fix(orchestrator): address review on host control server transport (#468)

Codex review on #496:

- **High — ambiguous delivery no longer orphans a launched bottle.** A
  timeout / dropped response from the host controller is now the ambiguous
  BrokerUnavailableError (distinct from the definite BrokerAuthError /
  BrokerClientError). OrchestratorCore.launch_bottle keeps the registry
  row on the ambiguous case instead of deregistering — deregistering would
  orphan a running container with no record (reconcile reaps rows, never
  containers). The row is left for reconcile to reap iff the bottle is not
  actually live. Definite failures still roll back, so a real failure
  leaves no orphan row.
- **Medium — the privileged endpoint bounds request bodies.** The host
  server rejects an oversized Content-Length with 413 before reading it,
  and sets a per-request socket timeout, so a caller that can merely reach
  the socket (no signed token) can't exhaust memory or a handler thread.

Tests: ambiguous-keep vs definite-rollback in the launch path; the
BrokerUnavailableError/BrokerClientError split in BrokerClient; the 413
body cap + handler error paths (driven in-thread, since daemon request
threads lose coverage); and the __main__ entrypoint broker selection.
Diff-coverage 98%; pyright clean; pylint 9.88.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/canaries.yml

@@ -2,7 +2,7 @@
 # digest, etc.) without coupling every dev push to upstream registry
 # availability.
 #
-# Opt-in via BOT_BOTTLE_RUN_CANARIES=1 so the same files can be run
+# Opt-in via CLAUDE_BOTTLE_RUN_CANARIES=1 so the same files can be run
 # locally with the same gating.
 
 name: canaries
@@ -17,7 +17,7 @@ jobs:
   canaries:
     runs-on: ubuntu-latest
     env:
-      BOT_BOTTLE_RUN_CANARIES: "1"
+      CLAUDE_BOTTLE_RUN_CANARIES: "1"
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -25,7 +25,4 @@ jobs:
       # No actions/setup-python: canaries are stdlib unittest on the image's
       # system Python 3.12 (older act_runner mishandles setup-python's PATH).
       - name: Run canaries
-        run: |
-          python3 -m scripts.unittest_gate \
-            -t . -s tests/canaries -v \
-            --minimum-executed 1 --fail-on-skip
+        run: python3 -m unittest discover -t . -s tests/canaries -v

.gitea/workflows/lint.yml

@@ -4,13 +4,6 @@ on:
   push:
     paths:
       - "**.py"
-      - "Dockerfile*"
-      - "bot_bottle/contrib/*/Dockerfile"
-      - "bot_bottle/contrib/*/package.json"
-      - "bot_bottle/contrib/*/package-lock.json"
-      - "bot_bottle/contrib/codex/codex-package_SHA256SUMS"
-      - "requirements.gateway.*"
-      - "image-build-args.json"
       - ".pylintrc"
       - ".gitea/workflows/lint.yml"
 
@@ -20,9 +13,6 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - name: Enforce immutable image inputs
-        run: python3 scripts/check_image_inputs.py
-
       # No actions/setup-python: the runner image already ships Python 3.12,
       # and older act_runner engines mishandle setup-python's PATH. Install
       # into the ephemeral job container's system Python — the pylint/pyright

.gitea/workflows/prd-number-check.yml

@@ -3,7 +3,6 @@ name: prd-number-check
 on:
   pull_request:
     types: [opened, reopened, synchronize]
-    branches: [main]
 
 jobs:
   require-numbered-prds:

.gitea/workflows/pre-release-test.yml

@@ -60,9 +60,6 @@ jobs:
 
   integration-docker:
     runs-on: ubuntu-latest
-    concurrency:
-      group: integration-docker-infra
-      cancel-in-progress: false
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -87,30 +84,7 @@ jobs:
         env:
           BOT_BOTTLE_BACKEND: docker
           COVERAGE_FILE: ${{ github.workspace }}/.coverage.docker
-        run: |
-          set -euo pipefail
-          DOCKER_CLIENT_NETWORK=$(
-            docker inspect "$(hostname)" |
-              python3 -c 'import json,sys; n=json.load(sys.stdin)[0]["NetworkSettings"]["Networks"]; print(next(iter(n)))'
-          )
-          test -n "$DOCKER_CLIENT_NETWORK"
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          export NO_PROXY="*"
-          export no_proxy="*"
-          export BOT_BOTTLE_DOCKER_CLIENT_NETWORK="$DOCKER_CLIENT_NETWORK"
-          export BOT_BOTTLE_DOCKER_ROOT_MOUNT="bot-bottle-ci-root-$RUN_KEY"
-          export BOT_BOTTLE_DOCKER_CA_MOUNT="bot-bottle-ci-ca-$RUN_KEY"
-          python3 -m coverage run -m scripts.unittest_gate \
-            -t . -s tests/integration -v \
-            --minimum-executed 22 --fail-on-skip
-
-      - name: Clean Docker integration volumes
-        if: always()
-        run: |
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          docker volume rm --force \
-            "bot-bottle-ci-root-$RUN_KEY" \
-            "bot-bottle-ci-ca-$RUN_KEY" 2>/dev/null || true
+        run: python3 -m coverage run -m unittest discover -t . -s tests/integration -v
 
       # Non-dot name so upload-artifact's dotfile-skipping glob picks it up.
       - name: Stage docker coverage for upload

.gitea/workflows/refresh-image-locks.yml

@@ -1,97 +0,0 @@
-# Manually refresh the committed package locks and the pinned Codex installer
-# checksum after deliberately changing a direct version in the source files.
-#
-# The job uploads the generated files for review; it never commits or pushes.
-
-name: refresh-image-locks
-
-on:
-  workflow_dispatch:
-  push:
-    paths:
-      - 'requirements.gateway.in'
-      - 'bot_bottle/contrib/claude/package.json'
-      - 'bot_bottle/contrib/pi/package.json'
-      - 'bot_bottle/contrib/codex/Dockerfile'
-      - 'image-build-args.json'
-      - '.gitea/workflows/refresh-image-locks.yml'
-
-permissions:
-  code: read
-
-jobs:
-  refresh:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Resolve image runtime versions
-        id: runtimes
-        run: |
-          python3 - <<'PY' >> "$GITHUB_OUTPUT"
-          import json
-          import re
-          inputs = json.load(open("image-build-args.json"))
-          for output, name in (
-              ("python-version", "PYTHON_BASE_IMAGE"),
-              ("node-version", "NODE_BASE_IMAGE"),
-          ):
-              match = re.search(r":(\d+\.\d+\.\d+)-", inputs[name])
-              if match is None:
-                  raise SystemExit(f"cannot resolve runtime version from {name}")
-              print(f"{output}={match.group(1)}")
-          PY
-
-      - name: Use the image Python version
-        uses: actions/setup-python@v5
-        with:
-          python-version: '${{ steps.runtimes.outputs.python-version }}'
-
-      - name: Use the image Node version
-        uses: actions/setup-node@v4
-        with:
-          node-version: '${{ steps.runtimes.outputs.node-version }}'
-
-      - name: Compile gateway Python lock
-        run: |
-          python3 -m venv /tmp/image-lock-tools
-          /tmp/image-lock-tools/bin/python -m pip install \
-            pip==25.2 \
-            pip-tools==7.5.1
-          /tmp/image-lock-tools/bin/python -m piptools compile \
-            --generate-hashes \
-            --output-file requirements.gateway.lock \
-            requirements.gateway.in
-
-      - name: Resolve provider npm locks
-        run: |
-          for provider in claude pi; do
-            (
-              cd "bot_bottle/contrib/$provider"
-              npm install --package-lock-only --ignore-scripts --no-audit --no-fund
-            )
-          done
-          python3 scripts/complete_npm_lock_integrity.py \
-            bot_bottle/contrib/claude/package-lock.json \
-            bot_bottle/contrib/pi/package-lock.json
-
-      - name: Refresh pinned Codex archive checksums
-        run: |
-          CODEX_VERSION=$(
-            sed -n 's/^ARG CODEX_VERSION=//p' bot_bottle/contrib/codex/Dockerfile
-          )
-          test -n "$CODEX_VERSION"
-          curl -fsSL \
-            "https://github.com/openai/codex/releases/download/rust-v${CODEX_VERSION}/codex-package_SHA256SUMS" \
-            -o bot_bottle/contrib/codex/codex-package_SHA256SUMS
-
-      - name: Upload refreshed inputs
-        uses: actions/upload-artifact@v3
-        with:
-          name: image-input-locks
-          path: |
-            requirements.gateway.lock
-            bot_bottle/contrib/claude/package-lock.json
-            bot_bottle/contrib/pi/package-lock.json
-            bot_bottle/contrib/codex/codex-package_SHA256SUMS

.gitea/workflows/test.yml

@@ -12,49 +12,33 @@ on:
       - 'bot_bottle/**'
       - 'tests/**/*.py'
       - 'cli.py'
-      - 'install.sh'
-      - 'setup.py'
-      - 'MANIFEST.in'
-      - 'flake.nix'
-      - 'nix/firecracker-netpool.nix'
       - 'scripts/coverage.sh'
       - 'scripts/critical-modules.txt'
-      - 'scripts/**/*.py'
+      - 'scripts/diff_coverage.py'
+      - 'scripts/tracker_policy.py'
       - 'scripts/firecracker-netpool.sh'
       - 'Dockerfile*'
-      - 'image-build-args.json'
       - 'pyproject.toml'
       - 'requirements-dev.txt'
-      - 'requirements.gateway.*'
       - '.coveragerc'
       - '.dockerignore'
       - '.gitea/workflows/test.yml'
-      - '.gitea/workflows/refresh-image-locks.yml'
-      - '.gitea/workflows/pre-release-test.yml'
   pull_request:
     paths:
       - 'bot_bottle/**'
       - 'tests/**/*.py'
       - 'cli.py'
-      - 'install.sh'
-      - 'setup.py'
-      - 'MANIFEST.in'
-      - 'flake.nix'
-      - 'nix/firecracker-netpool.nix'
       - 'scripts/coverage.sh'
       - 'scripts/critical-modules.txt'
-      - 'scripts/**/*.py'
+      - 'scripts/diff_coverage.py'
+      - 'scripts/tracker_policy.py'
       - 'scripts/firecracker-netpool.sh'
       - 'Dockerfile*'
-      - 'image-build-args.json'
       - 'pyproject.toml'
       - 'requirements-dev.txt'
-      - 'requirements.gateway.*'
       - '.coveragerc'
       - '.dockerignore'
       - '.gitea/workflows/test.yml'
-      - '.gitea/workflows/refresh-image-locks.yml'
-      - '.gitea/workflows/pre-release-test.yml'
 
 jobs:
   unit:
@@ -87,9 +71,6 @@ jobs:
 
   integration-docker:
     runs-on: ubuntu-latest
-    concurrency:
-      group: integration-docker-infra
-      cancel-in-progress: false
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -102,51 +83,11 @@ jobs:
           python3 --version
           python3 cli.py backend status --backend=docker
 
-      - name: Preflight — clear any leftover poisoned gateway network
-        run: |
-          # The gateway network has a fixed name and persists across jobs on
-          # this shared runner. A pre-fix or concurrent launch can leave it with
-          # a malformed IPv6 subnet that trips docker's own ParseAddr in
-          # `network inspect` (see PR #515); the code now self-heals it, but the
-          # heal can't run if `network inspect` is what's broken on some daemon
-          # versions. Drop the network here so this run recreates it IPv4-only.
-          # Remove the attached gateway container first (else `network rm` fails
-          # on active endpoints); both are recreated by ensure_running. Harmless
-          # when absent.
-          docker rm --force bot-bottle-orch-gateway 2>/dev/null || true
-          docker network rm bot-bottle-gateway 2>/dev/null || true
-
       - name: Run integration tests (docker) with coverage
         env:
           BOT_BOTTLE_BACKEND: docker
           COVERAGE_FILE: ${{ github.workspace }}/.coverage.docker
-        run: |
-          set -euo pipefail
-          # act_runner executes this job in a container while sharing the host
-          # Docker socket. Attach control-plane siblings to the job's network,
-          # and use named volumes for state the host daemon must mount.
-          DOCKER_CLIENT_NETWORK=$(
-            docker inspect "$(hostname)" |
-              python3 -c 'import json,sys; n=json.load(sys.stdin)[0]["NetworkSettings"]["Networks"]; print(next(iter(n)))'
-          )
-          test -n "$DOCKER_CLIENT_NETWORK"
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          export NO_PROXY="*"
-          export no_proxy="*"
-          export BOT_BOTTLE_DOCKER_CLIENT_NETWORK="$DOCKER_CLIENT_NETWORK"
-          export BOT_BOTTLE_DOCKER_ROOT_MOUNT="bot-bottle-ci-root-$RUN_KEY"
-          export BOT_BOTTLE_DOCKER_CA_MOUNT="bot-bottle-ci-ca-$RUN_KEY"
-          python3 -m coverage run -m scripts.unittest_gate \
-            -t . -s tests/integration -v \
-            --minimum-executed 22 --fail-on-skip
-
-      - name: Clean Docker integration volumes
-        if: always()
-        run: |
-          RUN_KEY="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-0}}"
-          docker volume rm --force \
-            "bot-bottle-ci-root-$RUN_KEY" \
-            "bot-bottle-ci-ca-$RUN_KEY" 2>/dev/null || true
+        run: python3 -m coverage run -m unittest discover -t . -s tests/integration -v
 
       - name: Stage docker coverage for upload
         run: cp .coverage.docker coverage-docker.dat
@@ -157,114 +98,6 @@ jobs:
           name: coverage-docker
           path: coverage-docker.dat
 
-  image-input-builds:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Verify shared bases cover supported architectures
-        run: |
-          set -euo pipefail
-          python_ref=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["PYTHON_BASE_IMAGE"])')
-          node_ref=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["NODE_BASE_IMAGE"])')
-          docker_cli_ref=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["DOCKER_CLI_BASE_IMAGE"])')
-          test -n "$python_ref"
-          test -n "$node_ref"
-          test -n "$docker_cli_ref"
-          for ref in "$python_ref" "$node_ref" "$docker_cli_ref"; do
-            docker buildx imagetools inspect --raw "$ref" |
-              python3 -c '
-          import json
-          import sys
-          manifest = json.load(sys.stdin)
-          platforms = {
-              (item["platform"]["os"], item["platform"]["architecture"])
-              for item in manifest["manifests"]
-              if item.get("platform", {}).get("os") != "unknown"
-          }
-          required = {("linux", "amd64"), ("linux", "arm64")}
-          missing = required - platforms
-          if missing:
-              raise SystemExit(f"base manifest lacks supported platforms: {missing}")
-          '
-          done
-
-      - name: Verify Codex archives for all supported architectures
-        run: |
-          set -euo pipefail
-          codex_version=$(
-            sed -n 's/^ARG CODEX_VERSION=//p' bot_bottle/contrib/codex/Dockerfile
-          )
-          test -n "$codex_version"
-          tmp=$(mktemp -d)
-          trap 'rm -rf "$tmp"' EXIT
-          for target in \
-            aarch64-unknown-linux-musl \
-            x86_64-unknown-linux-musl
-          do
-            asset="codex-package-${target}.tar.gz"
-            expected=$(
-              awk -v asset="$asset" '$2 == asset { print $1 }' \
-                bot_bottle/contrib/codex/codex-package_SHA256SUMS
-            )
-            test -n "$expected"
-            curl -fsSL \
-              "https://github.com/openai/codex/releases/download/rust-v${codex_version}/${asset}" \
-              -o "$tmp/$asset"
-            echo "$expected  $tmp/$asset" | sha256sum -c -
-            tar -tzf "$tmp/$asset" > "$tmp/$asset.contents"
-            grep -Fx 'bin/codex' "$tmp/$asset.contents"
-            grep -Fx 'bin/codex-code-mode-host' "$tmp/$asset.contents"
-            grep -Fx 'codex-package.json' "$tmp/$asset.contents"
-          done
-
-      - name: Build and smoke-test all supported images
-        run: |
-          set -euo pipefail
-          suffix="${GITHUB_RUN_ID:-${GITHUB_RUN_NUMBER:-image-inputs}}"
-          orchestrator="bot-bottle-orchestrator-inputs:${suffix}"
-          gateway="bot-bottle-gateway-inputs:${suffix}"
-          orchestrator_fc="bot-bottle-orchestrator-fc-inputs:${suffix}"
-          claude="bot-bottle-claude-inputs:${suffix}"
-          codex="bot-bottle-codex-inputs:${suffix}"
-          pi="bot-bottle-pi-inputs:${suffix}"
-          python_base=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["PYTHON_BASE_IMAGE"])')
-          node_base=$(python3 -c \
-            'import json; print(json.load(open("image-build-args.json"))["NODE_BASE_IMAGE"])')
-
-          docker build --build-arg "PYTHON_BASE_IMAGE=$python_base" \
-            -t "$orchestrator" -f Dockerfile.orchestrator .
-          orchestrator_id=$(docker image inspect --format '{{.Id}}' "$orchestrator")
-          case "$orchestrator_id" in sha256:*) ;; *) exit 1 ;; esac
-          orchestrator_base="bot-bottle-orchestrator-inputs:sha256-${orchestrator_id#sha256:}"
-          docker image tag "$orchestrator_id" "$orchestrator_base"
-          test "$(
-            docker image inspect --format '{{.Id}}' "$orchestrator_base"
-          )" = "$orchestrator_id"
-          docker build --build-arg "PYTHON_BASE_IMAGE=$python_base" \
-            -t "$gateway" -f Dockerfile.gateway .
-          docker build \
-            --build-arg "ORCHESTRATOR_BASE_IMAGE=$orchestrator_base" \
-            -t "$orchestrator_fc" -f Dockerfile.orchestrator.fc .
-          docker build --build-arg "NODE_BASE_IMAGE=$node_base" \
-            -t "$claude" -f bot_bottle/contrib/claude/Dockerfile .
-          docker build --build-arg "NODE_BASE_IMAGE=$node_base" \
-            -t "$codex" -f bot_bottle/contrib/codex/Dockerfile .
-          docker build --build-arg "NODE_BASE_IMAGE=$node_base" \
-            -t "$pi" -f bot_bottle/contrib/pi/Dockerfile .
-
-          docker run --rm --entrypoint python3 "$orchestrator" -c \
-            'import bot_bottle.orchestrator'
-          docker run --rm --entrypoint mitmdump "$gateway" --version
-          docker run --rm "$claude" claude --version
-          docker run --rm "$codex" codex --version
-          docker run --rm "$pi" pi --version
-
   coverage:
     needs: [unit, integration-docker]
     timeout-minutes: 15
@@ -298,7 +131,7 @@ jobs:
       - name: Combined coverage (unit + docker integration)
         run: PYTHON=python3 bash scripts/coverage.sh aggregate critical
 
-      - name: Diff-coverage gate (changed lines >= 80%)
+      - name: Diff-coverage gate (changed lines >= 90%)
         run: |
           git fetch --no-tags origin main:refs/remotes/origin/main
-          python3 scripts/diff_coverage.py --base origin/main --min 80
+          python3 scripts/diff_coverage.py --base origin/main --min 90

.gitea/workflows/update-badges.yml

@@ -33,28 +33,19 @@ jobs:
       - name: Run coverage and extract percentage
         id: coverage
         run: |
-          set -euo pipefail
-          # Never publish a badge from a failed or partial test run.
-          python3 -m coverage run -m unittest discover -t . -s tests/unit
-          REPORT=$(python3 -m coverage report)
-          printf '%s\n' "$REPORT"
-          PERCENT=$(printf '%s\n' "$REPORT" | awk '$1 == "TOTAL" {gsub("%", "", $NF); print $NF}')
-          test -n "$PERCENT"
+          python3 -m coverage run -m unittest discover -t . -s tests/unit > /dev/null 2>&1 || true
+          PERCENT=$(python3 -m coverage report 2>/dev/null | grep '^TOTAL' | grep -oP '\d+(?=%)' | tail -1)
           echo "percent=$PERCENT" >> $GITHUB_OUTPUT
           echo "Coverage: $PERCENT%"
 
       - name: Extract core (critical-module) coverage percentage
         id: core_coverage
         run: |
-          set -euo pipefail
           # Reuses the .coverage data from the previous step. The core list is
-          # validated single source of truth. Fail if a listed path disappeared
-          # or if the measured core falls below ADR 0004's 90% minimum.
-          INCLUDE=$(python3 scripts/critical_modules.py)
-          REPORT=$(python3 -m coverage report --include="$INCLUDE" --fail-under=90)
-          printf '%s\n' "$REPORT"
-          PERCENT=$(printf '%s\n' "$REPORT" | awk '$1 == "TOTAL" {gsub("%", "", $NF); print $NF}')
-          test -n "$PERCENT"
+          # the single source of truth in scripts/critical-modules.txt; every
+          # core module is unit-tested, so the unit-only run is accurate for it.
+          INCLUDE=$(grep -vE '^[[:space:]]*(#|$)' scripts/critical-modules.txt | paste -sd, -)
+          PERCENT=$(python3 -m coverage report --include="$INCLUDE" 2>/dev/null | grep '^TOTAL' | grep -oP '\d+(?=%)' | tail -1)
           echo "percent=$PERCENT" >> $GITHUB_OUTPUT
           echo "Core coverage: $PERCENT%"
 

Dockerfile.gateway

@@ -36,23 +36,11 @@
 #   9420  git-gate smart HTTP (VM-backend agent-facing transport)
 #   9100  supervise (MCP HTTP)
 
-# Based on an exact `python:3.12.13-slim-trixie` multi-architecture manifest
-# rather than the
+# Based on `python:3.12-slim` (Debian trixie) rather than the
 # `mitmproxy/mitmproxy` image (Debian bookworm), matching the trixie base the
 # orchestrator image needs for buildah (Dockerfile.orchestrator.fc). mitmproxy
 # is pip-installed to the same effect as the upstream image.
-ARG PYTHON_BASE_IMAGE
-FROM ${PYTHON_BASE_IMAGE}
-
-# Freeze apt's package universe as well as the base filesystem. Without a
-# snapshot, the same Dockerfile resolves different package versions over time.
-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
+FROM python:3.12-slim
 
 # Runtime system deps:
 #   git supplies the `git daemon` subcommand (no separate package)
@@ -60,19 +48,16 @@ RUN sed -i \
 #   openssh-client supplies the upstream SSH transport the
 #     pre-receive hook uses to forward accepted refs.
 #   ca-certificates is needed for mitmdump upstream TLS.
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
  && apt-get install -y --no-install-recommends \
       git openssh-client ca-certificates \
  && rm -rf /var/lib/apt/lists/*
 
 # mitmdump (the egress data plane). The upstream mitmproxy image baked
-# this in; on the plain python base we install a fully resolved lock whose
-# distributions are all hash-verified. Its CA dir is set explicitly via
-# `--set confdir=` in
+# this in; on the plain python base we pip-install the same pinned
+# version. Its CA dir is set explicitly via `--set confdir=` in
 # egress-entrypoint.sh, so it doesn't depend on a `mitmproxy` home user.
-COPY requirements.gateway.lock /tmp/requirements.gateway.lock
-RUN pip install --no-cache-dir --require-hashes \
-      -r /tmp/requirements.gateway.lock
+RUN pip install --no-cache-dir mitmproxy==11.1.3
 
 # gitleaks (the pre-receive hook's secret scanner). Installed from its
 # official release, pinned by version + SHA256 and verified — rather than

Dockerfile.orchestrator

@@ -9,24 +9,19 @@
 #     Keeping the content in one place means future orchestrator deps (e.g.
 #     iroh) are added here once, not duplicated per backend.
 #
-# It stays deliberately lean: only the pinned FastAPI/Uvicorn control-plane
-# stack is installed here — none of the gateway's mitmproxy/git/gitleaks
-# (that's Dockerfile.gateway) and no buildah (that's firecracker-only).
+# It stays deliberately lean: the control plane is **stdlib-only** today, so
+# no third-party payload — none of the gateway's mitmproxy/git/gitleaks
+# (that's Dockerfile.gateway) and no buildah (that's the firecracker
+# builder, and lives only in Dockerfile.orchestrator.fc). Keeping the
+# secret-dense control plane on a minimal dependency surface is the point
+# (PRD 0070's "secret concentration").
 #
-# Shares an exact multi-architecture Python/trixie manifest with the gateway
-# image. The version-qualified tag keeps the human-readable upstream version;
-# the digest makes the bytes immutable.
+# Shares the trixie `python:3.12-slim` base with the gateway image.
 
-ARG PYTHON_BASE_IMAGE
-FROM ${PYTHON_BASE_IMAGE}
+FROM python:3.12-slim
 
 WORKDIR /app
 
-COPY requirements.orchestrator.lock /tmp/requirements.orchestrator.lock
-RUN pip install --no-cache-dir --require-hashes \
-        -r /tmp/requirements.orchestrator.lock \
-    && rm /tmp/requirements.orchestrator.lock
-
 # The orchestrator content. Baked so the image is self-contained (runs from
 # a built image, no runtime bind-mount); the docker backend may still
 # bind-mount /app for dev live-reload, which simply overlays this copy.

Dockerfile.orchestrator.fc

@@ -12,21 +12,10 @@
 # bare microVM (no fuse-overlayfs / overlay module / subuid maps). The trixie
 # base (from Dockerfile.orchestrator's python:3.12-slim) carries buildah 1.39,
 # which parses the Dockerfile heredocs agent images use (bookworm's 1.28 can't).
-# Matches image_builder. There is deliberately no default: the build coordinator
-# passes the exact local image ID returned by `docker image inspect`, so this
-# stage cannot silently resolve a stale `:latest` tag.
-ARG ORCHESTRATOR_BASE_IMAGE
-FROM ${ORCHESTRATOR_BASE_IMAGE}
+# Matches image_builder.
+FROM bot-bottle-orchestrator:latest
 
-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
-
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
  && apt-get install -y --no-install-recommends \
       buildah crun netavark aardvark-dns \
  && rm -rf /var/lib/apt/lists/*

MANIFEST.in

@@ -4,8 +4,5 @@
 include Dockerfile.gateway
 include Dockerfile.orchestrator
 include Dockerfile.orchestrator.fc
-include image-build-args.json
-include requirements.gateway.in
-include requirements.gateway.lock
 include nix/firecracker-netpool.nix
 include scripts/firecracker-netpool.sh

README.md

@@ -5,7 +5,7 @@
 # bot-bottle
 
 [![test](https://gitea.dideric.is/didericis/bot-bottle/actions/workflows/test.yml/badge.svg?branch=main)](https://gitea.dideric.is/didericis/bot-bottle/actions?workflow=test.yml)
-[![coverage](https://img.shields.io/badge/coverage-84%25-brightgreen)](https://coverage.readthedocs.io/)
+[![coverage](https://img.shields.io/badge/coverage-83%25-brightgreen)](https://coverage.readthedocs.io/)
 [![core coverage](https://img.shields.io/badge/core%20coverage-94%25-brightgreen)](https://gitea.dideric.is/didericis/bot-bottle/src/branch/main/docs/decisions/0004-coverage-policy.md)
 
 **Problem:** Developer wants to run a coding agent without supervision, but they don't want a prompt injected or misbehaving agent wrecking their environment or exfiltrating sensitive data.
@@ -15,7 +15,7 @@
 ## Features
 
 - **Per-bottle egress allowlist** — TLS-bumped HTTP/HTTPS chokepoint with a per-manifest host allowlist; per-route path/method/header `matches` filtering; outbound DLP scanning for known tokens and secrets, inbound DLP scanning for prompt-injection attempts; DoH and arbitrary hosts blocked by default.
-- **Per-route token-match policy** — each egress route picks what happens when the outbound DLP catches a token via `dlp.outbound_on_match`: `supervise` (default) holds the request and surfaces it in `bot-bottle supervise` for approval (an approved value is remembered for the life of the proxy); `redact` scrubs the value and forwards; `block` is a hard `403`. Cuts false-positive friction without weakening default-deny.
+- **Per-route token-match policy** — each egress route picks what happens when the outbound DLP catches a token via `dlp.outbound_on_match`: `supervise` (default) holds the request and surfaces it in `./cli.py supervise` for approval (an approved value is remembered for the life of the proxy); `redact` scrubs the value and forwards; `block` is a hard `403`. Cuts false-positive friction without weakening default-deny.
 - **Tokens the agent never sees** — host secrets live in a gateway; the agent dials `http://gateway:9099/<path>` and the proxy strips inbound `Authorization` and injects the real token before forwarding. `printenv` in the agent shows proxy URLs only.
 - **Gitleaks-scanned push (git-gate)** — `bottle.git` remotes route through a per-bottle `git daemon` that gitleaks-scans incoming refs pre-receive and forwards clean refs upstream over SSH. The agent never holds the upstream credential.
 - **Manifest-scoped skills + secrets** — each bottle declares its skills, env, git identity, remotes, and egress routes; unknown keys die at load.
@@ -39,7 +39,7 @@ On the legacy Docker backend, the same logical bottle is two containers per agen
 The Docker topology looks like this:
 
 ```
-                            host  ( bot-bottle )
+                            host  ( ./cli.py )
                                   │
                           starts  │  stops
                                   ▼
@@ -71,25 +71,11 @@ When the agent exits, `cli.py` tears down every gateway and both networks; nothi
 
 ## Quickstart
 
-```sh
-curl -fsSL https://gitea.dideric.is/didericis/bot-bottle/raw/branch/main/install.sh | sh
-```
+On compatible macOS hosts, the default backend requires Apple's `container` CLI and does not require Docker. The Firecracker backend (Linux) requires Docker on the host for the gateway plus the `firecracker` binary and KVM. The legacy Docker backend requires Docker. Claude bottles also need a long-lived Claude Code OAuth token (`claude setup-token`) exported as `BOT_BOTTLE_CLAUDE_OAUTH_TOKEN`.
 
-The installer is a bootstrapper: it finds a suitable Python, installs bot-bottle with `pipx` (falling back to `pip --user`), creates `~/.bot-bottle`, and runs `bot-bottle doctor`. It is idempotent and never uses `sudo`. Python-native users can skip it entirely with `pipx install bot-bottle` or `uv tool install bot-bottle`.
+Use `BOT_BOTTLE_BACKEND=docker ./cli.py start <agent>` on hosts where neither Apple Container nor KVM is available and Docker is the desired backend.
 
-### Requirements
-
-**Python ≥ 3.11**, and this is the one that trips people up on macOS: the `python3` Apple ships at `/usr/bin/python3` is **3.9.6**, which is too old. Bare `python3` resolves to that stub far more often than people expect. `path_helper` builds a login shell's `PATH` from `/etc/paths` and then appends `/etc/paths.d/*`, and `/usr/bin` sits in the former — so even when `/opt/homebrew/bin` *is* on the `PATH` (via `/etc/paths.d/homebrew`), it comes after `/usr/bin` and loses. Prepending a newer Python is something your shell profile does, and a fresh account, a launchd job, or a CI runner has no such profile. So the installer looks past bare `python3` before giving up: it tries `python3`, then the versioned `python3.11`–`python3.14` names, then `/opt/homebrew/bin`, `/usr/local/bin`, `~/.local/bin`, and python.org framework builds — and tells you which one it picked when it isn't the obvious one. Point it somewhere specific with `BOT_BOTTLE_PYTHON=/path/to/python3`.
-
-**No `pipx` required.** If `pipx` is present the installer uses it and stays out of the way. If it isn't, bot-bottle installs into a private venv at `~/.bot-bottle/venv` (override with `BOT_BOTTLE_VENV`) and symlinks the entry point into `~/.local/bin`. There is deliberately no `pip install --user` path: Homebrew, python.org and Debian/Ubuntu interpreters are all externally managed (PEP 668), which blocks `--user` outright — so on a Mac it is never the fallback it appears to be. A venv is exempt from PEP 668, and `venv` is stdlib, so unlike `pipx` there is nothing to bootstrap first.
-
-**`git`**, because the default install spec is a `git+` URL. Set `BOT_BOTTLE_INSTALL_SPEC` to a wheel path or index name to avoid it.
-
-**A backend**, which the installer deliberately does *not* install for you — `doctor` reports what's missing afterwards. On compatible macOS hosts, the default backend requires Apple's `container` CLI and does not require Docker. The Firecracker backend (Linux) requires Docker on the host for the gateway plus the `firecracker` binary and KVM. The legacy Docker backend requires Docker. Claude bottles also need a long-lived Claude Code OAuth token (`claude setup-token`) exported as `BOT_BOTTLE_CLAUDE_OAUTH_TOKEN`.
-
-Use `BOT_BOTTLE_BACKEND=docker bot-bottle start <agent>` on hosts where neither Apple Container nor KVM is available and Docker is the desired backend.
-
-> **CI (macOS Apple Container):** the advisory `integration-macos` job in `.gitea/workflows/pre-release-test.yml` runs only on manual dispatch. It targets a self-hosted host-mode runner labelled `macos`; Apple Container cannot run inside the Linux pull-request runner. Provision an Apple Silicon host with the `container` CLI running and Python ≥ 3.11 plus `coverage` on the launchd service's explicit `PATH`. The infra container is a singleton (`bot-bottle-mac-infra`), so keep runner concurrency at 1. Its coverage is reported separately and never feeds the required pull-request gate.
+> **CI (macOS Apple Container):** the `integration-macos` job (`.gitea/workflows/test.yml`) runs the integration suite against `BOT_BOTTLE_BACKEND=macos-container` on a self-hosted macOS runner labelled `macos`, because Apple Container needs the host virtualization framework and cannot run in a Linux container (so it can't reuse the `kvm` runner). Provision an Apple Silicon host with the `container` CLI on `PATH` and `container system status` running, then register the runner in **host mode** (not docker mode) with the `macos` label — `brew install gitea-runner` (the `act_runner` rename). Give it a Python ≥ 3.11 with `coverage` importable on the launchd service's `PATH` (a launchd service doesn't inherit your shell profile, so pin `node` and the Python env explicitly). The job is **advisory** — `workflow_dispatch` (manual) only, never triggered by push or PR — since a single laptop that sleeps/roams must not block merges or churn on every push to main; its coverage doesn't feed the gate. The infra container is a singleton (`bot-bottle-mac-infra`), so keep runner concurrency at 1.
 
 ### Containers inside a bottle
 
@@ -180,18 +166,18 @@ On Linux, a KVM-capable host defaults to the Firecracker backend. It needs:
 - **`/dev/kvm`** present and accessible. Load `kvm-intel` or `kvm-amd` (and enable virtualization in BIOS/firmware). The invoking user must be in the `kvm` group: `sudo usermod -aG kvm "$USER"` then re-login. bot-bottle preflights this and reports exactly what's missing.
 - **`firecracker`** on `PATH`: grab a release from <https://github.com/firecracker-microvm/firecracker/releases>. Start flows print this pointer when the binary is missing.
 - **Docker** for the gateway and image build.
-- **A one-time privileged network setup** — the per-bottle TAP pool plus the fail-closed `nftables` isolation table. Run `bot-bottle backend setup --backend=firecracker` for the host-appropriate config (a NixOS module, a `sudo` script elsewhere); `bot-bottle backend status --backend=firecracker` reports what's present, including whether the pool range collides with an existing route. The pool defaults to `10.243.0.0/16` (an obscure RFC-1918 block that dodges docker/libvirt/LAN and, deliberately, Tailscale's `100.64.0.0/10` CGNAT range); override with `BOT_BOTTLE_FC_IP_BASE` if it clashes on your host.
+- **A one-time privileged network setup** — the per-bottle TAP pool plus the fail-closed `nftables` isolation table. Run `./cli.py backend setup --backend=firecracker` for the host-appropriate config (a NixOS module, a `sudo` script elsewhere); `./cli.py backend status --backend=firecracker` reports what's present, including whether the pool range collides with an existing route. The pool defaults to `10.243.0.0/16` (an obscure RFC-1918 block that dodges docker/libvirt/LAN and, deliberately, Tailscale's `100.64.0.0/10` CGNAT range); override with `BOT_BOTTLE_FC_IP_BASE` if it clashes on your host.
 
 ```sh
-BOT_BOTTLE_BACKEND=firecracker bot-bottle start <agent>
+BOT_BOTTLE_BACKEND=firecracker ./cli.py start <agent>
 ```
 
 > **NixOS:** enable `virtualisation.docker`, ensure the KVM module is loaded (`boot.kernelModules = [ "kvm-intel" ];` or `kvm-amd`), and add your user to the `kvm` and `docker` groups. For the network pool, consume the flake module — `imports = [ inputs.bot-bottle.nixosModules.firecracker-netpool ]; services.bot-bottle-firecracker = { enable = true; owner = "you"; };` — then `nixos-rebuild switch` (imperative nft/TAP rules don't survive a rebuild; channel users can `imports = [ <bot-bottle>/nix/firecracker-netpool.nix ]`). `firecracker` isn't in nixpkgs by default as a user binary — install the release binary (pin the version) and put it on `PATH`.
 
-> **CI:** Firecracker integration runs in the manually dispatched `.gitea/workflows/pre-release-test.yml` on a self-hosted runner labelled `kvm`; privileged KVM hosts never execute unreviewed PR code automatically. Provision it like a normal Firecracker host: `firecracker` on `PATH`, `/dev/kvm`, the cached guest kernel and static dropbear, and the persistent TAP/nft pool. The required pull-request workflow runs unit plus the complete Docker integration suite on `ubuntu-latest`; see `docs/ci.md`.
+> **CI:** the coverage gate (`.gitea/workflows/test.yml` → `coverage` job) runs on a self-hosted runner labelled `kvm`, because the Firecracker backend's VM/SSH orchestration is exercised only by the integration suite, which needs `/dev/kvm` + the provisioned pool (a container runner would skip it and read as uncovered). Provision that runner exactly like a normal Firecracker host — `firecracker` on `PATH`, `/dev/kvm`, the cached guest kernel + static dropbear, and the pool installed as the persistent systemd unit — then register it with the `kvm` label. A Docker-capable hosted job builds the candidate once; KVM tests boot those exact bytes, and a successful main run publishes them. The unit/lint jobs still run on `ubuntu-latest`.
 
 ```sh
-bot-bottle start <agent>   # builds the image on first run, drops you into claude
+./cli.py start <agent>   # builds the image on first run, drops you into claude
 ```
 
 ## Manifest
@@ -267,7 +253,7 @@ You help maintain Gitea-hosted projects.
 | `dlp.outbound_on_match` | no | What to do when an outbound token is detected: `supervise` (default for manifest routes — hold for operator approval), `redact` (scrub the value and forward), or `block` (hard 403). Agent-provider routes (e.g. `api.anthropic.com`) default to `redact`. |
 | `git.fetch` | no | `true` permits smart HTTP clone/fetch (`git-upload-pack`) for this host. Push (`git-receive-pack`) remains blocked. |
 
-When an outbound DLP detector matches a token, the route's `dlp.outbound_on_match` policy decides what happens. Under the default `supervise`, the proxy queues an `egress-token-allow` proposal for the operator's `bot-bottle supervise` TUI and holds the request open until it is answered (or `EGRESS_TOKEN_ALLOW_TIMEOUT_SECONDS`, default 300s, elapses — after which it fails closed). The operator never sees the raw token, only the host, method, path, and a redacted snippet; approving adds the value to an in-memory safelist for the life of the egress proxy. Under `redact`, the matched value is scrubbed from the body, headers, and path and the request is forwarded (failing closed if a match lands somewhere unredactable, like the hostname). Under `block` it stays a hard `403`. Structural blocks (CRLF injection) and not-in-allowlist host blocks are always hard `403`s regardless of policy.
+When an outbound DLP detector matches a token, the route's `dlp.outbound_on_match` policy decides what happens. Under the default `supervise`, the proxy queues an `egress-token-allow` proposal for the operator's `./cli.py supervise` TUI and holds the request open until it is answered (or `EGRESS_TOKEN_ALLOW_TIMEOUT_SECONDS`, default 300s, elapses — after which it fails closed). The operator never sees the raw token, only the host, method, path, and a redacted snippet; approving adds the value to an in-memory safelist for the life of the egress proxy. Under `redact`, the matched value is scrubbed from the body, headers, and path and the request is forwarded (failing closed if a match lands somewhere unredactable, like the hostname). Under `block` it stays a hard `403`. Structural blocks (CRLF injection) and not-in-allowlist host blocks are always hard `403`s regardless of policy.
 
 More examples in `examples/`. Full design lives under `docs/prds/`; the trust-boundary rationale is in `docs/prds/0011-per-file-md-manifest.md`.
 

bot_bottle/agent_provider.py

@@ -226,7 +226,7 @@ class AgentProvider(ABC):
         initial task in a non-interactive (headless) session.
 
         Called only when ``--prompt`` is passed to
-        ``bot-bottle start --headless``; the returned args are appended
+        ``./cli.py start --headless``; the returned args are appended
         after the provider's ``bypass_args`` and ``startup_args``."""
 
     def provision_ca(self, bottle: "Bottle", plan: "BottlePlan") -> None:

bot_bottle/backend/__init__.py

@@ -30,7 +30,6 @@ if TYPE_CHECKING:
         BottleImages,
         BottlePlan,
         BottleSpec,
-        EnumerationError,
         ExecResult,
     )
     from .selection import (
@@ -60,7 +59,6 @@ _LAZY_MODULES: dict[str, str] = {
     "BottleImages": "base",
     "BottleBackend": "base",
     "BackendStatus": "base",
-    "EnumerationError": "base",
     "get_bottle_backend": "selection",
     "known_backend_names": "selection",
     "has_backend": "selection",
@@ -102,7 +100,6 @@ __all__ = [
     "BottlePlan",
     "BottleSpec",
     "ExecResult",
-    "EnumerationError",
     "CommitCancelled",
     "Freezer",
     "get_freezer",

bot_bottle/backend/base.py

@@ -21,23 +21,20 @@ from abc import ABC, abstractmethod
 from contextlib import AbstractContextManager, contextmanager
 from dataclasses import dataclass
 from pathlib import Path
-from typing import TYPE_CHECKING, Generator, Generic, Sequence, TypeVar
+from typing import Generator, Generic, Sequence, TypeVar
 
-from ..agent_provider import AgentProvisionPlan, get_provider
+from ..agent_provider import AgentProvisionPlan, get_provider, build_agent_provision_plan
 from ..egress import EgressPlan
 from ..git_gate import GitGatePlan
 from ..log import die, info
 from ..util import expand_tilde
 from ..manifest import Manifest, ManifestIndex
 from ..supervisor.plan import SupervisePlan
-from ..env import ResolvedEnv
+from ..env import resolve_env, ResolvedEnv
 from ..workspace import WorkspacePlan, workspace_plan
 from .print_util import print_multi, visible_agent_env_names
 from .util import host_skill_dir
 
-if TYPE_CHECKING:
-    from .gateway_attach import GatewayAttachResources
-
 
 class BackendStatus(enum.IntEnum):
     """Return codes for BottleBackend.status(). READY == 0 so callsites
@@ -45,10 +42,6 @@ class BackendStatus(enum.IntEnum):
     READY = 0
 
 
-class EnumerationError(RuntimeError):
-    """A backend could not produce an authoritative live-resource snapshot."""
-
-
 @dataclass(frozen=True)
 class BottleSpec:
     """CLI-supplied intent. Backend-agnostic — each backend's prepare
@@ -175,10 +168,6 @@ class BottleCleanupPlan(ABC):
         """True iff there is nothing to clean up; the CLI uses this to
         short-circuit before showing the y/N."""
 
-    @abstractmethod
-    def intersect(self, current: "BottleCleanupPlan") -> "BottleCleanupPlan":
-        """Resources both displayed to the operator and currently removable."""
-
 
 @dataclass(frozen=True)
 class ExecResult:
@@ -273,17 +262,6 @@ class Bottle(ABC):
 
 PlanT = TypeVar("PlanT", bound=BottlePlan)
 CleanupT = TypeVar("CleanupT", bound=BottleCleanupPlan)
-# The backend-specific handle for one running bottle the reconcile attaches to
-# the gateway (a run dir for firecracker, a container name for docker/macOS).
-# Registry-style callers that don't care about the handle bind it to `Any`
-# (`BottleBackend[Any, Any, Any]`).
-AttachTargetT = TypeVar("AttachTargetT")
-
-
-class InfraLaunchError(RuntimeError):
-    """A per-host infra (gateway + orchestrator) launch/reconcile step could not
-    complete. Shared across backends so the base backend can raise + catch one
-    type; each backend's ``infra_launch`` module re-exports it."""
 
 
 @dataclass(frozen=True)
@@ -298,7 +276,7 @@ class BottleImages:
     sidecar: str | Path = ""
 
 
-class BottleBackend(ABC, Generic[PlanT, CleanupT, AttachTargetT]):
+class BottleBackend(ABC, Generic[PlanT, CleanupT]):
     """Abstract base for selectable bottle backends. Concrete subclasses
     (e.g. DockerBottleBackend) own their own prepare/launch impls.
     Parameterized over the backend's concrete plan + cleanup-plan types
@@ -318,18 +296,82 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT, AttachTargetT]):
         backend-specific resolution (names, scratch files, etc.). The
         validation step is enforced here so a future backend cannot
         accidentally skip it. No remote/runtime resources are created."""
-        from .preparation import BottlePreparationPlanner
-        prepared = BottlePreparationPlanner(self).prepare(spec)
+        from .resolve_common import (
+            merge_provision_env_vars,
+            mint_slug,
+            prepare_agent_state_dir,
+            prepare_egress,
+            prepare_git_gate,
+            prepare_supervise,
+            reject_nested_containers,
+            resolve_manifest_dockerfile,
+            write_launch_metadata,
+        )
+
+        manifest = self._validate(spec)
+
+        if not self.supports_nested_containers:
+            reject_nested_containers(self.name, manifest)
+
+        self._preflight()
+
+        from ..git_gate import GitGate
+        manifest = GitGate().preflight_host_keys(
+            manifest,
+            headless=spec.headless,
+            home_md=spec.manifest.home_md,
+        )
+
+        manifest_bottle = manifest.bottle
+        manifest_agent_provider = manifest_bottle.agent_provider
+        agent_provider = get_provider(manifest_agent_provider.template)
+        resolved_env = resolve_env(manifest)
+        workspace = workspace_plan(spec, guest_home=agent_provider.guest_home)
+
+        slug = mint_slug(spec)
+        write_launch_metadata(slug, spec, compose_project="", backend=self.name)
+
+        # Manifest may override the Dockerfile per-bottle; otherwise fall
+        # back to the provider plugin's bundled Dockerfile (next to its
+        # agent_provider.py module).
+        if manifest_agent_provider.dockerfile:
+            agent_dockerfile_path = resolve_manifest_dockerfile(
+                manifest_agent_provider.dockerfile, spec,
+            )
+        else:
+            agent_dockerfile_path = str(agent_provider.dockerfile)
+
+        agent_dir, prompt_file = prepare_agent_state_dir(slug, manifest)
+
+        agent_provision_plan = build_agent_provision_plan(
+            template=manifest_agent_provider.template,
+            dockerfile=agent_dockerfile_path,
+            state_dir=agent_dir,
+            instance_name=f"bot-bottle-{slug}",
+            prompt_file=prompt_file,
+            guest_env=self._build_guest_env(resolved_env),
+            forward_host_credentials=manifest_agent_provider.forward_host_credentials,
+            auth_token=manifest_agent_provider.auth_token,
+            host_env=dict(os.environ),
+            trusted_project_path=workspace.workdir,
+            label=spec.label,
+            color=spec.color,
+            provider_settings=manifest_agent_provider.settings,
+        )
+        agent_provision_plan = merge_provision_env_vars(agent_provision_plan)
+        egress_plan = prepare_egress(manifest_bottle, slug, agent_provision_plan)
+        supervise_plan = prepare_supervise(manifest_bottle, slug)
+        git_gate_plan = prepare_git_gate(manifest_bottle, slug)
 
         return self._resolve_plan(
             spec,
-            manifest=prepared.manifest,
-            slug=prepared.slug,
-            resolved_env=prepared.resolved_env,
-            agent_provision_plan=prepared.agent_provision_plan,
-            egress_plan=prepared.egress_plan,
-            supervise_plan=prepared.supervise_plan,
-            git_gate_plan=prepared.git_gate_plan,
+            manifest=manifest,
+            slug=slug,
+            resolved_env=resolved_env,
+            agent_provision_plan=agent_provision_plan,
+            egress_plan=egress_plan,
+            supervise_plan=supervise_plan,
+            git_gate_plan=git_gate_plan,
             stage_dir=stage_dir,
         )
 
@@ -526,31 +568,6 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT, AttachTargetT]):
         compose ls`; firecracker cross-references its running gateway
         containers against per-bottle metadata."""
 
-    def attach_bottled_agents_to_gateway(self) -> None:
-        """Reconcile every running bottle against the freshly-(re)booted gateway
-        on the cold-boot bring-up path (PRD 0081). The shared flow + fail-hard
-        policy live in `gateway_attach`; backends override only the three
-        primitives below (ADR 0006)."""
-        from .gateway_attach import reconcile_running_bottles
-        reconcile_running_bottles(self)
-
-    @abstractmethod
-    def _gateway_attach_resources(self) -> "GatewayAttachResources":
-        """Gather what every bottle needs to (re)attach to the current gateway
-        (the CA now). Raises if the gateway isn't reachable (aborts reconcile)."""
-
-    @abstractmethod
-    def _running_bottles(self) -> Sequence[AttachTargetT]:
-        """The live bottles as backend handles for `_attach_bottle_to_gateway`.
-        Raises if the live set can't be determined (fail hard, no partial set)."""
-
-    @abstractmethod
-    def _attach_bottle_to_gateway(
-        self, bottle: AttachTargetT, resources: "GatewayAttachResources",
-    ) -> None:
-        """(Re)attach one bottle to the current gateway (SSH / `exec`+`cp`).
-        Raises `InfraLaunchError` naming the bottle on failure."""
-
     @classmethod
     @abstractmethod
     def is_available(cls) -> bool:
@@ -570,7 +587,7 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT, AttachTargetT]):
         host-appropriate config or commands. Prints to stdout/stderr and
         returns a shell exit code (0 = nothing to report / success). A
         backend that needs no host setup prints a short note and returns
-        0. Invoked generically by `bot-bottle backend setup [--backend=…]`
+        0. Invoked generically by `./cli.py backend setup [--backend=…]`
         so operators can provision any backend without a
         backend-specific command. Classmethod (like `is_available`) —
         it's a host query, not per-bottle state."""
@@ -587,14 +604,14 @@ class BottleBackend(ABC, Generic[PlanT, CleanupT, AttachTargetT]):
         stderr. When quiet=True returns the status code silently —
         useful for cheap programmatic checks.
 
-        Invoked by `bot-bottle backend status [--backend=…]` (quiet=False)
+        Invoked by `./cli.py backend status [--backend=…]` (quiet=False)
         and by is_backend_ready() (caller-controlled)."""
 
     @classmethod
     @abstractmethod
     def teardown(cls) -> int:
         """Undo `setup()` — the inverse operation, surfaced as
-        `bot-bottle backend teardown [--backend=…]` (uninstall). Symmetric
+        `./cli.py backend teardown [--backend=…]` (uninstall). Symmetric
         with setup: where setup is advisory (prints the privileged
         commands / declarative config to apply), teardown prints the
         commands / config change to remove the host prerequisites. A

bot_bottle/backend/cleanup_control.py

@@ -1,60 +0,0 @@
-"""Shared destructive-cleanup execution and failure accounting."""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-from collections.abc import Sequence
-from pathlib import Path
-
-
-class CleanupError(RuntimeError):
-    """One or more approved cleanup mutations did not complete."""
-
-
-class CleanupFailures:
-    """Attempt every approved mutation, then fail with complete diagnostics."""
-
-    def __init__(self) -> None:
-        self._messages: list[str] = []
-
-    def run(self, argv: Sequence[str], description: str) -> None:
-        raw_timeout = os.environ.get(
-            "BOT_BOTTLE_CLEANUP_COMMAND_TIMEOUT_SECONDS", "120",
-        )
-        try:
-            timeout = float(raw_timeout)
-        except ValueError:
-            timeout = 120.0
-        try:
-            result = subprocess.run(
-                list(argv), capture_output=True, text=True, check=False,
-                timeout=max(timeout, 1.0),
-            )
-        except (OSError, subprocess.SubprocessError) as exc:
-            self._messages.append(f"{description}: {exc}")
-            return
-        if result.returncode != 0:
-            detail = (result.stderr or result.stdout).strip()
-            self._messages.append(
-                f"{description}: {detail or f'exit {result.returncode}'}"
-            )
-
-    def remove_tree(self, path: Path, description: str) -> None:
-        try:
-            shutil.rmtree(path)
-        except FileNotFoundError:
-            return
-        except OSError as exc:
-            self._messages.append(f"{description}: {exc}")
-
-    def record(self, message: str) -> None:
-        self._messages.append(message)
-
-    def raise_if_any(self) -> None:
-        if self._messages:
-            raise CleanupError("; ".join(self._messages))
-
-
-__all__ = ["CleanupError", "CleanupFailures"]

bot_bottle/backend/docker/backend.py

@@ -23,7 +23,7 @@ import shutil
 import io
 from contextlib import contextmanager, redirect_stderr
 from pathlib import Path
-from typing import TYPE_CHECKING, Generator, Sequence
+from typing import Generator, Sequence
 
 from ...supervisor.types import SUPERVISE_HOSTNAME, SUPERVISE_PORT
 from ...agent_provider import AgentProvisionPlan
@@ -33,7 +33,6 @@ from ...git_gate import GitGatePlan
 from ...supervisor.plan import SupervisePlan
 from ...manifest import Manifest
 from .. import ActiveAgent, BottleBackend, BottleImages, BottleSpec
-from ..gateway_attach import GatewayAttachResources
 from . import cleanup as _cleanup
 from . import enumerate as _enumerate
 from . import launch as _launch
@@ -41,27 +40,12 @@ from . import resolve_plan as _resolve_plan
 from .bottle import DockerBottle
 from .bottle_cleanup_plan import DockerBottleCleanupPlan
 from .bottle_plan import DockerBottlePlan
-
-if TYPE_CHECKING:
-    from .infra import DockerInfraService
-
-
-class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanupPlan", str]):
+class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanupPlan"]):
     """Docker backend implementation. Selected by BOT_BOTTLE_BACKEND
     when set to `docker`; retained as a legacy/example backend."""
 
     name = "docker"
 
-    def __init__(self, *, infra: "DockerInfraService | None" = None) -> None:
-        # The infra service whose gateway just cold-booted, passed in on the
-        # bring-up reconcile path (PRD 0081) so `_gateway_attach_resources`
-        # reads THAT gateway's CA rather than a fresh default-named service —
-        # otherwise a non-default instance (an isolated integration test's
-        # `-itest-` gateway) reads the default `bot-bottle-orch-gateway`, which
-        # doesn't exist for it (#519 review). None for ordinary construction:
-        # falls back to the per-host default singleton.
-        self._infra = infra
-
     @classmethod
     def is_available(cls) -> bool:
         """`docker` on PATH is sufficient; we don't probe `docker info`
@@ -156,22 +140,3 @@ class DockerBottleBackend(BottleBackend["DockerBottlePlan", "DockerBottleCleanup
 
     def enumerate_active(self) -> Sequence[ActiveAgent]:
         return _enumerate.enumerate_active()
-
-    def _gateway_attach_resources(self) -> GatewayAttachResources:
-        from .infra import DockerInfraService
-        infra = self._infra if self._infra is not None else DockerInfraService()
-        return GatewayAttachResources(ca_pem=infra.gateway().ca_cert_pem())
-
-    def _running_bottles(self) -> Sequence[str]:
-        from .infra import DockerInfraService
-        from .infra_launch import running_agent_containers
-        infra = self._infra if self._infra is not None else DockerInfraService()
-        return running_agent_containers(
-            network=infra.network, gateway_name=infra.gateway().name,
-        )
-
-    def _attach_bottle_to_gateway(
-        self, bottle: str, resources: GatewayAttachResources,
-    ) -> None:
-        from .infra_launch import push_ca_to_container
-        push_ca_to_container(bottle, resources.ca_pem)

bot_bottle/backend/docker/bottle_cleanup_plan.py

@@ -46,22 +46,6 @@ class DockerBottleCleanupPlan(BottleCleanupPlan):
             and not self.orphan_state_dirs
         )
 
-    def intersect(self, current: BottleCleanupPlan) -> "DockerBottleCleanupPlan":
-        if not isinstance(current, DockerBottleCleanupPlan):
-            raise TypeError("cleanup plans must have the same backend type")
-        return DockerBottleCleanupPlan(
-            projects=tuple(x for x in self.projects if x in current.projects),
-            stray_containers=tuple(
-                x for x in self.stray_containers if x in current.stray_containers
-            ),
-            stray_networks=tuple(
-                x for x in self.stray_networks if x in current.stray_networks
-            ),
-            orphan_state_dirs=tuple(
-                x for x in self.orphan_state_dirs if x in current.orphan_state_dirs
-            ),
-        )
-
     def print(self) -> None:
         print(file=sys.stderr)
         for name in self.projects:

bot_bottle/backend/docker/cleanup.py

@@ -23,12 +23,11 @@ Active-agent enumeration lives in `backend/docker/enumerate.py`.
 
 from __future__ import annotations
 
+import shutil
 import subprocess
 
 from ...paths import bot_bottle_root
-from ...log import info
-from .. import EnumerationError
-from ..cleanup_control import CleanupFailures
+from ...log import info, warn
 from . import util as docker_mod
 from .bottle_cleanup_plan import DockerBottleCleanupPlan
 from ...bottle_state import bottle_state_dir, is_preserved
@@ -37,17 +36,15 @@ from .compose import COMPOSE_PROJECT_PREFIX, list_compose_projects
 
 def _list_prefixed_containers() -> list[str]:
     """All bot-bottle-prefixed containers, running or stopped."""
-    try:
-        result = subprocess.run(
-            ["docker", "ps", "-a",
-             "--filter", f"name=^{COMPOSE_PROJECT_PREFIX}",
-             "--format", "{{.Names}}\t{{.Label \"com.docker.compose.project\"}}"],
-            capture_output=True, text=True, check=False,
-        )
-    except OSError as exc:
-        raise EnumerationError(f"docker ps failed: {exc}") from exc
+    result = subprocess.run(
+        ["docker", "ps", "-a",
+         "--filter", f"name=^{COMPOSE_PROJECT_PREFIX}",
+         "--format", "{{.Names}}\t{{.Label \"com.docker.compose.project\"}}"],
+        capture_output=True, text=True, check=False,
+    )
     if result.returncode != 0:
-        raise EnumerationError(f"docker ps failed: {result.stderr.strip()}")
+        warn(f"docker ps failed: {result.stderr.strip()}")
+        return []
     out: list[str] = []
     for line in (result.stdout or "").splitlines():
         if not line:
@@ -66,19 +63,15 @@ def _list_prefixed_networks() -> list[str]:
     to a compose project. Compose-managed networks have a
     `com.docker.compose.project` label; bare ones (from pre-compose
     code paths) don't."""
-    try:
-        result = subprocess.run(
-            ["docker", "network", "ls",
-             "--filter", f"name={COMPOSE_PROJECT_PREFIX}",
-             "--format", "{{.Name}}\t{{.Label \"com.docker.compose.project\"}}"],
-            capture_output=True, text=True, check=False,
-        )
-    except OSError as exc:
-        raise EnumerationError(f"docker network ls failed: {exc}") from exc
+    result = subprocess.run(
+        ["docker", "network", "ls",
+         "--filter", f"name={COMPOSE_PROJECT_PREFIX}",
+         "--format", "{{.Name}}\t{{.Label \"com.docker.compose.project\"}}"],
+        capture_output=True, text=True, check=False,
+    )
     if result.returncode != 0:
-        raise EnumerationError(
-            f"docker network ls failed: {result.stderr.strip()}"
-        )
+        warn(f"docker network ls failed: {result.stderr.strip()}")
+        return []
     out: list[str] = []
     for line in (result.stdout or "").splitlines():
         if not line:
@@ -127,10 +120,7 @@ def prepare_cleanup() -> DockerBottleCleanupPlan:
     `enumerate_active_agents()` so the orphan-state-dir bucket
     doesn't include slugs whose non-docker bottle is still up."""
     docker_mod.require_docker()
-    projects = list_compose_projects(
-        warn_on_error=False,
-        raise_on_error=True,
-    )
+    projects = list_compose_projects()
     project_set = set(projects)
     # Late import to avoid a circular at module-load time —
     # the backend package's __init__ imports this module.
@@ -150,30 +140,40 @@ def cleanup(plan: DockerBottleCleanupPlan) -> None:
     """Remove everything in the plan. Projects first (whose `compose
     down` reaps their containers + networks atomically), then stray
     legacy resources, then orphan state dirs."""
-    failures = CleanupFailures()
     for project in plan.projects:
         info(f"docker compose down  ({project})")
-        failures.run(
+        result = subprocess.run(
             ["docker", "compose", "-p", project, "down", "--volumes"],
-            f"docker compose down failed for {project}",
+            capture_output=True, text=True, check=False,
         )
+        if result.returncode != 0:
+            warn(
+                f"compose down failed for {project}: "
+                f"{result.stderr.strip()}"
+            )
 
     for name in plan.stray_containers:
         info(f"removing stray container {name}")
-        failures.run(
+        subprocess.run(
             ["docker", "rm", "-f", name],
-            f"removing stray container {name}",
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
         )
 
     for name in plan.stray_networks:
         info(f"removing stray network {name}")
-        failures.run(
+        subprocess.run(
             ["docker", "network", "rm", name],
-            f"removing stray network {name}",
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
         )
 
     for identity in plan.orphan_state_dirs:
         path = bottle_state_dir(identity)
         info(f"removing orphan state dir {path}")
-        failures.remove_tree(path, f"removing orphan state dir {path}")
-    failures.raise_if_any()
+        try:
+            shutil.rmtree(path, ignore_errors=True)
+        except OSError as e:
+            warn(f"failed to remove {path}: {e}")

bot_bottle/backend/docker/compose.py

@@ -16,7 +16,6 @@ from pathlib import Path
 from typing import Any
 
 from ...log import die, warn
-from ..base import EnumerationError
 
 
 # --- Lifecycle helpers (PRD 0018 chunk 3) ----------------------------------
@@ -53,20 +52,19 @@ def slug_from_compose_project(project: str) -> str:
 
 
 def list_compose_projects(
-    *,
-    include_stopped: bool = True,
-    warn_on_error: bool = True,
-    raise_on_error: bool = False,
+    *, include_stopped: bool = True, warn_on_error: bool = True,
 ) -> list[str]:
     """All compose project names starting with `bot-bottle-`.
     `include_stopped=True` (default) runs `docker compose ls --all`
     so exited projects appear too; pass False to get only projects
     with at least one running container.
 
-    Best-effort callers get ``[]`` on Docker errors or malformed output.
-    Enumeration callers pass ``raise_on_error=True`` so a failed query is not
-    reported as an authoritative empty result.
-    """
+    Returns [] on docker daemon errors or malformed output rather
+    than raising — callers should treat the empty list as "no
+    projects discoverable", not "no projects exist". `warn_on_error`
+    stays true for explicit operator commands like cleanup, but active
+    discovery paths set it false so dashboard refreshes don't spam
+    stderr while Docker Desktop is stopped."""
     argv = ["docker", "compose", "ls", "--format", "json"]
     if include_stopped:
         argv.insert(3, "--all")
@@ -74,30 +72,19 @@ def list_compose_projects(
         result = subprocess.run(
             argv, capture_output=True, text=True, check=False,
         )
-    except OSError as exc:
-        # Not only "not found": docker on PATH but not executable by this
-        # user raises PermissionError. Either way the query never ran, so an
-        # enumeration caller must not read the empty result as authoritative.
-        if raise_on_error:
-            raise EnumerationError(
-                f"docker compose ls failed: docker unavailable ({exc})"
-            ) from exc
+    except FileNotFoundError:
+        # docker binary not on PATH — same shape as a daemon-down
+        # error from the caller's POV: no projects discoverable.
         return []
     if result.returncode != 0:
-        message = f"docker compose ls failed: {result.stderr.strip()}"
-        if raise_on_error:
-            raise EnumerationError(message)
         if warn_on_error:
-            warn(message)
+            warn(f"docker compose ls failed: {result.stderr.strip()}")
         return []
     try:
         projects = json.loads(result.stdout or "[]")
     except json.JSONDecodeError as e:
-        message = f"docker compose ls returned malformed JSON: {e}"
-        if raise_on_error:
-            raise EnumerationError(message) from e
         if warn_on_error:
-            warn(message)
+            warn(f"docker compose ls returned malformed JSON: {e}")
         return []
     names: list[str] = []
     for p in projects:
@@ -110,10 +97,7 @@ def list_compose_projects(
 
 
 def list_active_slugs(
-    *,
-    include_stopped: bool = False,
-    warn_on_error: bool = True,
-    raise_on_error: bool = False,
+    *, include_stopped: bool = False, warn_on_error: bool = True,
 ) -> list[str]:
     """Slugs (project name minus prefix) of currently-running
     bottles. Used by the dashboard's operator-edit verbs to choose
@@ -124,7 +108,6 @@ def list_active_slugs(
             for p in list_compose_projects(
                 include_stopped=include_stopped,
                 warn_on_error=warn_on_error,
-                raise_on_error=raise_on_error,
             )
         ) if slug
     )

bot_bottle/backend/docker/consolidated_launch.py

@@ -13,7 +13,6 @@ orchestrator-facing wiring so that sequence stays testable in isolation.
 
 from __future__ import annotations
 
-import tempfile
 from dataclasses import dataclass
 
 from ... import log
@@ -25,13 +24,15 @@ from ...gateway import GATEWAY_NETWORK
 from .infra import INFRA_NAME, DockerInfraService
 from ...orchestrator.store.secret_store import ENV_VAR_SECRET_NAME
 from ...orchestrator.reprovision import reprovision_bottles
-from ..base import InfraLaunchError
 from ..provision_bottle import deprovision_bottle, provision_bottle
-from ..util import AGENT_CA_PATH
 from .gateway_transport import DockerGatewayTransport
 from .gateway_net import next_free_ip
 
 
+class ConsolidatedLaunchError(RuntimeError):
+    """The consolidated register/provision sequence could not complete."""
+
+
 @dataclass(frozen=True)
 class LaunchContext:
     """What the agent container needs to join the shared gateway."""
@@ -53,7 +54,7 @@ def _network_cidr(network: str) -> str:
     ])
     cidr = proc.stdout.strip()
     if proc.returncode != 0 or not cidr:
-        raise InfraLaunchError(
+        raise ConsolidatedLaunchError(
             f"gateway network {network} has no subnet: {proc.stderr.strip()}"
         )
     return cidr
@@ -67,75 +68,12 @@ def _network_container_ips(network: str) -> list[str]:
         "docker", "network", "inspect", "--format",
         "{{range .Containers}}{{.IPv4Address}} {{end}}", network,
     ])
-    if proc.returncode != 0:
-        detail = proc.stderr.strip() or f"exit {proc.returncode}"
-        raise InfraLaunchError(
-            f"could not inspect addresses on gateway network {network}: {detail}"
-        )
     ips: list[str] = []
     for entry in proc.stdout.split():
         ips.append(entry.split("/", 1)[0])
     return ips
 
 
-def running_agent_containers(
-    network: str = GATEWAY_NETWORK, gateway_name: str = INFRA_NAME,
-) -> list[str]:
-    """Every running agent container on the gateway `network` (the gateway
-    itself excluded) — the bottles the bring-up reconcile attaches to the fresh
-    gateway (PRD 0081). Raises `OSError` if `docker` can't be run (fail hard: a
-    reconcile that can't list its bottles must not look like "no bottles")."""
-    proc = run_docker([
-        "docker", "network", "inspect", "--format",
-        "{{range .Containers}}{{.Name}}\n{{end}}", network,
-    ])
-    if proc.returncode != 0:
-        detail = proc.stderr.strip() or f"exit {proc.returncode}"
-        raise InfraLaunchError(
-            f"could not enumerate bottles on gateway network {network}: {detail}"
-        )
-    return [
-        name for name in (line.strip() for line in proc.stdout.splitlines())
-        if name and name != gateway_name
-    ]
-
-
-def push_ca_to_container(container: str, ca_pem: str) -> None:
-    """(Re)attach one running agent container to the current gateway: replace
-    its trusted gateway CA with `ca_pem` and rebuild its trust store via
-    `docker cp` + `docker exec` (PRD 0081). Unconditional install — there is one
-    gateway, so no fingerprint match is needed.
-
-    Fail hard: raises `InfraLaunchError` (naming the container) on any failure —
-    the base reconcile aggregates and surfaces it rather than leaving the agent
-    silently unable to reach the gateway."""
-    mkdir = run_docker(
-        ["docker", "exec", container, "mkdir", "-p",
-         "/usr/local/share/ca-certificates"]
-    )
-    if mkdir.returncode != 0:
-        raise InfraLaunchError(
-            f"CA push to {container} failed (mkdir): {mkdir.stderr.strip()}"
-        )
-    with tempfile.NamedTemporaryFile("w", suffix=".crt") as tmp:
-        tmp.write(ca_pem)
-        tmp.flush()
-        cp = run_docker(["docker", "cp", tmp.name, f"{container}:{AGENT_CA_PATH}"])
-    if cp.returncode != 0:
-        raise InfraLaunchError(
-            f"CA push to {container} failed (cp): {cp.stderr.strip()}"
-        )
-    ex = run_docker(
-        ["docker", "exec", container, "sh", "-c",
-         f"chmod 644 {AGENT_CA_PATH} && update-ca-certificates"]
-    )
-    if ex.returncode != 0:
-        raise InfraLaunchError(
-            f"CA push to {container} failed (update-ca-certificates): "
-            f"{ex.stderr.strip()}"
-        )
-
-
 def _reprovision_running_bottles(
     orchestrator_url: str,
     network: str = GATEWAY_NETWORK,
@@ -242,8 +180,6 @@ def deprovision_consolidated(
 __all__ = [
     "LaunchContext",
     "launch_consolidated",
-    "running_agent_containers",
-    "push_ca_to_container",
     "deprovision_consolidated",
-    "InfraLaunchError",
+    "ConsolidatedLaunchError",
 ]

bot_bottle/backend/docker/enumerate.py

@@ -1,8 +1,9 @@
 """Active-agent enumeration for the docker backend.
 
 Returns `ActiveAgent` records the CLI `active` command and the
-dashboard agents pane consume. Docker query failures raise rather
-than masquerading as an authoritative empty result.
+dashboard agents pane consume. Empty when docker isn't reachable
+— gated by `has_backend('docker')` at the cross-backend caller
+so this module trusts that docker is available when called.
 
 The parser (`_parse_services_by_project`) is exposed for direct
 unit testing; the docker `docker ps` invocation is in
@@ -12,18 +13,17 @@ from __future__ import annotations
 
 import subprocess
 
-from .. import ActiveAgent, EnumerationError
+from .. import ActiveAgent
 from ...bottle_state import read_metadata
 from .compose import compose_project_name, list_active_slugs
 
 
 def enumerate_active() -> list[ActiveAgent]:
-    """All currently-running docker-backed agents."""
-    slugs = list_active_slugs(
-        include_stopped=False,
-        warn_on_error=False,
-        raise_on_error=True,
-    )
+    """All currently-running docker-backed agents. Caller is
+    responsible for gating on `has_backend('docker')` if it
+    matters; if docker is missing the `docker ps` call below
+    returns an empty list silently."""
+    slugs = list_active_slugs(include_stopped=False, warn_on_error=False)
     if not slugs:
         return []
     services_by_project = _query_services_by_project()
@@ -74,9 +74,8 @@ def _query_services_by_project() -> dict[str, set[str]]:
             ],
             capture_output=True, text=True, check=False,
         )
-    except OSError as exc:
-        # Missing, or on PATH but not executable by this user (PermissionError).
-        raise EnumerationError(f"docker ps failed: docker unavailable ({exc})") from exc
+    except FileNotFoundError:
+        return {}
     if r.returncode != 0:
-        raise EnumerationError(f"docker ps failed: {r.stderr.strip()}")
+        return {}
     return _parse_services_by_project(r.stdout or "")

bot_bottle/backend/docker/gateway.py

@@ -17,10 +17,6 @@ from ...gateway import (
   DEFAULT_CA_TIMEOUT_SECONDS, CA_POLL_SECONDS, GATEWAY_CA_CERT, GatewayError
 )
 
-DEFAULT_GATEWAY_SUBNET = "10.242.255.0/24"
-_GATEWAY_SUBNET_LABEL = "bot-bottle.gateway-subnet"
-
-
 class DockerGateway(Gateway):
     """The consolidated gateway as a single, fixed-name Docker container.
 
@@ -39,8 +35,6 @@ class DockerGateway(Gateway):
         build_context: Path | None = None,
         dockerfile: str | None = GATEWAY_DOCKERFILE,
         host_port_bindings: tuple[int, ...] = (),
-        ca_mount_source: str | Path | None = None,
-        subnet: str | None = None,
     ) -> None:
         self.image_ref = image_ref
         self.name = name
@@ -65,15 +59,6 @@ class DockerGateway(Gateway):
         # backend's dev-harness gateway so VMs can reach it via their TAP link;
         # Docker's DNAT + the nft `ct status dnat accept` rule handle the rest.
         self._host_port_bindings = host_port_bindings
-        self._subnet = (
-            subnet
-            or os.environ.get("BOT_BOTTLE_DOCKER_GATEWAY_SUBNET", "").strip()
-            or DEFAULT_GATEWAY_SUBNET
-        )
-        configured_ca = os.environ.get("BOT_BOTTLE_DOCKER_CA_MOUNT", "").strip()
-        self._ca_mount_source = str(
-            ca_mount_source or configured_ca or host_gateway_ca_dir()
-        )
 
     def image_exists(self) -> bool:
         return run_docker(["docker", "image", "inspect", self.image_ref]).returncode == 0
@@ -96,11 +81,6 @@ class DockerGateway(Gateway):
                 str(context)]
         if os.environ.get("BOT_BOTTLE_NO_CACHE"):
             argv.insert(2, "--no-cache")
-        for name, value in resources.image_build_args(
-            self._dockerfile,
-            context=context,
-        ).items():
-            argv[-1:-1] = ["--build-arg", f"{name}={value}"]
         proc = run_docker(argv)
         if proc.returncode != 0:
             raise GatewayError(f"gateway image build failed: {proc.stderr.strip()}")
@@ -129,78 +109,16 @@ class DockerGateway(Gateway):
     def _ensure_network(self) -> None:
         """Create the shared gateway network if it doesn't exist. Idempotent —
         a concurrent create loses harmlessly (the loser sees 'already exists').
-        The explicit subnet is required because bottle attribution pins source
-        IPs; Docker rejects static endpoint addresses on an auto-IPAM network."""
-        inspected = run_docker([
-            "docker", "network", "inspect",
-            "--format", f'{{{{index .Labels "{_GATEWAY_SUBNET_LABEL}"}}}}',
-            self.network,
-        ])
-        if inspected.returncode == 0:
-            marker = inspected.stdout.strip()
-            if marker in {"", self._subnet}:
-                return
-            # Inspectable but mislabelled: the stale auto-IPAM network created
-            # by older releases. Replace it below.
-            stale = True
-        else:
-            # inspect failed. Classify by stderr — do NOT assume "not absent"
-            # implies "poisoned": a transient daemon/API error, permission
-            # failure, timeout, or bad context also fails here, and destroying
-            # the shared gateway on that guess would tear the network out from
-            # under every live bottle.
-            err = inspected.stderr.lower()
-            if "no such network" in err or "not found" in err:
-                # Absent: nothing to replace — create it below.
-                stale = False
-            elif "parseaddr" in err:
-                # Present but poisoned. A daemon that default-enables IPv6
-                # attaches an fdd0::/64 subnet whose `::1/64` gateway trips
-                # docker's own netip.ParseAddr in `network inspect`/`ls`, so the
-                # command exits non-zero with that signature. A fixed release
-                # never *creates* such a network, but one can survive on a
-                # shared host from an older or concurrent launch — and
-                # `--ipv6=false` alone can't heal it, since the create below only
-                # no-ops on "already exists". Force-replace it so later reads
-                # (e.g. `_network_cidr` pinning a source IP) stop failing.
-                stale = True
-            else:
-                # Unrecognized failure: no evidence the network is malformed.
-                # Surface it rather than mutate shared state on a guess.
-                raise GatewayError(
-                    f"gateway network {self.network} could not be inspected: "
-                    f"{inspected.stderr.strip()}"
-                )
-        if stale:
-            # Migrate the stale/poisoned network. Removing the fixed gateway is
-            # safe here: this launch recreates it.
-            run_docker(["docker", "rm", "--force", self.name])
-            removed = run_docker(["docker", "network", "rm", self.network])
-            if removed.returncode != 0 and "no such network" not in removed.stderr.lower():
-                raise GatewayError(
-                    f"gateway network {self.network} needs explicit subnet "
-                    f"{self._subnet} but could not be replaced: "
-                    f"{removed.stderr.strip()}"
-                )
-        proc = run_docker([
-            "docker", "network", "create",
-            # bot-bottle attribution pins IPv4 source IPs; it has no IPv6
-            # support. Disable IPv6 explicitly so a daemon that default-enables
-            # it (default-address-pools) can't attach an fdd0::/64 subnet — a
-            # malformed `::1/64` gateway address then trips docker's own
-            # ParseAddr in `network inspect`/`ls`, which poisons every launch
-            # that reads this network's subnet.
-            "--ipv6=false",
-            "--subnet", self._subnet,
-            "--label", f"{_GATEWAY_SUBNET_LABEL}={self._subnet}",
-            self.network,
-        ])
+        Docker picks the subnet; the launcher reads it back to allocate IPs."""
+        if run_docker(["docker", "network", "inspect", self.network]).returncode == 0:
+            return
+        proc = run_docker(["docker", "network", "create", self.network])
         if proc.returncode != 0 and "already exists" not in proc.stderr:
             raise GatewayError(
                 f"gateway network {self.network} failed to create: {proc.stderr.strip()}"
             )
 
-    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> bool:
+    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> None:
         # Bind to this orchestrator (PRD 0070): stash the URL its daemons resolve
         # policy against + the pre-minted `gateway` token they present, then bring
         # the container up. The gateway never mints, so it holds no signing key —
@@ -225,9 +143,9 @@ class DockerGateway(Gateway):
         # Recreate when the running container's image is stale (a rebuild),
         # so source changes to the gateway's flat daemons take effect — not
         # just when the container is absent.
-        self._ensure_network()
         if self.is_running() and self._running_image_is_current():
-            return False
+            return
+        self._ensure_network()
         # Clear any stale (stopped OR outdated-image) container holding the
         # fixed name, then start fresh. `rm --force` on an absent name is a
         # tolerated no-op.
@@ -240,7 +158,7 @@ class DockerGateway(Gateway):
             # Persist the self-generated CA on the host so it survives both
             # container recreation AND docker volume pruning (agents trust it)
             # — see host_gateway_ca_dir / issue #450.
-            "--volume", f"{self._ca_mount_source}:{MITMPROXY_HOME}",
+            "--volume", f"{host_gateway_ca_dir()}:{MITMPROXY_HOME}",
             # No DB mount: the data plane (egress / supervise / git-gate) reaches
             # the supervise queue over the control-plane RPC and never opens
             # bot-bottle.db, so the gateway container gets no file handle on it
@@ -271,9 +189,6 @@ class DockerGateway(Gateway):
         # pre-connect window (they retry /resolve per request).
         if self._control_network:
             self._connect_control_network()
-        # (Re)created a fresh container — signal a cold boot so the caller
-        # reconciles running bottles against it (PRD 0081).
-        return True
 
     def _connect_control_network(self) -> None:
         """Ensure the `--internal` control network exists and attach the gateway
@@ -338,4 +253,4 @@ class DockerGateway(Gateway):
     def provisioning_transport(self) -> GatewayTransport:
         """The exec/cp transport git-gate provisioning stages per-bottle repos +
         deploy keys through (over the docker socket)."""
-        return DockerGatewayTransport(self.name)
+        return DockerGatewayTransport(self.name)

bot_bottle/backend/docker/infra.py

@@ -33,6 +33,7 @@ from .orchestrator import (
     ORCHESTRATOR_NAME,
     ORCHESTRATOR_NETWORK,
 )
+from ...paths import bot_bottle_root
 from ... import resources
 from ...gateway import (
     GATEWAY_IMAGE,
@@ -68,8 +69,6 @@ class DockerInfraService(InfraService):
         gateway_image: str = GATEWAY_IMAGE,
         repo_root: Path | None = None,
         host_root: Path | None = None,
-        root_mount_source: str | Path | None = None,
-        gateway_ca_mount_source: str | Path | None = None,
         orchestrator_name: str = ORCHESTRATOR_NAME,
         orchestrator_label: str = ORCHESTRATOR_LABEL,
         gateway_name: str = GATEWAY_NAME,
@@ -79,14 +78,10 @@ class DockerInfraService(InfraService):
         self.control_network = control_network
         self.orchestrator_image = orchestrator_image
         self.gateway_image = gateway_image
-        # Build context: the repo root in a checkout, a staged copy from the
-        # installed wheel otherwise (bot_bottle.resources).
+        # Build context / bind-mount source: the repo root in a checkout, a
+        # staged copy from the installed wheel otherwise (bot_bottle.resources).
         self._repo_root = repo_root if repo_root is not None else resources.build_root()
-        if host_root is not None and root_mount_source is not None:
-            raise ValueError("pass host_root or root_mount_source, not both")
-        self._host_root = host_root
-        self._root_mount_source = root_mount_source
-        self._gateway_ca_mount_source = gateway_ca_mount_source
+        self._host_root = host_root or bot_bottle_root()
         self._orchestrator_name = orchestrator_name
         self._orchestrator_label = orchestrator_label
         self._gateway_name = gateway_name
@@ -103,7 +98,6 @@ class DockerInfraService(InfraService):
             control_network=self.control_network,
             repo_root=self._repo_root,
             host_root=self._host_root,
-            root_mount_source=self._root_mount_source,
         )
 
     def gateway(self) -> DockerGateway:
@@ -118,7 +112,6 @@ class DockerInfraService(InfraService):
             network=self.network,
             control_network=self.control_network,
             build_context=self._repo_root,
-            ca_mount_source=self._gateway_ca_mount_source,
         )
 
     def ensure_running(
@@ -142,16 +135,9 @@ class DockerInfraService(InfraService):
         # mints the role-scoped `gateway` JWT here and hands it to the gateway,
         # which never sees the key (#469). `connect_to_orchestrator` is
         # idempotent.
-        cold_booted = gateway.connect_to_orchestrator(
+        gateway.connect_to_orchestrator(
             orchestrator.gateway_url(), orchestrator.mint_gateway_token(),
         )
-        # A (re)created gateway container minted/mounted its CA afresh and lost
-        # every bottle's per-bottle state; reconcile the already-running bottles
-        # against it (PRD 0081). Skipped when a healthy current gateway was left
-        # untouched — no cold boot, nothing to reconcile.
-        if cold_booted:
-            from .backend import DockerBottleBackend
-            DockerBottleBackend(infra=self).attach_bottled_agents_to_gateway()
         return orchestrator.url()
 
     def stop(self) -> None:

bot_bottle/backend/docker/launch.py

@@ -61,7 +61,7 @@ from .compose import (
 )
 from .consolidated_compose import consolidated_agent_compose
 from ...orchestrator.store.config_store import resolve_teardown_timeout
-from .infra_launch import launch_consolidated, deprovision_consolidated
+from .consolidated_launch import launch_consolidated, deprovision_consolidated
 from .infra import INFRA_NAME
 from .gateway import DockerGateway
 from ... import resources

bot_bottle/backend/docker/orchestrator.py

@@ -42,9 +42,13 @@ ORCHESTRATOR_IMAGE = os.environ.get(
 )
 ORCHESTRATOR_DOCKERFILE = "Dockerfile.orchestrator"
 # Baked as a container label so `ensure_running` can detect whether the running
-# orchestrator image was built from the current source.
+# orchestrator is executing the current bind-mounted source.
 ORCHESTRATOR_SOURCE_HASH_LABEL = "bot-bottle-orchestrator-source-hash"
 
+# The bind-mount path for the live control-plane source inside the container.
+# PYTHONPATH points here so a code change takes effect on the next launch
+# without an image rebuild.
+_SRC_IN_CONTAINER = "/bot-bottle-src"
 # Bot-bottle host-root bind-mount (DB + state) inside the orchestrator. The
 # control plane opens bot-bottle.db under here (via BOT_BOTTLE_ROOT ->
 # host_db_path()); it is the ONLY container with a handle on it (issue #469).
@@ -68,51 +72,23 @@ class DockerOrchestrator(Orchestrator):
         control_network: str = ORCHESTRATOR_NETWORK,
         repo_root: Path | None = None,
         host_root: Path | None = None,
-        root_mount_source: str | Path | None = None,
-        client_host: str | None = None,
-        client_network: str | None = None,
-        bind_host: str | None = None,
         dockerfile: str | None = ORCHESTRATOR_DOCKERFILE,
     ) -> None:
-        if host_root is not None and root_mount_source is not None:
-            raise ValueError("pass host_root or root_mount_source, not both")
         self.image_ref = image_ref
         self.name = name
         self.label = label
         self.port = port
         self.control_network = control_network
-        # Build context: the repo root in a checkout, a staged copy from the
-        # installed wheel otherwise (bot_bottle.resources).
+        # Build context / bind-mount source: the repo root in a checkout, a
+        # staged copy from the installed wheel otherwise (bot_bottle.resources).
         self._repo_root = repo_root if repo_root is not None else resources.build_root()
-        configured_root = os.environ.get("BOT_BOTTLE_DOCKER_ROOT_MOUNT", "").strip()
-        self._root_mount_source = str(
-            root_mount_source or configured_root or host_root or bot_bottle_root()
-        )
-        configured_network = os.environ.get(
-            "BOT_BOTTLE_DOCKER_CLIENT_NETWORK", ""
-        ).strip()
-        self._client_network = client_network or configured_network or None
-        configured_host = os.environ.get(
-            "BOT_BOTTLE_DOCKER_HOST_ADDRESS", ""
-        ).strip()
-        self._client_host = (
-            client_host or configured_host
-            or (self.name if self._client_network else "127.0.0.1")
-        )
-        # A socket-shared CI runner reaches published ports through its Docker
-        # network rather than its own loopback. Production stays bound to host
-        # loopback unless a caller explicitly selects another client.
-        self._bind_host = bind_host or (
-            "0.0.0.0"
-            if not self._client_network and self._client_host != "127.0.0.1"
-            else "127.0.0.1"
-        )
+        self._host_root = host_root or bot_bottle_root()
         self._dockerfile = dockerfile
 
     def url(self) -> str:
-        """Control-plane URL reachable by this Docker client."""
-        port = DEFAULT_PORT if self._client_network else self.port
-        return f"http://{self._client_host}:{port}"
+        """Host-side control-plane URL — the orchestrator's published loopback,
+        which the CLI reaches."""
+        return f"http://127.0.0.1:{self.port}"
 
     def gateway_url(self) -> str:
         """The URL the gateway's data plane resolves policy against — the
@@ -131,11 +107,6 @@ class DockerOrchestrator(Orchestrator):
                 str(self._repo_root)]
         if os.environ.get("BOT_BOTTLE_NO_CACHE"):
             argv.insert(2, "--no-cache")
-        for name, value in resources.image_build_args(
-            self._dockerfile,
-            context=self._repo_root,
-        ).items():
-            argv[-1:-1] = ["--build-arg", f"{name}={value}"]
         proc = run_docker(argv)
         if proc.returncode != 0:
             raise GatewayError(
@@ -148,7 +119,8 @@ class DockerOrchestrator(Orchestrator):
         return self.name in proc.stdout.split()
 
     def _source_current(self, current_hash: str) -> bool:
-        """True iff the running orchestrator image matches current source."""
+        """True iff the running orchestrator was started from the current
+        bind-mounted source."""
         if not self.is_running():
             return False
         proc = run_docker([
@@ -210,19 +182,15 @@ class DockerOrchestrator(Orchestrator):
             # Control network only — agents are never on it, so they have no
             # route to the control plane (the L3 block, not just the JWT).
             "--network", self.control_network,
-            # Host CLI reaches the control plane here (loopback by default).
-            # Socket-shared CI joins the container directly to the job network;
-            # the host-side mapping remains loopback-only in that topology. The
+            # Host CLI reaches the control plane here (loopback only). The
             # orchestrator listens on the fixed DEFAULT_PORT inside the
             # container; self.port is the host-side published port.
-            "--publish", f"{self._bind_host}:{self.port}:{DEFAULT_PORT}",
-            # The image was rebuilt from `_repo_root` immediately before this
-            # launch. Running its baked package avoids a host-path bind mount,
-            # which is both more production-like and works with socket-shared
-            # CI where the daemon cannot see the job container's workspace.
+            "--publish", f"127.0.0.1:{self.port}:{DEFAULT_PORT}",
+            # Live control-plane source (code changes without an image rebuild).
+            "--volume", f"{self._repo_root}:{_SRC_IN_CONTAINER}:ro",
+            "--env", f"PYTHONPATH={_SRC_IN_CONTAINER}",
             # Orchestrator registry DB on the host (sole writer: control plane).
-            # `root_mount_source` may be a host path or a named Docker volume.
-            "--volume", f"{self._root_mount_source}:{_ROOT_IN_CONTAINER}",
+            "--volume", f"{self._host_root}:{_ROOT_IN_CONTAINER}",
             "--env", f"BOT_BOTTLE_ROOT={_ROOT_IN_CONTAINER}",
             # The signing key — held ONLY by the orchestrator (it verifies
             # tokens); the gateway gets the pre-minted `gateway` JWT, never the
@@ -237,15 +205,6 @@ class DockerOrchestrator(Orchestrator):
             raise OrchestratorStartError(
                 f"orchestrator container failed to start: {proc.stderr.strip()}"
             )
-        if self._client_network:
-            proc = run_docker([
-                "docker", "network", "connect", self._client_network, self.name,
-            ])
-            if proc.returncode != 0:
-                raise OrchestratorStartError(
-                    f"orchestrator container failed to join client network "
-                    f"{self._client_network}: {proc.stderr.strip()}"
-                )
 
     def stop(self) -> None:
         """Remove the control-plane container (idempotent)."""

bot_bottle/backend/docker/setup.py

@@ -8,7 +8,7 @@ pointer, and `status()` reports whether docker is usable.
 This is intentionally minimal; a richer version (daemon config checks,
 gVisor/runsc install guidance, rootless-docker hints) is tracked
 separately. Reached via `DockerBottleBackend.setup` / `.status`, which
-the generic `bot-bottle backend {setup,status}` dispatches to.
+the generic `./cli.py backend {setup,status}` dispatches to.
 """
 
 from __future__ import annotations
@@ -69,7 +69,7 @@ def teardown() -> int:
     sys.stderr.write(
         "Docker backend: nothing to undo — it provisions no privileged host "
         "state (networks and the gateway are per-launch and are "
-        "removed by `bot-bottle cleanup`). Docker itself is left installed.\n"
+        "removed by `./cli.py cleanup`). Docker itself is left installed.\n"
     )
     return 0
 
@@ -89,5 +89,5 @@ def status() -> int:
     runsc = _docker_on_path() and _util.runsc_available()
     sys.stderr.write(f"gVisor runsc runtime: {'registered' if runsc else 'not registered (optional)'}\n")
     if not ok:
-        sys.stderr.write("\nRun: bot-bottle backend setup --backend=docker\n")
+        sys.stderr.write("\nRun: ./cli.py backend setup --backend=docker\n")
     return 0 if ok else 1

bot_bottle/backend/docker/util.py

@@ -6,18 +6,12 @@ from __future__ import annotations
 
 import os
 from datetime import datetime, timezone
+import re
 import shutil
 import subprocess
 from typing import Iterator
 
-from ... import resources
 from ...log import die, info
-from ...util import slugify as _slugify
-
-
-def slugify(name: str) -> str:
-    """Compatibility wrapper; new generic callers import ``bot_bottle.util``."""
-    return _slugify(name)
 
 
 def run_docker(
@@ -120,13 +114,20 @@ def docker_cp(src: str, dest: str) -> None:
             f"{(result.stderr or '').strip() or '<no stderr>'}")
 
 
-def build_image(
-    ref: str,
-    context: str,
-    *,
-    dockerfile: str = "",
-    build_args: dict[str, str] | None = None,
-) -> None:
+_SLUG_RE = re.compile(r"[^a-z0-9]+")
+
+
+def slugify(name: str) -> str:
+    """Lowercase, non-alnum runs → '-', trimmed. Dies on empty result."""
+    if not name:
+        die("slugify: missing name")
+    slug = _SLUG_RE.sub("-", name.lower()).strip("-")
+    if not slug:
+        die(f"name '{name}' produced an empty slug; use alphanumeric characters")
+    return slug
+
+
+def build_image(ref: str, context: str, *, dockerfile: str = "") -> None:
     """Invokes `docker build` every call. Layer cache makes no-change
     rebuilds cheap; running every time means Dockerfile edits land
     without manual `docker rmi`.
@@ -146,61 +147,10 @@ def build_image(
         args.append("--no-cache")
     if dockerfile:
         args.extend(["-f", dockerfile])
-    effective_build_args = resources.image_build_args(
-        dockerfile,
-        context=context,
-    ) if dockerfile else {}
-    effective_build_args.update(build_args or {})
-    for name, value in effective_build_args.items():
-        args.extend(["--build-arg", f"{name}={value}"])
     args.append(context)
     subprocess.run(args, check=True)
 
 
-def image_id(ref: str) -> str:
-    """Return the exact content-addressed ID for a local image.
-
-    This is used when one locally built image is another Dockerfile's base:
-    passing the ID prevents a mutable tag from being resolved between builds.
-    """
-    result = run_docker(["docker", "image", "inspect", "--format", "{{.Id}}", ref])
-    image = result.stdout.strip()
-    if result.returncode != 0 or not image.startswith("sha256:"):
-        detail = (result.stderr or result.stdout or "").strip()
-        die(f"could not resolve exact image ID for {ref!r}: {detail or '<no detail>'}")
-    return image
-
-
-def pinned_local_image_ref(ref: str) -> str:
-    """Give a local image a content-derived tag and verify the tag resolves
-    back to the same image ID.
-
-    BuildKit treats a bare ``sha256:...`` ID in ``FROM`` as a registry
-    repository name. A tag whose complete suffix is the local image ID remains
-    resolvable by BuildKit, while the post-tag inspection keeps the handoff
-    fail-closed.
-    """
-    image = image_id(ref)
-    digest = image.removeprefix("sha256:")
-    if len(digest) != 64 or any(char not in "0123456789abcdef" for char in digest):
-        die(f"could not derive a local base tag from invalid image ID {image!r}")
-
-    repository = ref.split("@", 1)[0]
-    last_slash = repository.rfind("/")
-    last_colon = repository.rfind(":")
-    if last_colon > last_slash:
-        repository = repository[:last_colon]
-    pinned_ref = f"{repository}:sha256-{digest}"
-
-    result = run_docker(["docker", "image", "tag", image, pinned_ref])
-    if result.returncode != 0:
-        detail = (result.stderr or result.stdout or "").strip()
-        die(f"could not tag exact local image {image}: {detail or '<no detail>'}")
-    if image_id(pinned_ref) != image:
-        die(f"content-derived local tag {pinned_ref!r} did not resolve to {image}")
-    return pinned_ref
-
-
 def verify_agent_image(image: str, argv: tuple[str, ...]) -> None:
     """Run `argv` inside a throwaway container of a freshly built agent
     image and die loudly if it fails, instead of shipping an image

bot_bottle/backend/egress_apply.py

@@ -11,8 +11,7 @@ from pathlib import Path
 
 from ..bottle_state import egress_state_dir
 from ..egress import EGRESS_ROUTES_FILENAME
-from ..gateway.egress.schema import load_config
-from ..gateway.egress.types import LOG_OFF
+from ..gateway.egress.addon_core import LOG_OFF, load_config
 
 
 class EgressApplyError(RuntimeError):

bot_bottle/backend/firecracker/backend.py

@@ -20,7 +20,6 @@ from ...git_gate import GitGatePlan
 from ...manifest import Manifest
 from ...supervisor.plan import SupervisePlan
 from .. import ActiveAgent, BottleBackend, BottleImages, BottleSpec
-from ..gateway_attach import GatewayAttachResources
 from . import cleanup as _cleanup
 from . import enumerate as _enumerate
 from . import launch as _launch
@@ -32,7 +31,7 @@ from .bottle_plan import FirecrackerBottlePlan
 
 
 class FirecrackerBottleBackend(
-    BottleBackend["FirecrackerBottlePlan", "FirecrackerBottleCleanupPlan", "Path"]
+    BottleBackend["FirecrackerBottlePlan", "FirecrackerBottleCleanupPlan"]
 ):
     name = "firecracker"
 
@@ -120,19 +119,6 @@ class FirecrackerBottleBackend(
     def enumerate_active(self) -> Sequence[ActiveAgent]:
         return _enumerate.enumerate_active()
 
-    def _gateway_attach_resources(self) -> GatewayAttachResources:
-        from .gateway import FirecrackerGateway
-        return GatewayAttachResources(ca_pem=FirecrackerGateway().ca_cert_pem())
-
-    def _running_bottles(self) -> Sequence[Path]:
-        return _cleanup.live_run_dirs()
-
-    def _attach_bottle_to_gateway(
-        self, bottle: Path, resources: GatewayAttachResources,
-    ) -> None:
-        from .infra_launch import attach_ca_to_agent_vm
-        attach_ca_to_agent_vm(bottle, resources.ca_pem)
-
     def supervise_mcp_url(self, plan: FirecrackerBottlePlan) -> str:
         return plan.agent_supervise_url
 

bot_bottle/backend/firecracker/bottle_cleanup_plan.py

@@ -27,11 +27,3 @@ class FirecrackerBottleCleanupPlan(BottleCleanupPlan):
     @property
     def empty(self) -> bool:
         return not (self.vm_pids or self.run_dirs)
-
-    def intersect(self, current: BottleCleanupPlan) -> "FirecrackerBottleCleanupPlan":
-        if not isinstance(current, FirecrackerBottleCleanupPlan):
-            raise TypeError("cleanup plans must have the same backend type")
-        return FirecrackerBottleCleanupPlan(
-            vm_pids=tuple(x for x in self.vm_pids if x in current.vm_pids),
-            run_dirs=tuple(x for x in self.run_dirs if x in current.run_dirs),
-        )

bot_bottle/backend/firecracker/cleanup.py

@@ -11,9 +11,10 @@ Reaps *orphans* only — resources with no live VM behind them:
     — a VMM left lingering after its dir was removed.
 
 A run dir with a *live* firecracker process is a running bottle and is
-left strictly alone: it is neither killed nor removed. Active-agent
-enumeration uses this same process snapshot, so cleanup and generic
-backend consumers agree about which bottles are running.
+left strictly alone: it is neither killed nor removed. (The backend's
+`enumerate_active` registry is still a stub — #354 — so a live process
+is the only reliable "this bottle is in use" signal we have. Once the
+registry lands, registry-orphaned-but-running VMs can be reaped too.)
 
 TAP slots free themselves (the flock drops when the launcher exits), so
 there is nothing to reclaim there.
@@ -21,16 +22,14 @@ there is nothing to reclaim there.
 
 from __future__ import annotations
 
-from collections.abc import Sequence
 import os
+import shutil
 import signal
 import subprocess
 from pathlib import Path
 
 from ...log import info
-from .. import EnumerationError
-from ..cleanup_control import CleanupError, CleanupFailures
-from . import lifecycle_lock, util
+from . import util
 from .bottle_cleanup_plan import FirecrackerBottleCleanupPlan
 
 
@@ -38,7 +37,7 @@ def _run_root() -> Path:
     return util.cache_dir() / "run"
 
 
-def _run_dir_of(args: Sequence[str], run_root: Path) -> Path | None:
+def _run_dir_of(cmd: str, run_root: Path) -> Path | None:
     """The bottle run dir a firecracker cmdline belongs to, or None.
 
     A bottle VM is launched with `--config-file <run_root>/<slug>/config.json`,
@@ -46,35 +45,15 @@ def _run_dir_of(args: Sequence[str], run_root: Path) -> Path | None:
     the run root. Anything else (a builder VM, the infra VM elsewhere) is
     not ours to reap here.
     """
-    for i, arg in enumerate(args):
-        if arg == "--config-file" and i + 1 < len(args):
-            parent = Path(args[i + 1]).parent
+    toks = cmd.split()
+    for i, tok in enumerate(toks):
+        if tok == "--config-file" and i + 1 < len(toks):
+            parent = Path(toks[i + 1]).parent
             if parent.parent == run_root:
                 return parent
     return None
 
 
-def _decode_cmdline(raw: bytes) -> tuple[str, ...]:
-    """Decode Linux's NUL-delimited argv without losing embedded spaces."""
-    return tuple(
-        value.decode(errors="surrogateescape")
-        for value in raw.split(b"\0") if value
-    )
-
-
-def _process_args(pid: int) -> tuple[str, ...] | None:
-    """Read one process's lossless argv, or None when it exited meanwhile."""
-    try:
-        raw = Path(f"/proc/{pid}/cmdline").read_bytes()
-    except FileNotFoundError:
-        return None
-    except OSError as exc:
-        raise EnumerationError(
-            f"could not inspect Firecracker pid {pid}: {exc}"
-        ) from exc
-    return _decode_cmdline(raw)
-
-
 def _scan_processes(run_root: Path) -> tuple[set[str], list[int]]:
     """Inspect running firecracker VMs under ``run_root``.
 
@@ -83,34 +62,23 @@ def _scan_processes(run_root: Path) -> tuple[set[str], list[int]]:
       * ``orphan_pids`` — firecracker pids whose run dir no longer exists
         (a lingering VMM to kill).
     """
-    try:
-        result = subprocess.run(
-            ["pgrep", "firecracker"],
-            capture_output=True, text=True, check=False,
-        )
-    except OSError as exc:
-        raise EnumerationError(
-            f"could not enumerate Firecracker processes: {exc}"
-        ) from exc
-    if result.returncode == 1:
-        # pgrep's documented "no processes matched" result.
-        return set(), []
+    result = subprocess.run(
+        ["pgrep", "-a", "firecracker"],
+        capture_output=True, text=True, check=False,
+    )
     if result.returncode != 0:
-        detail = (result.stderr or "").strip() or f"exit {result.returncode}"
-        raise EnumerationError(
-            f"could not enumerate Firecracker processes: {detail}"
-        )
+        return set(), []
     live: set[str] = set()
     orphan_pids: list[int] = []
     for line in result.stdout.splitlines():
+        parts = line.split(None, 1)
+        if len(parts) != 2:
+            continue
         try:
-            pid = int(line.strip())
+            pid = int(parts[0])
         except ValueError:
             continue
-        args = _process_args(pid)
-        if args is None:
-            continue
-        run_dir = _run_dir_of(args, run_root)
+        run_dir = _run_dir_of(parts[1], run_root)
         if run_dir is None:
             continue
         if run_dir.is_dir():
@@ -146,54 +114,12 @@ def prepare_cleanup() -> FirecrackerBottleCleanupPlan:
 
 
 def cleanup(plan: FirecrackerBottleCleanupPlan) -> None:
-    """Revalidate the preview under the launch lock, then remove its survivors."""
-    with lifecycle_lock.hold():
-        fresh = prepare_cleanup()
-        approved_pids = set(plan.vm_pids).intersection(fresh.vm_pids)
-        approved_dirs = set(plan.run_dirs).intersection(fresh.run_dirs)
-        failures = CleanupFailures()
-        for pid in sorted(approved_pids):
-            try:
-                _terminate_orphan(pid, _run_root())
-            except CleanupError as exc:
-                failures.record(str(exc))
-        for path in sorted(approved_dirs):
-            info(f"rm -rf {path}")
-            failures.remove_tree(Path(path), f"removing Firecracker run dir {path}")
-        failures.raise_if_any()
-
-
-def _terminate_orphan(pid: int, run_root: Path) -> None:
-    """Signal exactly the process identity that still owns an orphan config."""
-    try:
-        pidfd = os.pidfd_open(pid)
-    except ProcessLookupError:
-        return
-    except OSError as exc:
-        raise EnumerationError(
-            f"could not pin Firecracker pid {pid} for cleanup: {exc}"
-        ) from exc
-    try:
-        try:
-            raw = Path(f"/proc/{pid}/cmdline").read_bytes()
-        except FileNotFoundError:
-            return
-        except OSError as exc:
-            raise EnumerationError(
-                f"could not revalidate Firecracker pid {pid}: {exc}"
-            ) from exc
-        args = _decode_cmdline(raw)
-        run_dir = _run_dir_of(args, run_root)
-        if run_dir is None or run_dir.is_dir():
-            return
+    for pid in plan.vm_pids:
         info(f"kill firecracker VM pid {pid}")
         try:
-            signal.pidfd_send_signal(pidfd, signal.SIGTERM)
+            os.kill(pid, signal.SIGTERM)
         except ProcessLookupError:
-            return
-        except OSError as exc:
-            raise CleanupError(
-                f"could not signal Firecracker pid {pid}: {exc}"
-            ) from exc
-    finally:
-        os.close(pidfd)
+            pass
+    for path in plan.run_dirs:
+        info(f"rm -rf {path}")
+        shutil.rmtree(path, ignore_errors=True)

bot_bottle/backend/firecracker/consolidated_launch.py

@@ -40,9 +40,7 @@ from ...orchestrator.lifecycle import (
 )
 from ...orchestrator.reprovision import reprovision_bottles
 from ...orchestrator.store.secret_store import ENV_VAR_SECRET_NAME
-from ..base import InfraLaunchError
 from ..provision_bottle import deprovision_bottle, provision_bottle
-from ..util import AGENT_CA_PATH
 from . import cleanup, util
 from .gateway import FirecrackerGateway
 from .infra import FirecrackerInfraService
@@ -50,6 +48,10 @@ from .infra import FirecrackerInfraService
 _ENV_VAR_SECRET_PATH = "/run/bot-bottle/env-var-secret"
 
 
+class ConsolidatedLaunchError(RuntimeError):
+    """The consolidated register/provision sequence could not complete."""
+
+
 @dataclass(frozen=True)
 class LaunchContext:
     """What the Firecracker launch needs from the consolidated sequence."""
@@ -81,48 +83,12 @@ def persist_env_var_secret(private_key: Path, guest_ip: str, secret: str) -> Non
         input=secret, capture_output=True, text=True, check=False,
     )
     if proc.returncode != 0:
-        raise InfraLaunchError(
+        raise ConsolidatedLaunchError(
             f"failed to persist {ENV_VAR_SECRET_NAME} in agent VM: "
             f"{proc.stderr.strip() or '<no stderr>'}"
         )
 
 
-def attach_ca_to_agent_vm(run_dir: Path, ca_pem: str) -> None:
-    """(Re)attach one running agent VM (identified by its `run_dir`) to the
-    current gateway: replace its trusted gateway CA with `ca_pem` and rebuild
-    its trust store over SSH (PRD 0081). Unconditional install — there is one
-    gateway, so no fingerprint match is needed. Bare-pipe input keeps the cert
-    off argv.
-
-    Fail hard: raises `InfraLaunchError` (naming the bottle) if the run dir is
-    malformed or the push fails — the base reconcile aggregates and surfaces it
-    rather than leaving the agent silently unable to reach the gateway."""
-    guest_ip = _guest_ip_from_config(run_dir / "config.json")
-    private_key = run_dir / "bottle_id_ed25519"
-    if not guest_ip or not private_key.is_file():
-        raise InfraLaunchError(
-            f"{run_dir.name}: cannot resolve guest IP / SSH key to attach it "
-            f"to the gateway"
-        )
-    install = (
-        "umask 022; mkdir -p /usr/local/share/ca-certificates && "
-        f"cat > {AGENT_CA_PATH} && chmod 644 {AGENT_CA_PATH} && "
-        "update-ca-certificates"
-    )
-    try:
-        proc = subprocess.run(
-            util.ssh_base_argv(private_key, guest_ip) + [install],
-            input=ca_pem, capture_output=True, text=True, check=False,
-        )
-    except OSError as exc:
-        raise InfraLaunchError(f"{run_dir.name} ({guest_ip}): CA push failed: {exc}") from exc
-    if proc.returncode != 0:
-        raise InfraLaunchError(
-            f"{run_dir.name} ({guest_ip}): CA push failed: "
-            f"{proc.stderr.strip() or '<no stderr>'}"
-        )
-
-
 def _reprovision_running_bottles(client: OrchestratorClient) -> None:
     """Read keys from live agent VMs and restore the restarted gateway."""
     try:
@@ -195,8 +161,7 @@ def deprovision_consolidated(
 __all__ = [
     "LaunchContext",
     "launch_consolidated",
-    "attach_ca_to_agent_vm",
     "deprovision_consolidated",
-    "InfraLaunchError",
+    "ConsolidatedLaunchError",
     "OrchestratorStartError",
 ]

bot_bottle/backend/firecracker/enumerate.py

@@ -1,32 +1,14 @@
 """Active-agent enumeration for the Firecracker backend.
 
-Running bottles are the Firecracker processes whose ``--config-file`` points
-at an existing per-bottle run directory. The same authoritative process scan
-protects cleanup from deleting live VMs; operational scan failures propagate
-as ``EnumerationError`` instead of masquerading as an empty host.
+The backend is disabled during the companion-container removal (#385) — it can't
+launch bottles, so there are none to enumerate. Real enumeration returns
+with the backend's consolidated relaunch (#354).
 """
 
 from __future__ import annotations
 
-from ...bottle_state import read_metadata
 from .. import ActiveAgent
-from .cleanup import live_run_dirs
 
 
 def enumerate_active() -> list[ActiveAgent]:
-    out: list[ActiveAgent] = []
-    for run_dir in live_run_dirs():
-        slug = run_dir.name
-        metadata = read_metadata(slug)
-        out.append(ActiveAgent(
-            backend_name="firecracker",
-            slug=slug,
-            agent_name=metadata.agent_name if metadata else "?",
-            started_at=metadata.started_at if metadata else "",
-            # Firecracker uses the shared gateway, so there are no
-            # per-bottle gateway service containers to report.
-            services=(),
-            label=metadata.label if metadata else "",
-            color=metadata.color if metadata else "",
-        ))
-    return out
+    return []

bot_bottle/backend/firecracker/gateway.py

@@ -69,17 +69,13 @@ class FirecrackerGateway(Gateway):
         self._orchestrator_url = ""
         self._gateway_token = ""
 
-    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> bool:
+    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> None:
         """Boot the gateway VM on its link resolving policy against
         `orchestrator_url`, then seed `gateway_token` over SSH. The orchestrator's
         guest IP is parsed from the URL and passed on the cmdline (`bb_orch=`), so
         the baked init stays IP-independent. Boot the orchestrator first — the
         gateway daemons reach it at startup. The gateway never mints, so it holds
-        no signing key, only this token (#469).
-
-        Always returns True: the firecracker gateway VM is booted fresh here
-        (this runs only on the infra cold-boot path), so it is always a cold
-        boot that minted a new CA — the caller reconciles running bottles."""
+        no signing key, only this token (#469)."""
         self._orchestrator_url = orchestrator_url
         self._gateway_token = gateway_token
         if not self._orchestrator_url:
@@ -109,7 +105,6 @@ class FirecrackerGateway(Gateway):
             "the gateway JWT to the gateway VM (its data plane will not start)",
         )
         self._vm = vm
-        return True
 
     def is_running(self) -> bool:
         return infra_vm._pidfile_alive(infra_vm._gw_dir())

bot_bottle/backend/firecracker/image_builder.py

@@ -19,14 +19,12 @@ from __future__ import annotations
 import fcntl
 import hashlib
 import os
-import shlex
 import shutil
 import subprocess
 from contextlib import contextmanager
 from pathlib import Path
 from typing import Generator
 
-from ... import resources
 from ...log import die, info
 from . import util
 from .infra import FirecrackerInfraService
@@ -57,11 +55,6 @@ def _rootfs_digest(dockerfile: Path) -> str:
     h = hashlib.sha256()
     h.update(_dockerfile_hash(dockerfile).encode())
     h.update(b"\0")
-    for name, value in resources.image_build_args(dockerfile).items():
-        h.update(name.encode())
-        h.update(b"=")
-        h.update(value.encode())
-        h.update(b"\0")
     h.update(util._GUEST_INIT.encode())
     return h.hexdigest()[:16]
 
@@ -154,13 +147,7 @@ def _build_in_infra(
         if prep.returncode != 0:
             die(f"preparing build dir in the infra VM failed: {prep.stderr.strip()}")
         _send_dockerfile(key, ip, dockerfile, ctx)
-        _buildah_build(
-            key,
-            ip,
-            ctx,
-            tag,
-            resources.image_build_args(dockerfile),
-        )
+        _buildah_build(key, ip, ctx, tag)
         _smoke_test(key, ip, tag, smoke_ctr, smoke_test)
         _stream_rootfs(key, ip, tag, export_ctr, base)
     finally:
@@ -197,26 +184,15 @@ def _send_dockerfile(private_key: Path, guest_ip: str, dockerfile: Path, ctx: st
             f"{proc.stderr.decode(errors='replace').strip()}")
 
 
-def _buildah_build(
-    private_key: Path,
-    guest_ip: str,
-    ctx: str,
-    tag: str,
-    build_args: dict[str, str],
-) -> None:
+def _buildah_build(private_key: Path, guest_ip: str, ctx: str, tag: str) -> None:
     # Stream buildah's step-by-step output straight to our stderr (like the
     # docker backend's `docker build`), so a long first build (base pull +
     # apt/npm installs) shows live progress instead of a silent wait. The
     # remote stderr is where buildah writes its `STEP i/n` lines.
     info(f"buildah build {tag} in the infra VM (streaming output)")
-    arg_flags = " ".join(
-        f"--build-arg {shlex.quote(f'{name}={value}')}"
-        for name, value in build_args.items()
-    )
     rc = _ssh_streamed(
         private_key, guest_ip,
-        f"buildah build {_BUILD_FLAGS} {arg_flags} "
-        f"-t {tag} -f {ctx}/Dockerfile {ctx}/ctx",
+        f"buildah build {_BUILD_FLAGS} -t {tag} -f {ctx}/Dockerfile {ctx}/ctx",
         timeout=_BUILD_TIMEOUT_SECONDS,
     )
     if rc != 0:

bot_bottle/backend/firecracker/infra.py

@@ -67,17 +67,9 @@ class FirecrackerInfraService(InfraService):
             # holds the signing key) mints the role-scoped `gateway` JWT for the
             # gateway, which never sees the key (#469).
             orchestrator.ensure_running(startup_timeout=startup_timeout)
-            cold_booted = self.gateway().connect_to_orchestrator(
+            self.gateway().connect_to_orchestrator(
                 orchestrator.gateway_url(), orchestrator.mint_gateway_token())
             infra_vm.record_booted_version(want)
-            # The fresh gateway rootfs minted a new CA and lost every bottle's
-            # git-gate/token state; reconcile the already-running bottles against
-            # it so a gateway rebuild doesn't silently break their egress
-            # (PRD 0081). Cold-boot only — the adopt fast-paths above never reach
-            # here, so a healthy current gateway is left untouched.
-            if cold_booted:
-                from .backend import FirecrackerBottleBackend
-                FirecrackerBottleBackend().attach_bottled_agents_to_gateway()
             return url
 
     def stop(self) -> None:

bot_bottle/backend/firecracker/infra_artifact.py

@@ -41,8 +41,6 @@ from ... import resources
 from ...log import die, info
 from . import util
 
-ARTIFACT_HTTP_TIMEOUT_SECONDS = 30.0
-
 # Bump if the on-disk artifact *format* changes (compression, layout) so a new
 # scheme can't collide with a cached/published artifact of the old one.
 _ARTIFACT_FORMAT = "1"
@@ -51,18 +49,9 @@ _ARTIFACT_FORMAT = "1"
 # from its own generic package; the Dockerfiles baked into each differ (only the
 # orchestrator rootfs carries buildah), so the versions are hashed separately.
 ROLES = ("orchestrator", "gateway")
-_BUILD_INPUTS = {
-    "orchestrator": (
-        "image-build-args.json",
-        "Dockerfile.orchestrator",
-        "Dockerfile.orchestrator.fc",
-        "requirements.orchestrator.lock",
-    ),
-    "gateway": (
-        "image-build-args.json",
-        "Dockerfile.gateway",
-        "requirements.gateway.lock",
-    ),
+_DOCKERFILES = {
+    "orchestrator": ("Dockerfile.orchestrator", "Dockerfile.orchestrator.fc"),
+    "gateway": ("Dockerfile.gateway",),
 }
 
 _DEFAULT_BASE = "https://gitea.dideric.is"
@@ -112,7 +101,7 @@ def infra_artifact_version(
         h.update(str(path.relative_to(repo_root)).encode())
         h.update(b"\0")
         h.update(path.read_bytes())
-    for name in _BUILD_INPUTS[role]:
+    for name in _DOCKERFILES[role]:
         h.update(name.encode())
         h.update(b"\0")
         h.update((repo_root / name).read_bytes())
@@ -166,9 +155,7 @@ def _download(url: str, dest: Path) -> None:
     """Stream `url` to `dest` (atomic via a `.part` sibling)."""
     tmp = dest.with_suffix(dest.suffix + ".part")
     try:
-        with urllib.request.urlopen(
-            _open(url), timeout=ARTIFACT_HTTP_TIMEOUT_SECONDS,
-        ) as resp, open(tmp, "wb") as out:
+        with urllib.request.urlopen(_open(url)) as resp, open(tmp, "wb") as out:
             shutil.copyfileobj(resp, out, _CHUNK)
     except urllib.error.HTTPError as e:
         tmp.unlink(missing_ok=True)

bot_bottle/backend/firecracker/infra_vm.py

@@ -133,15 +133,10 @@ def build_infra_images_with_docker() -> None:
     root = str(resources.build_root())
     docker_mod.build_image(
         _ORCHESTRATOR_IMAGE, root, dockerfile="Dockerfile.orchestrator")
-    orchestrator_base = docker_mod.pinned_local_image_ref(_ORCHESTRATOR_IMAGE)
     docker_mod.build_image(
         _GATEWAY_IMAGE, root, dockerfile="Dockerfile.gateway")
     docker_mod.build_image(
-        _ORCHESTRATOR_FC_IMAGE,
-        root,
-        dockerfile="Dockerfile.orchestrator.fc",
-        build_args={"ORCHESTRATOR_BASE_IMAGE": orchestrator_base},
-    )
+        _ORCHESTRATOR_FC_IMAGE, root, dockerfile="Dockerfile.orchestrator.fc")
 
 
 def build_rootfs_dir(role: str) -> Path:
@@ -204,7 +199,7 @@ def boot_vm(
     Records the PID."""
     if not netpool.tap_present(slot.iface):
         die(f"infra link {slot.iface} not present.\n"
-            f"    bot-bottle backend setup --backend=firecracker")
+            f"    ./cli.py backend setup --backend=firecracker")
 
     run_dir.mkdir(parents=True, exist_ok=True)
     rootfs = run_dir / "rootfs.ext4"

bot_bottle/backend/firecracker/isolation_probe.py

@@ -108,7 +108,7 @@ def verify_isolation(private_key: Path, guest_ip: str) -> None:
         die(f"ISOLATION FAILURE: the VM reached the host canary "
             f"{canary_ip}:{canary_port}. The egress boundary is not in "
             f"force — refusing to run the agent (fail-closed). Verify the "
-            f"nft table with: bot-bottle backend setup --backend=firecracker")
+            f"nft table with: ./cli.py backend setup --backend=firecracker")
     if result.returncode == 2:
         die("isolation probe inconclusive: the guest has no python3/bash/nc "
             "to run the connectivity test. Refusing to continue "

bot_bottle/backend/firecracker/launch.py

@@ -46,12 +46,12 @@ from ...log import die, info, warn
 from ...supervisor.types import SUPERVISE_PORT
 from ..docker.egress import EGRESS_PORT
 from ..util import AGENT_CA_BUNDLE, AGENT_CA_PATH
-from . import firecracker_vm, image_builder, isolation_probe, lifecycle_lock, netpool, util
+from . import firecracker_vm, image_builder, isolation_probe, netpool, util
 from .bottle import FirecrackerBottle
 from .bottle_plan import FirecrackerBottlePlan
 from ...orchestrator.store.config_store import resolve_teardown_timeout
 from ...orchestrator.store.secret_store import ENV_VAR_SECRET_NAME
-from .infra_launch import (
+from .consolidated_launch import (
     launch_consolidated,
     persist_env_var_secret,
     deprovision_consolidated,
@@ -164,29 +164,25 @@ def launch(
         )
 
         # Step 6: build the per-bottle rootfs + SSH key, then boot.
-        # Cleanup takes the same lock while refreshing its process snapshot.
-        # Hold it until the VMM exists so a newly-created run dir can never be
-        # mistaken for an orphan in the build-before-boot window.
-        with lifecycle_lock.hold():
-            run_dir = util.cache_dir() / "run" / plan.slug
-            run_dir.mkdir(parents=True, exist_ok=True)
-            # Remove the run dir on teardown so the per-bottle rootfs.ext4 (~1G)
-            # doesn't leak. Registered before vm.terminate below so it runs
-            # *after* it (ExitStack is LIFO).
-            stack.callback(lambda: shutil.rmtree(run_dir, ignore_errors=True))
-            rootfs = run_dir / "rootfs.ext4"
-            util.build_rootfs_ext4(agent_base, rootfs)
-            private_key, pubkey = util.generate_keypair(run_dir)
+        run_dir = util.cache_dir() / "run" / plan.slug
+        run_dir.mkdir(parents=True, exist_ok=True)
+        # Remove the run dir on teardown so the per-bottle rootfs.ext4 (~1G)
+        # doesn't leak. Registered before vm.terminate below so it runs *after*
+        # it (ExitStack is LIFO): the VM is gone before we rm its rootfs.
+        stack.callback(lambda: shutil.rmtree(run_dir, ignore_errors=True))
+        rootfs = run_dir / "rootfs.ext4"
+        util.build_rootfs_ext4(agent_base, rootfs)
+        private_key, pubkey = util.generate_keypair(run_dir)
 
-            vm = firecracker_vm.boot(
-                name=plan.container_name,
-                rootfs=rootfs,
-                tap=slot.iface,
-                guest_ip=slot.guest_ip,
-                host_ip=slot.host_ip,
-                pubkey=pubkey,
-                run_dir=run_dir,
-            )
+        vm = firecracker_vm.boot(
+            name=plan.container_name,
+            rootfs=rootfs,
+            tap=slot.iface,
+            guest_ip=slot.guest_ip,
+            host_ip=slot.host_ip,
+            pubkey=pubkey,
+            run_dir=run_dir,
+        )
         stack.callback(vm.terminate)
         firecracker_vm.wait_for_ssh(vm, private_key)
         persist_env_var_secret(private_key, slot.guest_ip, ctx.env_var_secret)

bot_bottle/backend/firecracker/lifecycle_lock.py

@@ -1,30 +0,0 @@
-"""Serialize Firecracker run-directory creation with orphan cleanup."""
-
-from __future__ import annotations
-
-import fcntl
-from contextlib import contextmanager
-from pathlib import Path
-from typing import Generator
-
-from . import util
-
-
-def _lock_path() -> Path:
-    return util.cache_dir() / "run.lifecycle.lock"
-
-
-@contextmanager
-def hold() -> Generator[None]:
-    """Exclude cleanup while a launch directory lacks a visible VMM."""
-    path = _lock_path()
-    path.parent.mkdir(parents=True, exist_ok=True)
-    with path.open("a", encoding="utf-8") as handle:
-        fcntl.flock(handle, fcntl.LOCK_EX)
-        try:
-            yield
-        finally:
-            fcntl.flock(handle, fcntl.LOCK_UN)
-
-
-__all__ = ["hold"]

bot_bottle/backend/firecracker/netpool.py

@@ -3,7 +3,7 @@ config renderers (shell command + NixOS module) shown to operators.
 
 The Firecracker backend needs a privileged one-time network setup:
 a pool of point-to-point TAP devices (owned by the invoking user, so
-`bot-bottle start` never needs root) and a dedicated nftables table that
+`./cli.py start` never needs root) and a dedicated nftables table that
 isolates every VM. The pool parameters live in exactly one place —
 `netpool.defaults.env`, a plain KEY=VALUE file next to this module —
 and every consumer reads *that*: this module (below), the shell script
@@ -177,20 +177,14 @@ def gw_slot() -> Slot:
 # --- fail-closed verification ---------------------------------------
 
 def _run_ok(argv: list[str]) -> bool:
-    """Run a probe command, treating an unavailable binary as failure
+    """Run a probe command, treating a missing binary as failure
     (rather than crashing) so callers can stay fail-closed."""
     try:
         return subprocess.run(
             argv, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
             check=False,
         ).returncode == 0
-    except OSError:
-        # Not only "missing". A name on PATH that isn't executable by this
-        # user raises PermissionError, and CPython reports that EACCES in
-        # preference to the ENOENT from the other PATH entries — which is
-        # how `doctor` came to die with a traceback on a fresh macOS
-        # account. Any OSError means the probe couldn't run, which for a
-        # fail-closed check is indistinguishable from "not present".
+    except FileNotFoundError:
         return False
 
 
@@ -250,9 +244,7 @@ def overlapping_routes() -> list[RouteConflict]:
             ["ip", "-json", "route", "show", "table", "all"],
             capture_output=True, text=True, check=False,
         )
-    except OSError:
-        # Missing, or present-but-not-executable for this user; either way
-        # there are no routes we can enumerate. See _run_ok.
+    except FileNotFoundError:
         return []
     if proc.returncode != 0 or not proc.stdout.strip():
         return []
@@ -315,11 +307,11 @@ def allocate(slug: str) -> tuple[Slot, IO[str]]:
         return s, handle
     die(f"Firecracker TAP pool exhausted ({pool_size()} slots, all in "
         f"use). Stop a running bottle or raise BOT_BOTTLE_FC_POOL_SIZE "
-        f"and re-run `bot-bottle backend setup --backend=firecracker`.")
+        f"and re-run `./cli.py backend setup --backend=firecracker`.")
     raise AssertionError("unreachable")
 
 
-# --- config renderers (shown by `bot-bottle backend setup`) -----------
+# --- config renderers (shown by `./cli.py backend setup`) -----------
 
 # The persistent unit is the portable install: the same systemd oneshot
 # on every systemd distro (Debian/Ubuntu/Fedora/RHEL/Arch/…).

bot_bottle/backend/firecracker/publish_infra.py

@@ -34,7 +34,6 @@ from pathlib import Path
 from . import infra_artifact, infra_vm, util
 
 _CHUNK = 1 << 20
-_REGISTRY_HTTP_TIMEOUT_SECONDS = 30.0
 
 _GZ_NAME = "rootfs.ext4.gz"
 _SHA_NAME = "rootfs.ext4.gz.sha256"
@@ -92,9 +91,7 @@ def _put(url: str, body: "bytes | Path", token: str) -> None:
         req.add_header("Authorization", f"token {token}")
     req.add_header("Content-Type", "application/octet-stream")
     try:
-        with urllib.request.urlopen(
-            req, timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ) as resp:
+        with urllib.request.urlopen(req) as resp:
             print(f"  uploaded {url} (HTTP {resp.status})")
     except urllib.error.HTTPError as e:
         if e.code == 409:
@@ -115,9 +112,7 @@ def _delete(url: str, token: str) -> None:
     if token:
         req.add_header("Authorization", f"token {token}")
     try:
-        with urllib.request.urlopen(
-            req, timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ):
+        with urllib.request.urlopen(req):
             pass
     except urllib.error.HTTPError as e:
         if e.code != 404:
@@ -156,10 +151,7 @@ def _try_download_published(role: str, role_dir: Path) -> str | None:
     version = _role_version(role)
     sha_url = infra_artifact.artifact_url(version, _SHA_NAME, role=role)
     try:
-        with urllib.request.urlopen(
-            infra_artifact._open(sha_url),
-            timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ):
+        with urllib.request.urlopen(infra_artifact._open(sha_url)):
             pass
     except urllib.error.HTTPError as e:
         if e.code == 404:
@@ -203,10 +195,7 @@ def _publish_bundle(role: str, role_dir: Path, token: str) -> str:
     # present, a re-publish is a no-op. Otherwise clear any partial upload left
     # by an interrupted prior attempt and upload the complete set.
     try:
-        with urllib.request.urlopen(
-            infra_artifact._open(sha_url),
-            timeout=_REGISTRY_HTTP_TIMEOUT_SECONDS,
-        ) as resp:
+        with urllib.request.urlopen(infra_artifact._open(sha_url)) as resp:
             remote_sha = resp.read().decode("utf-8").split()[0].strip().lower()
     except urllib.error.HTTPError as e:
         if e.code != 404:

bot_bottle/backend/firecracker/setup.py

@@ -8,7 +8,7 @@ bundled setup script. `status()` reports what's present, including
 whether the pool range collides with an existing route.
 
 Called through `FirecrackerBottleBackend.setup` / `.status`, which the
-generic `bot-bottle backend {setup,status}` command dispatches to.
+generic `./cli.py backend {setup,status}` command dispatches to.
 """
 
 from __future__ import annotations
@@ -34,7 +34,7 @@ _UNIT_PATH = Path("/etc/systemd/system") / netpool.SYSTEMD_UNIT
 
 def _owner() -> str:
     # Under `sudo`, USER is root but SUDO_USER is the real invoker — the
-    # TAPs must be owned by them so `bot-bottle start` stays rootless.
+    # TAPs must be owned by them so `./cli.py start` stays rootless.
     return os.environ.get("SUDO_USER") or os.environ.get("USER") or "youruser"
 
 
@@ -161,7 +161,7 @@ def _setup_systemd() -> None:
         if rc == 0:
             sys.stderr.write(
                 f"Installed and started {netpool.SYSTEMD_UNIT}. Verify with "
-                f"`bot-bottle backend status --backend=firecracker`.\n"
+                f"`./cli.py backend status --backend=firecracker`.\n"
             )
         else:
             sys.stderr.write(
@@ -181,7 +181,7 @@ def _setup_systemd() -> None:
     )
     sys.stderr.write(
         f"\n(Or re-run this as root to install it directly: "
-        f"sudo bot-bottle backend setup --backend=firecracker)\n"
+        f"sudo ./cli.py backend setup --backend=firecracker)\n"
     )
 
 
@@ -334,7 +334,7 @@ def status() -> int:
         sys.stderr.write(f"range overlap: none (base {netpool.ip_base()})\n")
     _report_persistence()
     if not ok:
-        sys.stderr.write("\nRun: bot-bottle backend setup --backend=firecracker\n")
+        sys.stderr.write("\nRun: ./cli.py backend setup --backend=firecracker\n")
     return 0 if ok else 1
 
 

bot_bottle/backend/firecracker/util.py

@@ -9,7 +9,7 @@ generation.
 
 The privileged network setup (TAP pool + nft table) is a one-time
 operator step — see `netpool.py`, `scripts/firecracker-netpool.sh`,
-and `bot-bottle backend setup --backend=firecracker`.
+and `./cli.py backend setup --backend=firecracker`.
 """
 
 from __future__ import annotations
@@ -132,18 +132,18 @@ def _require_network_pool() -> None:
              f"{netpool.pool_size()} slots) overlaps existing routes: "
              f"{detail}. This can shadow or be shadowed by that route; "
              f"set BOT_BOTTLE_FC_IP_BASE to a free range and re-run "
-             f"bot-bottle backend setup --backend=firecracker.")
+             f"./cli.py backend setup --backend=firecracker.")
     missing = netpool.missing_taps()
     if missing:
         die(f"network pool incomplete — missing TAP devices: "
-            f"{', '.join(missing)}.\n    bot-bottle backend setup --backend=firecracker")
+            f"{', '.join(missing)}.\n    ./cli.py backend setup --backend=firecracker")
     if shutil.which("nft") is not None and not netpool.nft_table_present():
         # nft is queryable and says the table is absent — that's a
         # definite, catchable misconfiguration; fail early.
         warn(f"isolation table `inet {netpool.NFT_TABLE}` not found via nft. "
              "If this is a permissions issue it will be re-checked "
              "empirically after boot; otherwise run: "
-             "bot-bottle backend setup --backend=firecracker")
+             "./cli.py backend setup --backend=firecracker")
 
 
 # --- rootfs pipeline (rootless) -------------------------------------

bot_bottle/backend/freeze.py

@@ -43,7 +43,7 @@ class Freezer(ABC):
 
         Calls _freeze for the backend-specific snapshot, then writes the
         committed image reference to per-bottle state and marks the bottle
-        preserved so the next `bot-bottle resume` boots from the snapshot.
+        preserved so the next `./cli.py resume` boots from the snapshot.
 
         Raises CommitCancelled if the user declines an interactive
         confirmation prompt (e.g. the macos-container stop prompt).
@@ -51,7 +51,7 @@ class Freezer(ABC):
         image_ref = self._freeze(agent)
         write_committed_image(agent.slug, image_ref)
         mark_preserved(agent.slug)
-        info(f"to resume from this snapshot: bot-bottle resume {agent.slug}")
+        info(f"to resume from this snapshot: ./cli.py resume {agent.slug}")
         self._export_hint(agent.slug, image_ref)
 
     @abstractmethod

bot_bottle/backend/gateway_attach.py

@@ -1,54 +0,0 @@
-"""The shared gateway-attach reconcile flow (PRD 0081).
-
-`BottleBackend.attach_bottled_agents_to_gateway()` delegates here so every
-backend reconciles running bottles against a freshly-booted gateway *the same
-way* — the control flow + fail-hard policy live in one place and backends
-override only the primitives (see ADR 0006). Kept out of `backend/base.py` so
-the backend contract module stays lean (the base.py size guardrail).
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import TYPE_CHECKING, Any
-
-from .base import InfraLaunchError
-
-if TYPE_CHECKING:
-    from .base import BottleBackend
-
-
-@dataclass(frozen=True)
-class GatewayAttachResources:
-    """Everything a running bottle needs to (re)attach to the current gateway on
-    a cold boot (PRD 0081). Gathered once per reconcile and handed to every
-    bottle. The CA now; egress secrets and git-gate state join as the reconcile
-    grows (#516)."""
-
-    ca_pem: str
-
-
-def reconcile_running_bottles(backend: "BottleBackend[Any, Any, Any]") -> None:
-    """Reconcile every already-running bottle against the freshly-(re)booted
-    gateway: gather the attach resources once, then attach every live bottle.
-
-    Fail hard, never skip: a bottle that silently can't reach the fresh gateway
-    (its egress just starts failing TLS) is worse than a loud bring-up failure,
-    so any attach failure aborts bring-up. Every bottle is attempted first and
-    the failures are raised together, so one bring-up surfaces the full blast
-    radius rather than one bottle at a time."""
-    resources = backend._gateway_attach_resources()
-    failures: list[str] = []
-    for bottle in backend._running_bottles():
-        try:
-            backend._attach_bottle_to_gateway(bottle, resources)
-        except InfraLaunchError as exc:
-            failures.append(str(exc))
-    if failures:
-        raise InfraLaunchError(
-            f"could not attach {len(failures)} running bottle(s) to the "
-            f"freshly-booted gateway:\n  " + "\n  ".join(failures)
-        )
-
-
-__all__ = ["GatewayAttachResources", "reconcile_running_bottles"]

bot_bottle/backend/macos_container/backend.py

@@ -14,7 +14,6 @@ from ...git_gate import GitGatePlan
 from ...supervisor.plan import SupervisePlan
 from ...manifest import Manifest
 from .. import ActiveAgent, BottleBackend, BottleImages, BottleSpec
-from ..gateway_attach import GatewayAttachResources
 from . import cleanup as _cleanup
 from . import enumerate as _enumerate
 from . import launch as _launch
@@ -26,7 +25,7 @@ from .bottle_plan import MacosContainerBottlePlan
 
 
 class MacosContainerBottleBackend(
-    BottleBackend["MacosContainerBottlePlan", "MacosContainerBottleCleanupPlan", str]
+    BottleBackend["MacosContainerBottlePlan", "MacosContainerBottleCleanupPlan"]
 ):
     """Apple Container backend. Selected by
     `BOT_BOTTLE_BACKEND=macos-container` or
@@ -118,19 +117,5 @@ class MacosContainerBottleBackend(
     def enumerate_active(self) -> Sequence[ActiveAgent]:
         return _enumerate.enumerate_active()
 
-    def _gateway_attach_resources(self) -> GatewayAttachResources:
-        from .infra import MacosInfraService
-        return GatewayAttachResources(ca_pem=MacosInfraService().ca_cert_pem())
-
-    def _running_bottles(self) -> Sequence[str]:
-        from .infra_launch import running_agent_containers
-        return running_agent_containers()
-
-    def _attach_bottle_to_gateway(
-        self, bottle: str, resources: GatewayAttachResources,
-    ) -> None:
-        from .infra_launch import push_ca_to_container
-        push_ca_to_container(bottle, resources.ca_pem)
-
     def supervise_mcp_url(self, plan: MacosContainerBottlePlan) -> str:
         return plan.agent_supervise_url

bot_bottle/backend/macos_container/bottle_cleanup_plan.py

@@ -25,11 +25,3 @@ class MacosContainerBottleCleanupPlan(BottleCleanupPlan):
     @property
     def empty(self) -> bool:
         return not self.containers and not self.networks
-
-    def intersect(self, current: BottleCleanupPlan) -> "MacosContainerBottleCleanupPlan":
-        if not isinstance(current, MacosContainerBottleCleanupPlan):
-            raise TypeError("cleanup plans must have the same backend type")
-        return MacosContainerBottleCleanupPlan(
-            containers=tuple(x for x in self.containers if x in current.containers),
-            networks=tuple(x for x in self.networks if x in current.networks),
-        )

bot_bottle/backend/macos_container/cleanup.py

@@ -4,9 +4,7 @@ from __future__ import annotations
 
 import subprocess
 
-from .. import EnumerationError
-from ..cleanup_control import CleanupFailures
-from ...log import info
+from ...log import info, warn
 from . import util as container_mod
 from .bottle_cleanup_plan import MacosContainerBottleCleanupPlan
 
@@ -21,8 +19,8 @@ def _list_prefixed_containers() -> list[str]:
         check=False,
     )
     if result.returncode != 0:
-        detail = result.stderr.strip() or f"exit {result.returncode}"
-        raise EnumerationError(f"container list failed: {detail}")
+        warn(f"container list failed: {result.stderr.strip()}")
+        return []
     return sorted(
         name for name in (line.strip() for line in result.stdout.splitlines())
         if name.startswith(_PREFIX)
@@ -37,8 +35,7 @@ def _list_prefixed_networks() -> list[str]:
         check=False,
     )
     if result.returncode != 0:
-        detail = result.stderr.strip() or f"exit {result.returncode}"
-        raise EnumerationError(f"container network list failed: {detail}")
+        return []
     return sorted(
         name for name in (line.strip() for line in result.stdout.splitlines())
         if name.startswith(_PREFIX)
@@ -54,17 +51,19 @@ def prepare_cleanup() -> MacosContainerBottleCleanupPlan:
 
 
 def cleanup(plan: MacosContainerBottleCleanupPlan) -> None:
-    failures = CleanupFailures()
     for name in plan.containers:
         info(f"container delete --force {name}")
-        failures.run(
+        subprocess.run(
             ["container", "delete", "--force", name],
-            f"deleting container {name}",
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
         )
     for name in plan.networks:
         info(f"container network delete {name}")
-        failures.run(
+        subprocess.run(
             ["container", "network", "delete", name],
-            f"deleting network {name}",
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
         )
-    failures.raise_if_any()

bot_bottle/backend/macos_container/consolidated_launch.py

@@ -34,7 +34,6 @@ every real command arrives through `container exec`.
 
 from __future__ import annotations
 
-import tempfile
 from dataclasses import dataclass
 
 from ...egress import EgressPlan
@@ -43,9 +42,7 @@ from ...log import info
 from ...orchestrator.client import OrchestratorClient, OrchestratorClientError
 from ...orchestrator.reprovision import reprovision_bottles
 from ...orchestrator.store.secret_store import ENV_VAR_SECRET_NAME
-from ..base import InfraLaunchError
 from ..provision_bottle import deprovision_bottle, provision_bottle
-from ..util import AGENT_CA_PATH
 from . import util as container_mod
 from .enumerate import CONTAINER_NAME_PREFIX, EnumerationError, enumerate_active
 from .gateway import GATEWAY_NETWORK
@@ -53,6 +50,10 @@ from .gateway_transport import MacosGatewayTransport
 from .infra import MacosInfraService, OrchestratorStartError
 
 
+class ConsolidatedLaunchError(RuntimeError):
+    """The consolidated register/provision sequence could not complete."""
+
+
 @dataclass(frozen=True)
 class GatewayEndpoint:
     """What the agent `container run` needs to reach the shared gateway.
@@ -97,52 +98,6 @@ def ensure_gateway(
     return endpoint
 
 
-def running_agent_containers() -> list[str]:
-    """Every running agent container's name — the bottles the bring-up reconcile
-    attaches to the fresh gateway (PRD 0081). Raises `EnumerationError` if the
-    live set can't be determined (fail hard rather than reconcile a partial
-    set)."""
-    return [f"{CONTAINER_NAME_PREFIX}{agent.slug}" for agent in enumerate_active()]
-
-
-def push_ca_to_container(name: str, ca_pem: str) -> None:
-    """(Re)attach one running agent container to the current gateway: replace
-    its trusted gateway CA with `ca_pem` and rebuild its trust store via
-    `container cp` + `container exec` (PRD 0081). Unconditional install — there
-    is one gateway, so no fingerprint match is needed.
-
-    Fail hard: raises `InfraLaunchError` (naming the container) on any failure —
-    the base reconcile aggregates and surfaces it rather than leaving the agent
-    silently unable to reach the gateway."""
-    mkdir = container_mod.run_container_argv(
-        ["container", "exec", name, "mkdir", "-p",
-         "/usr/local/share/ca-certificates"]
-    )
-    if mkdir.returncode != 0:
-        raise InfraLaunchError(
-            f"CA push to {name} failed (mkdir): {(mkdir.stderr or '').strip()}"
-        )
-    with tempfile.NamedTemporaryFile("w", suffix=".crt") as tmp:
-        tmp.write(ca_pem)
-        tmp.flush()
-        cp = container_mod.run_container_argv(
-            ["container", "cp", tmp.name, f"{name}:{AGENT_CA_PATH}"]
-        )
-    if cp.returncode != 0:
-        raise InfraLaunchError(
-            f"CA push to {name} failed (cp): {(cp.stderr or '').strip()}"
-        )
-    ex = container_mod.run_container_argv(
-        ["container", "exec", name, "sh", "-c",
-         f"chmod 644 {AGENT_CA_PATH} && update-ca-certificates"]
-    )
-    if ex.returncode != 0:
-        raise InfraLaunchError(
-            f"CA push to {name} failed (update-ca-certificates): "
-            f"{(ex.stderr or '').strip()}"
-        )
-
-
 def _reprovision_running_bottles(endpoint: GatewayEndpoint) -> None:
     """Recover keys from live Apple containers and restore gateway tokens."""
     try:
@@ -245,12 +200,10 @@ __all__ = [
     "GatewayEndpoint",
     "LaunchContext",
     "ensure_gateway",
-    "running_agent_containers",
-    "push_ca_to_container",
     "live_source_ips",
     "register_agent",
     "deprovision_consolidated",
-    "InfraLaunchError",
+    "ConsolidatedLaunchError",
     "OrchestratorStartError",
     "GATEWAY_NETWORK",
 ]

bot_bottle/backend/macos_container/enumerate.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import subprocess
 
 from ...bottle_state import read_metadata
-from .. import ActiveAgent, EnumerationError
+from .. import ActiveAgent
 from .infra import INFRA_NAME, ORCHESTRATOR_NAME
 
 # The name every agent container carries: `bot-bottle-<slug>`. Exported
@@ -20,18 +20,17 @@ CONTAINER_NAME_PREFIX = "bot-bottle-"
 _INFRA_NAMES = frozenset({INFRA_NAME, ORCHESTRATOR_NAME})
 
 
+class EnumerationError(RuntimeError):
+    """container list failed; the resulting live set is not authoritative."""
+
+
 def enumerate_active() -> list[ActiveAgent]:
-    try:
-        result = subprocess.run(
-            ["container", "list", "--quiet"],
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-    except FileNotFoundError as exc:
-        raise EnumerationError(
-            "container list failed: container CLI not found"
-        ) from exc
+    result = subprocess.run(
+        ["container", "list", "--quiet"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
     if result.returncode != 0:
         raise EnumerationError(
             f"container list failed: "

bot_bottle/backend/macos_container/gateway.py

@@ -104,15 +104,11 @@ class MacosGateway(Gateway):
         container_mod.build_image(
             self.image_ref, str(self._repo_root), dockerfile="Dockerfile.gateway")
 
-    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> bool:
+    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> None:
         """Bind the gateway to this orchestrator and (re)start it, dual-homed on
         the agent + control networks, resolving policy against `orchestrator_url`
         (the orchestrator's control-network address — Apple has no container
-        DNS) and presenting `gateway_token`.
-
-        Always returns True: this recreates the gateway container unconditionally
-        (a cold boot), so the caller reconciles running bottles against it
-        (PRD 0081)."""
+        DNS) and presenting `gateway_token`."""
         self._orchestrator_url = orchestrator_url
         self._gateway_token = gateway_token
         # Fail closed on a missing policy source or token: the resolver-only data
@@ -160,7 +156,6 @@ class MacosGateway(Gateway):
                 f"gateway container failed to start: "
                 f"{(result.stderr or '').strip() or '<no stderr>'}"
             )
-        return True
 
     def is_running(self) -> bool:
         return container_mod.container_is_running(self.name)

bot_bottle/backend/macos_container/infra.py

@@ -138,15 +138,7 @@ class MacosInfraService(InfraService):
         # `gateway` JWT and hands it to the gateway, which never sees the key
         # (#469).
         url = orchestrator.url()
-        cold_booted = gateway.connect_to_orchestrator(
-            url, orchestrator.mint_gateway_token())
-        # A (re)created gateway container minted/mounted its CA afresh and lost
-        # every bottle's per-bottle state; reconcile the already-running bottles
-        # against it (PRD 0081). Skipped when a healthy current gateway was left
-        # untouched — no cold boot, nothing to reconcile.
-        if cold_booted:
-            from .backend import MacosContainerBottleBackend
-            MacosContainerBottleBackend().attach_bottled_agents_to_gateway()
+        gateway.connect_to_orchestrator(url, orchestrator.mint_gateway_token())
         return url
 
     def ca_cert_pem(self, *, timeout: float = DEFAULT_CA_TIMEOUT_SECONDS) -> str:

bot_bottle/backend/macos_container/launch.py

@@ -5,7 +5,7 @@ proxies egress through the one per-host gateway, replacing the per-bottle
 companion container removed in #385.
 
 The order differs from docker's, forced by Apple Container 1.0.0 having no
-`--ip` (see `infra_launch`): the agent is started *before* it is
+`--ip` (see `consolidated_launch`): the agent is started *before* it is
 registered, because its DHCP-assigned address — the attribution key — does not
 exist until then.
 
@@ -64,7 +64,7 @@ from . import nested_containers as nested_containers_mod
 from .bottle_plan import MacosContainerBottlePlan
 from ...orchestrator.store.config_store import resolve_teardown_timeout
 from ...orchestrator.store.secret_store import ENV_VAR_SECRET_NAME, new_env_var_secret
-from .infra_launch import (
+from .consolidated_launch import (
     GatewayEndpoint,
     ensure_gateway,
     register_agent,
@@ -107,8 +107,7 @@ def _layer_nested_containers(
     """
     if not plan.nested_containers:
         return agent_image
-    pinned_base = container_mod.pinned_local_image_ref(agent_image)
-    derived = f"{pinned_base}{nested_containers_mod.IMAGE_SUFFIX}"
+    derived = f"{agent_image}{nested_containers_mod.IMAGE_SUFFIX}"
     if plan.spec.image_policy == "cached":
         if not container_mod.image_exists(derived):
             die(
@@ -117,10 +116,7 @@ def _layer_nested_containers(
             )
         info(f"using cached nested-container image {derived!r}")
         return derived
-    return nested_containers_mod.build_image(
-        pinned_base,
-        container_mod.build_image,
-    )
+    return nested_containers_mod.build_image(agent_image, container_mod.build_image)
 
 
 @contextmanager

bot_bottle/backend/macos_container/nested_containers.py

@@ -55,7 +55,7 @@ _GUEST_DEVICES = ("/dev/fuse", "/dev/net/tun")
 
 
 def build_image(
-    pinned_base: str,
+    base_image: str,
     build: Callable[..., None],
 ) -> str:
     """Layer the nested-container tooling onto an already-built agent image.
@@ -66,15 +66,14 @@ def build_image(
     # TODO(#394): replace this hand-rolled Dockerfile with a docker-layer
     # abstraction once that infrastructure exists.
     """
-    image = f"{pinned_base}{IMAGE_SUFFIX}"
+    image = f"{base_image}{IMAGE_SUFFIX}"
     init_script = Path(__file__).with_name("nested-containers-init.sh")
     with tempfile.TemporaryDirectory(prefix="bot-bottle-nested-containers.") as tmp:
         context = Path(tmp)
         shutil.copy2(init_script, context / "nested-containers-init.sh")
         (context / "Dockerfile").write_text(
-            "ARG DOCKER_CLI_BASE_IMAGE\n"
-            "FROM ${DOCKER_CLI_BASE_IMAGE} AS docker_cli\n"
-            f"FROM {pinned_base}\n"
+            "FROM docker:28-cli AS docker_cli\n"
+            f"FROM {base_image}\n"
             "USER root\n"
             "COPY --from=docker_cli /usr/local/bin/docker /usr/local/bin/docker\n"
             "COPY --from=docker_cli /usr/local/libexec/docker/cli-plugins/"

bot_bottle/backend/macos_container/setup.py

@@ -5,7 +5,7 @@ Like Docker, this backend needs no privileged network-pool provisioning
 running. `setup()` points at the install/`container system start` steps;
 `status()` reports readiness. Reached via
 `MacosContainerBottleBackend.setup` / `.status`, dispatched from the
-generic `bot-bottle backend {setup,status}`.
+generic `./cli.py backend {setup,status}`.
 """
 
 from __future__ import annotations
@@ -75,5 +75,5 @@ def status() -> int:
         if not _service_running():
             ok = False
     if not ok:
-        sys.stderr.write("\nRun: bot-bottle backend setup --backend=macos-container\n")
+        sys.stderr.write("\nRun: ./cli.py backend setup --backend=macos-container\n")
     return 0 if ok else 1

bot_bottle/backend/macos_container/util.py

@@ -13,7 +13,6 @@ import time
 from datetime import datetime, timezone
 from typing import Iterable
 
-from ... import resources
 from ...log import die, info
 
 
@@ -61,13 +60,7 @@ def dns_server() -> str:
     return _host_ipv4_dns() or _DEFAULT_DNS
 
 
-def build_image(
-    ref: str,
-    context: str,
-    *,
-    dockerfile: str = "",
-    build_args: dict[str, str] | None = None,
-) -> None:
+def build_image(ref: str, context: str, *, dockerfile: str = "") -> None:
     """Build an OCI image with Apple's BuildKit-backed `container build`.
 
     Set `BOT_BOTTLE_NO_CACHE=1` (the `start --no-cache` flag) to force
@@ -90,13 +83,6 @@ def build_image(
         if not os.path.isabs(dockerfile):
             dockerfile = os.path.join(context, dockerfile)
         args.extend(["-f", dockerfile])
-    effective_build_args = resources.image_build_args(
-        dockerfile,
-        context=context,
-    ) if dockerfile else {}
-    effective_build_args.update(build_args or {})
-    for name, value in effective_build_args.items():
-        args.extend(["--build-arg", f"{name}={value}"])
     args.append(context)
     subprocess.run(args, check=True)
 
@@ -682,47 +668,6 @@ def image_id(ref: str) -> str:
     raise AssertionError("unreachable")
 
 
-def pinned_local_image_ref(ref: str) -> str:
-    """Tag a local image with its complete content ID for a stable ``FROM``.
-
-    Agent images are immediately used as bases for the optional
-    nested-containers layer. A content-derived tag prevents another concurrent
-    build from moving the provider's ordinary ``:latest`` tag between those
-    two builds.
-
-    Unlike Docker, `container image tag` only accepts ``image-name[:tag]`` as
-    its source and rejects a bare image ID ("cannot specify 64 byte hex string
-    as reference"), so the mutable ``ref`` is what gets tagged here. The
-    post-tag inspection below is what keeps that fail-closed: if ``ref`` moved
-    between the two commands, the new tag will not resolve to the ID this call
-    derived its name from.
-    """
-    image = image_id(ref)
-    digest = image.removeprefix("sha256:")
-    if len(digest) != 64 or any(char not in "0123456789abcdef" for char in digest):
-        die(f"could not derive a local base tag from invalid image ID {image!r}")
-    repository = ref.split("@", 1)[0]
-    last_slash = repository.rfind("/")
-    last_colon = repository.rfind(":")
-    if last_colon > last_slash:
-        repository = repository[:last_colon]
-    pinned_ref = f"{repository}:sha256-{digest}"
-    result = subprocess.run(
-        [_CONTAINER, "image", "tag", ref, pinned_ref],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        die(
-            f"could not tag exact local image {image} via {ref!r}: "
-            f"{(result.stderr or result.stdout or '').strip() or '<no detail>'}"
-        )
-    if image_id(pinned_ref) != image:
-        die(f"content-derived local tag {pinned_ref!r} did not resolve to {image}")
-    return pinned_ref
-
-
 def image_created_at(ref: str) -> datetime | None:
     """Return the image creation timestamp as an aware UTC datetime, or None
     when the field is absent or unparseable (e.g. FROM-scratch images, images

bot_bottle/backend/preparation.py

@@ -1,124 +0,0 @@
-"""Backend-neutral preparation planner.
-
-This module owns the shared transformation from a CLI ``BottleSpec`` to the
-typed inputs consumed by a concrete backend's ``_resolve_plan``. Backend
-classes retain only their validation/preflight/env hooks and their
-backend-specific final resolution.
-"""
-
-from __future__ import annotations
-
-import os
-from dataclasses import dataclass
-from typing import TYPE_CHECKING, Protocol
-
-from ..agent_provider import AgentProvisionPlan, build_agent_provision_plan, get_provider
-from ..egress import EgressPlan
-from ..env import ResolvedEnv, resolve_env
-from ..git_gate import GitGate, GitGatePlan
-from ..manifest import Manifest
-from ..supervisor.plan import SupervisePlan
-from ..workspace import workspace_plan
-from .resolve_common import (
-    merge_provision_env_vars,
-    mint_slug,
-    prepare_agent_state_dir,
-    prepare_egress,
-    prepare_git_gate,
-    prepare_supervise,
-    reject_nested_containers,
-    resolve_manifest_dockerfile,
-    write_launch_metadata,
-)
-
-if TYPE_CHECKING:
-    from .base import BottleSpec
-
-
-class PreparationBackend(Protocol):
-    """Backend hooks needed by the shared planner."""
-
-    name: str
-    supports_nested_containers: bool
-
-    def _validate(self, spec: BottleSpec) -> Manifest: ...
-    def _preflight(self) -> None: ...
-    def _build_guest_env(self, resolved_env: ResolvedEnv) -> dict[str, str]: ...
-
-
-@dataclass(frozen=True)
-class PreparedBottle:
-    """Typed, backend-neutral result of shared launch preparation."""
-
-    manifest: Manifest
-    slug: str
-    resolved_env: ResolvedEnv
-    agent_provision_plan: AgentProvisionPlan
-    egress_plan: EgressPlan
-    git_gate_plan: GitGatePlan
-    supervise_plan: SupervisePlan | None
-
-
-class BottlePreparationPlanner:
-    """Run the common, side-effect-limited part of bottle preparation."""
-
-    def __init__(self, backend: PreparationBackend) -> None:
-        self._backend = backend
-
-    def prepare(self, spec: BottleSpec) -> PreparedBottle:
-        backend = self._backend
-        # These are deliberately protected backend hooks: only this shared
-        # planner orchestrates them, while concrete backends provide the
-        # implementation.
-        manifest = backend._validate(spec)  # pylint: disable=protected-access
-        if not backend.supports_nested_containers:
-            reject_nested_containers(backend.name, manifest)
-
-        backend._preflight()  # pylint: disable=protected-access
-        manifest = GitGate().preflight_host_keys(
-            manifest,
-            headless=spec.headless,
-            home_md=spec.manifest.home_md,
-        )
-
-        bottle = manifest.bottle
-        provider_config = bottle.agent_provider
-        provider = get_provider(provider_config.template)
-        resolved_env = resolve_env(manifest)
-        workspace = workspace_plan(spec, guest_home=provider.guest_home)
-        slug = mint_slug(spec)
-        write_launch_metadata(slug, spec, compose_project="", backend=backend.name)
-
-        dockerfile = (
-            resolve_manifest_dockerfile(provider_config.dockerfile, spec)
-            if provider_config.dockerfile
-            else str(provider.dockerfile)
-        )
-        agent_dir, prompt_file = prepare_agent_state_dir(slug, manifest)
-        provision = build_agent_provision_plan(
-            template=provider_config.template,
-            dockerfile=dockerfile,
-            state_dir=agent_dir,
-            instance_name=f"bot-bottle-{slug}",
-            prompt_file=prompt_file,
-            guest_env=backend._build_guest_env(  # pylint: disable=protected-access
-                resolved_env
-            ),
-            forward_host_credentials=provider_config.forward_host_credentials,
-            auth_token=provider_config.auth_token,
-            host_env=dict(os.environ),
-            trusted_project_path=workspace.workdir,
-            label=spec.label,
-            color=spec.color,
-            provider_settings=provider_config.settings,
-        )
-        provision = merge_provision_env_vars(provision)
-        return PreparedBottle(
-            manifest=manifest,
-            slug=slug,
-            resolved_env=resolved_env,
-            agent_provision_plan=provision,
-            egress_plan=prepare_egress(bottle, slug, provision),
-            git_gate_plan=prepare_git_gate(bottle, slug),
-            supervise_plan=prepare_supervise(bottle, slug),
-        )

bot_bottle/backend/provision_bottle.py

@@ -2,7 +2,7 @@
 
 Register a bottle with the orchestrator and provision its git-gate state into
 the shared gateway (`provision_bottle`), and the inverse teardown
-(`deprovision_bottle`). Backend-neutral — each backend's infra_launch
+(`deprovision_bottle`). Backend-neutral — each backend's consolidated_launch
 drives these through its own `GatewayTransport` rather than re-implementing
 them. The git-gate half of the work lives in `provision_gateway`.
 """

bot_bottle/backend/provision_gateway.py

@@ -63,23 +63,12 @@ def provision_git_gate(
     transport.exec(["chmod", "+x", "/etc/git-gate/access-hook"])
     creds = _creds_dir(bottle_id)
     transport.exec(["mkdir", "-p", creds])
-    transport.exec(["chmod", "700", creds])
-    credential_paths: list[str] = []
     for u in plan.upstreams:
         if u.identity_file:
-            key_path = f"{creds}/{u.name}-key"
-            transport.cp_into(u.identity_file, key_path)
-            credential_paths.append(key_path)
+            transport.cp_into(u.identity_file, f"{creds}/{u.name}-key")
         known_hosts = str(u.known_hosts_file)
         if known_hosts and known_hosts != ".":
-            known_hosts_path = f"{creds}/{u.name}-known_hosts"
-            transport.cp_into(known_hosts, known_hosts_path)
-            credential_paths.append(known_hosts_path)
-    # Copy-mode behavior differs across Docker, Apple Container, and SSH.
-    # Apply the security contract inside the gateway so every backend produces
-    # the same private credential namespace.
-    if credential_paths:
-        transport.exec(["chmod", "600", *credential_paths])
+            transport.cp_into(known_hosts, f"{creds}/{u.name}-known_hosts")
     # Init the bare repos + per-repo credential config for this namespace.
     script = git_gate_render_provision(bottle_id, plan.upstreams)
     transport.exec(["sh", "-c", script])

bot_bottle/backend/resolve_common.py

@@ -30,7 +30,6 @@ from ..log import die
 from ..manifest import Manifest, ManifestBottle
 from ..supervisor.plan import SupervisePlan
 from ..orchestrator.supervisor import Supervisor
-from ..util import slugify
 from . import BottleSpec
 
 
@@ -45,7 +44,8 @@ def mint_slug(spec: BottleSpec) -> str:
     if spec.identity:
         return spec.identity
     if spec.label:
-        return slugify(spec.label)
+        from .docker import util as docker_mod
+        return docker_mod.slugify(spec.label)
     return bottle_identity(spec.agent_name)
 
 

bot_bottle/backend/selection.py

@@ -26,10 +26,10 @@ from .base import ActiveAgent, BackendStatus, BottleBackend
 # Tests may replace _backends with a {name: fake} dict via patch.object;
 # _get_backends() returns the current module-level value as-is when it
 # is not None, so test fakes take effect without triggering real imports.
-_backends: dict[str, BottleBackend[Any, Any, Any]] | None = None
+_backends: dict[str, BottleBackend[Any, Any]] | None = None
 
 
-def _get_backends() -> dict[str, BottleBackend[Any, Any, Any]]:
+def _get_backends() -> dict[str, BottleBackend[Any, Any]]:
     """Return the registry of all backend instances, loading lazily on first call."""
     global _backends  # pylint: disable=global-statement
     if _backends is None:
@@ -48,7 +48,7 @@ def get_bottle_backend(
     name: str | None = None,
     *,
     prompt: bool = True,
-) -> BottleBackend[Any, Any, Any]:
+) -> BottleBackend[Any, Any]:
     """Resolve the bottle backend.
 
     `name` precedence:
@@ -86,7 +86,7 @@ def _print_vm_install_instructions() -> None:
         info("Then start the service:  container system start")
     else:
         info("Install Firecracker: https://github.com/firecracker-microvm/firecracker/releases")
-        info("Configure the host:  bot-bottle backend setup")
+        info("Configure the host:  ./cli.py backend setup")
 
 
 def _auto_select_backend(prompt: bool = True) -> str:

bot_bottle/cli/commands/backend.py

@@ -1,9 +1,9 @@
 """`backend` CLI command — generic host setup/status across backends.
 
-`bot-bottle backend setup    [--backend=NAME]` provisions (or points at how
+`./cli.py backend setup    [--backend=NAME]` provisions (or points at how
 to provision) the chosen backend's one-time host prerequisites.
-`bot-bottle backend status   [--backend=NAME]` reports readiness.
-`bot-bottle backend teardown [--backend=NAME]` undoes setup (uninstall).
+`./cli.py backend status   [--backend=NAME]` reports readiness.
+`./cli.py backend teardown [--backend=NAME]` undoes setup (uninstall).
 
 All dispatch to the backend's `setup()` / `status()` / `teardown()`
 classmethods, so there are no backend-specific commands — swapping

bot_bottle/cli/commands/cleanup.py

@@ -1,7 +1,7 @@
 """cleanup: stop and remove all orphaned bot-bottle resources.
 
 Walks every registered backend (docker, firecracker, macos-container)
-so a single `bot-bottle cleanup` reaps every backend's leftovers — a
+so a single `./cli.py cleanup` reaps every backend's leftovers — a
 firecracker bottle's VM processes and run dirs won't survive a
 docker-only cleanup pass (issue addressed alongside #77).
 
@@ -22,7 +22,6 @@ from __future__ import annotations
 import sys
 
 from ...backend import get_bottle_backend, has_backend, known_backend_names
-from ...backend.cleanup_control import CleanupError
 from ...log import info
 from ...util import read_tty_line
 
@@ -53,20 +52,10 @@ def cmd_cleanup(_argv: list[str]) -> int:
         info("cleanup: skipped")
         return 0
 
-    # Confirmation authorizes a fresh authoritative snapshot, not blind use of
-    # identities that may have changed while the operator reviewed the preview.
-    failures: list[str] = []
-    for name, backend, displayed in prepared:
-        current = backend.prepare_cleanup()
-        approved = displayed.intersect(current)
-        if approved.empty:
+    for name, backend, plan in prepared:
+        if plan.empty:
             continue
-        try:
-            backend.cleanup(approved)
-        except CleanupError as exc:
-            failures.append(f"{name}: {exc}")
-    if failures:
-        raise CleanupError("cleanup incomplete: " + "; ".join(failures))
+        backend.cleanup(plan)
     info("cleanup: done")
     return 0
 

bot_bottle/cli/commands/commit.py

@@ -4,7 +4,7 @@ Docker bottles are committed to a local Docker image. Macos-container
 bottles are exported and rebuilt as a local Apple Container image.
 Firecracker bottles stream the guest rootfs out over SSH and rebuild a
 local Docker image. The resulting reference is stored in per-bottle
-state so the next `bot-bottle resume <slug>` boots from the snapshot
+state so the next `./cli.py resume <slug>` boots from the snapshot
 instead of rebuilding from the Dockerfile.
 """
 
@@ -37,7 +37,7 @@ def cmd_commit(argv: list[str]) -> int:
     if slug is None:
         active = enumerate_active_agents()
         if not active:
-            die("no active bottles; start one with `bot-bottle start`")
+            die("no active bottles; start one with `./cli.py start`")
         choices = [a.slug for a in active]
         slug = tui.filter_select(choices, title="Select bottle to commit")
         if slug is None:

bot_bottle/cli/commands/resume.py

@@ -8,7 +8,7 @@ override and transcript snapshot under the same state dir.
 
 Use case: an interrupted or preserved bottle needs to be relaunched;
 the operator runs
-    bot-bottle resume <identity>
+    ./cli.py resume <identity>
 to bring up the replacement from the recorded state.
 """
 

bot_bottle/cli/commands/start.py

@@ -25,11 +25,12 @@ from typing import Callable
 from ...agent_provider import get_provider, runtime_for
 from ...backend import (
     Bottle,
-    BottlePlan,
     BottleSpec,
     enumerate_active_agents,
     get_bottle_backend,
 )
+from ...backend.docker import util as docker_mod
+from ...backend.docker.bottle_plan import DockerBottlePlan
 from ...bottle_state import (
     cleanup_state,
     is_preserved,
@@ -39,7 +40,7 @@ from ...image_cache import StaleImageError
 from ...log import info, die
 from ...manifest import Manifest, ManifestIndex
 from ..constants import PROG
-from ...util import read_tty_line, slugify
+from ...util import read_tty_line
 from .. import tui
 
 
@@ -203,19 +204,19 @@ def _start_headless(
     if not os.isatty(stdin_fd):
         die(
             "--headless requires a PTY on stdin; run via:\n"
-            "  script -q /dev/null bot-bottle start ..."
+            "  script -q /dev/null ./cli.py start ..."
         )
 
     agent_name = args.name
     if not agent_name:
-        die("--headless requires an agent name: bot-bottle start <agent> --headless")
+        die("--headless requires an agent name: ./cli.py start <agent> --headless")
     manifest.require_agent(agent_name)  # raises ManifestError if unknown
 
     prompt = args.prompt
     if not prompt:
         die(
             "--headless requires --prompt: "
-            "bot-bottle start <agent> --headless --prompt 'Do the thing'"
+            "./cli.py start <agent> --headless --prompt 'Do the thing'"
         )
 
     if args.bottle:
@@ -256,10 +257,10 @@ def _uniquify_label_headless(label: str) -> str:
     logging the chosen label. Orchestrators fire-and-forget many bottles,
     so silently picking a free name beats erroring on every collision."""
     active_slugs = {a.slug for a in enumerate_active_agents()}
-    if slugify(label) not in active_slugs:
+    if docker_mod.slugify(label) not in active_slugs:
         return label
     n = 2
-    while slugify(f"{label}-{n}") in active_slugs:
+    while docker_mod.slugify(f"{label}-{n}") in active_slugs:
         n += 1
     chosen = f"{label}-{n}"
     info(f"label '{label}' already in use; using '{chosen}'")
@@ -273,11 +274,11 @@ def prepare_with_preflight(
     spec: BottleSpec,
     *,
     stage_dir: Path,
-    render_preflight: Callable[[BottlePlan, str], None],
+    render_preflight: Callable[[DockerBottlePlan, str], None],
     prompt_yes: Callable[[], bool],
     dry_run: bool = False,
     backend_name: str | None = None,
-) -> tuple[BottlePlan | None, str]:
+) -> tuple[DockerBottlePlan | None, str]:
     """Run `backend.prepare`, render the preflight summary via the
     injected callable, prompt y/N via the injected callable.
 
@@ -319,9 +320,9 @@ def attach_agent(
 
     `resume=True` adds `--continue` so claude picks up its most
     recent session non-interactively (no session-picker prompt).
-    First-attach paths (`bot-bottle start`) leave it False.
+    First-attach paths (`./cli.py start`) leave it False.
 
-    Used as the inner step of `bot-bottle start`."""
+    Used as the inner step of `./cli.py start`."""
     runtime = runtime_for(agent_provider_template)
     info(
         f"attaching interactive {agent_provider_template} session "
@@ -354,7 +355,7 @@ def settle_state(identity: str) -> None:
     if not identity:
         return
     if is_preserved(identity):
-        info(f"to resume this bottle: bot-bottle resume {identity}")
+        info(f"to resume this bottle: ./cli.py resume {identity}")
         return
     cleanup_state(identity)
 
@@ -404,7 +405,7 @@ def _resolve_unique_label(label: str, color: str) -> tuple[str, str]:
     in use among running bottles.  Passes through unchanged when no
     collision is found on the first check."""
     while True:
-        slug_candidate = slugify(label)
+        slug_candidate = docker_mod.slugify(label)
         active_slugs = {a.slug for a in enumerate_active_agents()}
         if slug_candidate not in active_slugs:
             return label, color
@@ -431,7 +432,7 @@ def _select_image_policy() -> str | None:
 
 
 def _text_render_preflight():
-    def _render(plan: BottlePlan, backend_name: str) -> None:
+    def _render(plan: DockerBottlePlan, backend_name: str) -> None:
         print(file=sys.stderr)
         print(f"backend: {backend_name}", file=sys.stderr)
         print(_manifest_to_yaml(plan.manifest), file=sys.stderr)

bot_bottle/cli/commands/supervise.py

@@ -110,7 +110,7 @@ def discover_pending() -> list[QueuedProposal]:
 def _approval_status(qp: QueuedProposal, verb: str) -> str:
     """Status-line text after a successful approval."""
     base = f"{verb} {qp.proposal.tool} for [{qp.label}]"
-    return f"{base}; resume: bot-bottle resume {qp.label}"
+    return f"{base}; resume: ./cli.py resume {qp.label}"
 
 
 def _detail_lines(
@@ -368,7 +368,7 @@ def _main_loop(stdscr: "curses._CursesWindow") -> None:  # type: ignore  # pragm
         elif key in (curses.KEY_UP, ord("k")):
             selected = max(selected - 1, 0)
         elif key in (curses.KEY_ENTER, 10, 13):
-            status_line = _detail_view(stdscr, qp, green_attr=green_attr)
+            _detail_view(stdscr, qp, green_attr=green_attr)
         elif key == ord("a"):
             try:
                 status_line = _approve_from_tui(stdscr, qp)
@@ -456,7 +456,7 @@ def _detail_view(
     qp: QueuedProposal,
     *,
     green_attr: int = 0,
-) -> str:  # pragma: no cover
+) -> None:  # pragma: no cover
     """Render the full proposal. Scrollable. Press q to return."""
     lines = _detail_lines(qp, green_attr=green_attr)
     offset = 0
@@ -473,7 +473,7 @@ def _detail_view(
         stdscr.refresh()
         key = stdscr.getch()
         if key in (ord("q"), 27):
-            return ""
+            return
         if key in (curses.KEY_DOWN, ord("j")):
             offset = min(offset + 1, max(0, len(lines) - 1))
         elif key in (curses.KEY_UP, ord("k")):
@@ -484,34 +484,31 @@ def _detail_view(
             offset = max(0, len(lines) - 1)
         elif key == ord("a"):
             try:
-                return _approve_from_tui(stdscr, qp)
-            except ApplyError as exc:
-                return f"apply failed: {exc}"
+                _approve_from_tui(stdscr, qp)
+            except ApplyError:
+                pass
+            return
         elif key == ord("m"):
             if qp.proposal.tool in _REPORT_ONLY_TOOLS:
-                return f"modify unavailable for {qp.proposal.tool}"
+                return
             edited = _modify(stdscr, qp)
-            if edited is None:
-                return "modify aborted (no change)"
-            try:
-                return _approve_from_tui(
-                    stdscr, qp, final_file=edited,
-                    notes="operator modified before approving",
-                )
-            except ApplyError as exc:
-                return f"apply failed: {exc}"
+            if edited is not None:
+                try:
+                    _approve_from_tui(
+                        stdscr, qp, final_file=edited,
+                        notes="operator modified before approving",
+                    )
+                except ApplyError:
+                    pass
+            return
         elif key == ord("r"):
             reason = _prompt(stdscr, "reject reason: ")
             if reason:
                 reject(qp, reason=reason)
-                return f"rejected {qp.proposal.tool} for [{qp.label}]"
-            return "reject aborted (empty reason)"
+            return
 
 
-def _modify(
-    stdscr: "curses._CursesWindow",  # type: ignore
-    qp: QueuedProposal,
-) -> str | None:  # pragma: no cover
+def _modify(stdscr: "curses._CursesWindow", qp: QueuedProposal) -> str | None:  # type: ignore  # pragma: no cover
     """Suspend curses, open $EDITOR on the proposed file, return edited content."""
     suffix = _suffix_for_tool(qp.proposal.tool)
     curses.endwin()

bot_bottle/cli/tui.py

@@ -16,8 +16,6 @@ import os
 import sys
 from typing import Any, Optional
 
-from ..log import debug
-
 
 def filter_multiselect(
     items: list[str],
@@ -44,11 +42,7 @@ def filter_multiselect(
 
     try:
         tty_fd = open(tty_path, "r+b", buffering=0)
-    except OSError as exc:
-        debug(
-            "multi-select unavailable; treating it as cancellation",
-            context={"error_type": type(exc).__name__, "tty": tty_path},
-        )
+    except OSError:
         return None
 
     try:
@@ -79,11 +73,7 @@ def filter_select(
 
     try:
         tty_fd = open(tty_path, "r+b", buffering=0)
-    except OSError as exc:
-        debug(
-            "filter-select unavailable; treating it as cancellation",
-            context={"error_type": type(exc).__name__, "tty": tty_path},
-        )
+    except OSError:
         return None
 
     try:
@@ -139,11 +129,7 @@ def _run_picker(items: list[str], *, title: str, tty_fd: int) -> Optional[str]:
             curses.nocbreak()
             curses.echo()
             curses.endwin()
-    except Exception as exc:  # noqa: W0718 — curses can raise many error types
-        debug(
-            "filter-select display failed; treating it as cancellation",
-            context={"error_type": type(exc).__name__},
-        )
+    except Exception:  # noqa: W0718 — curses can raise many error types
         return None
     finally:
         sys.__stdin__ = orig_stdin    # type: ignore[assignment]
@@ -306,11 +292,7 @@ def _run_multiselect(
             curses.nocbreak()
             curses.echo()
             curses.endwin()
-    except Exception as exc:  # noqa: W0718
-        debug(
-            "multi-select display failed; treating it as cancellation",
-            context={"error_type": type(exc).__name__},
-        )
+    except Exception:  # noqa: W0718
         return None
     finally:
         sys.__stdin__ = orig_stdin    # type: ignore[assignment]
@@ -576,21 +558,13 @@ def name_color_modal(
     """
     try:
         tty_fd = open(tty_path, "r+b", buffering=0)  # pylint: disable=consider-using-with
-    except OSError as exc:
-        debug(
-            "name/color picker unavailable; using defaults",
-            context={"error_type": type(exc).__name__, "tty": tty_path},
-        )
+    except OSError:
         return default_label, ""
 
     try:
         fd_dup = os.dup(tty_fd.fileno())
         return _run_name_color(default_label, tty_fd=fd_dup, disclaimer=disclaimer)
-    except Exception as exc:  # noqa: BLE001  # pylint: disable=broad-exception-caught
-        debug(
-            "name/color picker failed; using defaults",
-            context={"error_type": type(exc).__name__},
-        )
+    except Exception:  # noqa: BLE001  # pylint: disable=broad-exception-caught
         return default_label, ""
     finally:
         tty_fd.close()

bot_bottle/contrib/claude/Dockerfile

@@ -8,17 +8,9 @@
 # Layer ordering is deliberate: the npm install lives in its own layer so
 # changes to the rest of the repo (or to the CMD) don't bust it.
 
-# Version-qualified Node LTS, pinned to its multi-architecture manifest.
-ARG NODE_BASE_IMAGE
-FROM ${NODE_BASE_IMAGE}
-
-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
+# Current Node LTS; slim variant keeps the image small while still
+# providing apt-get for any future additions.
+FROM node:22-trixie-slim
 
 # Install runtime system deps. claude-code shells out to git for several
 # features (status checks, commits, PR creation) — without git in the
@@ -28,7 +20,7 @@ RUN sed -i \
 # HTTPS_PROXY-aware tool (curl itself, plus anything that shells out
 # to it) works against egress's bumped TLS without the agent needing
 # local DNS.
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
   && apt-get install -y --no-install-recommends \
   git \
   ca-certificates \
@@ -43,17 +35,15 @@ RUN apt-get -o Acquire::Check-Valid-Until=false update \
 # (claude-code is a Node CLI), but is convenient for the agent to
 # shell out to for ad-hoc scripts. Kept on its own layer so it can
 # be moved to a downstream image if the base ever needs to shrink.
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
   && apt-get install -y --no-install-recommends python3 python3-pip python3-venv \
   && rm -rf /var/lib/apt/lists/*
 
-# Install from the committed npm lock. `npm ci` verifies every registry
-# artifact against its lockfile integrity and refuses dependency drift.
-COPY bot_bottle/contrib/claude/package.json \
-     bot_bottle/contrib/claude/package-lock.json /opt/claude/
-RUN cd /opt/claude \
-  && npm ci --omit=dev --no-fund --no-audit \
-  && ln -s /opt/claude/node_modules/.bin/claude /usr/local/bin/claude \
+# Install claude-code globally. Pinned to the version verified in the v1
+# build (`claude --version` returns 2.1.126). Bump deliberately when
+# rolling forward; an unpinned install would mean rebuilds silently pick
+# up new behavior.
+RUN npm install -g --no-fund --no-audit @anthropic-ai/claude-code@2.1.172 \
   && npm cache clean --force
 
 # Git reads both ~/.gitconfig and ~/.config/git/config. Keep its XDG config

bot_bottle/contrib/claude/package-lock.json

@@ -1,140 +0,0 @@
-{
-  "name": "bot-bottle-claude-image",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "name": "bot-bottle-claude-image",
-      "dependencies": {
-        "@anthropic-ai/claude-code": "2.1.172"
-      }
-    },
-    "node_modules/@anthropic-ai/claude-code": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-2.1.172.tgz",
-      "integrity": "sha512-SfwC+5fQcmNbvvm+1vLiZbfUxt0PQz9lbXapj9+FI+XY/2e+3zgteBM4JFEXBjULZj1DtZXHmKtAROUrMM9GZg==",
-      "hasInstallScript": true,
-      "license": "SEE LICENSE IN README.md",
-      "bin": {
-        "claude": "bin/claude.exe"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      },
-      "optionalDependencies": {
-        "@anthropic-ai/claude-code-darwin-arm64": "2.1.172",
-        "@anthropic-ai/claude-code-darwin-x64": "2.1.172",
-        "@anthropic-ai/claude-code-linux-arm64": "2.1.172",
-        "@anthropic-ai/claude-code-linux-arm64-musl": "2.1.172",
-        "@anthropic-ai/claude-code-linux-x64": "2.1.172",
-        "@anthropic-ai/claude-code-linux-x64-musl": "2.1.172",
-        "@anthropic-ai/claude-code-win32-arm64": "2.1.172",
-        "@anthropic-ai/claude-code-win32-x64": "2.1.172"
-      }
-    },
-    "node_modules/@anthropic-ai/claude-code-darwin-arm64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-darwin-arm64/-/claude-code-darwin-arm64-2.1.172.tgz",
-      "integrity": "sha512-pBRgDo8PAgbt2aE4oc6ZrKdOa/Ax36RAduhLCaI8NWD3a0RDb5mETzQciQLwnuenk0bs27vIRh9Yg1jAYG/0+A==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-darwin-x64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-darwin-x64/-/claude-code-darwin-x64-2.1.172.tgz",
-      "integrity": "sha512-vSgibgeCyvCFiLJSXu/sgcd3L/tUjSiS/tfS9rJLXUjElw8satMJhA5pqPUiBmKMflOWKMufbZgzXvLx+OhvFw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-linux-arm64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-arm64/-/claude-code-linux-arm64-2.1.172.tgz",
-      "integrity": "sha512-Ql7AbyaXnlA6NwDUaQGO7ZZis21rMjYjbKzpksMCvY35CmsJqanYgbYSn/rE83u/tZpKo+NqOv+bWEDSzsZ02w==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-linux-arm64-musl": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-arm64-musl/-/claude-code-linux-arm64-musl-2.1.172.tgz",
-      "integrity": "sha512-Pa9mGGmp8QCRC2j1cgcWRRkwsK1x4bPsS3CcLRd936Op0k5et62tD3qIYhUPQOIxeuxe9Tt/y7lX1cx7JTDxyA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-linux-x64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-x64/-/claude-code-linux-x64-2.1.172.tgz",
-      "integrity": "sha512-RYCY9EHkmtoAlwBKcWRzGIhuus+GM2CIVCfU81cTQAwDcCHunoBeFn3NqAcFV1VKb4dk9TRarAmQcWMKJrpPig==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-linux-x64-musl": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-linux-x64-musl/-/claude-code-linux-x64-musl-2.1.172.tgz",
-      "integrity": "sha512-1NflAnV/MqIlD4rzlGDVsJgGK2xJ2ldVd5pkcbu7PsDJBW5dzKYVa4PmD0715K8Yiji8jQovh/nhIo6gYyTfVQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-win32-arm64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-win32-arm64/-/claude-code-win32-arm64-2.1.172.tgz",
-      "integrity": "sha512-Gj8mIbHDDSGWnoriqB1Jt1uH6cvNBFDQBtIYarCcv0fs+QGCEP6qm2GIaKqxAbwkUaLT0sCW/7+ukvkNdSltuQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@anthropic-ai/claude-code-win32-x64": {
-      "version": "2.1.172",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code-win32-x64/-/claude-code-win32-x64-2.1.172.tgz",
-      "integrity": "sha512-OkheFwagiCEKaO2Sb0j3JTO1NrcR3zTlFik/AN+yQPefhUIGP6vHQDbBG5ksuFe+Dyd9s+P95OUh8WDhccb+Ng==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "SEE LICENSE IN LICENSE.md",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    }
-  }
-}

bot_bottle/contrib/claude/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "bot-bottle-claude-image",
-  "private": true,
-  "dependencies": {
-    "@anthropic-ai/claude-code": "2.1.172"
-  }
-}

bot_bottle/contrib/codex/Dockerfile

@@ -3,22 +3,9 @@
 # Mirrors the default Claude image shape: Node LTS, git/network tooling,
 # non-root node user, and the provider CLI installed for that user.
 
-ARG NODE_BASE_IMAGE
-FROM ${NODE_BASE_IMAGE}
+FROM node:22-trixie-slim
 
-# Remote-control requires the standalone package layout. Keep this exact release
-# in sync with the committed upstream archive checksums.
-ARG CODEX_VERSION=0.145.0
-
-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
-
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
   && apt-get install -y --no-install-recommends \
   git \
   ca-certificates \
@@ -32,7 +19,7 @@ RUN apt-get -o Acquire::Check-Valid-Until=false update \
 # (codex is a Node CLI), but is convenient for the agent to shell
 # out to for ad-hoc scripts. Kept on its own layer so it can be
 # moved to a downstream image if the base ever needs to shrink.
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
   && apt-get install -y --no-install-recommends python3 python3-pip python3-venv \
   && rm -rf /var/lib/apt/lists/*
 
@@ -43,29 +30,10 @@ WORKDIR /home/node
 
 ENV PATH="/home/node/.local/bin:${PATH}"
 
-# Install the exact standalone release archive selected by the target
-# architecture. The checksum list is copied from the immutable upstream release
-# and committed so a rebuild cannot silently accept changed release bytes.
-COPY --chown=node:node bot_bottle/contrib/codex/codex-package_SHA256SUMS /tmp/codex-package_SHA256SUMS
-RUN case "$(dpkg --print-architecture)" in \
-      amd64) codex_target=x86_64-unknown-linux-musl ;; \
-      arm64) codex_target=aarch64-unknown-linux-musl ;; \
-      *) echo "unsupported Codex architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
-    esac \
-  && codex_asset="codex-package-${codex_target}.tar.gz" \
-  && codex_sha256="$(awk -v asset="${codex_asset}" '$2 == asset { print $1 }' /tmp/codex-package_SHA256SUMS)" \
-  && test -n "${codex_sha256}" \
-  && curl -fsSL \
-      "https://github.com/openai/codex/releases/download/rust-v${CODEX_VERSION}/${codex_asset}" \
-      -o "/tmp/${codex_asset}" \
-  && echo "${codex_sha256}  /tmp/${codex_asset}" | sha256sum -c - \
-  && codex_release="/home/node/.codex/packages/standalone/releases/${CODEX_VERSION}-${codex_target}" \
-  && mkdir -p "${codex_release}" /home/node/.local/bin \
-  && tar -xzf "/tmp/${codex_asset}" -C "${codex_release}" \
-  && ln -s bin/codex "${codex_release}/codex" \
-  && ln -s "${codex_release}" /home/node/.codex/packages/standalone/current \
-  && ln -s /home/node/.codex/packages/standalone/current/bin/codex /home/node/.local/bin/codex \
-  && rm "/tmp/${codex_asset}" \
-  && test "$(codex --version)" = "codex-cli ${CODEX_VERSION}"
+# Remote-control support requires the standalone Codex install layout
+# under ~/.codex/packages/standalone/current. The npm package can run
+# the TUI, but remote-control commands expect this installer-owned path.
+RUN mkdir -p /home/node/.codex \
+  && curl -fsSL https://chatgpt.com/codex/install.sh | sh
 
 CMD ["codex"]

bot_bottle/contrib/codex/codex-package_SHA256SUMS

@@ -1,2 +0,0 @@
-54f79a05aba6f9abf8ef988abcae8bf2fcefba20beb549b4ff2b3acdb2cb6f54  codex-package-aarch64-unknown-linux-musl.tar.gz
-71a28d362c96ac9829bf8203a2c71be451aeb726adb843167fdaf0eae8fe7dd9  codex-package-x86_64-unknown-linux-musl.tar.gz

bot_bottle/contrib/pi/Dockerfile

@@ -2,18 +2,9 @@
 #
 # Node LTS, git/network tooling, and the Pi coding-agent CLI installed globally.
 
-ARG NODE_BASE_IMAGE
-FROM ${NODE_BASE_IMAGE}
+FROM node:22-trixie-slim
 
-ARG DEBIAN_SNAPSHOT=20260724T000000Z
-RUN sed -i \
-      -e "s|http://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian-security|http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|http://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      -e "s|https://deb.debian.org/debian|http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT}|g" \
-      /etc/apt/sources.list.d/debian.sources
-
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
   && apt-get install -y --no-install-recommends \
   git \
   ca-certificates \
@@ -24,10 +15,13 @@ RUN apt-get -o Acquire::Check-Valid-Until=false update \
   && ln -s /usr/bin/fdfind /usr/local/bin/fd \
   && rm -rf /var/lib/apt/lists/*
 
-RUN apt-get -o Acquire::Check-Valid-Until=false update \
+RUN apt-get update \
   && apt-get install -y --no-install-recommends python3 python3-pip python3-venv \
   && rm -rf /var/lib/apt/lists/*
 
+RUN npm install -g --ignore-scripts --no-fund --no-audit @earendil-works/pi-coding-agent \
+  && npm cache clean --force
+
 RUN install -d -o node -g node -m 755 /home/node/.config /home/node/.config/git \
   && mkdir -p /home/node/.pi/agent \
   /home/node/.pi/context-mode/sessions \
@@ -40,15 +34,10 @@ RUN install -d -o node -g node -m 755 /home/node/.config /home/node/.config/git
 USER node
 WORKDIR /home/node
 
-# Pi discovers npm packages from its agent directory. Installing the CLI and
-# extensions together from the committed lock makes all direct and transitive
-# package versions deterministic, with npm integrity verification.
-COPY --chown=node:node bot_bottle/contrib/pi/package.json \
-     bot_bottle/contrib/pi/package-lock.json /home/node/.pi/agent/
-RUN cd /home/node/.pi/agent \
-  && npm ci --omit=dev --no-fund --no-audit \
-  && npm cache clean --force
-
-ENV PATH="/home/node/.pi/agent/node_modules/.bin:${PATH}"
+RUN pi install npm:@harms-haus/pi-cwd \
+  && pi install npm:pi-web-access \
+  && pi install npm:context-mode \
+  && pi install npm:pi-subagents \
+  && pi install npm:pi-mcp-adapter
 
 CMD ["pi"]

bot_bottle/contrib/pi/package.json

@@ -1,15 +0,0 @@
-{
-  "name": "bot-bottle-pi-image",
-  "private": true,
-  "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.81.1",
-    "@earendil-works/pi-agent-core": "0.81.1",
-    "@earendil-works/pi-ai": "0.81.1",
-    "@earendil-works/pi-tui": "0.81.1",
-    "@harms-haus/pi-cwd": "1.0.0",
-    "context-mode": "1.0.169",
-    "pi-mcp-adapter": "2.11.0",
-    "pi-subagents": "0.35.1",
-    "pi-web-access": "0.13.0"
-  }
-}

bot_bottle/egress/plan.py

@@ -11,7 +11,7 @@ from __future__ import annotations
 from dataclasses import dataclass
 from pathlib import Path
 
-from ..gateway.egress.types import Route
+from ..gateway.egress.addon_core import Route
 
 
 @dataclass(frozen=True)
@@ -19,7 +19,7 @@ class EgressRoute(Route):
     """Host-side extension of the addon's `Route`.
 
     Inherits `host`, `matches`, `auth_scheme`, and `token_env`
-    from the gateway's wire `Route` — those are the fields that cross the
+    from `egress_addon_core.Route` — those are the fields that cross the
     YAML wire into the gateway. The fields below are host-only and
     are never serialised to the addon.
 

bot_bottle/egress/service.py

@@ -14,8 +14,8 @@ import secrets
 from pathlib import Path
 from typing import TYPE_CHECKING
 
-from ..gateway.egress.dlp_config import ON_MATCH_REDACT
-from ..gateway.egress.types import (
+from ..gateway.egress.addon_core import (
+    ON_MATCH_REDACT,
     HeaderMatch as CoreHeaderMatch,
     MatchEntry as CoreMatchEntry,
     PathMatch as CorePathMatch,

bot_bottle/gateway/__init__.py

@@ -122,18 +122,12 @@ class Gateway(abc.ABC):
         return
 
     @abc.abstractmethod
-    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> bool:
+    def connect_to_orchestrator(self, orchestrator_url: str, gateway_token: str) -> None:
         """Bind the gateway to this orchestrator and bring it up: store the URL +
         the pre-minted `gateway` token as instance state, then (re)start the
         gateway unit carrying the mitmproxy CA + that token, resolving policy
         against `orchestrator_url`. Idempotent — a healthy, current gateway on
-        the same binding is left alone; a changed binding reconciles it.
-
-        Returns True when the gateway was actually (re)brought up (a cold boot,
-        so its mitmproxy minted a fresh CA and lost its per-bottle state), False
-        when a healthy current gateway was left untouched. The bring-up flow
-        uses this as the cold-boot signal that gates the running-bottle
-        reconcile (`attach_bottled_agents_to_gateway`, PRD 0081)."""
+        the same binding is left alone; a changed binding reconciles it."""
 
     @abc.abstractmethod
     def is_running(self) -> bool:

bot_bottle/gateway/bootstrap.py

@@ -136,18 +136,10 @@ def _pump(name: str, stream: IO[bytes]) -> None:
     """Read lines from `stream`, prefix with `[name]`, write to
     stdout. Runs in its own thread per child; daemon=True so a
     blocked read doesn't keep the process alive after main exits."""
-    try:
-        for raw in iter(stream.readline, b""):
-            line = raw.decode("utf-8", errors="replace").rstrip("\n")
-            sys.stdout.write(f"[{name}] {line}\n")
-            sys.stdout.flush()
-    except (OSError, ValueError) as exc:
-        # The manager closes a dead child's pipe after wait() and before a
-        # restart. A pump can be between readline calls at that exact moment;
-        # closed-stream errors are normal completion, not uncaught thread
-        # failures. Preserve genuinely unexpected I/O diagnostics.
-        if not stream.closed:
-            _log(f"{name} output pump stopped: {type(exc).__name__}: {exc}")
+    for raw in iter(stream.readline, b""):
+        line = raw.decode("utf-8", errors="replace").rstrip("\n")
+        sys.stdout.write(f"[{name}] {line}\n")
+        sys.stdout.flush()
 
 
 def _spawn(spec: _DaemonSpec) -> subprocess.Popen[bytes]:

bot_bottle/gateway/bounded_http.py

@@ -1,137 +0,0 @@
-"""Shared resource boundaries for gateway stdlib HTTP services."""
-
-from __future__ import annotations
-
-import http.server
-import io
-import socket
-import threading
-import time
-from dataclasses import dataclass
-from typing import Any, Protocol
-
-
-class Readable(Protocol):
-    def read(self, size: int = -1, /) -> bytes: ...
-
-
-class Writable(Protocol):
-    def write(self, data: bytes, /) -> object: ...
-
-
-@dataclass(frozen=True)
-class BodyReadError(Exception):
-    status: int
-    message: str
-
-
-def read_declared_body(
-    stream: Readable,
-    connection: socket.socket,
-    raw_length: str | None,
-    *,
-    maximum: int,
-    timeout_seconds: float,
-    require_length: bool,
-) -> bytes:
-    """Validate and read exactly one declared body under a read deadline."""
-    output = io.BytesIO()
-    copy_declared_body(
-        stream, output, connection, raw_length, maximum=maximum,
-        timeout_seconds=timeout_seconds, require_length=require_length,
-    )
-    return output.getvalue()
-
-
-def copy_declared_body(
-    stream: Readable,
-    output: Writable,
-    connection: socket.socket,
-    raw_length: str | None,
-    *,
-    maximum: int,
-    timeout_seconds: float,
-    require_length: bool,
-) -> int:
-    """Copy one declared body to a sink without retaining it in memory."""
-    if raw_length is None:
-        if require_length:
-            raise BodyReadError(411, "Content-Length required")
-        raw_length = "0"
-    try:
-        length = int(raw_length)
-    except ValueError as exc:
-        raise BodyReadError(400, "invalid Content-Length") from exc
-    if length < 0:
-        raise BodyReadError(400, "invalid Content-Length")
-    if length > maximum:
-        raise BodyReadError(413, "request body too large")
-    previous_timeout = connection.gettimeout()
-    deadline = time.monotonic() + timeout_seconds
-    remaining = length
-    try:
-        while remaining:
-            timeout = deadline - time.monotonic()
-            if timeout <= 0:
-                raise BodyReadError(408, "request body read timed out")
-            connection.settimeout(timeout)
-            chunk = stream.read(min(remaining, 64 * 1024))
-            if not chunk:
-                raise BodyReadError(400, "incomplete request body")
-            output.write(chunk)
-            remaining -= len(chunk)
-    except TimeoutError as exc:
-        raise BodyReadError(408, "request body read timed out") from exc
-    finally:
-        connection.settimeout(previous_timeout)
-    return length
-
-
-class BoundedThreadingHTTPServer(http.server.ThreadingHTTPServer):
-    """ThreadingHTTPServer with a hard cap on in-flight request threads."""
-
-    daemon_threads = True
-
-    def __init__(  # pylint: disable=consider-using-with
-        self, *args, max_workers: int = 32, **kwargs,  # type: ignore[no-untyped-def]
-    ):
-        if max_workers < 1:
-            raise ValueError("max_workers must be positive")
-        self._request_slots = threading.BoundedSemaphore(max_workers)
-        super().__init__(*args, **kwargs)
-
-    def process_request(
-        self, request: Any, client_address: Any,
-    ) -> None:
-        if not self._request_slots.acquire(  # pylint: disable=consider-using-with
-            blocking=False,
-        ):
-            try:
-                request.sendall(
-                    b"HTTP/1.1 503 Service Unavailable\r\n"
-                    b"Content-Length: 0\r\nConnection: close\r\n\r\n"
-                )
-            finally:
-                self.shutdown_request(request)
-            return
-        try:
-            super().process_request(request, client_address)
-        except BaseException:
-            self._request_slots.release()
-            raise
-
-    def process_request_thread(
-        self, request: Any, client_address: Any,
-    ) -> None:
-        try:
-            super().process_request_thread(request, client_address)
-        finally:
-            self._request_slots.release()
-
-
-__all__ = [
-    "BodyReadError",
-    "BoundedThreadingHTTPServer",
-    "copy_declared_body",
-    "read_declared_body",
-]

bot_bottle/gateway/egress/addon.py

@@ -16,35 +16,29 @@ import typing
 from mitmproxy import http  # type: ignore[import-not-found]  # pylint: disable=import-error
 
 from bot_bottle.constants import IDENTITY_HEADER
-from bot_bottle.gateway.egress.dlp_detectors import redact_tokens
-from bot_bottle.gateway.egress.dlp_config import (
+from bot_bottle.gateway.egress.dlp_detectors import redact_tokens, strip_crlf
+from bot_bottle.gateway.egress.addon_core import (
+    LOG_BLOCKS,
+    LOG_FULL,
     DEFAULT_OUTBOUND_ON_MATCH,
     ON_MATCH_BLOCK,
     ON_MATCH_REDACT,
-)
-from bot_bottle.gateway.egress.context import resolve_client_context
-from bot_bottle.gateway.egress.dlp import (
-    build_inbound_scan_text,
-    build_token_allow_payload,
-    scan_inbound,
-    scan_outbound,
-)
-from bot_bottle.gateway.egress.outbound_pipeline import redact_request, scan_request
-from bot_bottle.gateway.egress.matching import (
-    decide,
-    match_route,
-)
-from bot_bottle.gateway.egress.request_pipeline import (
-    evaluate_route_policy,
-    git_block_reason,
-)
-from bot_bottle.gateway.egress.schema import route_to_yaml_dict
-from bot_bottle.gateway.egress.types import (
-    LOG_BLOCKS,
-    LOG_FULL,
     Config,
     Route,
     ScanResult,
+    build_inbound_scan_text,
+    build_outbound_scan_text,
+    build_token_allow_payload,
+    decide,
+    decide_git_fetch,
+    is_git_fetch_request,
+    is_git_push_request,
+    match_route,
+    resolve_client_context,
+    outbound_scan_headers,
+    route_to_yaml_dict,
+    scan_inbound,
+    scan_outbound,
 )
 from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver
 from bot_bottle.supervisor.types import (
@@ -389,9 +383,19 @@ class EgressAddon:
         self._passthrough_conns.discard(conn_id)
 
     async def request(self, flow: http.HTTPFlow) -> None:
-        config, slug, env = self._request_context(flow)
         request_path, _, query = flow.request.path.partition("?")
 
+        # Reuse the context stashed by http_connect for HTTPS flows (one
+        # orchestrator round-trip per connection). Plain-HTTP flows have no
+        # prior CONNECT stash, so resolve now and stash for response/websocket.
+        meta = getattr(flow, "metadata", None)
+        if isinstance(meta, dict) and _FLOW_CTX_KEY in meta:
+            config, slug, env = meta[_FLOW_CTX_KEY]
+            self._request_token(flow)  # strip identity headers; token already resolved
+        else:
+            config, slug, env = self._resolve_flow(flow)
+            self._stash_flow_ctx(flow, config, slug, env)
+
         # Introspection ("_egress.local/allowlist") reports the calling bottle's
         # own resolved routes — served after resolution so it reflects this
         # bottle's policy, not a stale global.
@@ -412,66 +416,56 @@ class EgressAddon:
             # the path/query the git checks below rely on.
             request_path, _, query = flow.request.path.partition("?")
 
-        if not self._allow_git_request(flow, config, request_path, query):
+        if is_git_push_request(request_path, query):
+            self._block(
+                flow,
+                "egress: git push over HTTPS is not supported; "
+                "use the bottle.git SSH path (gitleaks-scanned by "
+                "git-gate's pre-receive hook).",
+                ctx=self._req_ctx(flow),
+            )
             return
 
-        self._apply_route_policy(flow, config, route, request_path, env)
+        if is_git_fetch_request(request_path, query):
+            git_decision = decide_git_fetch(
+                config.routes, flow.request.pretty_host,
+            )
+            if git_decision.action == "block":
+                self._block(
+                    flow,
+                    git_decision.reason,
+                    ctx=self._req_ctx(flow),
+                )
+                return
 
-    def _request_context(
-        self, flow: http.HTTPFlow,
-    ) -> tuple[Config, str, "typing.Mapping[str, str]"]:
-        """Resolve one bottle context, reusing the HTTPS CONNECT snapshot."""
-        meta = getattr(flow, "metadata", None)
-        if isinstance(meta, dict) and _FLOW_CTX_KEY in meta:
-            config, slug, env = meta[_FLOW_CTX_KEY]
-            self._request_token(flow)
-            return config, slug, env
-        config, slug, env = self._resolve_flow(flow)
-        self._stash_flow_ctx(flow, config, slug, env)
-        return config, slug, env
-
-    def _allow_git_request(
-        self, flow: http.HTTPFlow, config: Config,
-        request_path: str, query: str,
-    ) -> bool:
-        """Apply the HTTPS Git push/fetch boundary before general routing."""
-        reason = git_block_reason(
-            config.routes, flow.request.pretty_host, request_path, query,
-        )
-        if not reason:
-            return True
-        self._block(flow, reason, ctx=self._req_ctx(flow))
-        return False
-
-    def _apply_route_policy(
-        self, flow: http.HTTPFlow, config: Config, route: Route | None,
-        request_path: str, env: "typing.Mapping[str, str]",
-    ) -> None:
-        """Strip agent auth, evaluate the route, then inject gateway auth."""
         # Strip agent-set Authorization after DLP scan so smuggled tokens
         # are caught above; the route may inject gateway-owned auth below.
         # Routes with preserve_auth=True pass the header through as-is so the
         # agent's own credentials (e.g. registry bearer tokens) reach the upstream.
-        result = evaluate_route_policy(
-            config,
-            route,
-            host=flow.request.pretty_host,
-            request_path=request_path,
-            method=flow.request.method,
-            headers=dict(flow.request.headers),
-            env=env,
-        )
-        if result.strip_authorization:
+        if route is None or not route.preserve_auth:
             flow.request.headers.pop("authorization", None)
 
-        if result.block_reason:
-            self._block(flow, result.block_reason, ctx=self._req_ctx(flow))
+        # Build headers mapping for match evaluation
+        req_headers = {k.lower(): v for k, v in flow.request.headers.items()}
+
+        decision = decide(
+            config.routes,
+            flow.request.pretty_host,
+            request_path,
+            env,
+            request_method=flow.request.method,
+            request_headers=req_headers,
+            deny_reason=config.deny_reason,
+        )
+
+        if decision.action == "block":
+            self._block(flow, decision.reason, ctx=self._req_ctx(flow))
             return
 
-        if result.inject_authorization is not None:
-            flow.request.headers["authorization"] = result.inject_authorization
+        if decision.inject_authorization is not None:
+            flow.request.headers["authorization"] = decision.inject_authorization
 
-        if result.log_request:
+        if config.log >= LOG_FULL:
             self._log_request(flow, env)
 
     def _block_dlp(self, flow: http.HTTPFlow, result: ScanResult) -> None:
@@ -495,12 +489,20 @@ class EgressAddon:
         Loops so the supervise policy can re-scan after each approval — a
         second, un-approved token in the same request is still caught."""
         while True:
-            request_path, _, _ = flow.request.path.partition("?")
-            result = scan_request(
-                flow.request,
-                route,
-                env,
-                safe_tokens=self._safe_tokens_for(slug),
+            request_path, _, query = flow.request.path.partition("?")
+            body = flow.request.get_text(strict=False) or ""
+            headers = outbound_scan_headers(route, dict(flow.request.headers))
+            scan_text = build_outbound_scan_text(
+                flow.request.pretty_host, request_path, query, headers, body,
+            )
+            # CRLF is scanned only over the request line + headers, never the
+            # body (see scan_outbound) — a body is not an injection vector.
+            crlf_text = build_outbound_scan_text(
+                flow.request.pretty_host, request_path, query, headers, "",
+            )
+            result = scan_outbound(
+                route, scan_text, env,
+                safe_tokens=self._safe_tokens_for(slug), crlf_text=crlf_text,
             )
             if result is None or result.severity != "block":
                 return True
@@ -510,7 +512,7 @@ class EgressAddon:
             # redact scrubs every detection (tokens and structural CRLF) and
             # forwards; it fails closed only if a match survives the scrub.
             if policy == ON_MATCH_REDACT:
-                if redact_request(flow.request, route, env):
+                if self._redact_outbound(flow, route, env):
                     if self._flow_log(flow) >= LOG_BLOCKS:
                         sys.stderr.write(json.dumps({
                             "event": "egress_redacted",
@@ -543,6 +545,41 @@ class EgressAddon:
                 return False  # _supervise_token_block wrote the 403 response
             # loop: the approved value is now in safe_tokens; re-scan.
 
+    def _redact_outbound(
+        self, flow: http.HTTPFlow, route: Route, env: "typing.Mapping[str, str]",
+    ) -> bool:
+        """Scrub detected tokens (and CRLF injection sequences) from the mutable
+        request surfaces (body, headers, path/query) and re-scan. `env` is the
+        per-bottle env overlay. Returns True if the request is now clean; False
+        if a block-severity match remains on a surface redaction cannot rewrite
+        (the hostname) so the caller fails closed."""
+        body = flow.request.get_text(strict=False)
+        if body:
+            redacted_body = redact_tokens(body, env=env)
+            if redacted_body != body:
+                flow.request.text = redacted_body
+        for name, value in list(flow.request.headers.items()):
+            if name.lower() == "host":
+                continue  # routing-critical; never a legitimate token
+            redacted = strip_crlf(redact_tokens(value, env=env))
+            if redacted != value:
+                flow.request.headers[name] = redacted
+        redacted_path = strip_crlf(redact_tokens(flow.request.path, env=env))
+        if redacted_path != flow.request.path:
+            flow.request.path = redacted_path
+
+        request_path, _, query = flow.request.path.partition("?")
+        new_body = flow.request.get_text(strict=False) or ""
+        headers = outbound_scan_headers(route, dict(flow.request.headers))
+        scan_text = build_outbound_scan_text(
+            flow.request.pretty_host, request_path, query, headers, new_body,
+        )
+        crlf_text = build_outbound_scan_text(
+            flow.request.pretty_host, request_path, query, headers, "",
+        )
+        result = scan_outbound(route, scan_text, env, crlf_text=crlf_text)
+        return result is None or result.severity != "block"
+
     async def _supervise_token_block(
         self,
         flow: http.HTTPFlow,

bot_bottle/gateway/egress/context.py

@@ -1,77 +0,0 @@
-"""Fail-closed resolution of a client's policy and egress credentials."""
-
-from __future__ import annotations
-
-import typing
-
-from ...log import debug
-from .types import Config
-
-
-DENY_UNATTRIBUTED = (
-    "egress: this request was not attributed to any bottle, so no egress policy "
-    "applies and every host is denied. Either the bottle's registry row is "
-    "missing/ambiguous (torn down, or another bottle claimed its source IP), or "
-    "the request carried no matching identity token — check that the caller's "
-    "proxy URL includes it. This is not an allowlist problem."
-)
-DENY_UNPARSEABLE = (
-    "egress: this bottle's egress policy could not be parsed, so it is being "
-    "treated as deny-all. Fix the bottle's egress.routes; every host is denied "
-    "until it loads."
-)
-DENY_RESOLVER_ERROR = (
-    "egress: the orchestrator could not be reached to resolve this bottle's "
-    "egress policy, so every host is denied (fail-closed). Check that the "
-    "control plane is up; this is not an allowlist problem."
-)
-
-
-class PolicyResolverLike(typing.Protocol):
-    def resolve(self, source_ip: str, identity_token: str = ...) -> str | None: ...
-
-
-class ContextResolverLike(typing.Protocol):
-    def resolve_policy_and_bottle_id(
-        self, source_ip: str, identity_token: str = ...,
-    ) -> tuple[str | None, str | None, dict[str, str]]: ...
-
-
-def _config_from_policy(policy: str | None) -> Config:
-    # Local import keeps schema parsing independent of resolver protocols.
-    from .schema import load_config
-    if not policy:
-        return Config(routes=(), deny_reason=DENY_UNATTRIBUTED)
-    try:
-        return load_config(policy)
-    except ValueError:
-        return Config(routes=(), deny_reason=DENY_UNPARSEABLE)
-
-
-def resolve_client_config(
-    resolver: PolicyResolverLike, client_ip: str, identity_token: str = "",
-) -> Config:
-    try:
-        policy = resolver.resolve(client_ip, identity_token)
-    except Exception as exc:  # noqa: BLE001 - a policy lookup failure must deny
-        debug(
-            "egress policy resolution failed; applying deny-all",
-            context={"error_type": type(exc).__name__},
-        )
-        return Config(routes=(), deny_reason=DENY_RESOLVER_ERROR)
-    return _config_from_policy(policy)
-
-
-def resolve_client_context(
-    resolver: ContextResolverLike, client_ip: str, identity_token: str = "",
-) -> tuple[Config, str, dict[str, str]]:
-    try:
-        policy, bottle_id, tokens = resolver.resolve_policy_and_bottle_id(
-            client_ip, identity_token)
-    except Exception as exc:  # noqa: BLE001 - a policy lookup failure must deny
-        debug(
-            "egress context resolution failed; applying deny-all",
-            context={"error_type": type(exc).__name__},
-        )
-        return Config(routes=(), deny_reason=DENY_RESOLVER_ERROR), "", {}
-    return _config_from_policy(policy), (bottle_id or ""), tokens

bot_bottle/gateway/egress/dlp.py

@@ -1,99 +0,0 @@
-"""DLP scan dispatch and safe proposal rendering for egress requests."""
-
-from __future__ import annotations
-
-import typing
-
-from .types import Route, ScanResult
-
-
-def build_outbound_scan_text(host: str, path: str, query: str,
-                             headers: typing.Mapping[str, str], body: str) -> str:
-    parts = [host, path]
-    if query:
-        parts.append(query)
-    parts.extend(f"{name}: {value}" for name, value in headers.items())
-    if body:
-        parts.append(body)
-    return "\n".join(parts)
-
-
-def outbound_scan_headers(route: Route, headers: typing.Mapping[str, str]) -> dict[str, str]:
-    """Drop agent Authorization when the route injects gateway-owned auth."""
-    skip_auth = bool(route.auth_scheme and route.token_env)
-    return {name: value for name, value in headers.items()
-            if not (skip_auth and name.lower() == "authorization")}
-
-
-def build_inbound_scan_text(headers: typing.Mapping[str, str], body: str) -> str:
-    parts = [f"{name}: {value}" for name, value in headers.items()]
-    if body:
-        parts.append(body)
-    return "\n".join(parts)
-
-
-def _enabled(configured: tuple[str, ...] | None, name: str) -> bool:
-    return configured is None or name in configured
-
-
-def scan_outbound(route: Route, body: str | bytes, environ: typing.Mapping[str, str], *,
-                  safe_tokens: typing.AbstractSet[str] | None = None,
-                  crlf_text: str | None = None) -> ScanResult | None:
-    if not route.inspect:
-        return None
-    try:
-        from dlp_detectors import (  # type: ignore[import-not-found]
-            scan_crlf_injection, scan_entropy, scan_known_secrets, scan_token_patterns)
-    except ImportError:  # pragma: no cover - gateway's flat module path
-        from .dlp_detectors import (
-            scan_crlf_injection, scan_entropy, scan_known_secrets, scan_token_patterns)
-    if isinstance(body, bytes):
-        try:
-            text = body.decode("utf-8")
-        except UnicodeDecodeError:
-            text = body.decode("latin-1")
-    else:
-        text = body
-    result = scan_crlf_injection(text if crlf_text is None else crlf_text)
-    if result is not None:
-        return result
-    if _enabled(route.outbound_detectors, "token_patterns"):
-        result = scan_token_patterns(text, location="body", safe_tokens=safe_tokens)
-        if result is not None:
-            return result
-    if _enabled(route.outbound_detectors, "known_secrets"):
-        extra = tuple(prefix for prefix in environ.get(
-            "BOT_BOTTLE_SENSITIVE_PREFIXES", "").split(",") if prefix)
-        result = scan_known_secrets(text, location="body", env=environ,
-                                    sensitive_prefixes=("EGRESS_TOKEN_",) + extra,
-                                    safe_tokens=safe_tokens)
-        if result is not None:
-            return result
-    if route.outbound_detectors is not None and "entropy" in route.outbound_detectors:
-        return scan_entropy(text, location="body")
-    return None
-
-
-def build_token_allow_payload(host: str, method: str, path: str, result: ScanResult) -> str:
-    """Render redacted operator context; the raw matched secret is excluded."""
-    lines = [
-        "egress blocked an outbound request carrying a detected token",
-        f"host: {host}", f"method: {method}", f"path: {path}",
-        f"detector: {result.reason}",
-    ]
-    if result.context:
-        lines.append(f"context: {result.context}")
-    return "\n".join(lines) + "\n"
-
-
-def scan_inbound(route: Route, body: str | bytes) -> ScanResult | None:
-    if not route.inspect:
-        return None
-    try:
-        from dlp_detectors import scan_naive_injection  # type: ignore[import-not-found]
-    except ImportError:  # pragma: no cover - gateway's flat module path
-        from .dlp_detectors import scan_naive_injection
-    text = body if isinstance(body, str) else body.decode("utf-8", errors="replace")
-    if _enabled(route.inbound_detectors, "naive_injection_detection"):
-        return scan_naive_injection(text)
-    return None

bot_bottle/gateway/egress/dlp_detectors.py

@@ -19,7 +19,7 @@ from math import log2
 from collections import Counter
 from urllib.parse import quote as url_quote
 
-from .types import ScanResult
+from .addon_core import ScanResult
 
 
 # ---------------------------------------------------------------------------

bot_bottle/gateway/egress/matching.py

@@ -1,112 +0,0 @@
-"""Route matching and request-policy decisions for the egress gateway."""
-
-from __future__ import annotations
-
-import typing
-
-from .types import Decision, MatchEntry, PathMatch, Route
-
-
-def _path_matches(pm: PathMatch, request_path: str) -> bool:
-    if pm.type == "exact":
-        return request_path == pm.value
-    if pm.type == "prefix":
-        if request_path == pm.value:
-            return True
-        if not pm.value.endswith("/"):
-            return request_path.startswith(pm.value + "/")
-        return request_path.startswith(pm.value)
-    return (
-        pm.type == "regex"
-        and pm.compiled is not None
-        and pm.compiled.search(request_path) is not None
-    )
-
-
-def _entry_matches(
-    entry: MatchEntry, request_path: str, request_method: str,
-    request_headers: typing.Mapping[str, str],
-) -> bool:
-    if entry.paths and not any(_path_matches(pm, request_path) for pm in entry.paths):
-        return False
-    if entry.methods and request_method.upper() not in entry.methods:
-        return False
-    for match in entry.headers:
-        value = request_headers.get(match.name.lower())
-        if value is None:
-            return False
-        if match.type == "exact" and value != match.value:
-            return False
-        if match.type == "regex" and (
-            match.compiled is None or match.compiled.search(value) is None
-        ):
-            return False
-    return True
-
-
-def evaluate_matches(
-    route: Route, request_path: str, request_method: str = "GET",
-    request_headers: typing.Mapping[str, str] | None = None,
-) -> bool:
-    """Return whether a request satisfies a route's optional match entries."""
-    if not route.matches:
-        return True
-    return any(_entry_matches(entry, request_path, request_method, request_headers or {})
-               for entry in route.matches)
-
-
-def is_git_push_request(path: str, query: str) -> bool:
-    return path.endswith("/git-receive-pack") or (
-        path.endswith("/info/refs") and any(
-            pair.partition("=") == ("service", "=", "git-receive-pack")
-            for pair in query.split("&")
-        )
-    )
-
-
-def is_git_fetch_request(path: str, query: str) -> bool:
-    return path.endswith("/git-upload-pack") or (
-        path.endswith("/info/refs") and any(
-            pair.partition("=") == ("service", "=", "git-upload-pack")
-            for pair in query.split("&")
-        )
-    )
-
-
-def match_route(routes: typing.Sequence[Route], request_host: str) -> Route | None:
-    target = request_host.lower()
-    return next((route for route in routes if route.host.lower() == target), None)
-
-
-def decide(
-    routes: typing.Sequence[Route], request_host: str, request_path: str,
-    environ: typing.Mapping[str, str], *, request_method: str = "GET",
-    request_headers: typing.Mapping[str, str] | None = None, deny_reason: str = "",
-) -> Decision:
-    route = match_route(routes, request_host)
-    if route is None:
-        return Decision("block", deny_reason or (
-            f"egress: host {request_host!r} is not in the bottle's egress.routes "
-            "allowlist. Declare a route for it or remove the request."))
-    if not evaluate_matches(route, request_path, request_method, request_headers):
-        return Decision("block", (
-            f"egress: request {request_method} {request_path!r} does not match any "
-            f"entry in matches for {route.host!r}"))
-    if route.auth_scheme and route.token_env:
-        token = environ.get(route.token_env, "")
-        if not token:
-            return Decision("block", (
-                f"egress: route for {route.host!r} declared auth but env var "
-                f"{route.token_env!r} is unset"))
-        return Decision("forward", inject_authorization=f"{route.auth_scheme} {token}")
-    return Decision("forward")
-
-
-def decide_git_fetch(routes: typing.Sequence[Route], request_host: str) -> Decision:
-    route = match_route(routes, request_host)
-    if route is not None and route.git_fetch:
-        return Decision("forward")
-    return Decision("block", (
-        "egress: git fetch/clone over HTTPS is not allowed by default; use git-gate "
-        "for declared repos or set egress.routes[].git.fetch=true for explicit "
-        "read-only HTTPS Git access."))

bot_bottle/gateway/egress/outbound_pipeline.py

@@ -1,83 +0,0 @@
-"""Outbound DLP request scanning and redaction for the egress pipeline."""
-
-from __future__ import annotations
-
-from typing import ItemsView, Mapping, Protocol
-
-from .dlp import (
-    build_outbound_scan_text,
-    outbound_scan_headers,
-    scan_outbound,
-)
-from .dlp_detectors import redact_tokens, strip_crlf
-from .types import Route, ScanResult
-
-
-class MutableHeaders(Protocol):
-    def items(self) -> ItemsView[str, str]: ...
-    def __getitem__(self, name: str, /) -> str: ...
-    def __setitem__(self, name: str, value: str, /) -> None: ...
-
-
-class MutableRequest(Protocol):
-    pretty_host: str
-    path: str
-    headers: MutableHeaders
-    text: str
-
-    def get_text(self, strict: bool = False) -> str | None: ...
-
-
-def scan_request(
-    request: MutableRequest,
-    route: Route,
-    env: Mapping[str, str],
-    *,
-    safe_tokens: set[str] | None = None,
-) -> ScanResult | None:
-    """Scan all mutable outbound request surfaces in their canonical order."""
-    request_path, _, query = request.path.partition("?")
-    headers = outbound_scan_headers(route, dict(request.headers.items()))
-    body = request.get_text(strict=False) or ""
-    scan_text = build_outbound_scan_text(
-        request.pretty_host, request_path, query, headers, body,
-    )
-    # Bodies cannot alter HTTP framing, so CRLF detection is deliberately
-    # restricted to the request line and headers.
-    crlf_text = build_outbound_scan_text(
-        request.pretty_host, request_path, query, headers, "",
-    )
-    return scan_outbound(
-        route,
-        scan_text,
-        env,
-        safe_tokens=safe_tokens,
-        crlf_text=crlf_text,
-    )
-
-
-def redact_request(
-    request: MutableRequest,
-    route: Route,
-    env: Mapping[str, str],
-) -> bool:
-    """Redact mutable request surfaces and return whether the result is clean."""
-    body = request.get_text(strict=False)
-    if body:
-        redacted_body = redact_tokens(body, env=env)
-        if redacted_body != body:
-            request.text = redacted_body
-    for name, value in list(request.headers.items()):
-        if name.lower() == "host":
-            continue
-        redacted = strip_crlf(redact_tokens(value, env=env))
-        if redacted != value:
-            request.headers[name] = redacted
-    redacted_path = strip_crlf(redact_tokens(request.path, env=env))
-    if redacted_path != request.path:
-        request.path = redacted_path
-    result = scan_request(request, route, env)
-    return result is None or result.severity != "block"
-
-
-__all__ = ["MutableRequest", "redact_request", "scan_request"]

bot_bottle/gateway/egress/request_pipeline.py

@@ -1,92 +0,0 @@
-"""Framework-neutral request policy stages for the egress adapter.
-
-The mitmproxy addon owns flow mutation and response construction. This module
-owns the ordered Git and route-policy decisions so those rules remain directly
-testable without a live proxy flow.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Mapping, Sequence
-
-from .matching import (
-    decide,
-    decide_git_fetch,
-    is_git_fetch_request,
-    is_git_push_request,
-)
-from .types import LOG_FULL, Config, Route
-
-GIT_PUSH_BLOCK_REASON = (
-    "egress: git push over HTTPS is not supported; "
-    "use the bottle.git SSH path (gitleaks-scanned by "
-    "git-gate's pre-receive hook)."
-)
-
-
-@dataclass(frozen=True)
-class RoutePolicyResult:
-    """The flow mutations and outcome produced by general route policy."""
-
-    block_reason: str = ""
-    strip_authorization: bool = False
-    inject_authorization: str | None = None
-    log_request: bool = False
-
-
-def git_block_reason(
-    routes: Sequence[Route],
-    host: str,
-    request_path: str,
-    query: str,
-) -> str:
-    """Return the HTTPS Git policy denial, or ``""`` when allowed."""
-    if is_git_push_request(request_path, query):
-        return GIT_PUSH_BLOCK_REASON
-    if not is_git_fetch_request(request_path, query):
-        return ""
-    decision = decide_git_fetch(routes, host)
-    return decision.reason if decision.action == "block" else ""
-
-
-def evaluate_route_policy(
-    config: Config,
-    route: Route | None,
-    *,
-    host: str,
-    request_path: str,
-    method: str,
-    headers: Mapping[str, str],
-    env: Mapping[str, str],
-) -> RoutePolicyResult:
-    """Evaluate authorization stripping, matching, injection, and logging."""
-    strip_authorization = route is None or not route.preserve_auth
-    effective_headers = {
-        name.lower(): value
-        for name, value in headers.items()
-        if not (strip_authorization and name.lower() == "authorization")
-    }
-    decision = decide(
-        config.routes,
-        host,
-        request_path,
-        env,
-        request_method=method,
-        request_headers=effective_headers,
-        deny_reason=config.deny_reason,
-    )
-    return RoutePolicyResult(
-        block_reason=decision.reason if decision.action == "block" else "",
-        strip_authorization=strip_authorization,
-        inject_authorization=decision.inject_authorization,
-        log_request=config.log >= LOG_FULL,
-    )
-
-
-__all__ = [
-    "GIT_PUSH_BLOCK_REASON",
-    "RoutePolicyResult",
-    "evaluate_route_policy",
-    "git_block_reason",
-]

bot_bottle/gateway/egress/schema.py

@@ -1,349 +0,0 @@
-"""Egress policy schema parsing and serialization (PRD 0017 / 0053)."""
-
-from __future__ import annotations
-
-import re
-import typing
-
-from ...yaml_subset import YamlSubsetError, parse_yaml_subset
-from .dlp_config import parse_inspect_block
-from .types import (
-    HEADER_MATCH_TYPES,
-    LOG_BLOCKS,
-    LOG_FULL,
-    LOG_OFF,
-    PATH_MATCH_TYPES,
-    VALID_METHODS,
-    Config,
-    HeaderMatch,
-    MatchEntry,
-    PathMatch,
-    Route,
-)
-
-# Parsing
-# ---------------------------------------------------------------------------
-
-def _parse_path_match(idx: int, j: int, raw: object) -> PathMatch:
-    label = f"route[{idx}] matches paths[{j}]"
-    if not isinstance(raw, dict):
-        raise ValueError(f"{label}: must be an object")
-    raw_dict: dict[str, object] = typing.cast(dict[str, object], raw)
-    ptype = raw_dict.get("type", "prefix")
-    if not isinstance(ptype, str) or ptype not in PATH_MATCH_TYPES:
-        raise ValueError(
-            f"{label}: 'type' must be one of {', '.join(PATH_MATCH_TYPES)} "
-            f"(got {ptype!r})"
-        )
-    value = raw_dict.get("value")
-    if not isinstance(value, str) or not value:
-        raise ValueError(f"{label}: 'value' must be a non-empty string")
-    if ptype in ("exact", "prefix") and not value.startswith("/"):
-        raise ValueError(
-            f"{label}: value {value!r} must start with '/' for "
-            f"type {ptype!r}"
-        )
-    compiled: re.Pattern[str] | None = None
-    if ptype == "regex":
-        try:
-            compiled = re.compile(value)
-        except re.error as e:
-            raise ValueError(
-                f"{label}: regex {value!r} failed to compile: {e}"
-            ) from e
-    for k in raw_dict:
-        if k not in ("type", "value"):
-            raise ValueError(f"{label}: unknown key {k!r}")
-    return PathMatch(type=ptype, value=value, compiled=compiled)
-
-
-def _parse_header_match(idx: int, j: int, raw: object) -> HeaderMatch:
-    label = f"route[{idx}] matches headers[{j}]"
-    if not isinstance(raw, dict):
-        raise ValueError(f"{label}: must be an object")
-    raw_dict: dict[str, object] = typing.cast(dict[str, object], raw)
-    name = raw_dict.get("name")
-    if not isinstance(name, str) or not name:
-        raise ValueError(f"{label}: 'name' must be a non-empty string")
-    value = raw_dict.get("value")
-    if not isinstance(value, str):
-        raise ValueError(f"{label}: 'value' must be a string")
-    htype = raw_dict.get("type", "exact")
-    if not isinstance(htype, str) or htype not in HEADER_MATCH_TYPES:
-        raise ValueError(
-            f"{label}: 'type' must be one of {', '.join(HEADER_MATCH_TYPES)} "
-            f"(got {htype!r})"
-        )
-    compiled: re.Pattern[str] | None = None
-    if htype == "regex":
-        try:
-            compiled = re.compile(value)
-        except re.error as e:
-            raise ValueError(
-                f"{label}: regex {value!r} failed to compile: {e}"
-            ) from e
-    for k in raw_dict:
-        if k not in ("name", "value", "type"):
-            raise ValueError(f"{label}: unknown key {k!r}")
-    return HeaderMatch(name=name, value=value, type=htype, compiled=compiled)
-
-
-def _parse_match_entry(idx: int, k: int, raw: object) -> MatchEntry:
-    label = f"route[{idx}] matches[{k}]"
-    if not isinstance(raw, dict):
-        raise ValueError(f"{label}: must be an object")
-    raw_dict: dict[str, object] = typing.cast(dict[str, object], raw)
-
-    paths: tuple[PathMatch, ...] = ()
-    paths_raw = raw_dict.get("paths")
-    if paths_raw is not None:
-        if not isinstance(paths_raw, list):
-            raise ValueError(f"{label}: 'paths' must be a list")
-        paths_list = typing.cast(list[object], paths_raw)
-        paths = tuple(_parse_path_match(idx, j, p) for j, p in enumerate(paths_list))
-
-    methods: tuple[str, ...] = ()
-    methods_raw = raw_dict.get("methods")
-    if methods_raw is not None:
-        if not isinstance(methods_raw, list):
-            raise ValueError(f"{label}: 'methods' must be a list")
-        methods_list = typing.cast(list[object], methods_raw)
-        normalised: list[str] = []
-        for j, m in enumerate(methods_list):
-            if not isinstance(m, str):
-                raise ValueError(f"{label}: methods[{j}] must be a string")
-            upper = m.upper()
-            if upper not in VALID_METHODS:
-                raise ValueError(
-                    f"{label}: methods[{j}] {m!r} is not a valid HTTP method"
-                )
-            normalised.append(upper)
-        methods = tuple(normalised)
-
-    headers: tuple[HeaderMatch, ...] = ()
-    headers_raw = raw_dict.get("headers")
-    if headers_raw is not None:
-        if not isinstance(headers_raw, list):
-            raise ValueError(f"{label}: 'headers' must be a list")
-        headers_list = typing.cast(list[object], headers_raw)
-        headers = tuple(
-            _parse_header_match(idx, j, h) for j, h in enumerate(headers_list)
-        )
-
-    for key in raw_dict:
-        if key not in ("paths", "methods", "headers"):
-            raise ValueError(f"{label}: unknown key {key!r}")
-
-    return MatchEntry(paths=paths, methods=methods, headers=headers)
-
-
-def parse_routes(payload: object) -> tuple[Route, ...]:
-    if not isinstance(payload, dict):
-        raise ValueError("routes payload: top-level must be an object")
-    payload_dict: dict[str, object] = typing.cast(dict[str, object], payload)
-    raw: object = payload_dict.get("routes")
-    if not isinstance(raw, list):
-        raise ValueError("routes payload: 'routes' must be a list")
-    raw_list: list[object] = typing.cast(list[object], raw)
-    out: list[Route] = []
-    for i, r in enumerate(raw_list):
-        out.append(_parse_one(i, r))
-    return tuple(out)
-
-
-def _parse_one(idx: int, raw: object) -> Route:
-    label = f"route[{idx}]"
-    if not isinstance(raw, dict):
-        raise ValueError(f"{label}: must be an object (got {type(raw).__name__})")
-    raw_dict: dict[str, object] = typing.cast(dict[str, object], raw)
-    host: object = raw_dict.get("host")
-    if not isinstance(host, str) or not host:
-        raise ValueError(f"{label}: 'host' must be a non-empty string")
-    legacy_flat = "inspect" not in raw_dict
-    inspect_raw = raw_dict.get("inspect", {})
-    if inspect_raw is False:
-        inspect = False
-        settings: dict[str, object] = {}
-    elif isinstance(inspect_raw, dict):
-        inspect = True
-        settings = (
-            {k: v for k, v in raw_dict.items() if k != "host"}
-            if legacy_flat
-            else typing.cast(dict[str, object], inspect_raw)
-        )
-        legacy_dlp = settings.pop("dlp", None)
-        if isinstance(legacy_dlp, dict):
-            settings.update(typing.cast(dict[str, object], legacy_dlp))
-        elif legacy_dlp is not None:
-            raise ValueError(
-                f"{label} ({host}): legacy 'dlp' must be an object"
-            )
-    else:
-        raise ValueError(f"{label} ({host}): 'inspect' must be false or an object")
-
-    # matches
-    matches: tuple[MatchEntry, ...] = ()
-    matches_raw = settings.get("matches")
-    if matches_raw is not None:
-        if not isinstance(matches_raw, list):
-            raise ValueError(f"{label} ({host}): 'matches' must be a list")
-        matches_list = typing.cast(list[object], matches_raw)
-        matches = tuple(
-            _parse_match_entry(idx, k, m) for k, m in enumerate(matches_list)
-        )
-
-    # auth (unchanged wire format)
-    auth_scheme: object = settings.get("auth_scheme", "")
-    token_env: object = settings.get("token_env", "")
-    if not isinstance(auth_scheme, str):
-        raise ValueError(f"{label} ({host}): 'auth_scheme' must be a string")
-    if not isinstance(token_env, str):
-        raise ValueError(f"{label} ({host}): 'token_env' must be a string")
-    if bool(auth_scheme) != bool(token_env):
-        raise ValueError(
-            f"{label} ({host}): 'auth_scheme' and 'token_env' must be both "
-            f"set or both empty (got auth_scheme={auth_scheme!r}, "
-            f"token_env={token_env!r})"
-        )
-
-    # git-over-HTTPS policy
-    git_fetch = False
-    git_raw = settings.get("git")
-    if git_raw is not None:
-        if not isinstance(git_raw, dict):
-            raise ValueError(f"{label} ({host}): 'git' must be an object")
-        git_dict: dict[str, object] = typing.cast(dict[str, object], git_raw)
-        fetch_raw = git_dict.get("fetch", False)
-        if fetch_raw is True or fetch_raw is False:
-            git_fetch = fetch_raw
-        else:
-            raise ValueError(f"{label} ({host}): 'git.fetch' must be a boolean")
-        for k in git_dict:
-            if k != "fetch":
-                raise ValueError(
-                    f"{label} ({host}): git has unknown key {k!r}; "
-                    "accepted key is 'fetch'"
-                )
-
-    # dlp detectors
-    outbound_detectors, inbound_detectors, outbound_on_match = parse_inspect_block(
-        idx, host, settings,
-    )
-
-    preserve_auth_raw = settings.get("preserve_auth", False)
-    if preserve_auth_raw is not True and preserve_auth_raw is not False:
-        raise ValueError(
-            f"{label} ({host}): 'preserve_auth' must be a boolean"
-        )
-    preserve_auth: bool = preserve_auth_raw
-
-    for k in settings:
-        if k not in (
-            "matches", "auth_scheme", "token_env", "git", "preserve_auth",
-            "outbound_detectors", "inbound_detectors", "outbound_on_match",
-        ):
-            raise ValueError(
-                f"{label} ({host}): inspect has unknown key {k!r}"
-            )
-    for k in raw_dict:
-        if not legacy_flat and k not in ("host", "inspect"):
-            raise ValueError(
-                f"{label} ({host}): unknown key {k!r}; accepted keys "
-                f"are 'host' and 'inspect'"
-            )
-
-    return Route(
-        host=host,
-        matches=matches,
-        auth_scheme=auth_scheme,
-        token_env=token_env,
-        git_fetch=git_fetch,
-        outbound_detectors=outbound_detectors,
-        inbound_detectors=inbound_detectors,
-        outbound_on_match=outbound_on_match,
-        preserve_auth=preserve_auth,
-        inspect=inspect,
-    )
-
-
-def _path_match_to_dict(pm: PathMatch) -> dict[str, object]:
-    d: dict[str, object] = {"value": pm.value}
-    if pm.type != "prefix":
-        d["type"] = pm.type
-    return d
-
-
-def _header_match_to_dict(hm: HeaderMatch) -> dict[str, object]:
-    d: dict[str, object] = {"name": hm.name, "value": hm.value}
-    if hm.type != "exact":
-        d["type"] = hm.type
-    return d
-
-
-def _match_entry_to_dict(me: MatchEntry) -> dict[str, object]:
-    d: dict[str, object] = {}
-    if me.paths:
-        d["paths"] = [_path_match_to_dict(p) for p in me.paths]
-    if me.methods:
-        d["methods"] = list(me.methods)
-    if me.headers:
-        d["headers"] = [_header_match_to_dict(h) for h in me.headers]
-    return d
-
-
-def route_to_yaml_dict(r: Route) -> dict[str, object]:
-    """Serialize a Route to YAML-schema-compatible dict.
-
-    Uses the same field names the YAML parser accepts, so the output
-    can be round-tripped directly into an `allow` or `egress-block`
-    proposal without translation. Fields that are empty/default are
-    omitted so the agent doesn't copy irrelevant keys."""
-    d: dict[str, object] = {"host": r.host}
-    if not r.inspect:
-        d["inspect"] = False
-        return d
-    inspected: dict[str, object] = {}
-    if r.auth_scheme:
-        inspected["auth_scheme"] = r.auth_scheme
-        inspected["token_env"] = r.token_env
-    if r.matches:
-        inspected["matches"] = [_match_entry_to_dict(m) for m in r.matches]
-    if r.git_fetch:
-        inspected["git"] = {"fetch": True}
-    if r.outbound_detectors is not None:
-        inspected["outbound_detectors"] = list(r.outbound_detectors)
-    if r.inbound_detectors is not None:
-        inspected["inbound_detectors"] = list(r.inbound_detectors)
-    if r.outbound_on_match:
-        inspected["outbound_on_match"] = r.outbound_on_match
-    if r.preserve_auth:
-        inspected["preserve_auth"] = True
-    if inspected:
-        d["inspect"] = inspected
-    return d
-
-
-def parse_config(payload: object) -> "Config":
-    """Parse a full egress config payload (top-level log level + routes)."""
-    if not isinstance(payload, dict):
-        raise ValueError("routes payload: top-level must be an object")
-    payload_dict: dict[str, object] = typing.cast(dict[str, object], payload)
-
-    log_raw: object = payload_dict.get("log", LOG_OFF)
-    if log_raw is True or log_raw is False or not isinstance(log_raw, int) \
-            or log_raw not in (LOG_OFF, LOG_BLOCKS, LOG_FULL):
-        raise ValueError(
-            f"routes payload: 'log' must be {LOG_OFF}, {LOG_BLOCKS}, or {LOG_FULL}"
-        )
-
-    routes = parse_routes(payload)
-    return Config(routes=routes, log=log_raw)
-
-
-def load_config(text: str) -> "Config":
-    """Parse YAML text → Config (routes + log flag)."""
-    try:
-        payload = parse_yaml_subset(text)
-    except YamlSubsetError as e:
-        raise ValueError(f"routes payload: invalid YAML: {e}") from e
-    return parse_config(payload)

bot_bottle/gateway/egress/types.py

@@ -1,81 +0,0 @@
-"""Shared egress policy value objects.
-
-Kept dependency-free so the schema parser, matcher, DLP scanner, and addon
-adapter can use the same immutable public shapes without importing each other.
-"""
-
-from __future__ import annotations
-
-import re
-from dataclasses import dataclass
-
-
-PATH_MATCH_TYPES = ("exact", "prefix", "regex")
-HEADER_MATCH_TYPES = ("exact", "regex")
-VALID_METHODS = frozenset({
-    "GET", "HEAD", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "TRACE",
-    "CONNECT",
-})
-
-LOG_OFF = 0
-LOG_BLOCKS = 1
-LOG_FULL = 2
-
-
-@dataclass(frozen=True)
-class PathMatch:
-    type: str
-    value: str
-    compiled: re.Pattern[str] | None = None
-
-
-@dataclass(frozen=True)
-class HeaderMatch:
-    name: str
-    value: str
-    type: str = "exact"
-    compiled: re.Pattern[str] | None = None
-
-
-@dataclass(frozen=True)
-class MatchEntry:
-    paths: tuple[PathMatch, ...] = ()
-    methods: tuple[str, ...] = ()
-    headers: tuple[HeaderMatch, ...] = ()
-
-
-@dataclass(frozen=True)
-class Route:
-    host: str
-    matches: tuple[MatchEntry, ...] = ()
-    auth_scheme: str = ""
-    token_env: str = ""
-    git_fetch: bool = False
-    outbound_detectors: tuple[str, ...] | None = None
-    inbound_detectors: tuple[str, ...] | None = None
-    outbound_on_match: str = ""
-    preserve_auth: bool = False
-    inspect: bool = True
-
-
-@dataclass(frozen=True)
-class Config:
-    routes: tuple[Route, ...]
-    log: int = LOG_OFF
-    deny_reason: str = ""
-
-
-@dataclass(frozen=True)
-class Decision:
-    action: str
-    reason: str = ""
-    inject_authorization: str | None = None
-
-
-@dataclass(frozen=True)
-class ScanResult:
-    severity: str
-    reason: str
-    location: str = ""
-    context: str = ""
-    matched: str = ""

bot_bottle/gateway/git_gate/http_backend.py

@@ -21,19 +21,12 @@ from __future__ import annotations
 import os
 import subprocess
 import sys
-import tempfile
-import threading
 import typing
-from http.server import BaseHTTPRequestHandler
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from urllib.parse import urlsplit
 
 from bot_bottle.constants import GIT_GATE_TIMEOUT_SECS, IDENTITY_HEADER
-from bot_bottle.gateway.bounded_http import (
-    BodyReadError,
-    BoundedThreadingHTTPServer,
-    copy_declared_body,
-)
 from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver
 
 
@@ -84,10 +77,6 @@ def resolve_sandbox_root(
 
 # Bound memory use while still allowing ordinary git push packfiles.
 MAX_BODY_BYTES = 100 * 1024 * 1024
-REQUEST_BODY_TIMEOUT_SECONDS = 30.0
-MAX_REQUEST_WORKERS = 16
-MAX_BODY_WORKERS = 2
-_BODY_WORK_SLOTS = threading.BoundedSemaphore(MAX_BODY_WORKERS)
 
 
 class GitHttpHandler(BaseHTTPRequestHandler):
@@ -195,40 +184,27 @@ class GitHttpHandler(BaseHTTPRequestHandler):
             value = self.headers.get(header)
             if value:
                 env[variable] = value
-        if not _BODY_WORK_SLOTS.acquire(blocking=False):
-            self.send_error(503, "git request capacity exhausted")
-            return
+        raw_length = self.headers.get("content-length", "0") or "0"
         try:
-            with tempfile.TemporaryFile() as body:
-                try:
-                    copy_declared_body(
-                        self.rfile,
-                        body,
-                        self.connection,
-                        self.headers.get("content-length"),
-                        maximum=MAX_BODY_BYTES,
-                        timeout_seconds=REQUEST_BODY_TIMEOUT_SECONDS,
-                        require_length=False,
-                    )
-                except BodyReadError as exc:
-                    self.send_error(exc.status, exc.message)
-                    return
-                body.seek(0)
-                try:
-                    proc = subprocess.run(
-                        ["git", "http-backend"],
-                        stdin=body,
-                        env=env,
-                        capture_output=True,
-                        check=False,
-                        timeout=GIT_GATE_TIMEOUT_SECS,
-                    )
-                except (OSError, subprocess.SubprocessError) as exc:
-                    self.log_message("git http-backend unavailable: %s", exc)
-                    self.send_error(503, "git backend unavailable")
-                    return
-        finally:
-            _BODY_WORK_SLOTS.release()
+            length = int(raw_length)
+        except ValueError:
+            self.send_error(400, "Bad Content-Length")
+            return
+        if length < 0:
+            self.send_error(400, "Negative Content-Length")
+            return
+        if length > MAX_BODY_BYTES:
+            self.send_error(413, "Request body too large")
+            return
+        body = self.rfile.read(length) if length else b""
+        proc = subprocess.run(
+            ["git", "http-backend"],
+            input=body,
+            env=env,
+            capture_output=True,
+            check=False,
+            timeout=GIT_GATE_TIMEOUT_SECS,
+        )
         self._write_cgi_response(proc.stdout)
 
     def _repo_dir(self, sandbox_root: Path, path: str) -> Path | None:
@@ -297,9 +273,7 @@ def main() -> int:
             "(no single-tenant flat-root fallback)\n"
         )
         return 1
-    server = BoundedThreadingHTTPServer(
-        ("0.0.0.0", port), GitHttpHandler, max_workers=MAX_REQUEST_WORKERS,
-    )
+    server = ThreadingHTTPServer(("0.0.0.0", port), GitHttpHandler)
     # Resolve each request's sandbox namespace by source IP against the
     # orchestrator control plane.
     server.policy_resolver = PolicyResolver(orch_url)  # type: ignore[attr-defined]

bot_bottle/gateway/git_gate/render.py

@@ -252,27 +252,6 @@ cat > "$refs_file"
 
 zero=0000000000000000000000000000000000000000
 
-# Phase 0: reject Gitea AGit review refs before scanning or forwarding.
-# A push to refs/for/*, refs/draft/*, or refs/for-review/* asks Gitea to
-# open a pull request backed by a server-managed refs/pull/<n>/head rather
-# than an ordinary refs/heads/* branch. That breaks the git-gate workflow:
-# follow-up commits can't be pushed back through the branch, and Gitea
-# rejects later direct updates to the generated review ref. Fail the whole
-# push here (before any gitleaks scan or upstream forward) so the caller
-# pushes a real branch and opens the PR against it instead. Deletions
-# (new == zero) stay allowed so stale AGit refs can still be cleaned up.
-while IFS=' ' read -r old new ref; do
-  [ -z "$ref" ] && continue
-  [ "$new" = "$zero" ] && continue
-  case "$ref" in
-    refs/for/*|refs/draft/*|refs/for-review/*)
-      echo "git-gate: refusing AGit review ref $ref" >&2
-      echo "git-gate: push to refs/heads/<branch> and open a branch-backed pull request instead" >&2
-      exit 1
-      ;;
-  esac
-done < "$refs_file"
-
 supervise_gitleaks_allow() {
   log_opts=$1
   ref=$2
@@ -385,7 +364,7 @@ PY
       ;;
   esac
   echo "git-gate: queued # gitleaks:allow supervisor approval $proposal_id" >&2
-  echo "git-gate: approve with 'bot-bottle supervise' to continue this push" >&2
+  echo "git-gate: approve with './cli.py supervise' to continue this push" >&2
   waited=0
   while [ "$waited" -lt "$timeout" ]; do
     status=$(PYTHONPATH="/app${PYTHONPATH:+:$PYTHONPATH}" python3 - "$proposal_id" <<'PY'

bot_bottle/gateway/supervisor/mcp_dispatch.py

@@ -1,92 +0,0 @@
-"""Framework-neutral MCP method and tool dispatch."""
-
-from __future__ import annotations
-
-import json
-from dataclasses import dataclass
-from typing import Callable, Protocol
-
-from bot_bottle.gateway.egress.schema import load_config, route_to_yaml_dict
-from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver
-from bot_bottle.supervisor import types as _sv
-
-
-class Request(Protocol):
-    @property
-    def method(self) -> str: ...
-
-    @property
-    def params(self) -> dict[str, object]: ...
-
-
-class MethodNotFoundError(Exception):
-    """Raised when a JSON-RPC method has no MCP handler."""
-
-
-class RouteResolutionError(Exception):
-    """The caller's live route table could not be resolved authoritatively."""
-
-
-Handler = Callable[[dict[str, object]], object]
-
-
-@dataclass(frozen=True)
-class Handlers:
-    initialize: Handler
-    tools_list: Handler
-    list_routes: Handler
-    check_proposal: Handler
-    propose: Handler
-
-
-def dispatch(request: Request, handlers: Handlers) -> object:
-    """Route one parsed request without depending on the HTTP server."""
-    if request.method == "initialize":
-        return handlers.initialize(request.params)
-    if request.method == "notifications/initialized":
-        return None
-    if request.method == "tools/list":
-        return handlers.tools_list(request.params)
-    if request.method != "tools/call":
-        raise MethodNotFoundError(request.method)
-
-    tool = request.params.get("name")
-    if tool == _sv.TOOL_LIST_EGRESS_ROUTES:
-        return handlers.list_routes(request.params)
-    if tool == _sv.TOOL_CHECK_PROPOSAL:
-        return handlers.check_proposal(request.params)
-    return handlers.propose(request.params)
-
-
-def resolved_routes_payload(
-    resolver: PolicyResolver,
-    source_ip: str,
-    identity_token: str,
-) -> dict[str, object]:
-    """Render an authoritatively resolved route table for the calling bottle."""
-    try:
-        policy, bottle_id, _tokens = resolver.resolve_policy_and_bottle_id(
-            source_ip, identity_token,
-        )
-    except PolicyResolveError as exc:
-        raise RouteResolutionError("orchestrator unavailable") from exc
-    if not bottle_id:
-        raise RouteResolutionError("request source is not attributed to a bottle")
-    try:
-        config = load_config(policy or "")
-    except ValueError as exc:
-        raise RouteResolutionError("resolved policy is invalid") from exc
-    body = json.dumps(
-        {"routes": [route_to_yaml_dict(route) for route in config.routes]},
-        indent=2,
-    )
-    return {"content": [{"type": "text", "text": body}], "isError": False}
-
-
-__all__ = [
-    "Handlers",
-    "MethodNotFoundError",
-    "RouteResolutionError",
-    "dispatch",
-    "resolved_routes_payload",
-]

bot_bottle/gateway/supervisor/server.py

@@ -51,27 +51,17 @@ from __future__ import annotations
 import http.server
 import json
 import os
+import socketserver
 import sys
 import time
 import typing
 from dataclasses import dataclass
 
 from bot_bottle.constants import IDENTITY_HEADER
-from bot_bottle.gateway.bounded_http import (
-    BodyReadError,
-    BoundedThreadingHTTPServer,
-    read_declared_body,
+from bot_bottle.gateway.egress.addon_core import (
+    LOG_OFF, load_config, resolve_client_context, route_to_yaml_dict,
 )
-from bot_bottle.gateway.egress.schema import load_config
-from bot_bottle.gateway.egress.types import LOG_OFF
 from bot_bottle.gateway.policy_resolver import PolicyResolveError, PolicyResolver
-from bot_bottle.gateway.supervisor.mcp_dispatch import (
-    Handlers as DispatchHandlers,
-    MethodNotFoundError,
-    RouteResolutionError,
-    dispatch,
-    resolved_routes_payload,
-)
 from bot_bottle.supervisor import types as _sv
 
 
@@ -575,8 +565,6 @@ def format_unknown_proposal_text(proposal_id: str) -> str:
 # Max request body the server accepts. 1 MB is well above any realistic
 # routes.yaml proposal.
 MAX_BODY_BYTES = 1 * 1024 * 1024
-REQUEST_BODY_TIMEOUT_SECONDS = 10.0
-MAX_REQUEST_WORKERS = 32
 
 
 class MCPHandler(http.server.BaseHTTPRequestHandler):
@@ -599,18 +587,19 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
         self._write_text(405, "use POST for MCP requests\n")
 
     def do_POST(self) -> None:
-        try:
-            body = read_declared_body(
-                self.rfile,
-                self.connection,
-                self.headers.get("Content-Length"),
-                maximum=MAX_BODY_BYTES,
-                timeout_seconds=REQUEST_BODY_TIMEOUT_SECONDS,
-                require_length=True,
-            )
-        except BodyReadError as exc:
-            self._write_text(exc.status, exc.message + "\n")
+        length_header = self.headers.get("Content-Length")
+        if length_header is None:
+            self._write_text(411, "Content-Length required\n")
             return
+        try:
+            length = int(length_header)
+        except ValueError:
+            self._write_text(400, "invalid Content-Length\n")
+            return
+        if length < 0 or length > MAX_BODY_BYTES:
+            self._write_text(413, "request body too large\n")
+            return
+        body = self.rfile.read(length)
 
         try:
             req = parse_jsonrpc(body)
@@ -622,11 +611,6 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
 
         try:
             result = self._dispatch(req, config)
-        except MethodNotFoundError as e:
-            self._write_jsonrpc(
-                jsonrpc_error(req.id, ERR_METHOD_NOT_FOUND, f"method not found: {e}"),
-            )
-            return
         except _RpcClientError as e:
             self._write_jsonrpc(jsonrpc_error(req.id, e.code, e.message))
             return
@@ -649,42 +633,41 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
         self._write_jsonrpc(jsonrpc_result(req.id, result))
 
     def _dispatch(self, req: JsonRpcRequest, config: ServerConfig) -> object:
-        def check(params: dict[str, object]) -> object:
-            return handle_check_proposal(
-                params,
-                resolver=self._resolver_or_fail(),
-                source_ip=self.client_address[0],
-                identity_token=self._identity_token(),
-            )
-
-        def propose(params: dict[str, object]) -> object:
-            return handle_tools_call(
-                params,
-                config,
-                resolver=self._resolver_or_fail(),
-                source_ip=self.client_address[0],
-                identity_token=self._identity_token(),
-            )
-
-        def list_routes(_params: dict[str, object]) -> object:
-            try:
-                return resolved_routes_payload(
-                    self._resolver_or_fail(),
-                    self.client_address[0],
-                    self._identity_token(),
+        method = req.method
+        if method == "initialize":
+            return handle_initialize(req.params)
+        if method == "notifications/initialized":
+            return None  # ack-only
+        if method == "tools/list":
+            return handle_tools_list(req.params)
+        if method == "tools/call":
+            # `list-egress-routes` is read-only introspection. The shared gateway
+            # has no static route table (routes are resolved per request by
+            # source IP), so answer it from the calling bottle's resolved policy.
+            # Otherwise the agent sees an empty allowlist and composes an egress
+            # proposal that *replaces* the live routes instead of extending them
+            # — silently dropping base routes like api.anthropic.com on approval.
+            if req.params.get("name") == _sv.TOOL_LIST_EGRESS_ROUTES:
+                return self._resolved_routes_payload()
+            resolver = self._resolver_or_fail()
+            source_ip = self.client_address[0]
+            token = self._identity_token()
+            # `check-proposal` is a non-blocking read of the calling bottle's
+            # own queue — attributed by (source_ip, identity_token) like a
+            # proposal, but it never queues or blocks.
+            if req.params.get("name") == _sv.TOOL_CHECK_PROPOSAL:
+                return handle_check_proposal(
+                    req.params, resolver=resolver,
+                    source_ip=source_ip, identity_token=token,
                 )
-            except RouteResolutionError as exc:
-                raise _RpcInternalError(
-                    f"could not resolve live egress routes: {exc}"
-                ) from exc
-
-        return dispatch(req, DispatchHandlers(
-            initialize=handle_initialize,
-            tools_list=handle_tools_list,
-            list_routes=list_routes,
-            check_proposal=check,
-            propose=propose,
-        ))
+            # The control plane attributes the proposal to the source-IP + token
+            # resolved bottle, so the one shared queue holds each bottle's
+            # proposal under its own id — no slug is asserted by this daemon.
+            return handle_tools_call(
+                req.params, config, resolver=resolver,
+                source_ip=source_ip, identity_token=token,
+            )
+        raise _RpcClientError(ERR_METHOD_NOT_FOUND, f"method not found: {method}")
 
     def _identity_token(self) -> str:
         """The agent's per-bottle identity token from the request header (the
@@ -703,6 +686,20 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
             raise _RpcInternalError("supervise server has no policy resolver")
         return resolver
 
+    def _resolved_routes_payload(self) -> dict[str, object]:
+        """The calling bottle's live egress routes as the `list-egress-routes`
+        JSON payload, resolved by (source_ip, identity token). Fail-closed: an
+        unattributed source or an unreachable orchestrator yields an empty route
+        list (never another bottle's), courtesy of `resolve_client_context`."""
+        resolver = self._resolver_or_fail()
+        conf, _slug, _tokens = resolve_client_context(
+            resolver, self.client_address[0], self._identity_token(),
+        )
+        body = json.dumps(
+            {"routes": [route_to_yaml_dict(r) for r in conf.routes]}, indent=2,
+        )
+        return {"content": [{"type": "text", "text": body}], "isError": False}
+
     def _write_jsonrpc(self, body: bytes) -> None:
         self.send_response(200)
         self.send_header("Content-Type", "application/json")
@@ -722,7 +719,7 @@ class MCPHandler(http.server.BaseHTTPRequestHandler):
             self.wfile.write(encoded)
 
 
-class MCPServer(BoundedThreadingHTTPServer):
+class MCPServer(socketserver.ThreadingMixIn, http.server.HTTPServer):
     allow_reuse_address = True
     daemon_threads = True
     config: ServerConfig = ServerConfig()
@@ -731,9 +728,6 @@ class MCPServer(BoundedThreadingHTTPServer):
     # closed per request (see `_resolver_or_fail`).
     policy_resolver: "PolicyResolver | None" = None
 
-    def __init__(self, *args, **kwargs):  # type: ignore[no-untyped-def]
-        super().__init__(*args, max_workers=MAX_REQUEST_WORKERS, **kwargs)
-
 
 # --- Entry point -----------------------------------------------------------
 

bot_bottle/orchestrator/__init__.py

@@ -44,7 +44,7 @@ if TYPE_CHECKING:
     from ..gateway import Gateway, GatewayError
     from .lifecycle import Orchestrator
     from .service import OrchestratorCore
-    from .server import OrchestratorServer, create_app, make_server
+    from .server import OrchestratorServer, dispatch, make_server
 
 
 # Facade name -> submodule that defines it. Lazy so importing a leaf (or the
@@ -67,8 +67,8 @@ _LAZY: dict[str, str] = {
     "GatewayError": "..gateway",
     "Orchestrator": ".lifecycle",
     "OrchestratorCore": ".service",
-    "create_app": ".server",
     "OrchestratorServer": ".server",
+    "dispatch": ".server",
     "make_server": ".server",
 }
 
@@ -100,7 +100,7 @@ __all__ = [
     "GatewayError",
     "Orchestrator",
     "OrchestratorCore",
-    "create_app",
     "OrchestratorServer",
+    "dispatch",
     "make_server",
 ]

bot_bottle/orchestrator/__main__.py

@@ -1,7 +1,6 @@
 """Run the orchestrator control plane as a plain process (PRD 0070 dev-harness).
 
-    BOT_BOTTLE_ORCHESTRATOR_TOKEN=<signing-key> \
-        python -m bot_bottle.orchestrator [--host H] [--port P] [--db PATH]
+    python -m bot_bottle.orchestrator [--host H] [--port P] [--db PATH]
 
 The PRD sequences the orchestrator as a plain-process dev-harness first, so
 the consolidation core (registry + attribution + HTTP control plane + live
@@ -17,13 +16,14 @@ import secrets
 from pathlib import Path
 
 from .. import log
-from ..trust_domain import CONTROL_PLANE
-from .broker import LaunchBroker, StubBroker
-from .docker_broker import DockerBroker
-from .server import make_server
-from .service import OrchestratorCore
 from .store.store_manager import StoreManager
+from .broker import StubBroker, SubmitBroker
+from .broker_client import BrokerClient
+from .host_server import BROKER_SECRET_ENV, DEFAULT_PORT, broker_secret_from_env
+from .server import make_server
+from .docker_broker import DockerBroker
 from .store.registry_store import RegistryStore, default_db_path
+from .service import OrchestratorCore
 
 
 def main(argv: list[str] | None = None) -> int:
@@ -36,15 +36,15 @@ def main(argv: list[str] | None = None) -> int:
         help=f"registry DB path (default: {default_db_path()})",
     )
     parser.add_argument(
-        "--broker", choices=("stub", "docker"), default="stub",
-        help="launch broker: 'stub' records requests; 'docker' runs containers",
+        "--broker", choices=("stub", "docker", "http"), default="stub",
+        help="launch broker: 'stub' records requests; 'docker' runs containers "
+             "in-process; 'http' relays signed requests to a host control server",
+    )
+    parser.add_argument(
+        "--host-controller-url", default=f"http://127.0.0.1:{DEFAULT_PORT}",
+        help="host control server URL (used only with --broker http)",
     )
     args = parser.parse_args(argv)
-    if not CONTROL_PLANE.key_from_env():
-        log.die(
-            f"{CONTROL_PLANE.key_env} is required; refusing to start the "
-            "orchestrator without caller authentication"
-        )
 
     registry = RegistryStore(args.db)
     registry.migrate()
@@ -54,22 +54,39 @@ def main(argv: list[str] | None = None) -> int:
     # operator reaches it over HTTP (never a second, disconnected DB).
     StoreManager(registry.db_path).migrate()
 
-    # An ephemeral signing secret ties the orchestrator (signer) to its
-    # broker (verifier). 'stub' records launches instead of starting
-    # anything; 'docker' runs real containers (firecracker drops in later).
-    secret = secrets.token_bytes(32)
-    broker: LaunchBroker = DockerBroker(secret) if args.broker == "docker" else StubBroker(secret)
+    # A signing secret ties the orchestrator (signer) to its broker (verifier).
+    # 'stub' records launches instead of starting anything; 'docker' runs real
+    # containers in-process; 'http' relays signed requests to a separate host
+    # control server, which verifies and launches. For 'stub'/'docker' the
+    # secret is ephemeral (signer and verifier share this process); for 'http'
+    # it must be the SAME secret the host controller holds, so it is read from
+    # the shared env var (the chunk-1 stand-in for out-of-band provisioning).
+    broker: SubmitBroker
+    if args.broker == "http":
+        secret = broker_secret_from_env()
+        if secret is None:
+            parser.error(
+                f"--broker http requires a shared signing secret in "
+                f"${BROKER_SECRET_ENV} (hex), matching the host control server"
+            )
+        broker = BrokerClient(args.host_controller_url)
+    else:
+        secret = secrets.token_bytes(32)
+        broker = DockerBroker(secret) if args.broker == "docker" else StubBroker(secret)
     orchestrator = OrchestratorCore(registry, broker, secret)
 
     server = make_server(orchestrator, host=args.host, port=args.port)
+    bound_host, bound_port = server.server_address[0], server.server_address[1]
     log.info(
         "orchestrator control plane listening",
-        context={"host": args.host, "port": args.port, "db": str(registry.db_path)},
+        context={"host": bound_host, "port": bound_port, "db": str(registry.db_path)},
     )
     try:
-        server.run()
+        server.serve_forever()
     except KeyboardInterrupt:
         log.info("orchestrator shutting down")
+    finally:
+        server.server_close()
     return 0