deny_reason=config.deny_reason,
-    )
-    return RoutePolicyResult(
-        block_reason=decision.reason if decision.action == "block" else "",
-        strip_authorization=strip_authorization,
-        inject_authorization=decision.inject_authorization,
-        log_request=config.log >= LOG_FULL,
-    )
-
-
-__all__ = [
-    "GIT_PUSH_BLOCK_REASON",
-    "RoutePolicyResult",
-    "evaluate_route_policy",
-    "git_block_reason",
-]

bot_bottle/gateway/egress/schema.py

@@ -1,349 +0,0 @@
-"""Egress policy schema parsing and serialization (PRD 0017 / 0053)."""
-
-from __future__ import annotations
-
-import re
-import typing
-
-from ...yaml_subset import YamlSubsetError, parse_yaml_subset
-from .dlp_config import parse_inspect_block
-from .types import (
-    HEADER_MATCH_TYPES,
-    LOG_BLOCKS,
-    LOG_FULL,
-    LOG_OFF,
-    PATH_MATCH_TYPES,
-    VALID_METHODS,
-    Config,
-    HeaderMatch,
-    MatchEntry,
-    PathMatch,
-    Route,
-)
-
-# Parsing
-# ---------------------------------------------------------------------------
-
-def _parse_path_match(idx: int, j: int, raw: object) -> PathMatch:
-    label = f"route[{idx}] matches paths[{j}]"
-    if not isinstance(raw, dict):
-        raise ValueError(f"{label}: must be an object")
-    raw_dict: dict[str, object] = typing.cast(dict[str, object], raw)
-    ptype = raw_dict.get("type", "prefix")
-    if not isinstance(ptype, str) or ptype not in PATH_MATCH_TYPES:
-        raise ValueError(
-            f"{label}: 'type' must be one of {', '.join(PATH_MATCH_TYPES)} "
-            f"(got {ptype!r})"
-        )
-    value = raw_dict.get("value")
-    if not isinstance(value, str) or not value:
-        raise ValueError(f"{label}: 'value' must be a non-empty string")
-    if ptype in ("exact", "prefix") and not value.startswith("/"):
-        raise ValueError(
-            f"{label}: value {value!r} must start with '/' for "
-            f"type {ptype!r}"
-        )
-    compiled: re.Pattern[str] | None = None
-    if ptype == "regex":
-        try:
-            compiled = re.compile(value)
-        except re.error as e:
-            raise ValueError(
-                f"{label}: regex {value!r} failed to compile: {e}"
-            ) from e
-    for k in raw_dict:
-        if k not in ("type", "value"):
-            raise ValueError(f"{label}: unknown key {k!r}")
-    return PathMatch(type=ptype, value=value, compiled=compiled)
-
-
-def _parse_header_match(idx: int, j: int, raw: object) -> HeaderMatch:
-    label = f"route[{idx}] matches headers[{j}]"
-    if not isinstance(raw, dict):
-        raise ValueError(f"{label}: must be an object")
-    raw_dict: dict[str, object] = typing.cast(dict[str, object], raw)
-    name = raw_dict.get("name")
-    if not isinstance(name, str) or not name:
-        raise ValueError(f"{label}: 'name' must be a non-empty string")
-    value = raw_dict.get("value")
-    if not isinstance(value, str):
-        raise ValueError(f"{label}: 'value' must be a string")
-    htype = raw_dict.get("type", "exact")
-    if not isinstance(htype, str) or htype not in HEADER_MATCH_TYPES:
-        raise ValueError(
-            f"{label}: 'type' must be one of {', '.join(HEADER_MATCH_TYPES)} "
-            f"(got {htype!r})"
-        )
-    compiled: re.Pattern[str] | None = None
-    if htype == "regex":
-        try:
-            compiled = re.compile(value)
-        except re.error as e:
-            raise ValueError(
-                f"{label}: regex {value!r} failed to compile: {e}"
-            ) from e
-    for k in raw_dict:
-        if k not in ("name", "value", "type"):
-            raise ValueError(f"{label}: unknown key {k!r}")
-    return HeaderMatch(name=name, value=value, type=htype, compiled=compiled)
-
-
-def _parse_match_entry(idx: int, k: int, raw: object) -> MatchEntry:
-    label = f"route[{idx}] matches[{k}]"
-    if not isinstance(raw, dict):
-        raise ValueError(f"{label}: must be an object")
-    raw_dict: dict[str, object] = typing.cast(dict[str, object], raw)
-
-    paths: tuple[PathMatch, ...] = ()
-    paths_raw = raw_dict.get("paths")
-    if paths_raw is not None:
-        if not isinstance(paths_raw, list):
-            raise ValueError(f"{label}: 'paths' must be a list")
-        paths_list = typing.cast(list[object], paths_raw)
-        paths = tuple(_parse_path_match(idx, j, p) for j, p in enumerate(paths_list))
-
-    methods: tuple[str, ...] = ()
-    methods_raw = raw_dict.get("methods")
-    if methods_raw is not None:
-        if not isinstance(methods_raw, list):
-            raise ValueError(f"{label}: 'methods' must be a list")
-        methods_list = typing.cast(list[object], methods_raw)
-        normalised: list[str] = []
-        for j, m in enumerate(methods_list):
-            if not isinstance(m, str):
-                raise ValueError(f"{label}: methods[{j}] must be a string")
-            upper = m.upper()
-            if upper not in VALID_METHODS:
-                raise ValueError(
-                    f"{label}: methods[{j}] {m!r} is not a valid HTTP method"
-                )
-            normalised.append(upper)
-        methods = tuple(normalised)
-
-    headers: tuple[HeaderMatch, ...] = ()
-    headers_raw = raw_dict.get("headers")
-    if headers_raw is not None:
-        if not isinstance(headers_raw, list):
-            raise ValueError(f"{label}: 'headers' must be a list")
-        headers_list = typing.cast(list[object], headers_raw)
-        headers = tuple(
-            _parse_header_match(idx, j, h) for j, h in enumerate(headers_list)
-        )
-
-    for key in raw_dict:
-        if key not in ("paths", "methods", "headers"):
-            raise ValueError(f"{label}: unknown key {key!r}")
-
-    return MatchEntry(paths=paths, methods=methods, headers=headers)
-
-
-def parse_routes(payload: object) -> tuple[Route, ...]:
-    if not isinstance(payload, dict):
-        raise ValueError("routes payload: top-level must be an object")
-    payload_dict: dict[str, object] = typing.cast(dict[str, object], payload)
-    raw: object = payload_dict.get("routes")
-    if not isinstance(raw, list):
-        raise ValueError("routes payload: 'routes' must be a list")
-    raw_list: list[object] = typing.cast(list[object], raw)
-    out: list[Route] = []
-    for i, r in enumerate(raw_list):
-        out.append(_parse_one(i, r))
-    return tuple(out)
-
-
-def _parse_one(idx: int, raw: object) -> Route:
-    label = f"route[{idx}]"
-    if not isinstance(raw, dict):
-        raise ValueError(f"{label}: must be an object (got {type(raw).__name__})")
-    raw_dict: dict[str, object] = typing.cast(dict[str, object], raw)
-    host: object = raw_dict.get("host")
-    if not isinstance(host, str) or not host:
-        raise ValueError(f"{label}: 'host' must be a non-empty string")
-    legacy_flat = "inspect" not in raw_dict
-    inspect_raw = raw_dict.get("inspect", {})
-    if inspect_raw is False:
-        inspect = False
-        settings: dict[str, object] = {}
-    elif isinstance(inspect_raw, dict):
-        inspect = True
-        settings = (
-            {k: v for k, v in raw_dict.items() if k != "host"}
-            if legacy_flat
-            else typing.cast(dict[str, object], inspect_raw)
-        )
-        legacy_dlp = settings.pop("dlp", None)
-        if isinstance(legacy_dlp, dict):
-            settings.update(typing.cast(dict[str, object], legacy_dlp))
-        elif legacy_dlp is not None:
-            raise ValueError(
-                f"{label} ({host}): legacy 'dlp' must be an object"
-            )
-    else:
-        raise ValueError(f"{label} ({host}): 'inspect' must be false or an object")
-
-    # matches
-    matches: tuple[MatchEntry, ...] = ()
-    matches_raw = settings.get("matches")
-    if matches_raw is not None:
-        if not isinstance(matches_raw, list):
-            raise ValueError(f"{label} ({host}): 'matches' must be a list")
-        matches_list = typing.cast(list[object], matches_raw)
-        matches = tuple(
-            _parse_match_entry(idx, k, m) for k, m in enumerate(matches_list)
-        )
-
-    # auth (unchanged wire format)
-    auth_scheme: object = settings.get("auth_scheme", "")
-    token_env: object = settings.get("token_env", "")
-    if not isinstance(auth_scheme, str):
-        raise ValueError(f"{label} ({host}): 'auth_scheme' must be a string")
-    if not isinstance(token_env, str):
-        raise ValueError(f"{label} ({host}): 'token_env' must be a string")
-    if bool(auth_scheme) != bool(token_env):
-        raise ValueError(
-            f"{label} ({host}): 'auth_scheme' and 'token_env' must be both "
-            f"set or both empty (got auth_scheme={auth_scheme!r}, "
-            f"token_env={token_env!r})"
-        )
-
-    # git-over-HTTPS policy
-    git_fetch = False
-    git_raw = settings.get("git")
-    if git_raw is not None:
-        if not isinstance(git_raw, dict):
-            raise ValueError(f"{label} ({host}): 'git' must be an object")
-        git_dict: dict[str, object] = typing.cast(dict[str, object], git_raw)
-        fetch_raw = git_dict.get("fetch", False)
-        if fetch_raw is True or fetch_raw is False:
-            git_fetch = fetch_raw
-        else:
-            raise ValueError(f"{label} ({host}): 'git.fetch' must be a boolean")
-        for k in git_dict:
-            if k != "fetch":
-                raise ValueError(
-                    f"{label} ({host}): git has unknown key {k!r}; "
-                    "accepted key is 'fetch'"
-                )
-
-    # dlp detectors
-    outbound_detectors, inbound_detectors, outbound_on_match = parse_inspect_block(
-        idx, host, settings,
-    )
-
-    preserve_auth_raw = settings.get("preserve_auth", False)
-    if preserve_auth_raw is not True and preserve_auth_raw is not False:
-        raise ValueError(
-            f"{label} ({host}): 'preserve_auth' must be a boolean"
-        )
-    preserve_auth: bool = preserve_auth_raw
-
-    for k in settings:
-        if k not in (
-            "matches", "auth_scheme", "token_env", "git", "preserve_auth",
-            "outbound_detectors", "inbound_detectors", "outbound_on_match",
-        ):
-            raise ValueError(
-                f"{label} ({host}): inspect has unknown key {k!r}"
-            )
-    for k in raw_dict:
-        if not legacy_flat and k not in ("host", "inspect"):
-            raise ValueError(
-                f"{label} ({host}): unknown key {k!r}; accepted keys "
-                f"are 'host' and 'inspect'"
-            )
-
-    return Route(
-        host=host,
-        matches=matches,
-        auth_scheme=auth_scheme,
-        token_env=token_env,
-        git_fetch=git_fetch,
-        outbound_detectors=outbound_detectors,
-        inbound_detectors=inbound_detectors,
-        outbound_on_match=outbound_on_match,
-        preserve_auth=preserve_auth,
-        inspect=inspect,
-    )
-
-
-def _path_match_to_dict(pm: PathMatch) -> dict[str, object]:
-    d: dict[str, object] = {"value": pm.value}
-    if pm.type != "prefix":
-        d["type"] = pm.type
-    return d
-
-
-def _header_match_to_dict(hm: HeaderMatch) -> dict[str, object]:
-    d: dict[str, object] = {"name": hm.name, "value": hm.value}
-    if hm.type != "exact":
-        d["type"] = hm.type
-    return d
-
-
-def _match_entry_to_dict(me: MatchEntry) -> dict[str, object]:
-    d: dict[str, object] = {}
-    if me.paths:
-        d["paths"] = [_path_match_to_dict(p) for p in me.paths]
-    if me.methods:
-        d["methods"] = list(me.methods)
-    if me.headers:
-        d["headers"] = [_header_match_to_dict(h) for h in me.headers]
-    return d
-
-
-def route_to_yaml_dict(r: Route) -> dict[str, object]:
-    """Serialize a Route to YAML-schema-compatible dict.
-
-    Uses the same field names the YAML parser accepts, so the output
-    can be round-tripped directly into an `allow` or `egress-block`
-    proposal without translation. Fields that are empty/default are
-    omitted so the agent doesn't copy irrelevant keys."""
-    d: dict[str, object] = {"host": r.host}
-    if not r.inspect:
-        d["inspect"] = False
-        return d
-    inspected: dict[str, object] = {}
-    if r.auth_scheme:
-        inspected["auth_scheme"] = r.auth_scheme
-        inspected["token_env"] = r.token_env
-    if r.matches:
-        inspected["matches"] = [_match_entry_to_dict(m) for m in r.matches]
-    if r.git_fetch:
-        inspected["git"] = {"fetch": True}
-    if r.outbound_detectors is not None:
-        inspected["outbound_detectors"] = list(r.outbound_detectors)
-    if r.inbound_detectors is not None:
-        inspected["inbound_detectors"] = list(r.inbound_detectors)
-    if r.outbound_on_match:
-        inspected["outbound_on_match"] = r.outbound_on_match
-    if r.preserve_auth:
-        inspected["preserve_auth"] = True
-    if inspected:
-        d["inspect"] = inspected
-    return d
-
-
-def parse_config(payload: object) -> "Config":
-    """Parse a full egress config payload (top-level log level + routes)."""
-    if not isinstance(payload, dict):
-        raise ValueError("routes payload: top-level must be an object")
-    payload_dict: dict[str, object] = typing.cast(dict[str, object], payload)
-
-    log_raw: object = payload_dict.get("log", LOG_OFF)
-    if log_raw is True or log_raw is False or not isinstance(log_raw, int) \
-            or log_raw not in (LOG_OFF, LOG_BLOCKS, LOG_FULL):
-        raise ValueError(
-            f"routes payload: 'log' must be {LOG_OFF}, {LOG_BLOCKS}, or {LOG_FULL}"
-        )
-
-    routes = parse_routes(payload)
-    return Config(routes=routes, log=log_raw)
-
-
-def load_config(text: str) -> "Config":
-    """Parse YAML text → Config (routes + log flag)."""
-    try:
-        payload = parse_yaml_subset(text)
-    except YamlSubsetError as e:
-        raise ValueError(f"routes payload: invalid YAML: {e}") from e
-    return parse_config(payload)

bot_bottle/gateway/git_gate/http_backend.py

@@ -21,19 +21,12 @@ from __future__ import annotations
 import os
 import subprocess
 import sys
-import tempfile
-import threading
 import typing
-from http.server import BaseHTTPRequestHandler
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from urllib.parse import urlsplit
 
 from bot_bottle.constants import GIT_GATE_TIMEOUT_SECS, IDENTITY_HEADER
-from bot_bottle.gateway.bounded_http import (
-    BodyReadError,
-    BoundedThreadingHTTPServer,
-    copy_declared_body,
-)
 from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver
 
 
@@ -84,10 +77,6 @@ def resolve_sandbox_root(
 
 # Bound memory use while still allowing ordinary git push packfiles.
 MAX_BODY_BYTES = 100 * 1024 * 1024
-REQUEST_BODY_TIMEOUT_SECONDS = 30.0
-MAX_REQUEST_WORKERS = 16
-MAX_BODY_WORKERS = 2
-_BODY_WORK_SLOTS = threading.BoundedSemaphore(MAX_BODY_WORKERS)
 
 
 class GitHttpHandler(BaseHTTPRequestHandler):
@@ -195,40 +184,27 @@ class GitHttpHandler(BaseHTTPRequestHandler):
             value = self.headers.get(header)
             if value:
                 env[variable] = value
-        if not _BODY_WORK_SLOTS.acquire(blocking=False):
-            self.send_error(503, "git request capacity exhausted")
-            return
+        raw_length = self.headers.get("content-length", "0") or "0"
         try:
-            with tempfile.TemporaryFile() as body:
-                try:
-                    copy_declared_body(
-                        self.rfile,
-                        body,
-                        self.connection,
-                        self.headers.get("content-length"),
-                        maximum=MAX_BODY_BYTES,
-                        timeout_seconds=REQUEST_BODY_TIMEOUT_SECONDS,
-                        require_length=False,
-                    )
-                except BodyReadError as exc:
-                    self.send_error(exc.status, exc.message)
-                    return
-                body.seek(0)
-                try:
-                    proc = subprocess.run(
-                        ["git", "http-backend"],
-                        stdin=body,
-                        env=env,
-                        capture_output=True,
-                        check=False,
-                        timeout=GIT_GATE_TIMEOUT_SECS,
-                    )
-                except (OSError, subprocess.SubprocessError) as exc:
-                    self.log_message("git http-backend unavailable: %s", exc)
-                    self.send_error(503, "git backend unavailable")
-                    return
-        finally:
-            _BODY_WORK_SLOTS.release()
+            length = int(raw_length)
+        except ValueError:
+            self.send_error(400, "Bad Content-Length")
+            return
+        if length < 0:
+            self.send_error(400, "Negative Content-Length")
+            return
+        if length > MAX_BODY_BYTES:
+            self.send_error(413, "Request body too large")
+            return
+        body = self.rfile.read(length) if length else b""
+        proc = subprocess.run(
+            ["git", "http-backend"],
+            input=body,
+            env=env,
+            capture_output=True,
+            check=False,
+            timeout=GIT_GATE_TIMEOUT_SECS,
+        )
         self._write_cgi_response(proc.stdout)
 
     def _repo_dir(self, sandbox_root: Path, path: str) -> Path | None:
@@ -297,9 +273,7 @@ def main() -> int:
             "(no single-tenant flat-root fallback)\n"
         )
         return 1
-    server = BoundedThreadingHTTPServer(
-        ("0.0.0.0", port), GitHttpHandler, max_workers=MAX_REQUEST_WORKERS,
-    )
+    server = ThreadingHTTPServer(("0.0.0.0", port), GitHttpHandler)
     # Resolve each request's sandbox namespace by source IP against the
     # orchestrator control plane.
     server.policy_resolver = PolicyResolver(orch_url)  # type: ignore[attr-defined]

bot_bottle/gateway/git_gate/render.py

@@ -252,27 +252,6 @@ cat > "$refs_file"
 
 zero=0000000000000000000000000000000000000000
 
-# Phase 0: reject Gitea AGit review refs before scanning or forwarding.
-# A push to refs/for/*, refs/draft/*, or refs/for-review/* asks Gitea to
-# open a pull request backed by a server-managed refs/pull/<n>/head rather
-# than an ordinary refs/heads/* branch. That breaks the git-gate workflow:
-# follow-up commits can't be pushed back through the branch, and Gitea
-# rejects later direct updates to the generated review ref. Fail the whole
-# push here (before any gitleaks scan or upstream forward) so the caller
-# pushes a real branch and opens the PR against it instead. Deletions
-# (new == zero) stay allowed so stale AGit refs can still be cleaned up.
-while IFS=' ' read -r old new ref; do
-  [ -z "$ref" ] && continue
-  [ "$new" = "$zero" ] && continue
-  case "$ref" in
-    refs/for/*|refs/draft/*|refs/for-review/*)
-      echo "git-gate: refusing AGit review ref $ref" >&2
-      echo "git-gate: push to refs/heads/<branch> and open a branch-backed pull request instead" >&2
-      exit 1
-      ;;
-  esac
-done < "$refs_file"
-
 supervise_gitleaks_allow() {
   log_opts=$1
   ref=$2
@@ -385,7 +364,7 @@ PY
       ;;
   esac
   echo "git-gate: queued # gitleaks:allow supervisor approval $proposal_id" >&2
-  echo "git-gate: approve with 'bot-bottle supervise' to continue this push" >&2
+  echo "git-gate: approve with './cli.py supervise' to continue this push" >&2
   waited=0
   while [ "$waited" -lt "$timeout" ]; do
     status=$(PYTHONPATH="/app${PYTHONPATH:+:$PYTHONPATH}" python3 - "$proposal_id" <<'PY'

bot_bottle/gateway/supervisor/mcp_dispatch.py

@@ -1,92 +0,0 @@
-"""Framework-neutral MCP method and tool dispatch."""
-
-from __future__ import annotations
-
-import json
-from dataclasses import dataclass
-from typing import Callable, Protocol
-
-from bot_bottle.gateway.egress.schema import load_config, route_to_yaml_dict
-from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver
-from bot_bottle.supervisor import types as _sv
-
-
-class Request(Protocol):
-    @property
-    def method(self) -> str: ...
-
-    @property
-    def params(self) -> dict[str, object]: ...
-
-
-class MethodNotFoundError(Exception):
-    """Raised when a JSON-RPC method has no MCP handler."""
-
-
-class RouteResolutionError(Exception):
-    """The caller's live route table could not be resolved authoritatively."""
-
-
-Handler = Callable[[dict[str, object]], object]
-
-
-@dataclass(frozen=True)
-class Handlers:
-    initialize: Handler
-    tools_list: Handler
-    list_routes: Handler
-    check_proposal: Handler
-    propose: Handler
-
-
-def dispatch(request: Request, handlers: Handlers) -> object:
-    """Route one parsed request without depending on the HTTP server."""
-    if request.method == "initialize":
-        return handlers.initialize(request.params)
-    if request.method == "notifications/initialized":
-        return None
-    if request.method == "tools/list":
-        return handlers.tools_list(request.params)
-    if request.method != "tools/call":
-        raise MethodNotFoundError(request.method)
-
-    tool = request.params.get("name")
-    if tool == _sv.TOOL_LIST_EGRESS_ROUTES:
-        return handlers.list_routes(request.params)
-    if tool == _sv.TOOL_CHECK_PROPOSAL:
-        return handlers.check_proposal(request.params)
-    return handlers.propose(request.params)
-
-
-def resolved_routes_payload(
-    resolver: PolicyResolver,
-    source_ip: str,
-    identity_token: str,
-) -> dict[str, object]:
-    """Render an authoritatively resolved route table for the calling bottle."""
-    try:
-        policy, bottle_id, _tokens = resolver.resolve_policy_and_bottle_id(
-            source_ip, identity_token,
-        )
-    except PolicyResolveError as exc:
-        raise RouteResolutionError("orchestrator unavailable") from exc
-    if not bottle_id:
-        raise RouteResolutionError("request source is not attributed to a bottle")
-    try:
-        config = load_config(policy or "")
-    except ValueError as exc:
-        raise RouteResolutionError("resolved policy is invalid") from exc
-    body = json.dumps(
-        {"routes": [route_to_yaml_dict(route) for route in config.routes]},
-        indent=2,
-    )
-    return {"content": [{"type": "text", "text": body}], "isError": False}
-
-
-__all__ = [
-    "Handlers",
-    "MethodNotFoundError",
-    "RouteResolutionError",
-    "dispatch",
-    "resolved_routes_payload",
-]

bot_bottle/gateway/supervisor/server.py

@@ -51,27 +51,17 @@ from __future__ import annotations
 import http.server
 import json
 import os
+import socketserver
 import sys
 import time
 import typing
 from dataclasses import dataclass
 
 from bot_bottle.constants import IDENTITY_HEADER
-from bot_bottle.gateway.bounded_http import (
-    BodyReadError,
-    BoundedThreadingHTTPServer,
-    read_declared_body,
+from bot_bottle.gateway.egress.addon_core import (
+    LOG_OFF, load_config, resolve_client_context, route_to_yaml_dict,
 )
-from bot_bottle.gateway.egress.schema import load_config
-from bot_bottle.gateway.egress.types import LOG_OFF
 from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver
-from bot_bottle.gateway.supervisor.mcp_dispatch import (
-    Handlers as DispatchHandlers,
-    MethodNotFoundError,
-    RouteResolutionError,
-    dispatch,
-    resolved_routes_payload,
-)
 from bot_bottle.supervisor import types as _sv
 
 
@@ -575,8 +565,6 @@ def format_unknown_proposal_text(proposal_id: str) -> str:
 # Max request body the server accepts. 1 MB is well above any realistic
 # routes.yaml proposal.
 MAX_BODY_BYTES = 1 * 1024 * 1024
-REQUEST_BODY_TIMEOUT_SECONDS = 10.0
-MAX_REQUEST_WORKERS = 32
 
 
 class MCPHandler(http.server.BaseHTTPRequestHandler):
@@ -599,18 +587,19 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
         self._write_text(405, "use POST for MCP requests\n")
 
     def do_POST(self) -> None:
-        try:
-            body = read_declared_body(
-                self.rfile,
-                self.connection,
-                self.headers.get("Content-Length"),
-                maximum=MAX_BODY_BYTES,
-                timeout_seconds=REQUEST_BODY_TIMEOUT_SECONDS,
-                require_length=True,
-            )
-        except BodyReadError as exc:
-            self._write_text(exc.status, exc.message + "\n")
+        length_header = self.headers.get("Content-Length")
+        if length_header is None:
+            self._write_text(411, "Content-Length required\n")
             return
+        try:
+            length = int(length_header)
+        except ValueError:
+            self._write_text(400, "invalid Content-Length\n")
+            return
+        if length < 0 or length > MAX_BODY_BYTES:
+            self._write_text(413, "request body too large\n")
+            return
+        body = self.rfile.read(length)
 
         try:
             req = parse_jsonrpc(body)
@@ -622,11 +611,6 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
 
         try:
             result = self._dispatch(req, config)
-        except MethodNotFoundError as e:
-            self._write_jsonrpc(
-                jsonrpc_error(req.id, ERR_METHOD_NOT_FOUND, f"method not found: {e}"),
-            )
-            return
         except _RpcClientError as e:
             self._write_jsonrpc(jsonrpc_error(req.id, e.code, e.message))
             return
@@ -649,42 +633,41 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
         self._write_jsonrpc(jsonrpc_result(req.id, result))
 
     def _dispatch(self, req: JsonRpcRequest, config: ServerConfig) -> object:
-        def check(params: dict[str, object]) -> object:
-            return handle_check_proposal(
-                params,
-                resolver=self._resolver_or_fail(),
-                source_ip=self.client_address[0],
-                identity_token=self._identity_token(),
-            )
-
-        def propose(params: dict[str, object]) -> object:
-            return handle_tools_call(
-                params,
-                config,
-                resolver=self._resolver_or_fail(),
-                source_ip=self.client_address[0],
-                identity_token=self._identity_token(),
-            )
-
-        def list_routes(_params: dict[str, object]) -> object:
-            try:
-                return resolved_routes_payload(
-                    self._resolver_or_fail(),
-                    self.client_address[0],
-                    self._identity_token(),
+        method = req.method
+        if method == "initialize":
+            return handle_initialize(req.params)
+        if method == "notifications/initialized":
+            return None  # ack-only
+        if method == "tools/list":
+            return handle_tools_list(req.params)
+        if method == "tools/call":
+            # `list-egress-routes` is read-only introspection. The shared gateway
+            # has no static route table (routes are resolved per request by
+            # source IP), so answer it from the calling bottle's resolved policy.
+            # Otherwise the agent sees an empty allowlist and composes an egress
+            # proposal that *replaces* the live routes instead of extending them
+            # — silently dropping base routes like api.anthropic.com on approval.
+            if req.params.get("name") == _sv.TOOL_LIST_EGRESS_ROUTES:
+                return self._resolved_routes_payload()
+            resolver = self._resolver_or_fail()
+            source_ip = self.client_address[0]
+            token = self._identity_token()
+            # `check-proposal` is a non-blocking read of the calling bottle's
+            # own queue — attributed by (source_ip, identity_token) like a
+            # proposal, but it never queues or blocks.
+            if req.params.get("name") == _sv.TOOL_CHECK_PROPOSAL:
+                return handle_check_proposal(
+                    req.params, resolver=resolver,
+                    source_ip=source_ip, identity_token=token,
                 )
-            except RouteResolutionError as exc:
-                raise _RpcInternalError(
-                    f"could not resolve live egress routes: {exc}"
-                ) from exc
-
-        return dispatch(req, DispatchHandlers(
-            initialize=handle_initialize,
-            tools_list=handle_tools_list,
-            list_routes=list_routes,
-            check_proposal=check,
-            propose=propose,
-        ))
+            # The control plane attributes the proposal to the source-IP + token
+            # resolved bottle, so the one shared queue holds each bottle's
+            # proposal under its own id — no slug is asserted by this daemon.
+            return handle_tools_call(
+                req.params, config, resolver=resolver,
+                source_ip=source_ip, identity_token=token,
+            )
+        raise _RpcClientError(ERR_METHOD_NOT_FOUND, f"method not found: {method}")
 
     def _identity_token(self) -> str:
         """The agent's per-bottle identity token from the request header (the
@@ -703,6 +686,20 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
             raise _RpcInternalError("supervise server has no policy resolver")
         return resolver
 
+    def _resolved_routes_payload(self) -> dict[str, object]:
+        """The calling bottle's live egress routes as the `list-egress-routes`
+        JSON payload, resolved by (source_ip, identity token). Fail-closed: an
+        unattributed source or an unreachable orchestrator yields an empty route
+        list (never another bottle's), courtesy of `resolve_client_context`."""
+        resolver = self._resolver_or_fail()
+        conf, _slug, _tokens = resolve_client_context(
+            resolver, self.client_address[0], self._identity_token(),
+        )
+        body = json.dumps(
+            {"routes": [route_to_yaml_dict(r) for r in conf.routes]}, indent=2,
+        )
+        return {"content": [{"type": "text", "text": body}], "isError": False}
+
     def _write_jsonrpc(self, body: bytes) -> None:
         self.send_response(200)
         self.send_header("Content-Type", "application/json")
@@ -722,7 +719,7 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
             self.wfile.write(encoded)
 
 
-class MCPServer(BoundedThreadingHTTPServer):
+class MCPServer(socketserver.ThreadingMixIn, http.server.HTTPServer):
     allow_reuse_address = True
     daemon_threads = True
     config: ServerConfig = ServerConfig()
@@ -731,9 +728,6 @@ class MCPServer(BoundedThreadingHTTPServer):
     # closed per request (see `_resolver_or_fail`).
     policy_resolver: "PolicyResolver | None" = None
 
-    def __init__(self, *args, **kwargs):  # type: ignore[no-untyped-def]
-        super().__init__(*args, max_workers=MAX_REQUEST_WORKERS, **kwargs)
-
 
 # --- Entry point -----------------------------------------------------------
 

bot_bottle/orchestrator/__init__.py

@@ -44,7 +44,7 @@ if TYPE_CHECKING:
     from ..gateway import Gateway, GatewayError
     from .lifecycle import Orchestrator
     from .service import OrchestratorCore
-    from .server import OrchestratorServer, create_app, make_server
+    from .server import OrchestratorServer, dispatch, make_server
 
 
 # Facade name -> submodule that defines it. Lazy so importing a leaf (or the
@@ -67,8 +67,8 @@ _LAZY: dict[str, str] = {
     "GatewayError": "..gateway",
     "Orchestrator": ".lifecycle",
     "OrchestratorCore": ".service",
-    "create_app": ".server",
     "OrchestratorServer": ".server",
+    "dispatch": ".server",
     "make_server": ".server",
 }
 
@@ -100,7 +100,7 @@ __all__ = [
     "GatewayError",
     "Orchestrator",
     "OrchestratorCore",
-    "create_app",
     "OrchestratorServer",
+    "dispatch",
     "make_server",
 ]

bot_bottle/orchestrator/__main__.py

@@ -1,7 +1,6 @@
 """Run the orchestrator control plane as a plain process (PRD 0070 dev-harness).
 
-    BOT_BOTTLE_ORCHESTRATOR_TOKEN=<signing-key> \
-        python -m bot_bottle.orchestrator [--host H] [--port P] [--db PATH]
+    python -m bot_bottle.orchestrator [--host H] [--port P] [--db PATH]
 
 The PRD sequences the orchestrator as a plain-process dev-harness first, so
 the consolidation core (registry + attribution + HTTP control plane + live
@@ -17,13 +16,12 @@ import secrets
 from pathlib import Path
 
 from .. import log
-from ..trust_domain import CONTROL_PLANE
-from .broker import LaunchBroker, StubBroker
-from .docker_broker import DockerBroker
-from .server import make_server
-from .service import OrchestratorCore
 from .store.store_manager import StoreManager
+from .broker import LaunchBroker, StubBroker
+from .server import make_server
+from .docker_broker import DockerBroker
 from .store.registry_store import RegistryStore, default_db_path
+from .service import OrchestratorCore
 
 
 def main(argv: list[str] | None = None) -> int:
@@ -40,11 +38,6 @@ def main(argv: list[str] | None = None) -> int:
         help="launch broker: 'stub' records requests; 'docker' runs containers",
     )
     args = parser.parse_args(argv)
-    if not CONTROL_PLANE.key_from_env():
-        log.die(
-            f"{CONTROL_PLANE.key_env} is required; refusing to start the "
-            "orchestrator without caller authentication"
-        )
 
     registry = RegistryStore(args.db)
     registry.migrate()
@@ -62,14 +55,17 @@ def main(argv: list[str] | None = None) -> int:
     orchestrator = OrchestratorCore(registry, broker, secret)
 
     server = make_server(orchestrator, host=args.host, port=args.port)
+    bound_host, bound_port = server.server_address[0], server.server_address[1]
     log.info(
         "orchestrator control plane listening",
-        context={"host": args.host, "port": args.port, "db": str(registry.db_path)},
+        context={"host": bound_host, "port": bound_port, "db": str(registry.db_path)},
     )
     try:
-        server.run()
+        server.serve_forever()
     except KeyboardInterrupt:
         log.info("orchestrator shutting down")
+    finally:
+        server.server_close()
     return 0
 
 

bot_bottle/orchestrator/api.py

@@ -1,374 +0,0 @@
-"""FastAPI control-plane routes for the orchestrator."""
-# pyright: reportUnusedFunction=false
-
-from __future__ import annotations
-
-import asyncio
-import math
-import sys
-from fastapi import FastAPI, HTTPException
-from fastapi.exceptions import RequestValidationError
-from fastapi.responses import JSONResponse
-from pydantic import BaseModel, ConfigDict, StrictStr
-from starlette.types import ASGIApp, Message, Receive, Scope, Send
-
-from ..orchestrator_auth import ROLE_CLI, ROLES
-from ..supervisor.types import TOOLS
-from ..trust_domain import CONTROL_PLANE
-from .http_contract import (
-    MAX_BODY_BYTES,
-    ORCHESTRATOR_AUTH_HEADER,
-    REQUEST_BODY_TIMEOUT_SECONDS,
-)
-from .service import OrchestratorCore
-
-_GATEWAY_ROUTES = frozenset({
-    ("POST", "/resolve"),
-    ("POST", "/supervise/propose"),
-    ("POST", "/supervise/poll"),
-})
-
-
-class _StrictModel(BaseModel):
-    model_config = ConfigDict(extra="ignore", strict=True)
-
-
-class LaunchBody(_StrictModel):
-    source_ip: StrictStr
-    image_ref: StrictStr = ""
-    metadata: StrictStr = ""
-    policy: StrictStr = ""
-    tokens: dict[StrictStr, StrictStr] = {}
-    env_var_secret: StrictStr = ""
-
-
-class PolicyBody(_StrictModel):
-    policy: StrictStr
-
-
-class ReprovisionBody(_StrictModel):
-    env_var_secret: StrictStr
-
-
-class SecretBody(_StrictModel):
-    name: StrictStr
-    value: StrictStr
-    env_var_secret: StrictStr
-
-
-class ReconcileBody(_StrictModel):
-    live_source_ips: list[StrictStr]
-    grace_seconds: float | None = None
-
-
-class IdentityBody(_StrictModel):
-    source_ip: StrictStr
-    identity_token: StrictStr = ""
-
-
-class AttributeBody(_StrictModel):
-    source_ip: StrictStr
-    identity_token: StrictStr
-
-
-class RespondBody(_StrictModel):
-    proposal_id: StrictStr
-    bottle_slug: StrictStr
-    decision: StrictStr
-    notes: StrictStr = ""
-    final_file: StrictStr | None = None
-
-
-class ProposeBody(IdentityBody):
-    tool: StrictStr
-    proposed_file: StrictStr
-    justification: StrictStr
-
-
-class PollBody(IdentityBody):
-    proposal_id: StrictStr
-
-
-class ControlPlaneBoundary:
-    """Reject unauthenticated and oversized requests before reading a body."""
-
-    def __init__(self, app: ASGIApp, signing_key: str) -> None:
-        self.app = app
-        self.signing_key = signing_key
-
-    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
-        if scope["type"] != "http":
-            await self.app(scope, receive, send)
-            return
-        method = scope["method"]
-        route = scope["path"].rstrip("/") or "/"
-        if not (method == "GET" and route == "/health"):
-            headers = dict(scope["headers"])
-            presented = headers.get(
-                ORCHESTRATOR_AUTH_HEADER.encode(), b"",
-            ).decode(errors="ignore")
-            role = CONTROL_PLANE.verify(presented, self.signing_key)
-            if role is None:
-                await self._reject(
-                    scope, send, 401, "control-plane authentication required",
-                )
-                return
-            allowed = ROLES if (method, route) in _GATEWAY_ROUTES else {ROLE_CLI}
-            if role not in allowed:
-                await self._reject(scope, send, 403, "insufficient role for this route")
-                return
-            scope.setdefault("state", {})["role"] = role
-        raw_length = dict(scope["headers"]).get(b"content-length")
-        if raw_length is not None:
-            try:
-                length = int(raw_length)
-            except ValueError:
-                await self._reject(scope, send, 400, "invalid Content-Length")
-                return
-            if length < 0:
-                await self._reject(scope, send, 400, "invalid Content-Length")
-                return
-            if length > MAX_BODY_BYTES:
-                await self._reject(scope, send, 413, "request body too large")
-                return
-        try:
-            body = await self._read_body(receive)
-        except _BodyTooLarge:
-            await self._reject(scope, send, 413, "request body too large")
-            return
-        except TimeoutError:
-            await self._reject(scope, send, 408, "request body read timed out")
-            return
-        try:
-            await self.app(scope, self._replay_body(body), send)
-        except Exception as exc:  # noqa: BLE001 - redact control-plane failures
-            sys.stderr.write(
-                f"orchestrator: {method} {route} failed "
-                f"[error_type={type(exc).__name__}]\n"
-            )
-            sys.stderr.flush()
-            await self._reject(scope, send, 500, "internal error")
-
-    @staticmethod
-    async def _reject(
-        scope: Scope, send: Send, status: int, error: str,
-    ) -> None:
-        response = JSONResponse({"error": error}, status_code=status)
-        await response(scope, ControlPlaneBoundary._empty_receive, send)
-
-    @staticmethod
-    async def _empty_receive() -> Message:
-        return {"type": "http.disconnect"}
-
-    @staticmethod
-    async def _read_body(receive: Receive) -> bytes:
-        body = bytearray()
-        async with asyncio.timeout(REQUEST_BODY_TIMEOUT_SECONDS):
-            while True:
-                message = await receive()
-                if message["type"] != "http.request":
-                    break
-                body.extend(message.get("body", b""))
-                if len(body) > MAX_BODY_BYTES:
-                    raise _BodyTooLarge
-                if not message.get("more_body", False):
-                    break
-        return bytes(body)
-
-    @staticmethod
-    def _replay_body(body: bytes) -> Receive:
-        sent = False
-
-        async def replay() -> Message:
-            nonlocal sent
-            if sent:
-                return {"type": "http.disconnect"}
-            sent = True
-            return {"type": "http.request", "body": body, "more_body": False}
-
-        return replay
-
-
-class _BodyTooLarge(Exception):
-    """The streamed request exceeded the control-plane body limit."""
-
-
-def _required(value: str, name: str) -> str:
-    if not value:
-        raise HTTPException(400, f"{name} (string) is required")
-    return value
-
-
-def create_app(orch: OrchestratorCore, *, signing_key: str) -> FastAPI:
-    """Build the authenticated orchestrator ASGI application."""
-    key = signing_key.strip()
-    if not key:
-        raise ValueError(
-            "orchestrator control-plane signing key is required; "
-            "refusing to start without caller authentication"
-        )
-    app = FastAPI(
-        title="bot-bottle orchestrator",
-        docs_url=None,
-        redoc_url=None,
-        openapi_url=None,
-    )
-    app.add_middleware(ControlPlaneBoundary, signing_key=key)
-
-    @app.exception_handler(RequestValidationError)
-    async def invalid_request(
-        _request: object, exc: RequestValidationError,
-    ) -> JSONResponse:
-        errors = exc.errors()
-        location = errors[0].get("loc", ()) if errors else ()
-        field = str(location[1]) if len(location) > 1 else ""
-        suffix = f": {field}" if field else ""
-        return JSONResponse(
-            {"error": f"invalid request body{suffix}"},
-            status_code=400,
-        )
-
-    @app.get("/health")
-    def health() -> dict[str, str]:
-        return {"status": "ok"}
-
-    @app.get("/gateway")
-    def gateway() -> dict[str, object]:
-        return orch.gateway_status()
-
-    @app.get("/bottles")
-    def bottles() -> dict[str, object]:
-        return {"bottles": [record.redacted() for record in orch.registry.all()]}
-
-    @app.post("/bottles", status_code=201)
-    def launch(body: LaunchBody) -> dict[str, str]:
-        rec = orch.launch_bottle(
-            _required(body.source_ip, "source_ip"),
-            image_ref=body.image_ref,
-            metadata=body.metadata,
-            policy=body.policy,
-            tokens=dict(body.tokens),
-            env_var_secret=body.env_var_secret,
-        )
-        return {"bottle_id": rec.bottle_id, "identity_token": rec.identity_token}
-
-    @app.put("/bottles/{bottle_id}/policy")
-    def set_policy(bottle_id: str, body: PolicyBody) -> dict[str, object]:
-        if orch.set_policy(bottle_id, body.policy):
-            return {"updated": True}
-        raise HTTPException(404, "no such bottle")
-
-    @app.post("/bottles/{bottle_id}/reprovision_gateway")
-    def reprovision(bottle_id: str, body: ReprovisionBody) -> dict[str, object]:
-        secret = _required(body.env_var_secret, "env_var_secret")
-        if orch.reprovision_from_secret(bottle_id, secret):
-            return {"reprovisioned": True}
-        raise HTTPException(404, "no stored secrets for this bottle")
-
-    @app.post("/bottles/{bottle_id}/secret")
-    def update_secret(bottle_id: str, body: SecretBody) -> dict[str, object]:
-        # Update ONE egress token for a running bottle in place — the
-        # single-secret form of reprovision, for refreshing a short-lived host
-        # credential (e.g. the Codex access token) without a relaunch. cli-only
-        # (not in _GATEWAY_ROUTES): a bottle must never set its own tokens.
-        if orch.update_agent_secret(
-            bottle_id,
-            _required(body.name, "name"),
-            _required(body.value, "value"),
-            _required(body.env_var_secret, "env_var_secret"),
-        ):
-            return {"updated": True}
-        raise HTTPException(404, "no such bottle")
-
-    @app.delete("/bottles/{bottle_id}")
-    def teardown(bottle_id: str) -> dict[str, object]:
-        if orch.teardown_bottle(bottle_id):
-            return {"torn_down": True}
-        raise HTTPException(404, "no such bottle")
-
-    @app.post("/reconcile")
-    def reconcile(body: ReconcileBody) -> dict[str, object]:
-        if any(not ip for ip in body.live_source_ips):
-            raise HTTPException(400, "live_source_ips must contain non-empty strings")
-        kwargs: dict[str, float] = {}
-        if body.grace_seconds is not None:
-            if not math.isfinite(body.grace_seconds) or body.grace_seconds < 0:
-                raise HTTPException(
-                    400, "grace_seconds must be a non-negative finite number",
-                )
-            kwargs["grace_seconds"] = body.grace_seconds
-        return {"reaped": orch.reconcile(body.live_source_ips, **kwargs)}
-
-    @app.post("/attribute")
-    def attribute(body: AttributeBody) -> dict[str, str]:
-        rec = orch.attribute(body.source_ip, body.identity_token)
-        if rec is None:
-            raise HTTPException(403, "unattributed")
-        return {"bottle_id": rec.bottle_id}
-
-    @app.get("/supervise/proposals")
-    def proposals() -> dict[str, object]:
-        return {"proposals": orch.supervise_pending()}
-
-    @app.post("/supervise/respond")
-    def respond(body: RespondBody) -> dict[str, object]:
-        ok, error = orch.supervise_respond(
-            _required(body.proposal_id, "proposal_id"),
-            bottle_slug=_required(body.bottle_slug, "bottle_slug"),
-            decision=_required(body.decision, "decision"),
-            notes=body.notes,
-            final_file=body.final_file,
-        )
-        if not ok:
-            raise HTTPException(409, error)
-        return {"responded": True}
-
-    @app.post("/supervise/propose", status_code=201)
-    def propose(body: ProposeBody) -> dict[str, str]:
-        source_ip = _required(body.source_ip, "source_ip")
-        if body.tool not in TOOLS:
-            raise HTTPException(400, f"tool (string) must be one of {TOOLS}")
-        rec = orch.resolve(source_ip, body.identity_token)
-        if rec is None:
-            raise HTTPException(403, "unattributed")
-        proposal_id = orch.supervise_queue_proposal(
-            rec.bottle_id,
-            tool=body.tool,
-            proposed_file=_required(body.proposed_file, "proposed_file"),
-            justification=_required(body.justification, "justification"),
-        )
-        return {"proposal_id": proposal_id}
-
-    @app.post("/supervise/poll")
-    def poll(body: PollBody) -> dict[str, object]:
-        rec = orch.resolve(
-            _required(body.source_ip, "source_ip"), body.identity_token,
-        )
-        if rec is None:
-            raise HTTPException(403, "unattributed")
-        return orch.supervise_poll_response(
-            rec.bottle_id, _required(body.proposal_id, "proposal_id"),
-        )
-
-    @app.post("/resolve")
-    def resolve(body: IdentityBody) -> dict[str, object]:
-        rec = orch.resolve(
-            _required(body.source_ip, "source_ip"), body.identity_token,
-        )
-        if rec is None:
-            raise HTTPException(403, "unattributed")
-        return {
-            "bottle_id": rec.bottle_id,
-            "policy": rec.policy,
-            "tokens": orch.tokens_for(rec.bottle_id),
-        }
-
-    return app
-
-
-__all__ = [
-    "ControlPlaneBoundary",
-    "MAX_BODY_BYTES",
-    "ORCHESTRATOR_AUTH_HEADER",
-    "create_app",
-]