refactor: rename _supervise_types → supervise_types (treat as public)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix: remove unused DbVersionError import from cli/__init__
2026-07-06 18:25:01 +00:00 · 2026-07-06 18:05:08 +00:00 · 2026-07-06 17:47:52 +00:00
46 changed files with 269 additions and 1153 deletions
@@ -71,7 +71,6 @@ COPY bot_bottle/db_store.py          /app/db_store.py
 COPY bot_bottle/supervise_types.py   /app/supervise_types.py
 COPY bot_bottle/queue_store.py       /app/queue_store.py
 COPY bot_bottle/audit_store.py       /app/audit_store.py
-COPY bot_bottle/store_manager.py     /app/store_manager.py
 COPY bot_bottle/supervise.py         /app/supervise.py
 COPY bot_bottle/supervise_server.py  /app/supervise_server.py
 COPY bot_bottle/sidecar_init.py      /app/sidecar_init.py
@@ -25,7 +25,7 @@
 - **Provider templates (Claude, Codex)** — `Dockerfile.claude` / `Dockerfile.codex`, or a bottle-supplied Dockerfile. Claude auth via long-lived OAuth token; Codex via opt-in host device-auth forwarding.
 - **gVisor auto-detect** — on Linux hosts where `runsc` is registered with Docker, every bottle launches under it for a userspace syscall barrier; no manifest config required.
 - **Apple Container backend (macOS default when available)** — runs the agent and sidecar bundle with Apple's `container` CLI, using a host-only agent network plus a separate sidecar egress network.
- **Smolmachines backend** — runs the agent in a libkrun micro-VM while the sidecar bundle stays in Docker. TSI and smolmachines DNS filtering close the raw DNS exfiltration gap that exists in the legacy Docker backend. Runs on macOS (Hypervisor.framework) and Linux (KVM, `/dev/kvm`).
+- **Smolmachines backend** — runs the agent in a libkrun micro-VM while the sidecar bundle stays in Docker. TSI and smolmachines DNS filtering close the raw DNS exfiltration gap that exists in the legacy Docker backend.
 - **Legacy Docker backend** — still available for examples, CI, and hosts without Apple Container via `BOT_BOTTLE_BACKEND=docker` or `--backend=docker`.

 ## Architecture
@@ -71,26 +71,10 @@ When the agent exits, `cli.py` tears down every sidecar and both networks; nothi

 ## Quickstart

-On compatible macOS hosts, the default backend requires Apple's `container` CLI and does not require Docker. The smolmachines backend requires Docker on the host for the sidecar bundle plus `smolvm` (macOS or Linux). The legacy Docker backend requires Docker. Claude bottles also need a long-lived Claude Code OAuth token (`claude setup-token`) exported as `BOT_BOTTLE_CLAUDE_OAUTH_TOKEN`.
+On compatible macOS hosts, the default backend requires Apple's `container` CLI and does not require Docker. The smolmachines backend requires Docker on the host for the sidecar bundle plus smolvm. The legacy Docker backend requires Docker. Claude bottles also need a long-lived Claude Code OAuth token (`claude setup-token`) exported as `BOT_BOTTLE_CLAUDE_OAUTH_TOKEN`.

 Use `BOT_BOTTLE_BACKEND=docker ./cli.py start <agent>` on hosts where Apple Container is not installed and Docker is the desired backend.

-### smolmachines on Linux
-
-The smolmachines backend runs on Linux as well as macOS. On Linux, `smolvm`/libkrun use KVM, so the host needs:
-
- **`/dev/kvm`** present and accessible. Load `kvm-intel` or `kvm-amd` (and enable virtualization in BIOS/firmware). The invoking user must be in the `kvm` group: `sudo usermod -aG kvm "$USER"` then re-login. bot-bottle preflights this and reports exactly what's missing.
- **`smolvm`** on `PATH`: `curl -sSL https://smolmachines.com/install.sh | sh`.
- **Docker** for the sidecar bundle and image build, same as macOS.
-
-Per-bottle isolation works the same as macOS without any `ifconfig`/sudo step — all of `127.0.0.0/8` is already loopback on Linux, so each bottle's sidecar bundle is published on its own `127.0.0.<N>` and TSI's allowlist is scoped to that `/32`.
-
-```sh
-BOT_BOTTLE_BACKEND=smolmachines ./cli.py start <agent>
-```
-
-> **NixOS:** enable `virtualisation.docker`, ensure the KVM module is loaded (`boot.kernelModules = [ "kvm-intel" ];` or `kvm-amd`), and add your user to the `kvm` and `docker` groups. If you run bottles from a Gitea Actions runner, use a `host`-label runner so Docker, `smolvm`, and `/dev/kvm` are all reachable from the job. `smolvm` isn't in nixpkgs — install the release binary (pin the version) and put it on the runner's `PATH`.
-
 ```sh
 ./cli.py start <agent>   # builds the image on first run, drops you into claude
 ```
@@ -227,10 +227,6 @@ class AgentProvider(ABC):
        from .backend.util import AGENT_CA_PATH, log_ca_fingerprint, select_ca_cert
        from .log import die
        cert_host_path, label = select_ca_cert(plan.egress_plan)
-        # Ensure the target directory exists. smolvm's pack step may not
-        # preserve the empty /usr/local/share/ca-certificates/ directory
-        # on Linux; mkdir -p is idempotent and safe for all backends.
-        bottle.exec("mkdir -p /usr/local/share/ca-certificates", user="root")
        bottle.cp_in(str(cert_host_path), AGENT_CA_PATH)
        r = bottle.exec(
            f"chmod 644 {AGENT_CA_PATH} && update-ca-certificates",
@@ -15,29 +15,31 @@ except ImportError:
    from migrations import TableMigrations  # type: ignore[import-not-found]  # pylint: disable=import-error,no-name-in-module


+# One entry per schema version: _MIGRATIONS.migrations[0] brings a fresh DB
+# to version 1, [1] to version 2, and so on.  Add new migrations at the end;
+# never edit existing ones.
+_MIGRATIONS = TableMigrations("audit_store", [
+    # v1 — initial schema
+    """
+    CREATE TABLE IF NOT EXISTS supervise_audit_entries (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        timestamp TEXT NOT NULL,
+        bottle_slug TEXT NOT NULL,
+        component TEXT NOT NULL,
+        operator_action TEXT NOT NULL,
+        operator_notes TEXT NOT NULL,
+        justification TEXT NOT NULL,
+        diff TEXT NOT NULL
+    )
+    """,
+])
+
+
 class AuditStore(DbStore):
    """SQLite-backed persistent store for supervise audit entries."""

    def __init__(self, db_path: Path | None = None) -> None:
-        # One entry per schema version: migrations[0] brings a fresh DB to
-        # version 1, [1] to version 2, etc.  Add new entries at the end; never
-        # edit existing ones.
-        migrations = TableMigrations("audit_store", [
-            # v1 — initial schema
-            """
-            CREATE TABLE IF NOT EXISTS supervise_audit_entries (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                timestamp TEXT NOT NULL,
-                bottle_slug TEXT NOT NULL,
-                component TEXT NOT NULL,
-                operator_action TEXT NOT NULL,
-                operator_notes TEXT NOT NULL,
-                justification TEXT NOT NULL,
-                diff TEXT NOT NULL
-            )
-            """,
-        ])
-        super().__init__(db_path or host_db_path(), migrations)
+        super().__init__(db_path or host_db_path(), _MIGRATIONS)

    def write_audit_entry(self, entry: AuditEntry) -> Path:
        with self._connect() as conn:
@@ -405,15 +405,7 @@ def _sidecar_mounts(

    sp = plan.supervise_plan
    if sp is not None:
-        # `container run --mount type=bind` only accepts directory
-        # sources (a file source fails with "is not a directory") —
-        # mount db_path's dedicated parent dir instead of the file
-        # itself, same as the CA/routes mounts above.
-        mounts.append((
-            str(sp.db_path.parent),
-            str(Path(DB_PATH_IN_CONTAINER).parent),
-            False,
-        ))
+        mounts.append((str(sp.db_path), DB_PATH_IN_CONTAINER, False))

    return tuple(mounts)

@@ -47,24 +47,10 @@ _HOME_FOR = {
    "root": "/root",
 }

-_DEFAULT_PATH_FOR = {
-    # Committed smolmachine snapshots are rebuilt from a rootfs tarball and
-    # lose Docker image ENV metadata. Restore the provider CLI path here so
-    # resumed Codex bottles can still find the per-user install.
-    "node": (
-        "/home/node/.local/bin:"
-        "/home/node/.codex/packages/standalone/current/bin:"
-        "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-    ),
-    "root": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
-}
-

 def _env_assignments_for(user: str, env: Mapping[str, str]) -> list[str]:
    home = _HOME_FOR.get(user, f"/home/{user}")
    out = [f"HOME={home}", f"USER={user}"]
-    if "PATH" not in env:
-        out.append(f"PATH={_DEFAULT_PATH_FOR.get(user, _DEFAULT_PATH_FOR['root'])}")
    for k, v in env.items():
        out.append(f"{k}={v}")
    return out
@@ -17,7 +17,6 @@ from __future__ import annotations

 import dataclasses
 import os
-import platform
 from contextlib import ExitStack, contextmanager
 from pathlib import Path
 from typing import Callable, Generator
@@ -92,13 +91,12 @@ def launch(
    try:
        loopback_ip, network = _allocate_resources(plan, stack)
        plan = _mint_certs(plan)
-        proxy_host = _proxy_host(plan, loopback_ip)
-        plan = _start_bundle(plan, network, proxy_host, stack)
-        plan = _discover_urls(plan, proxy_host)
+        plan = _start_bundle(plan, network, loopback_ip, stack)
+        plan = _discover_urls(plan, loopback_ip)

        agent_from_path = _agent_from_path(plan)

-        _launch_vm(plan, agent_from_path, proxy_host, stack)
+        _launch_vm(plan, agent_from_path, loopback_ip, stack)
        _init_vm(plan)

        bottle = SmolmachinesBottle(
@@ -146,12 +144,10 @@ def _allocate_resources(
 ) -> tuple[str, str]:
    """Reserve a loopback alias and create the per-bottle docker bridge.

-    The per-bottle alias scopes TSI's allowlist to this bottle's
-    published ports so the agent can't reach other bottles' or host
-    services' ports on loopback. On macOS `ensure_pool` first
-    sudo-aliases the pool on `lo0`; on Linux that's a no-op since
-    all of 127.0.0.0/8 is already loopback, but the per-bottle
-    allocation runs on both."""
+    macOS only routes 127.0.0.1 by default; the per-bottle alias
+    scopes TSI's allowlist to this bottle's published ports so the
+    agent can't reach other bottles' or host services' ports on
+    loopback. No-op on Linux."""
    _loopback.ensure_pool()
    loopback_ip = _loopback.allocate(plan.slug)
    network = _bundle.bundle_network_name(plan.slug)
@@ -176,13 +172,13 @@ def _mint_certs(plan: SmolmachinesBottlePlan) -> SmolmachinesBottlePlan:
 def _start_bundle(
    plan: SmolmachinesBottlePlan,
    network: str,
-    proxy_host: str,
+    loopback_ip: str,
    stack: ExitStack,
 ) -> SmolmachinesBottlePlan:
    """Build the BundleLaunchSpec, resolve token env, start the
    sidecar bundle container, and register teardown."""
    plan = _provision_git_gate_keys(plan)
-    bundle_spec = _bundle_launch_spec(plan, network, proxy_host)
+    bundle_spec = _bundle_launch_spec(plan, network, loopback_ip)
    token_env = _resolve_token_env(plan, dict(os.environ))
    _bundle.ensure_bundle_image(bundle_spec.image)
    _bundle.start_bundle(bundle_spec, env={**os.environ, **token_env})
@@ -205,40 +201,39 @@ def _provision_git_gate_keys(

 def _discover_urls(
    plan: SmolmachinesBottlePlan,
-    proxy_host: str,
+    loopback_ip: str,
 ) -> SmolmachinesBottlePlan:
    """Discover host-side ports for published container ports and
    return the plan with URLs + guest_env stamped in.

-    `proxy_host` is the host IP that both TSI's allowlist and
-    docker's port-forward bindings are keyed to. On macOS it is the
-    per-bottle loopback alias; on Linux it is the per-bottle bridge
-    gateway (see `_proxy_host`). The agent dials the published port
-    on this IP for all bundle-hosted services.
+    Docker container IPs (192.168.x.x in the daemon's bridge)
+    aren't reachable from the smolvm guest on macOS — TSI uses
+    macOS networking, and macOS sees the daemon's bridge via the
+    published-port loopback forward only.

-    NO_PROXY includes `proxy_host` so supervise + git-gate URLs
-    bypass HTTPS_PROXY."""
+    NO_PROXY includes the per-bottle loopback alias so the
+    supervise + git-gate URLs bypass HTTPS_PROXY."""
    agent_facing_host_port = _bundle.bundle_host_port(
-        plan.slug, _EGRESS_PORT, host_ip=proxy_host,
+        plan.slug, _EGRESS_PORT, host_ip=loopback_ip,
    )
-    agent_proxy_url = f"http://{proxy_host}:{agent_facing_host_port}"
+    agent_proxy_url = f"http://{loopback_ip}:{agent_facing_host_port}"

    agent_git_gate_host = ""
    if plan.git_gate_plan.upstreams:
        git_gate_host_port = _bundle.bundle_host_port(
-            plan.slug, _GIT_HTTP_PORT, host_ip=proxy_host,
+            plan.slug, _GIT_HTTP_PORT, host_ip=loopback_ip,
        )
-        agent_git_gate_host = f"{proxy_host}:{git_gate_host_port}"
+        agent_git_gate_host = f"{loopback_ip}:{git_gate_host_port}"

    agent_supervise_url = ""
    if plan.supervise_plan is not None:
        supervise_host_port = _bundle.bundle_host_port(
-            plan.slug, _SUPERVISE_PORT, host_ip=proxy_host,
+            plan.slug, _SUPERVISE_PORT, host_ip=loopback_ip,
        )
-        agent_supervise_url = f"http://{proxy_host}:{supervise_host_port}/"
+        agent_supervise_url = f"http://{loopback_ip}:{supervise_host_port}/"

    existing_no_proxy = plan.guest_env.get("NO_PROXY", "localhost,127.0.0.1")
-    no_proxy = f"{existing_no_proxy},{proxy_host}"
+    no_proxy = f"{existing_no_proxy},{loopback_ip}"
    guest_env = {
        **plan.guest_env,
        "HTTPS_PROXY": agent_proxy_url,
@@ -268,32 +263,27 @@ def _discover_urls(
 def _launch_vm(
    plan: SmolmachinesBottlePlan,
    agent_from_path: Path,
-    proxy_host: str,
+    loopback_ip: str,
    stack: ExitStack,
 ) -> None:
    """Create, patch, and start the smolvm VM; register teardown.

-    --allow-cidr is `proxy_host/32` — the per-bottle loopback alias
-    on macOS or the bridge gateway on Linux (see `_proxy_host`). This
-    ensures the guest can only reach bundle ports published on that IP,
-    not the container IP directly. force_allowlist confirms the
-    allowlist persisted (patching smolvm 0.8.0's silent-drop of
-    --allow-cidr when combined with --from) and fails closed if it
-    can't. Smolfile isn't usable here — smolvm 0.8.0 makes --from
+    --allow-cidr is the per-bottle loopback alias so the guest can
+    only reach this bottle's bundle ports. force_allowlist patches
+    smolvm 0.8.0's silent-drop of --allow-cidr when combined with
+    --from. Smolfile isn't usable here — smolvm 0.8.0 makes --from
    and --smolfile mutually exclusive."""
-    tsi_cidr = f"{proxy_host}/32"
    _smolvm.machine_create(
        plan.machine_name,
        from_path=agent_from_path,
-        allow_cidrs=[tsi_cidr],
+        allow_cidrs=[f"{loopback_ip}/32"],
        env=plan.guest_env,
    )
    stack.callback(_smolvm.machine_delete, plan.machine_name)
-    # Confirm the booted VM's TSI allowlist will actually enforce the
-    # /32 before start (smolvm 0.8.0 silently drops `--allow-cidr`
-    # with `--from`, so the persisted state DB is patched if needed).
-    # Fails closed if enforcement can't be confirmed.
-    _loopback.force_allowlist(plan.machine_name, [tsi_cidr])
+    # Workaround smolvm 0.8.0: `--allow-cidr` is silently dropped
+    # when combined with `--from`. Patch the persisted state DB
+    # before start so the booted VM's TSI actually enforces.
+    _loopback.force_allowlist(plan.machine_name, [f"{loopback_ip}/32"])
    _smolvm.machine_start(plan.machine_name)
    stack.callback(_smolvm.machine_stop, plan.machine_name)

@@ -302,9 +292,7 @@ def _init_vm(plan: SmolmachinesBottlePlan) -> None:
    """Repair filesystem ownership and wait for exec channel readiness.

    Ownership repair: smolvm's pack process remaps files to the host
-    invoker's uid (e.g. 501 on macOS, 1000 on Linux). The chowns use
-    names not numbers so they're correct on either. /home/node must
-    be node:node so
+    invoker's uid (501 on macOS). /home/node must be node:node so
    Claude Code can write ~/.claude.json; /tmp + /var/tmp need root
    mode 1777 so non-root processes can create per-uid scratch dirs.
    All folded into one sh -c to avoid back-to-back exec calls
@@ -327,29 +315,8 @@ def _init_vm(plan: SmolmachinesBottlePlan) -> None:
    _smolvm.wait_exec_ready(plan.machine_name)


-def _proxy_host(plan: SmolmachinesBottlePlan, loopback_ip: str) -> str:
-    """Return the host IP for TSI's allowlist and docker port-forward bindings.
-
-    On macOS, the per-bottle loopback alias (e.g. ``127.0.0.16``) works
-    because macOS's network stack lets TSI intercept 127.x.x.x connects
-    from the guest before they reach the host's own loopback.
-
-    On Linux, the guest kernel's LOCAL routing table routes all
-    ``127.0.0.0/8`` to the guest's own loopback — those packets never
-    reach eth0 and TSI never sees them. Using the per-bottle bridge
-    gateway (e.g. ``192.168.N.1``) instead sidesteps the problem: it
-    is not a loopback address, so the guest routes it via eth0 and TSI
-    intercepts it normally. The TSI allowlist is ``gateway/32``, which
-    is distinct from the container IP (``192.168.N.2``), so the agent
-    still can't reach the egress daemon directly — TSI blocks any
-    connection to the container IP that isn't via the published port."""
-    if platform.system() == "Linux":
-        return plan.bundle_gateway
-    return loopback_ip
-
-
 def _bundle_launch_spec(
-    plan: SmolmachinesBottlePlan, network: str, proxy_host: str,
+    plan: SmolmachinesBottlePlan, network: str, loopback_ip: str,
 ) -> _bundle.BundleLaunchSpec:
    """Build a BundleLaunchSpec from the resolved inner Plans.

@@ -408,9 +375,8 @@ def _bundle_launch_spec(
        volumes.append((str(sp.db_path), DB_PATH_IN_CONTAINER, False))

    # Container ports the agent reaches from the smolvm guest —
-    # published on `proxy_host` so the TSI allowlist and the docker
-    # port-forward bindings point at the same IP. Egress is always
-    # the agent's HTTP/HTTPS proxy.
+    # published on host loopback so the guest can dial via TSI +
+    # macOS networking. Egress is always the agent's HTTP/HTTPS proxy.
    ports_to_publish: list[int] = [_EGRESS_PORT]
    if gp.upstreams:
        ports_to_publish.append(_GIT_HTTP_PORT)
@@ -427,7 +393,7 @@ def _bundle_launch_spec(
        environment=tuple(env),
        volumes=tuple(volumes),
        ports_to_publish=tuple(ports_to_publish),
-        publish_host_ip=proxy_host,
+        publish_host_ip=loopback_ip,
    )


@@ -501,12 +467,6 @@ def _ensure_smolmachine(image_ref: str, *, dockerfile: str = "") -> Path:
        return sidecar
    tarball = _SMOLMACHINE_CACHE_DIR / f"{digest}.image.tar"
    docker_mod.save(image_ref, str(tarball))
-    # On Linux, `docker save -o` writes the tarball with owner-only
-    # permissions (mode 600). The crane push container runs as UID
-    # 65532 (distroless nonroot) and can't read it through a bind
-    # mount unless world-read is set. The tarball is temporary and
-    # lives in ~/.cache, so 644 is safe.
-    tarball.chmod(0o644)
    try:
        with ephemeral_registry() as handle:
            push_ref = f"{handle.push_endpoint}/bot-bottle:{digest}"
@@ -33,13 +33,10 @@ sudo-add the missing pool on first use per boot — the aliases
 persist on `lo0` until reboot, so subsequent launches don't
 prompt.

-On Linux the whole `127.0.0.0/8` is already routed to `lo`, so
-docker can publish a bundle's ports directly on `127.0.0.<N>`
-with no `ifconfig`/sudo step. `ensure_pool` is therefore a no-op
-on Linux, but per-bottle alias *allocation* and the TSI allowlist
-DB patch run on both platforms — the isolation property is
-identical, it's just cheaper to set up on Linux. The state-DB
-path differs per platform (see `_smolvm_db_path`).
+Linux native daemons share the host's network namespace; the
+whole `127.0.0.0/8` is reachable by default and aliases are
+unnecessary. The pool logic detects native-Linux and skips sudo
+entirely; the DB patch is also gated on macOS.

 Allocation is coordinated by inspecting running bundle
 containers' published host IPs — each bottle's bundle owns the
@@ -50,7 +47,6 @@ from __future__ import annotations

 import fcntl
 import json
-import os
 import platform
 import re
 import sqlite3
@@ -61,34 +57,20 @@ from typing import Iterable
 from ...log import die, info


-def _smolvm_db_path() -> Path:
-    """smolvm's persistent VM state — a SQLite DB whose `vms` table
-    holds one JSON BLOB per machine. macOS stores it under
-    `Application Support`; Linux follows the XDG base-dir spec
-    (`$XDG_DATA_HOME`, default `~/.local/share`).
-
-    NOTE: the Linux location is inferred from smolvm's documented
-    `~/.local/share` install layout and must be confirmed against a
-    real Linux smolvm install. If it's wrong, `force_allowlist`'s
-    fail-closed check turns it into a clear launch-time error rather
-    than a silent escape."""
-    if platform.system() == "Darwin":
-        return (
-            Path.home()
-            / "Library"
-            / "Application Support"
-            / "smolvm"
-            / "server"
-            / "smolvm.db"
-        )
-    xdg_data = os.environ.get("XDG_DATA_HOME")
-    base = Path(xdg_data) if xdg_data else Path.home() / ".local" / "share"
-    return base / "smolvm" / "server" / "smolvm.db"
-
-
-# Resolved once at import: the host platform doesn't change within a
-# process. Tests patch this attribute directly.
-_SMOLVM_DB_PATH = _smolvm_db_path()
+# smolvm's persistent VM state on macOS — a SQLite DB whose `vms`
+# table holds one JSON BLOB per machine. The Linux path is
+# different, but smolmachines is macOS-only in v1 (PRD 0023) so
+# we hard-code this. If the file moves under us we'll see a
+# clear FileNotFoundError; not worth defensive cross-platform
+# detection until the backend actually needs Linux.
+_SMOLVM_DB_PATH = (
+    Path.home()
+    / "Library"
+    / "Application Support"
+    / "smolvm"
+    / "server"
+    / "smolvm.db"
+)


 # Sixteen aliases by default. Tunable for hosts that want more
@@ -149,74 +131,51 @@ def ensure_pool() -> None:


 def force_allowlist(machine_name: str, allowed_cidrs: list[str]) -> None:
-    """Ensure the machine's persisted TSI allowlist equals
-    `allowed_cidrs`, failing **closed** if that can't be confirmed.
+    """Patch smolvm's persistent VM-state DB to set the machine's
+    `allowed_cidrs` to the given list. Workaround for smolvm
+    0.8.0's silent-drop of `--allow-cidr` when used with `--from`.

-    Runs on both macOS and Linux. It exists because smolvm 0.8.0
-    silently drops `--allow-cidr` when combined with `--from`, so
-    the allowlist has to be written into smolvm's persistent state
-    DB before `machine start`. Rather than assume the flag was
-    dropped, we read the persisted row and only patch when it
-    doesn't already match — so a newer smolvm that honors the flag
-    is left untouched.
+    Must run AFTER `smolvm machine create` (the row has to
+    exist) and BEFORE `smolvm machine start` (smolvm reads the
+    row on start; in-flight VMs don't pick up changes). Once
+    smolvm honors the CLI flag upstream this whole function is
+    redundant — flag-respecting create + remove this call from
+    launch.

-    Must run AFTER `smolvm machine create` (the row has to exist)
-    and BEFORE `smolvm machine start` (smolvm reads the row on
-    start; in-flight VMs don't pick up changes).
-
-    Fail-closed: if the state DB is missing, the row is missing, or
-    the allowlist still doesn't match after patching, we `die()`
-    rather than boot a VM whose egress confinement we can't verify
-    — an unconfirmed allowlist is a sandbox-escape risk (the agent
-    VM could reach all of host loopback)."""
-    want = list(allowed_cidrs)
+    No-op on non-macOS — the DB path differs and the Linux
+    smolmachines code path isn't exercised in v1."""
+    if not _is_macos():
+        return
    if not _SMOLVM_DB_PATH.is_file():
        die(
-            f"smolvm state DB not found at {_SMOLVM_DB_PATH}; cannot "
-            f"confirm the TSI allowlist is enforced. Refusing to launch "
-            f"(fail-closed). Check `smolvm --version` and the DB "
-            f"location for your platform."
+            f"smolvm state DB not found at {_SMOLVM_DB_PATH}. "
+            f"smolvm 0.8.0 expected? `smolvm --version` to check."
        )
    con = sqlite3.connect(str(_SMOLVM_DB_PATH))
    try:
-        cfg = _read_machine_cfg(con, machine_name)
-        if cfg.get("allowed_cidrs") != want:
-            cfg["allowed_cidrs"] = want
-            # Write as BLOB (the column type smolvm uses) — passing a
-            # plain str makes sqlite store it as Text and smolvm then
-            # fails to read it.
-            con.execute(
-                "UPDATE vms SET data = ? WHERE name = ?",
-                (sqlite3.Binary(json.dumps(cfg).encode()), machine_name),
-            )
-            con.commit()
-            cfg = _read_machine_cfg(con, machine_name)
-        if cfg.get("allowed_cidrs") != want:
+        cur = con.cursor()
+        row = cur.execute(
+            "SELECT data FROM vms WHERE name = ?", (machine_name,),
+        ).fetchone()
+        if row is None:
            die(
-                f"could not enforce TSI allowlist {want!r} for machine "
-                f"{machine_name!r} (persisted value is "
-                f"{cfg.get('allowed_cidrs')!r}). Refusing to launch "
-                f"(fail-closed)."
+                f"smolvm DB has no row for machine {machine_name!r} — "
+                f"machine_create must run before force_allowlist."
            )
+        cfg = json.loads(row[0])
+        cfg["allowed_cidrs"] = list(allowed_cidrs)
+        # Write as BLOB (the column type smolvm uses) — passing a
+        # plain str makes sqlite store it as Text and smolvm then
+        # fails to read it.
+        cur.execute(
+            "UPDATE vms SET data = ? WHERE name = ?",
+            (sqlite3.Binary(json.dumps(cfg).encode()), machine_name),
+        )
+        con.commit()
    finally:
        con.close()


-def _read_machine_cfg(con: sqlite3.Connection, machine_name: str) -> dict[str, object]:
-    """Read + JSON-decode a machine's `data` BLOB from the smolvm
-    state DB. Dies (fail-closed) if the row is missing — the caller
-    can't confirm enforcement without it."""
-    row = con.execute(
-        "SELECT data FROM vms WHERE name = ?", (machine_name,),
-    ).fetchone()
-    if row is None:
-        die(
-            f"smolvm DB has no row for machine {machine_name!r} — "
-            f"machine_create must run before force_allowlist."
-        )
-    return json.loads(row[0])
-
-
 def allocate(_slug: str) -> str:
    """Pick the lowest-numbered alias from the pool not already
    in use by a running smolmachines bundle. Bails when the pool
@@ -225,17 +184,16 @@ def allocate(_slug: str) -> str:
    used (no on-disk reservation, allocation is purely
    docker-state-driven).

-    Runs on both platforms: the allocation logic (docker-state
-    inspection + the file lock) is platform-independent. macOS
-    needs `ensure_pool` to have aliased the addresses on `lo0`
-    first; on Linux all of `127.0.0.0/8` is already loopback, so
-    docker can publish on the chosen `127.0.0.<N>` with no setup.
-    Per-bottle scoping (so the agent can't reach other bottles' or
-    host services' loopback ports) therefore holds on both.
+    On non-macOS the whole `127.0.0.0/8` is loopback by default;
+    `127.0.0.1` is fine to share and we skip the alias dance.
+    This still returns a deterministic address so launch.py's
+    callers don't have to branch on platform.

    An exclusive file lock serialises concurrent calls so two
    simultaneous launches don't read the same docker state and
    claim the same alias."""
+    if not _is_macos():
+        return "127.0.0.1"
    _ALLOC_LOCK_PATH.parent.mkdir(parents=True, exist_ok=True)
    with open(_ALLOC_LOCK_PATH, "w", encoding="utf-8") as lf:
        fcntl.flock(lf, fcntl.LOCK_EX)
@@ -116,9 +116,10 @@ def machine_create(
    allow_cidrs: Sequence[str] = (),
    env: Mapping[str, str] | None = None,
 ) -> None:
-    """`smolvm machine create --name NAME [--image IMG | --from PATH]
-    [--allow-cidr CIDR ...] [-e K=V ...]`. NAME is passed as
-    `--name` (smolvm 1.4.7+; earlier versions took it positionally).
+    """`smolvm machine create NAME [--image IMG | --from PATH]
+    [--allow-cidr CIDR ...] [-e K=V ...]`. NAME is positional
+    (the CLI's exception to the `--name` pattern other
+    subcommands use).

    `image` (registry ref like `alpine:latest`) and `from_path`
    (a `.smolmachine` artifact) are mutually exclusive — one or
@@ -132,10 +133,12 @@ def machine_create(
    result without the Smolfile complication.

    `--net` is sent explicitly when `allow_cidrs` is non-empty.
-    `--allow-cidr` implies `--net` per the CLI help, but sending
-    `--net` explicitly is harmless and ensures the guest has
-    network access even if that implication changes across versions."""
-    args: list[str] = ["machine", "create", "--name", name]
+    smolvm 0.8.0's docs say `--allow-cidr` implies `--net`, but
+    empirically the implication only fires when no `--from` is
+    set — `--from PATH --allow-cidr X/32` silently produces a
+    machine with `network: false` and no routes in the guest, so
+    the agent can't reach the bundle's pinned IP."""
+    args: list[str] = ["machine", "create"]
    if image is not None:
        args += ["--image", image]
    if from_path is not None:
@@ -147,6 +150,7 @@ def machine_create(
    if env:
        for k, v in env.items():
            args += ["-e", f"{k}={v}"]
+    args.append(name)
    _smolvm(*args)


@@ -178,9 +182,10 @@ def machine_stop(name: str) -> None:


 def machine_delete(name: str) -> None:
-    """`smolvm machine delete --name NAME -f`. `-f` skips the
-    interactive confirmation — required for non-interactive teardown."""
-    _smolvm("machine", "delete", "--name", name, "-f")
+    """`smolvm machine delete -f NAME`. NAME is positional. `-f`
+    skips the interactive confirmation — required for
+    non-interactive teardown."""
+    _smolvm("machine", "delete", "-f", name)


 def machine_exec(
@@ -5,58 +5,26 @@ unit-tested without importing the docker subprocess paths."""
 from __future__ import annotations

 import hashlib
-import os
-import platform
 import shutil

 from ...log import die

-# libkrun's Linux backend drives the guest through KVM, so the host
-# must expose `/dev/kvm` and the invoking user must be able to open
-# it. macOS uses Hypervisor.framework and needs no device node.
-_KVM_DEVICE = "/dev/kvm"
-

 def smolmachines_preflight() -> None:
-    """Ensure the host can run the smolmachines backend before the
-    launch flow starts. Called from `_resolve_plan`; surfaces a
-    clear, actionable error instead of a cryptic `smolvm` failure
-    deep in launch.
-
-    Checks `smolvm` is on PATH (both platforms) and, on Linux,
-    that `/dev/kvm` exists and is accessible. `gvproxy` is no
-    longer required — see the PRD's design pivot section."""
-    if shutil.which("smolvm") is None:
-        die(
-            "BOT_BOTTLE_BACKEND=smolmachines requires `smolvm` on "
-            "PATH. Install with: "
-            "curl -sSL https://smolmachines.com/install.sh | sh. "
-            "To use the legacy Docker backend instead, set "
-            "BOT_BOTTLE_BACKEND=docker or pass --backend=docker."
-        )
-    if platform.system() == "Linux":
-        _preflight_kvm()
-
-
-def _preflight_kvm() -> None:
-    """Linux-only: libkrun needs `/dev/kvm`. Distinguish 'KVM not
-    enabled' from 'no permission' so the operator knows which to
-    fix."""
-    if not os.path.exists(_KVM_DEVICE):
-        die(
-            f"BOT_BOTTLE_BACKEND=smolmachines needs {_KVM_DEVICE} on "
-            "Linux but it is missing. Enable KVM: load the kvm-intel "
-            "or kvm-amd kernel module (and confirm virtualization is "
-            "enabled in BIOS/firmware). To use the legacy Docker "
-            "backend instead, set BOT_BOTTLE_BACKEND=docker."
-        )
-    if not os.access(_KVM_DEVICE, os.R_OK | os.W_OK):
-        die(
-            f"{_KVM_DEVICE} exists but is not readable/writable by the "
-            "current user. Add your user to the `kvm` group "
-            "(`sudo usermod -aG kvm \"$USER\"`) and re-login, or run "
-            "with access to the device."
-        )
+    """Ensure `smolvm` is on PATH before the launch flow runs.
+    Called from `_resolve_plan`; gives the operator a clear
+    install pointer rather than a cryptic FileNotFoundError
+    later. `gvproxy` is no longer required — see the PRD's design
+    pivot section."""
+    if shutil.which("smolvm") is not None:
+        return
+    die(
+        "BOT_BOTTLE_BACKEND=smolmachines requires `smolvm` on "
+        "PATH. Install with: "
+        "curl -sSL https://smolmachines.com/install.sh | sh. "
+        "To use the legacy Docker backend instead, set "
+        "BOT_BOTTLE_BACKEND=docker or pass --backend=docker."
+    )


 def smolmachines_bundle_subnet(slug: str) -> tuple[str, str, str]:
@@ -7,10 +7,10 @@ from __future__ import annotations

 import sys

-from ..errors import MissingEnvVarError
+from ..audit_store import AuditStore
 from ..log import Die, die, error
 from ..manifest import ManifestError
-from ..store_manager import StoreManager
+from ..queue_store import QueueStore
 from ._common import PROG
 from . import list as _list_mod
 from .cleanup import cmd_cleanup
@@ -76,8 +76,9 @@ def main(argv: list[str] | None = None) -> int:
    if handler is None:
        usage()
        die(f"unknown command: {command}")
-    mgr = StoreManager.instance()
-    if not mgr.is_migrated():
+    queue_store = QueueStore("")
+    audit_store = AuditStore()
+    if not queue_store.check_migrations() or not audit_store.check_migrations():
        sys.stderr.write("bot-bottle: database schema is out of date\n")
        sys.stderr.write("Migrate now? [y/N] ")
        sys.stderr.flush()
@@ -88,13 +89,13 @@ def main(argv: list[str] | None = None) -> int:
        if answer != "y":
            error("migration required — re-run and confirm to migrate")
            return 1
-        mgr.migrate()
+        queue_store.migrate()
+        audit_store.migrate()
    try:
        return handler(rest) or 0
-    except MissingEnvVarError as e:
-        error(str(e))
-        return 1
    except ManifestError as e:
+        # Manifest/config problems surface as a catchable exception;
+        # print the reason and exit non-zero (same UX die() used to give).
        error(str(e))
        return 1
    except Die as e:
@@ -108,13 +108,6 @@ def cmd_start(argv: list[str]) -> int:

    agent_name: str | None = args.name
    if agent_name is None:
-        if not manifest.all_agent_names:
-            print(
-                "bot-bottle: no agents defined. "
-                "Add an agent to ~/.bot-bottle/agents/ or ./bot-bottle/agents/ to get started.",
-                file=sys.stderr,
-            )
-            return 1
        agent_name = tui.filter_select(
            manifest.all_agent_names,
            title="Select agent",
@@ -242,7 +235,7 @@ def prepare_with_preflight(
    spec: BottleSpec,
    *,
    stage_dir: Path,
-    render_preflight: Callable[[DockerBottlePlan, str], None],
+    render_preflight: Callable[[DockerBottlePlan], None],
    prompt_yes: Callable[[], bool],
    dry_run: bool = False,
    backend_name: str | None = None,
@@ -263,7 +256,7 @@ def prepare_with_preflight(
    plan = backend.prepare(spec, stage_dir=stage_dir)
    identity = _identity_from_plan(plan)

-    render_preflight(plan, backend.name)
+    render_preflight(plan)

    if dry_run:
        info("dry-run requested; not starting container.")
@@ -390,9 +383,8 @@ def _text_prompt_yes() -> bool:


 def _text_render_preflight():
-    def _render(plan: DockerBottlePlan, backend_name: str) -> None:
+    def _render(plan: DockerBottlePlan) -> None:
        print(file=sys.stderr)
-        print(f"backend: {backend_name}", file=sys.stderr)
        print(_manifest_to_yaml(plan.manifest), file=sys.stderr)
    return _render

@@ -21,7 +21,7 @@ FROM node:22-slim
 # to it) works against egress's bumped TLS without the agent needing
 # local DNS.
 RUN apt-get update \
-  && apt-get install -y --no-install-recommends git ca-certificates curl ripgrep iproute2 dnsutils \
+  && apt-get install -y --no-install-recommends git ca-certificates curl ripgrep \
  && rm -rf /var/lib/apt/lists/*

 # App-specific deps. Python isn't required by claude-code itself
@@ -34,12 +34,6 @@ if TYPE_CHECKING:


 _SUPERVISE_MCP_NAME = "supervise"
-_CODEX_CLI = "/home/node/.codex/packages/standalone/current/bin/codex"
-_CODEX_CLI_PATH = (
-    "/home/node/.local/bin:"
-    "/home/node/.codex/packages/standalone/current/bin:"
-    "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-)


 def _skills_dir(guest_home: str) -> str:
@@ -56,7 +50,7 @@ def _prompt_path(guest_home: str) -> str:

 _RUNTIME = AgentProviderRuntime(
    template="codex",
-    command=_CODEX_CLI,
+    command="codex",
    image="bot-bottle-codex:latest",
    prompt_mode="read_prompt_file",
    bypass_args=("--dangerously-bypass-approvals-and-sandbox",),
@@ -151,8 +145,7 @@ class CodexAgentProvider(AgentProvider):
                "env",
                f"HOME={guest_home}",
                f"CODEX_HOME={auth_dir}",
-                f"PATH={_CODEX_CLI_PATH}",
-                _CODEX_CLI, "login", "status",
+                "codex", "login", "status",
            ), (
                "codex host credentials: dummy auth was copied into the "
                "guest, but Codex did not accept it"
@@ -274,7 +267,7 @@ class CodexAgentProvider(AgentProvider):
            return
        info(f"registering supervise MCP server in agent codex config → {supervise_url}")
        r = bottle.exec(
-            f"{shlex.quote(_CODEX_CLI)} mcp add {_SUPERVISE_MCP_NAME} --url "
+            f"codex mcp add {_SUPERVISE_MCP_NAME} --url "
            f"{shlex.quote(supervise_url)}",
            user="node",
        )
@@ -28,7 +28,7 @@ class DbStore:
        conn.row_factory = sqlite3.Row
        return conn

-    def is_migrated(self) -> bool:
+    def check_migrations(self) -> bool:
        """Return True if the DB is fully up-to-date, False if migration is needed."""
        if not self.db_path.exists():
            return False
@@ -23,7 +23,6 @@ from .egress_addon_core import (
    PathMatch as CorePathMatch,
    Route,
 )
-from .errors import MissingEnvVarError
 from .log import die

 if TYPE_CHECKING:
@@ -355,18 +354,16 @@ def egress_resolve_token_values(
    for token_env, token_ref in token_env_map.items():
        value = host_env.get(token_ref)
        if value is None:
-            raise MissingEnvVarError(
-                token_ref,
+            die(
                f"egress: host env var '{token_ref}' is unset. Set it "
                f"before launching, or remove the corresponding auth block "
-                f"from bottle.egress.routes.",
+                f"from bottle.egress.routes."
            )
        if not value:
-            raise MissingEnvVarError(
-                token_ref,
+            die(
                f"egress: host env var '{token_ref}' is empty. The "
                f"egress will not inject an empty token; set it to "
-                f"the real value or remove the route's auth block.",
+                f"the real value or remove the route's auth block."
            )
        out[token_env] = value
    return out
@@ -35,7 +35,6 @@ import re
 import sys
 from dataclasses import dataclass, field

-from .errors import MissingEnvVarError
 from .log import die
 from .manifest import Manifest

@@ -137,10 +136,9 @@ def resolve_env(manifest: Manifest) -> ResolvedEnv:
            host_var = env_entry_interpolated_from(raw)
            host_value = os.environ.get(host_var, "")
            if not host_value:
-                raise MissingEnvVarError(
-                    host_var,
+                die(
                    f"env entry {name} is interpolated from ${host_var}, "
-                    f"but ${host_var} is unset or empty in the host environment.",
+                    f"but ${host_var} is unset or empty in the host environment."
                )
            forwarded[name] = host_value
        else:  # literal
@@ -1,18 +0,0 @@
-"""bot-bottle application-level exception hierarchy.
-
-Exceptions here are caught by the CLI dispatcher (``cli/__init__.py``)
-and rendered as ``bot-bottle: error: …`` lines — same UX as ``die()``,
-but without coupling library code to stderr output."""
-
-from __future__ import annotations
-
-
-class MissingEnvVarError(Exception):
-    """Raised when a required host environment variable is unset or empty.
-
-    ``var_name`` is the exact name of the missing variable so callers
-    can display it without re-parsing the message string."""
-
-    def __init__(self, var_name: str, message: str) -> None:
-        self.var_name = var_name
-        super().__init__(message)
@@ -82,7 +82,6 @@ class GitGatePlan:



-
 class GitGate(ABC):
    """The per-agent git-gate. Encapsulates the host-side prepare
    (upstream lift + entrypoint/hook render); the sidecar's
@@ -13,7 +13,6 @@ import dataclasses
 from pathlib import Path
 from typing import TYPE_CHECKING

-from .errors import MissingEnvVarError
 from .log import info
 from .manifest import ManifestBottle, ManifestGitEntry
 from .git_gate_render import GitGateUpstream
@@ -35,10 +34,9 @@ def _provision_dynamic_key(
    pk = entry.Key
    token = os.environ.get(pk.forge_token_env)
    if token is None:
-        raise MissingEnvVarError(
-            pk.forge_token_env,
+        raise RuntimeError(
            f"git-gate.repos[{entry.Name!r}] key.forge_token_env"
-            f" = {pk.forge_token_env!r}: env var is not set",
+            f" = {pk.forge_token_env!r}: env var is not set"
        )
    api_url = pk.api_url or f"https://{entry.UpstreamHost}"
    provisioner = get_provisioner(pk.provider, token, api_url)
@@ -80,11 +78,10 @@ def revoke_git_gate_provisioned_keys(bottle: ManifestBottle, stage_dir: Path) ->
        key_id = id_file.read_text().strip()
        token = os.environ.get(pk.forge_token_env)
        if token is None:
-            raise MissingEnvVarError(
-                pk.forge_token_env,
+            raise RuntimeError(
                f"git-gate.repos[{entry.Name!r}] key.forge_token_env"
                f" = {pk.forge_token_env!r}: env var is not set;"
-                f" cannot revoke deploy key {key_id}",
+                f" cannot revoke deploy key {key_id}"
            )
        api_url = pk.api_url or f"https://{entry.UpstreamHost}"
        provisioner = get_provisioner(pk.provider, token, api_url)
@@ -228,7 +228,7 @@ supervise_gitleaks_allow() {
  fi

  proposal_id=$(
-    PYTHONPATH="/app${PYTHONPATH:+:$PYTHONPATH}" GITLEAKS_ALLOW_REF="$ref" python3 - "$report_file" <<'PY'
+    GITLEAKS_ALLOW_REF="$ref" python3 - "$report_file" <<'PY'
 import datetime
 import hashlib
 import json
@@ -236,10 +236,7 @@ import os
 import sys
 from pathlib import Path

-try:
-    import supervise as _sv
-except ImportError:
-    from bot_bottle import supervise as _sv
+from bot_bottle import supervise as _sv

 report_path = Path(sys.argv[1])
 slug = os.environ.get("SUPERVISE_BOTTLE_SLUG", "")
@@ -317,13 +314,10 @@ PY
  echo "git-gate: approve with './cli.py supervise' to continue this push" >&2
  waited=0
  while [ "$waited" -lt "$timeout" ]; do
-    status=$(PYTHONPATH="/app${PYTHONPATH:+:$PYTHONPATH}" python3 - "$slug" "$proposal_id" <<'PY'
+    status=$(python3 - "$slug" "$proposal_id" <<'PY'
 import sys

-try:
-    import supervise as _sv
-except ImportError:
-    from bot_bottle import supervise as _sv
+from bot_bottle import supervise as _sv

 slug = sys.argv[1]
 try:
@@ -342,13 +336,10 @@ PY
    if [ -n "$status" ]; then
      case "$status" in
        approved|modified)
-          PYTHONPATH="/app${PYTHONPATH:+:$PYTHONPATH}" python3 - "$slug" "$proposal_id" <<'PY' || true
+          python3 - "$slug" "$proposal_id" <<'PY' || true
 import sys

-try:
-    import supervise as _sv
-except ImportError:
-    from bot_bottle import supervise as _sv
+from bot_bottle import supervise as _sv

 _sv.archive_proposal(sys.argv[1], sys.argv[2])
 PY
@@ -16,6 +16,40 @@ except ImportError:
    from migrations import TableMigrations  # type: ignore[import-not-found]  # pylint: disable=import-error,no-name-in-module


+# One entry per schema version: _MIGRATIONS.migrations[0] brings a fresh DB
+# to version 1, [1] to version 2, and so on.  Add new migrations at the end;
+# never edit existing ones.
+_MIGRATIONS = TableMigrations("queue_store", [
+    # v1 — proposals table
+    """
+    CREATE TABLE IF NOT EXISTS supervise_proposals (
+        queue_key TEXT NOT NULL,
+        id TEXT NOT NULL,
+        bottle_slug TEXT NOT NULL,
+        tool TEXT NOT NULL,
+        proposed_file TEXT NOT NULL,
+        justification TEXT NOT NULL,
+        arrival_timestamp TEXT NOT NULL,
+        current_file_hash TEXT NOT NULL,
+        archived INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (queue_key, id)
+    )
+    """,
+    # v2 — responses table
+    """
+    CREATE TABLE IF NOT EXISTS supervise_responses (
+        queue_key TEXT NOT NULL,
+        proposal_id TEXT NOT NULL,
+        status TEXT NOT NULL,
+        notes TEXT NOT NULL,
+        final_file TEXT,
+        archived INTEGER NOT NULL DEFAULT 0,
+        PRIMARY KEY (queue_key, proposal_id)
+    )
+    """,
+])
+
+
 class QueueStore(DbStore):
    """SQLite-backed persistent store for supervise proposals and responses."""

@@ -29,39 +63,7 @@ class QueueStore(DbStore):
            # so we always fall through to host_db_path().
            env_path = os.environ.get("SUPERVISE_DB_PATH", "").strip()
            resolved = Path(env_path) if env_path else host_db_path()
-        # One entry per schema version: migrations[0] brings a fresh DB to
-        # version 1, [1] to version 2, etc.  Add new entries at the end; never
-        # edit existing ones.
-        migrations = TableMigrations("queue_store", [
-            # v1 — proposals table
-            """
-            CREATE TABLE IF NOT EXISTS supervise_proposals (
-                queue_key TEXT NOT NULL,
-                id TEXT NOT NULL,
-                bottle_slug TEXT NOT NULL,
-                tool TEXT NOT NULL,
-                proposed_file TEXT NOT NULL,
-                justification TEXT NOT NULL,
-                arrival_timestamp TEXT NOT NULL,
-                current_file_hash TEXT NOT NULL,
-                archived INTEGER NOT NULL DEFAULT 0,
-                PRIMARY KEY (queue_key, id)
-            )
-            """,
-            # v2 — responses table
-            """
-            CREATE TABLE IF NOT EXISTS supervise_responses (
-                queue_key TEXT NOT NULL,
-                proposal_id TEXT NOT NULL,
-                status TEXT NOT NULL,
-                notes TEXT NOT NULL,
-                final_file TEXT,
-                archived INTEGER NOT NULL DEFAULT 0,
-                PRIMARY KEY (queue_key, proposal_id)
-            )
-            """,
-        ])
-        super().__init__(resolved, migrations)
+        super().__init__(resolved, _MIGRATIONS)

    def write_proposal(self, proposal: Proposal) -> Path:
        with self._connect() as conn:
@@ -1,60 +0,0 @@
-"""Singleton manager for all bot-bottle SQLite stores (PRD 0013)."""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-try:
-    from .audit_store import AuditStore
-    from .queue_store import QueueStore
-except ImportError:
-    from audit_store import AuditStore  # type: ignore[import-not-found]  # pylint: disable=import-error,no-name-in-module
-    from queue_store import QueueStore  # type: ignore[import-not-found]  # pylint: disable=import-error,no-name-in-module
-
-_instance: StoreManager | None = None
-
-
-class StoreManager:
-    """Owns db_path and delegates migrate/is_migrated across all stores.
-
-    Use instance() for normal access. Call reset(db_path) in tests to swap
-    the singleton to a temp path, then reset() with no args to restore the
-    default."""
-
-    def __init__(self, db_path: Path | None = None) -> None:
-        if db_path is None:
-            # Lazy import to avoid a circular dependency: supervise imports
-            # StoreManager at module level; StoreManager must not import
-            # supervise at module level in return.
-            try:
-                from .supervise import host_db_path
-            except ImportError:
-                from supervise import host_db_path  # type: ignore[import-not-found]  # pylint: disable=import-error,no-name-in-module
-            db_path = host_db_path()
-        self.db_path = db_path
-
-    @classmethod
-    def instance(cls) -> StoreManager:
-        global _instance
-        if _instance is None:
-            _instance = cls()
-        return _instance
-
-    @classmethod
-    def reset(cls, db_path: Path | None = None) -> None:
-        """Replace the singleton. Pass db_path for test isolation; omit to restore default."""
-        global _instance
-        _instance = cls(db_path)
-
-    def is_migrated(self) -> bool:
-        return (
-            QueueStore("", self.db_path).is_migrated()
-            and AuditStore(self.db_path).is_migrated()
-        )
-
-    def migrate(self) -> None:
-        QueueStore("", self.db_path).migrate()
-        AuditStore(self.db_path).migrate()
-
-
-__all__ = ["StoreManager"]
@@ -110,10 +110,7 @@ def host_db_path() -> Path:
    # Calls bot_bottle_root() through this module's globals so that patches
    # on supervise.bot_bottle_root propagate to callers going through
    # supervise.host_db_path().
-    #
-    # Kept in its own "db" subdirectory (see supervise_types.host_db_path
-    # for why) — must stay in sync with that copy.
-    return bot_bottle_root() / "db" / HOST_DB_FILENAME
+    return bot_bottle_root() / HOST_DB_FILENAME


 def audit_log_path(component: str, slug: str) -> Path:
@@ -123,12 +120,10 @@ def audit_log_path(component: str, slug: str) -> Path:
 try:
    from .queue_store import QueueStore
    from .audit_store import AuditStore
-    from .store_manager import StoreManager
 except ImportError:
    # Sidecar bundle: files are flat-copied under /app, not a package.
    from queue_store import QueueStore  # type: ignore[import-not-found]  # pylint: disable=import-error,no-name-in-module
    from audit_store import AuditStore  # type: ignore[import-not-found]  # pylint: disable=import-error,no-name-in-module
-    from store_manager import StoreManager  # type: ignore[import-not-found]  # pylint: disable=import-error,no-name-in-module


 # --- Queue I/O -------------------------------------------------------------
@@ -259,11 +254,12 @@ class Supervise(ABC):
        """Stage the host database. Returns the plan; `internal_network`
        must be set by the launch step before .start runs."""
        del stage_dir
-        mgr = StoreManager.instance()
-        mgr.migrate()
+        db_path = host_db_path()
+        QueueStore(slug).migrate()
+        AuditStore(db_path).migrate()
        return SupervisePlan(
            slug=slug,
-            db_path=mgr.db_path,
+            db_path=db_path,
        )


@@ -277,7 +273,6 @@ __all__ = [
    "Proposal",
    "QueueStore",
    "Response",
-    "StoreManager",
    "STATUSES",
    "STATUS_APPROVED",
    "STATUS_MODIFIED",
@@ -50,14 +50,7 @@ def bot_bottle_root() -> Path:
 def host_db_path() -> Path:
    # Look up bot_bottle_root through this module's live namespace so that
    # monkey-patches on supervise_types.bot_bottle_root take effect.
-    #
-    # Lives in its own "db" subdirectory, not directly under
-    # bot_bottle_root(), so backends that can only bind-mount
-    # directories (macos_container's `container run --mount`, which
-    # rejects file sources with "is not a directory") can share this
-    # one file with a sidecar without also exposing bot_bottle_root()'s
-    # other contents (git-gate keys, per-bottle state, etc.).
-    return sys.modules[__name__].bot_bottle_root() / "db" / HOST_DB_FILENAME
+    return sys.modules[__name__].bot_bottle_root() / HOST_DB_FILENAME


 def _require_str(raw: dict[str, object], key: str) -> str:
@@ -1,227 +0,0 @@
-# PRD prd-new: smolmachines backend on Linux
-
- **Status:** Draft
- **Author:** Claude
- **Created:** 2026-06-25
- **Issue:** #283
-
-## Summary
-
-Make the `smolmachines` backend (PRD 0023) runnable on Linux, not
-just macOS. `smolvm` already supports Linux via KVM (`/dev/kvm`);
-the gap is entirely in bot-bottle's host-side glue, which hard-codes
-macOS assumptions in three places:
-
-1. **Preflight** only checks that `smolvm` is on `PATH` — it never
-   checks the Linux KVM prerequisite, so a misconfigured host fails
-   deep in the launch flow with an opaque `smolvm` error.
-2. **The TSI allowlist enforcement** (`force_allowlist`) — the
-   security property that confines the agent VM to its sidecar
-   bundle's `/32` — **no-ops on Linux today, failing _open_**. The
-   smolvm state-DB path it patches is hard-coded to macOS's
-   `~/Library/Application Support/...`.
-3. **Per-bottle loopback scoping** (`allocate`) returns the shared
-   `127.0.0.1` on Linux, which would let the agent VM reach every
-   service on host loopback — a downgrade from the per-bottle alias
-   isolation macOS gets.
-
-This PRD closes all three so a bottle launched with
-`BOT_BOTTLE_BACKEND=smolmachines` on Linux gets the same isolation
-guarantee it gets on macOS, and documents the Linux/NixOS host
-setup. The primary validation target is NixOS, but the changes are
-distro-agnostic.
-
-## Problem
-
-The smolmachines backend runs each bottle's agent inside a libkrun
-microVM via `smolvm`, with egress confined by TSI's `--allow-cidr`
-allowlist set to a single `/32` — the sidecar bundle's loopback
-address. Everything else (host loopback, LAN, internet) is denied at
-the VMM layer. That security property is the entire reason the
-backend exists.
-
-libkrun runs on Hypervisor.framework (macOS) **and** KVM (Linux), and
-`smolvm` ships Linux x86_64 / aarch64 builds that require `/dev/kvm`.
-So the microVM layer already works on Linux. What does not work is
-bot-bottle's host integration, which PRD 0023 explicitly scoped to
-macOS-only for v1. Three concrete blockers:
-
- **No KVM preflight.** On a Linux host without `/dev/kvm` (kernel
-  module not loaded) or without access to it (user not in the `kvm`
-  group), the failure surfaces as a cryptic `smolvm` non-zero exit
-  mid-launch instead of an actionable message.
-
- **TSI enforcement fails open on Linux.** `force_allowlist`
-  early-returns on non-macOS. It exists because `smolvm` 0.8.0
-  silently drops `--allow-cidr` when combined with `--from`, so the
-  allowlist has to be patched into smolvm's persisted state DB before
-  `machine start`. On Linux that patch never runs **and** the DB path
-  is the macOS path, so the booted VM's TSI allowlist is whatever
-  smolvm defaulted to — potentially all of `127.0.0.0/8`. That is the
-  exact sandbox-escape the backend is supposed to prevent.
-
- **No per-bottle loopback isolation on Linux.** `allocate` returns
-  `127.0.0.1` on Linux. Even with a correct allowlist, `127.0.0.1/32`
-  is shared by every service on host loopback, so the agent could
-  reach other bottles' published ports and host services. On macOS
-  this is solved with per-bottle `127.0.0.16..31` aliases added via
-  `sudo ifconfig lo0 alias`. On Linux the whole `127.0.0.0/8` is
-  already routed to `lo`, so docker can publish to `127.0.0.<N>`
-  with **no `ifconfig`/sudo step at all** — the isolation is actually
-  cheaper to achieve than on macOS.
-
-## Goals / Success Criteria
-
- `BOT_BOTTLE_BACKEND=smolmachines ./cli.py start <agent>` launches,
-  runs, and tears down a bottle on a Linux host with `/dev/kvm`.
- The TSI allowlist is enforced on Linux: PRD 0022's
-  `tests/integration/test_sandbox_escape.py` passes against
-  `BOT_BOTTLE_BACKEND=smolmachines` on Linux (the acceptance gate).
- Each Linux bottle is scoped to its own `127.0.0.<N>/32`, matching
-  the macOS per-bottle isolation property.
- A clear, actionable preflight error when `/dev/kvm` is missing or
-  inaccessible, with remediation (load `kvm-intel`/`kvm-amd`, join the
-  `kvm` group).
- **Fail-closed:** if bot-bottle cannot positively confirm the TSI
-  allowlist was persisted for a machine (DB missing, row missing,
-  patch didn't take), it `die()`s before `machine start` rather than
-  booting a VM with an unverified allowlist.
- macOS behavior is unchanged.
- README documents Linux + NixOS host setup.
-
-## Non-goals
-
- Rootless / non-KVM fallbacks (e.g. software emulation). Linux
-  smolmachines requires `/dev/kvm`, full stop.
- Removing Docker as a host dependency — the sidecar bundle and
-  image-build pipeline still use Docker on Linux, same as macOS.
- Auto-installing `smolvm` or configuring KVM on the operator's
-  behalf. Preflight reports; the operator remediates.
- Nested-virtualization tuning for running the runner itself inside a
-  VM (documented as a caveat, not solved here).
-
-## Design
-
-### Platform detection
-
-Reuse the existing `platform.system()` check already in
-`loopback_alias.py` (`_is_macos()`). "Linux" is "not macOS" for every
-branch below; no new third-platform path.
-
-### Preflight: KVM gate (`util.smolmachines_preflight`)
-
-After the existing `smolvm`-on-`PATH` check, add a Linux-only gate:
-
- `/dev/kvm` must exist → else `die()` with "enable KVM
-  (`kvm-intel`/`kvm-amd` kernel module)".
- `/dev/kvm` must be readable + writable by the current user
-  (`os.access(..., R_OK | W_OK)`) → else `die()` with "add your user
-  to the `kvm` group (and re-login)".
-
-macOS is unaffected (Hypervisor.framework needs no device node).
-
-### smolvm state-DB path (platform-aware)
-
-`loopback_alias._SMOLVM_DB_PATH` becomes platform-derived:
-
- macOS: `~/Library/Application Support/smolvm/server/smolvm.db`
-  (unchanged).
- Linux: `$XDG_DATA_HOME/smolvm/server/smolvm.db`, defaulting to
-  `~/.local/share/smolvm/server/smolvm.db`.
-
-> **Verification note:** the Linux DB location is inferred from
-> smolvm's documented `~/.local/share` install layout and the XDG
-> base-dir spec. It must be confirmed on a real Linux smolvm install;
-> if smolvm uses a different path or schema, the fail-closed check
-> below turns that into a clear `die()` at launch rather than a silent
-> escape.
-
-### TSI enforcement: cross-platform + fail-closed (`force_allowlist`)
-
-Rework `force_allowlist(machine_name, allowed_cidrs)` to run on
-**both** platforms and to fail closed:
-
-1. Resolve the state DB; if the file is missing, `die()` (cannot
-   confirm enforcement → refuse to launch).
-2. Read the machine's persisted row; if the row is missing, `die()`.
-3. If the row's `allowed_cidrs` already equals the requested list
-   (e.g. a newer `smolvm` that honors `--allow-cidr` at create), do
-   nothing — no write.
-4. Otherwise patch `allowed_cidrs` (the existing BLOB-encoded write)
-   and re-read.
-5. If, after the patch, `allowed_cidrs` still does not equal the
-   requested list, `die()`.
-
-This is robust across smolvm versions: it works whether `--allow-cidr`
-is silently dropped (0.8.0) or honored (newer), and it never boots a
-VM whose persisted allowlist it could not confirm. It is a strict
-improvement on macOS too (today's code writes unconditionally and
-never verifies).
-
-> The persisted-row check confirms our write took, not that smolvm's
-> runtime TSI enforces it. The runtime guarantee is covered by the
-> sandbox-escape acceptance test; the persisted check is the cheap
-> fail-closed guard at launch.
-
-### Per-bottle loopback scoping on Linux (`allocate`)
-
-`allocate` runs the same docker-state-driven allocation on Linux as on
-macOS (`_allocate_locked`, the file lock, and `_aliases_in_use` via
-`docker inspect` are all already cross-platform). The only macOS-only
-step, `ensure_pool` (the `sudo ifconfig lo0 alias` dance), stays
-macOS-only: on Linux `127.0.0.0/8` is already loopback, so docker can
-publish bundle ports directly on `127.0.0.<N>` with no setup.
-
-Net effect: Linux bottles get per-bottle `127.0.0.16..31/32` scoping
-identical to macOS, without sudo.
-
-### Launch flow
-
-`launch.py` needs no structural change — `_allocate_resources` already
-calls `ensure_pool()` (now a Linux no-op) then `allocate()` (now
-per-bottle on Linux), and `_launch_vm` already calls
-`force_allowlist()` (now active on Linux). Only the macOS-specific
-docstrings are updated to describe the cross-platform behavior.
-
-## Implementation chunks
-
-1. **Preflight KVM gate** — `util.smolmachines_preflight` +
-   unit tests for the missing-device and no-access branches.
-2. **Platform-aware DB path + fail-closed `force_allowlist`** —
-   `loopback_alias.py`; update/extend `TestForceAllowlist`.
-3. **Cross-platform `allocate`** — drop the Linux early-return; update
-   `TestAllocate` / `TestAllocateLock` for the new Linux behavior.
-4. **Docstring + comment cleanup** in `launch.py` and module headers.
-5. **Docs** — README requirements + a Linux/NixOS host-setup section.
-
-## Testing Strategy
-
- **Unit (CI, any OS):** the suite mocks `platform.system()` /
-  `subprocess` and patches `_SMOLVM_DB_PATH`, so the new Linux
-  branches are testable on the macOS/Linux CI runner without `smolvm`
-  or KVM. Covers: KVM preflight branches, fail-closed `force_allowlist`
-  (DB missing, row missing, patch-doesn't-take), per-bottle Linux
-  allocation + locking, platform-derived DB path.
- **Integration (Linux host with KVM — the acceptance gate):**
-  `tests/integration/test_sandbox_escape.py` against
-  `BOT_BOTTLE_BACKEND=smolmachines`. This cannot run on the macOS dev
-  box and must be executed on NixOS before merge.
-
-## Open questions / verification pending
-
- **Confirm the Linux smolvm state-DB path and schema** on a real
-  install (the `~/.local/share/...` inference above).
- **Confirm whether the current smolvm Linux build still drops
-  `--allow-cidr` with `--from`** (the 0.8.0 bug). The fail-closed
-  design handles either answer, but knowing lets us drop the DB patch
-  if upstream fixed it.
- **Confirm docker publishing to `127.0.0.<N>` on Linux** behaves as
-  expected end-to-end with TSI (high confidence; standard loopback
-  behavior, but unverified on the target host).
-
-## References
-
- PRD 0023 — smolmachines bottle backend (macOS v1).
- PRD 0022 — `test_sandbox_escape.py` acceptance gate.
- PRD 0024 — sidecar bundle image.
- smolvm: https://github.com/smol-machines/smolvm
@@ -1,4 +1,4 @@
-# PRD 0067: SQLite local storage
+# PRD prd-new: SQLite local storage

 - **Status:** Active
 - **Author:** codex
@@ -81,10 +81,10 @@ class TestSandboxEscape(unittest.TestCase):
        # those are missing rather than die-ing inside backend.prepare.
        backend_name = os.environ.get("BOT_BOTTLE_BACKEND", "docker")
        if backend_name == "smolmachines":
-            if sys.platform not in ("darwin", "linux"):
+            if sys.platform != "darwin":
                raise unittest.SkipTest(
-                    f"BOT_BOTTLE_BACKEND=smolmachines is not supported "
-                    f"on {sys.platform} (macOS and Linux only)"
+                    "BOT_BOTTLE_BACKEND=smolmachines is macOS-only in "
+                    "v1 (libkrun TSI)"
                )
            if shutil.which("smolvm") is None:
                raise unittest.SkipTest(
@@ -21,7 +21,7 @@ security properties the design pivot was about:
    bind-address mitigation is what closes TSI's port-granularity
    gap.

-Gated on macOS/Linux + smolvm + docker + not GITEA_ACTIONS — the
+Gated on macOS + smolvm + docker + not GITEA_ACTIONS — the
 runner can't host libkrun-backed VMs."""

 from __future__ import annotations
@@ -65,8 +65,8 @@ def _minimal_manifest() -> ManifestIndex:

@skip_unless_docker()
@unittest.skipUnless(
-    platform.system() in ("Darwin", "Linux"),
-    "smolvm requires macOS or Linux",
+    platform.system() == "Darwin",
+    "smolvm is macOS-only for v1; Linux+KVM path is a future PRD",
 )
@unittest.skipUnless(
    _smolvm_available(),
@@ -141,15 +141,7 @@ class TestSmolmachinesLaunch(unittest.TestCase):
        proxies = [line.strip() for line in r.stdout.splitlines()]
        self.assertEqual(2, len(proxies), proxies)
        self.assertEqual(proxies[0], proxies[1], proxies)
-        # macOS: proxy binds to the per-bottle loopback alias (127.x.x.x) so
-        # TSI can intercept guest connections to it.  Linux: the guest kernel
-        # routes 127.0.0.0/8 to its own loopback (TSI never sees those), so
-        # the proxy instead binds to the per-bottle bridge gateway (192.168.x.1)
-        # which routes via eth0 and is intercepted by TSI normally.
-        self.assertRegex(
-            proxies[0], r"^http://\d+\.\d+\.\d+\.\d+:\d+$",
-            "expected proxy URL to be an http://IP:port address",
-        )
+        self.assertTrue(proxies[0].startswith("http://127."), proxies[0])

        r = self.bottle.exec(
            "curl -fsS --max-time 20 https://example.com >/dev/null && echo OK"
@@ -2,7 +2,7 @@
 exercised against the real binary.

 The full machine-lifecycle round trip (create → start → exec →
-delete) is gated behind macOS/Linux platform check and lives
+delete) is gated behind macOS + Darwin platform check and lives
 in chunk 2d's smoke. This file just verifies `is_available()`
 correctly reports presence and `_smolvm()` can run a no-op
 subcommand without errors — enough to flag wrapper drift if
@@ -23,8 +23,8 @@ from bot_bottle.backend.smolmachines.smolvm import is_available
    "skipped under act_runner: smolvm not installed on the runner",
 )
@unittest.skipUnless(
-    platform.system() in ("Darwin", "Linux"),
-    "smolvm requires macOS or Linux",
+    platform.system() == "Darwin",
+    "smolvm is macOS-only for v1; Linux+KVM path is a future PRD",
 )
@unittest.skipUnless(
    is_available(),
@@ -35,10 +35,7 @@ class TestAgentProviderRuntime(unittest.TestCase):
            )
            config = Path(tmp, "codex-config.toml").read_text()
        self.assertEqual("codex", plan.template)
-        self.assertEqual(
-            "/home/node/.codex/packages/standalone/current/bin/codex",
-            plan.command,
-        )
+        self.assertEqual("codex", plan.command)
        self.assertEqual("read_prompt_file", plan.prompt_mode)
        self.assertEqual("/tmp/Dockerfile.codex", plan.dockerfile)
        self.assertEqual(
@@ -15,15 +15,13 @@ from bot_bottle.cli import main
 from bot_bottle.db_store import DbStore
 from bot_bottle.log import Die
 from bot_bottle.manifest import ManifestError
-from bot_bottle.store_manager import StoreManager


 class TestMainDispatch(unittest.TestCase):
    def setUp(self) -> None:
-        patcher = patch.object(DbStore, "is_migrated", return_value=True)
+        patcher = patch.object(DbStore, "check_migrations", return_value=True)
        self._mock_check = patcher.start()
        self.addCleanup(patcher.stop)
-        self.addCleanup(StoreManager.reset)

    def test_no_args_prints_usage_returns_2(self) -> None:
        with patch("sys.stderr", io.StringIO()):
@@ -64,15 +62,6 @@ class TestMainDispatch(unittest.TestCase):
            main(["x", "a", "b"])
        self.assertEqual([["a", "b"]], seen)

-    def test_missing_env_var_error_maps_to_1(self) -> None:
-        from bot_bottle.errors import MissingEnvVarError
-
-        def boom(_rest: list[str]) -> int:
-            raise MissingEnvVarError("MY_VAR", "MY_VAR is not set")
-
-        with patch.dict(climod.COMMANDS, {"x": boom}), patch("sys.stderr", io.StringIO()):
-            self.assertEqual(1, main(["x"]))
-
    def test_manifest_error_maps_to_1(self) -> None:
        def boom(_rest: list[str]) -> int:
            raise ManifestError("bad manifest")
@@ -9,7 +9,6 @@ is created.

 from __future__ import annotations

-import io
 import os
 import unittest
 from unittest.mock import MagicMock, patch
@@ -185,55 +184,5 @@ class TestCmdStartHeadless(unittest.TestCase):
        self.assertEqual("docker", self._launch_mock.call_args[1]["backend_name"])


-class TestPrepareWithPreflight(unittest.TestCase):
-    """prepare_with_preflight calls render_preflight with the plan and backend name."""
-
-    def test_render_preflight_called(self):
-        from pathlib import Path
-        mock_backend = MagicMock()
-        mock_plan = MagicMock()
-        mock_backend.prepare.return_value = mock_plan
-        mock_backend.name = "test-backend"
-        render = MagicMock()
-
-        with patch("bot_bottle.cli.start.get_bottle_backend", return_value=mock_backend), \
-             patch("bot_bottle.cli.start._identity_from_plan", return_value="id"), \
-             patch("bot_bottle.cli.start.info"):
-            start_mod.prepare_with_preflight(
-                MagicMock(),
-                stage_dir=Path("/tmp"),
-                render_preflight=render,
-                prompt_yes=MagicMock(),
-                dry_run=True,
-            )
-
-        render.assert_called_once_with(mock_plan, "test-backend")
-
-
-class TestNoAgentsDefined(unittest.TestCase):
-    """cmd_start prints an error and returns 1 when the manifest has no agents."""
-
-    def test_no_agents_defined_returns_1(self):
-        manifest = _make_manifest([], [])
-        with patch(
-            "bot_bottle.cli.start.ManifestIndex.resolve", return_value=manifest
-        ), patch("sys.stderr", io.StringIO()) as err:
-            rc = start_mod.cmd_start([])
-        self.assertEqual(1, rc)
-        self.assertIn("no agents defined", err.getvalue())
-
-
-class TestTextRenderPreflight(unittest.TestCase):
-    """_text_render_preflight returns a renderer that prints the backend name."""
-
-    def test_backend_name_in_output(self):
-        render = start_mod._text_render_preflight()
-        plan = MagicMock()
-        with patch("bot_bottle.cli.start._manifest_to_yaml", return_value=""), \
-             patch("sys.stderr", io.StringIO()) as err:
-            render(plan, "my-backend")
-        self.assertIn("my-backend", err.getvalue())
-
-
 if __name__ == "__main__":
    unittest.main()
@@ -261,36 +261,6 @@ class TestCodexProvision(unittest.TestCase):
        self.assertTrue(any("find" in s and "-delete" in s for s in scripts))
        self.assertTrue(any("runuser" in s and "codex login status" in s for s in scripts))

-    def test_forwarded_credentials_verify_sets_codex_path(self):
-        with tempfile.TemporaryDirectory(prefix="bb-codex-auth.") as tmp:
-            state_dir = Path(tmp)
-            prompt_file = state_dir / "prompt.txt"
-            prompt_file.write_text("")
-            with patch(
-                "bot_bottle.contrib.codex.agent_provider.codex_host_access_token",
-                return_value="token",
-            ), patch(
-                "bot_bottle.contrib.codex.agent_provider.write_codex_dummy_auth_file",
-            ):
-                provision = CodexAgentProvider().provision_plan(
-                    dockerfile="",
-                    state_dir=state_dir,
-                    instance_name="bot-bottle-demo-abc12",
-                    prompt_file=prompt_file,
-                    forward_host_credentials=True,
-                    host_env={},
-                )
-
-        verify_argv = provision.verify[0].argv
-        self.assertTrue(any(
-            item.startswith("PATH=/home/node/.local/bin:")
-            for item in verify_argv
-        ))
-        self.assertIn(
-            "/home/node/.codex/packages/standalone/current/bin/codex",
-            verify_argv,
-        )
-
    def test_dies_when_dir_creation_fails(self):
        provision = AgentProvisionPlan(
            template="codex", command="codex",
@@ -331,8 +301,7 @@ class TestCodexSuperviseMcp(unittest.TestCase):
        script = bottle.exec.call_args.args[0]
        self.assertEqual("node", bottle.exec.call_args.kwargs.get("user"))
        self.assertEqual(
-            "/home/node/.codex/packages/standalone/current/bin/codex "
-            f"mcp add supervise --url {_URL}",
+            f"codex mcp add supervise --url {_URL}",
            script,
        )

@@ -19,7 +19,7 @@ from bot_bottle.egress import (
    egress_sidecar_env_entries,
    egress_token_env_map,
 )
-from bot_bottle.errors import MissingEnvVarError
+from bot_bottle.log import Die
 from bot_bottle.manifest import ManifestIndex
 from bot_bottle.yaml_subset import parse_yaml_subset

@@ -499,14 +499,14 @@ class TestResolveTokenValues(unittest.TestCase):
        self.assertEqual({"EGRESS_TOKEN_0": "the-value"}, out)

    def test_missing_token_ref_dies(self):
-        with self.assertRaises(MissingEnvVarError):
+        with self.assertRaises(Die):
            egress_resolve_token_values(
                {"EGRESS_TOKEN_0": "GH_PAT"},
                {},
            )

    def test_empty_token_ref_dies(self):
-        with self.assertRaises(MissingEnvVarError):
+        with self.assertRaises(Die):
            egress_resolve_token_values(
                {"EGRESS_TOKEN_0": "GH_PAT"},
                {"GH_PAT": ""},
@@ -19,7 +19,6 @@ from bot_bottle.git_gate import (
    _resolve_identity_file,
    git_gate_upstreams_for_bottle,
 )
-from bot_bottle.errors import MissingEnvVarError
 from bot_bottle.manifest import ManifestIndex
 from tests.fixtures import fixture_minimal, fixture_with_git

@@ -218,16 +217,6 @@ class TestHookRender(unittest.TestCase):
        self.assertIn("supervisor approved # gitleaks:allow", hook)
        self.assertIn("supervisor rejected # gitleaks:allow", hook)

-    def test_inline_gitleaks_allow_python_imports_work_in_sidecar_layout(self):
-        hook = git_gate_render_hook()
-        # The sidecar image copies supervise.py flat under /app, while
-        # host-side tests import it through the bot_bottle package.
-        # Hooks execute from the bare repo directory, so the embedded
-        # Python must include /app and support both import layouts.
-        self.assertIn('PYTHONPATH="/app${PYTHONPATH:+:$PYTHONPATH}"', hook)
-        self.assertIn("import supervise as _sv", hook)
-        self.assertIn("from bot_bottle import supervise as _sv", hook)
-
    def test_inline_gitleaks_allow_fails_closed_without_supervisor(self):
        hook = git_gate_render_hook()
        self.assertIn(
@@ -422,7 +411,7 @@ class TestDynamicKeyProvisioning(unittest.TestCase):
    def test_revoke_missing_token_raises(self):
        bottle = self._gitea_manifest().bottles["dev"]
        (self.stage / "repo-deploy-key-id").write_text("123\n")
-        with patch.dict("os.environ", {}, clear=True), self.assertRaises(MissingEnvVarError) as cm:
+        with patch.dict("os.environ", {}, clear=True), self.assertRaises(RuntimeError) as cm:
            revoke_git_gate_provisioned_keys(bottle, self.stage)
        self.assertIn("env var is not set", str(cm.exception))

@@ -13,7 +13,6 @@ from pathlib import Path
 from typing import Any, cast
 from unittest.mock import patch

-from bot_bottle.errors import MissingEnvVarError
 from bot_bottle.git_gate import (
    _gitconfig_validate_value,
    _provision_dynamic_key,
@@ -121,7 +120,7 @@ class TestProvisionDynamicKey(unittest.TestCase):
                patch.dict("os.environ", {}, clear=False):
            import os
            os.environ.pop("GITEA_TOK", None)
-            with self.assertRaises(MissingEnvVarError):
+            with self.assertRaises(RuntimeError):
                _provision_dynamic_key(_gitea_entry(), "s", Path(d))


@@ -167,7 +166,7 @@ class TestRevokeProvisionedKeys(unittest.TestCase):
            import os
            os.environ.pop("GITEA_TOK", None)
            (Path(d) / "repo-deploy-key-id").write_text("kid123")
-            with self.assertRaises(MissingEnvVarError):
+            with self.assertRaises(RuntimeError):
                revoke_git_gate_provisioned_keys(_bottle(_gitea_entry()), Path(d))


@@ -30,19 +30,6 @@ class TestMacosContainerBottle(unittest.TestCase):
            argv,
        )

-    def test_agent_argv_accepts_absolute_provider_command(self):
-        command = "/home/node/.codex/packages/standalone/current/bin/codex"
-        bottle = MacosContainerBottle(
-            "bot-bottle-dev-abc",
-            lambda: None,
-            None,
-            agent_command=command,
-        )
-        with patch.dict(bottle_mod.os.environ, {}, clear=True):
-            argv = bottle.agent_argv(["run"])
-        self.assertIn(command, argv)
-        self.assertNotIn("codex", argv)
-
    def test_agent_argv_includes_workdir(self):
        bottle = MacosContainerBottle(
            "bot-bottle-dev-abc",
@@ -139,7 +139,7 @@ class TestMacosContainerLaunchArgv(unittest.TestCase):
            argv,
        )
        self.assertIn(
-            "type=bind,source=/state,target=/run/supervise",
+            "type=bind,source=/state/bot-bottle.db,target=/run/supervise/bot-bottle.db",
            argv,
        )

@@ -9,11 +9,7 @@ from __future__ import annotations

 import unittest

-from unittest.mock import patch
-
-from bot_bottle.env import resolve_env
-from bot_bottle.errors import MissingEnvVarError
-from bot_bottle.manifest import Manifest, ManifestBottle, ManifestIndex
+from bot_bottle.manifest import ManifestBottle, ManifestIndex
 from bot_bottle.manifest_agent import (
    ManifestAgent,
    ManifestAgentProvider,
@@ -242,26 +238,5 @@ class TestEagerIndexLookups(unittest.TestCase):
        self.assertIsNone(m.git_identity_summary())


-class TestResolveEnv(unittest.TestCase):
-    """resolve_env raises MissingEnvVarError when an interpolated entry's
-    host var is unset."""
-
-    def _manifest(self, env_dict: dict[str, str]) -> Manifest:
-        idx = ManifestIndex.from_json_obj({
-            "bottles": {"dev": {"env": env_dict}},
-            "agents": {"demo": {"bottle": "dev"}},
-        })
-        return idx.load_for_agent("demo")
-
-    def test_missing_interpolated_host_var_raises(self):
-        manifest = self._manifest({"API_KEY": "${HOST_API_KEY}"})
-        with patch.dict("os.environ", {}, clear=False):
-            import os
-            os.environ.pop("HOST_API_KEY", None)
-            with self.assertRaises(MissingEnvVarError) as cm:
-                resolve_env(manifest)
-        self.assertIn("HOST_API_KEY", str(cm.exception))
-
-
 if __name__ == "__main__":
    unittest.main()
@@ -79,11 +79,6 @@ class TestClaudeArgvWrapped(unittest.TestCase):
                "--",
                "runuser", "-u", "node", "--",
                "env", "HOME=/home/node", "USER=node",
-                (
-                    "PATH=/home/node/.local/bin:"
-                    "/home/node/.codex/packages/standalone/current/bin:"
-                    "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
-                ),
                "claude",
            ],
            argv,
@@ -132,24 +127,16 @@ class TestClaudeArgvWrapped(unittest.TestCase):
        self.assertIn("HTTPS_PROXY=http://127.0.0.1:1234", argv)
        self.assertIn("NO_PROXY=localhost", argv)

-    def test_guest_env_path_overrides_default_path(self):
-        argv = _unwrap(_bottle(None, PATH="/custom/bin").agent_argv([]))
-        self.assertIn("PATH=/custom/bin", argv)
-        self.assertFalse(any(
-            item.startswith("PATH=/home/node/.local/bin")
-            for item in argv
-        ))
-
    def test_runuser_switch_precedes_claude(self):
        # The dashboard's `_build_resume_argv_with_fallback` finds
        # the `claude` token to split exec-framing from the claude
        # tail. `runuser -u node --` must sit on the prefix side so
        # the shell wrap inherits the UID switch.
        argv = _bottle().agent_argv([])
-        runuser_idx = argv.index("runuser")
+        agent_idx = argv.index("claude")
        self.assertEqual(
            ["runuser", "-u", "node", "--", "env"],
-            argv[runuser_idx:runuser_idx + 5],
+            argv[agent_idx - 7:agent_idx - 2],
        )

    def test_pi_provider_appends_system_prompt_without_print_mode(self):
@@ -94,10 +94,6 @@ class TestEnsureSmolmachine(unittest.TestCase):
                calls.append(name)
            return _f

-        def save_and_record(image_ref: str, path: str) -> None:
-            Path(path).touch()
-            calls.append("save")
-
        with patch.object(
            _launch_mod.docker_mod, "build_image",
            side_effect=record("build"),
@@ -106,7 +102,7 @@ class TestEnsureSmolmachine(unittest.TestCase):
            return_value=f"sha256:{digest}fffffffffffffffff",
        ), patch.object(
            _launch_mod.docker_mod, "save",
-            side_effect=save_and_record,
+            side_effect=record("save"),
        ) as save, patch.object(
            _launch_mod, "ephemeral_registry",
            return_value=_Reg(),
@@ -8,7 +8,6 @@ inspecting running bundle containers' port bindings."""
 from __future__ import annotations

 import json
-import os
 import sqlite3
 import subprocess
 import tempfile
@@ -113,16 +112,9 @@ class TestEnsurePool(unittest.TestCase):


 class TestAllocate(unittest.TestCase):
-    def test_per_bottle_alias_on_linux(self):
-        # Linux gets the same per-bottle scoping as macOS (127/8 is
-        # already loopback, so no ifconfig is needed). A fresh host
-        # with no running bundles allocates the first pool entry.
-        with tempfile.TemporaryDirectory() as tmp:
-            lock_path = Path(tmp) / "smolmachines.lock"
-            with patch.object(loopback_alias, "_is_macos", return_value=False), \
-                 patch.object(loopback_alias, "_ALLOC_LOCK_PATH", lock_path), \
-                 patch.object(loopback_alias, "_aliases_in_use", return_value=set()):
-                self.assertEqual("127.0.0.16", loopback_alias.allocate("demo"))
+    def test_returns_loopback_on_linux(self):
+        with patch.object(loopback_alias, "_is_macos", return_value=False):
+            self.assertEqual("127.0.0.1", loopback_alias.allocate("demo"))

    def test_picks_lowest_unused_on_macos(self):
        # No bundles running -> first pool entry.
@@ -174,25 +166,12 @@ class TestAllocateLock(unittest.TestCase):

        self.assertIn(fcntl_mod.LOCK_EX, flock_calls)

-    def test_acquires_exclusive_lock_on_linux(self):
-        # Linux allocates per-bottle too, so it must take the same
-        # lock to serialise concurrent launches.
-        import fcntl as fcntl_mod
-        flock_calls: list[int] = []
-
-        def record_flock(fd, op):  # type: ignore
-            flock_calls.append(op)
-
-        with tempfile.TemporaryDirectory() as tmp:
-            lock_path = Path(tmp) / "smolmachines.lock"
-            with patch.object(loopback_alias, "_is_macos", return_value=False), \
-                 patch.object(loopback_alias, "_ALLOC_LOCK_PATH", lock_path), \
-                 patch.object(loopback_alias, "_aliases_in_use", return_value=set()), \
-                 patch.object(loopback_alias.fcntl, "flock",
-                              side_effect=record_flock):
-                loopback_alias.allocate("demo")
-
-        self.assertIn(fcntl_mod.LOCK_EX, flock_calls)
+    def test_no_lock_on_linux(self):
+        # Linux early-returns before touching the lock file.
+        with patch.object(loopback_alias, "_is_macos", return_value=False), \
+             patch.object(loopback_alias.fcntl, "flock") as flock:
+            loopback_alias.allocate("demo")
+        flock.assert_not_called()

    def test_sequential_allocations_with_shared_lock_are_serialised(self):
        # Two sequential calls share the same lock file. The second
@@ -262,12 +241,10 @@ class TestAliasInUseDetection(unittest.TestCase):


 class TestForceAllowlist(unittest.TestCase):
-    """Smolvm 0.8.0 silently drops `--allow-cidr` with `--from`, so
-    `force_allowlist` opens the state DB directly and sets the row's
-    `allowed_cidrs` field — on both macOS and Linux. It is
-    fail-closed: it dies rather than launching a VM whose allowlist
-    it can't confirm. Round-trip tests against a real SQLite DB to
-    lock down the BLOB encoding."""
+    """Smolvm 0.8.0 silently drops `--allow-cidr` with `--from`,
+    so `force_allowlist` opens the state DB directly and sets
+    the row's `allowed_cidrs` field. Round-trip tests against a
+    real SQLite DB to lock down the BLOB encoding."""

    def setUp(self):
        self._tmp = tempfile.TemporaryDirectory(prefix="smolvm-db.")
@@ -313,67 +290,17 @@ class TestForceAllowlist(unittest.TestCase):
        self.assertEqual(4, cfg["cpus"])
        self.assertTrue(cfg["network"])

-    def test_patches_on_linux_too(self):
-        # force_allowlist no longer no-ops on Linux — the TSI
-        # allowlist must be enforced there as well.
+    def test_noop_on_linux(self):
        with patch.object(loopback_alias, "_is_macos", return_value=False), \
             patch.object(loopback_alias, "_SMOLVM_DB_PATH", self.db):
            loopback_alias.force_allowlist("demo-vm", ["127.0.0.16/32"])
+        # DB row should be untouched.
        con = sqlite3.connect(str(self.db))
        cfg = json.loads(con.execute(
            "SELECT data FROM vms WHERE name='demo-vm'",
        ).fetchone()[0])
        con.close()
-        self.assertEqual(["127.0.0.16/32"], cfg["allowed_cidrs"])
-
-    def test_skips_write_when_already_matching(self):
-        # A newer smolvm that honors --allow-cidr at create leaves the
-        # row already correct; force_allowlist must not rewrite it. We
-        # detect a no-write by comparing the raw BLOB byte-for-byte
-        # (a rewrite re-serialises the JSON, changing key order/bytes
-        # is not guaranteed, but mtime/identity isn't observable — so
-        # we assert the stored bytes are exactly what we pre-seeded).
-        seeded = json.dumps({
-            "name": "demo-vm", "cpus": 4, "mem": 8192,
-            "network": True, "allowed_cidrs": ["127.0.0.16/32"],
-        }).encode()
-        con = sqlite3.connect(str(self.db))
-        con.execute(
-            "UPDATE vms SET data=? WHERE name='demo-vm'",
-            (sqlite3.Binary(seeded),),
-        )
-        con.commit()
-        con.close()
-
-        with patch.object(loopback_alias, "_is_macos", return_value=True), \
-             patch.object(loopback_alias, "_SMOLVM_DB_PATH", self.db):
-            loopback_alias.force_allowlist("demo-vm", ["127.0.0.16/32"])
-
-        con = sqlite3.connect(str(self.db))
-        stored = con.execute(
-            "SELECT data FROM vms WHERE name='demo-vm'").fetchone()[0]
-        con.close()
-        self.assertEqual(seeded, bytes(stored))
-
-    def test_dies_when_patch_does_not_take(self):
-        # If the persisted allowlist still doesn't match after the
-        # patch (e.g. wrong schema / smolvm stores it elsewhere),
-        # force_allowlist must fail closed rather than boot the VM.
-        original = loopback_alias._read_machine_cfg
-
-        def stale_cfg(con: sqlite3.Connection, name: str) -> dict[str, object]:
-            # Always report the un-patched row so the post-write
-            # verification never sees the requested cidrs.
-            cfg = original(con, name)
-            cfg["allowed_cidrs"] = None
-            return cfg
-
-        with patch.object(loopback_alias, "_is_macos", return_value=True), \
-             patch.object(loopback_alias, "_SMOLVM_DB_PATH", self.db), \
-             patch.object(loopback_alias, "_read_machine_cfg", side_effect=stale_cfg), \
-             patch.object(loopback_alias, "die", side_effect=SystemExit("die")):
-            with self.assertRaises(SystemExit):
-                loopback_alias.force_allowlist("demo-vm", ["127.0.0.16/32"])
+        self.assertIsNone(cfg["allowed_cidrs"])

    def test_dies_on_missing_db(self):
        with patch.object(loopback_alias, "_is_macos", return_value=True), \
@@ -396,35 +323,5 @@ class TestForceAllowlist(unittest.TestCase):
                loopback_alias.force_allowlist("not-in-db", ["127.0.0.16/32"])


-class TestSmolvmDbPath(unittest.TestCase):
-    """The smolvm state-DB path is platform-derived: Application
-    Support on macOS, XDG data dir on Linux."""
-
-    def test_macos_path(self):
-        with patch.object(loopback_alias.platform, "system", return_value="Darwin"):
-            p = loopback_alias._smolvm_db_path()
-        self.assertEqual(
-            ("Library", "Application Support", "smolvm", "server", "smolvm.db"),
-            p.parts[-5:],
-        )
-
-    def test_linux_default_xdg_path(self):
-        env = {k: v for k, v in os.environ.items() if k != "XDG_DATA_HOME"}
-        with patch.object(loopback_alias.platform, "system", return_value="Linux"), \
-             patch.dict(loopback_alias.os.environ, env, clear=True):
-            p = loopback_alias._smolvm_db_path()
-        self.assertEqual(
-            (".local", "share", "smolvm", "server", "smolvm.db"),
-            p.parts[-5:],
-        )
-
-    def test_linux_respects_xdg_data_home(self):
-        with patch.object(loopback_alias.platform, "system", return_value="Linux"), \
-             patch.dict(loopback_alias.os.environ,
-                        {"XDG_DATA_HOME": "/custom/data"}, clear=False):
-            p = loopback_alias._smolvm_db_path()
-        self.assertEqual(Path("/custom/data/smolvm/server/smolvm.db"), p)
-
-
 if __name__ == "__main__":
    unittest.main()
@@ -276,8 +276,8 @@ class TestProvisionCA(unittest.TestCase):
            str(self.egress_ca),
            AGENT_CA_PATH,
        )
-        self.assertEqual(2, bottle.exec.call_count)
-        script = bottle.exec.call_args_list[1].args[0]
+        bottle.exec.assert_called_once()
+        script = bottle.exec.call_args.args[0]
        self.assertIn("chmod 644", script)
        self.assertIn("update-ca-certificates", script)
        self.assertEqual("root", bottle.exec.call_args.kwargs.get("user"))
@@ -506,54 +506,5 @@ class TestProvisionGitUser(unittest.TestCase):
        self.assertIn("bot@example.com", calls[0][0])


-class TestProxyHost(unittest.TestCase):
-    """_proxy_host returns the bridge gateway on Linux and the loopback
-    alias on other platforms."""
-
-    def test_linux_returns_bundle_gateway(self):
-        plan = _plan()
-        with patch("bot_bottle.backend.smolmachines.launch.platform.system",
-                   return_value="Linux"):
-            result = _launch._proxy_host(plan, "127.0.0.16")
-        self.assertEqual(plan.bundle_gateway, result)
-
-    def test_non_linux_returns_loopback(self):
-        plan = _plan()
-        with patch("bot_bottle.backend.smolmachines.launch.platform.system",
-                   return_value="Darwin"):
-            result = _launch._proxy_host(plan, "127.0.0.16")
-        self.assertEqual("127.0.0.16", result)
-
-
-class TestDiscoverUrls(unittest.TestCase):
-    """_discover_urls stamps git-gate host + supervise URL into the plan."""
-
-    def test_git_gate_host_set_when_upstreams_present(self):
-        plan = _plan()
-        plan = replace(
-            plan,
-            git_gate_plan=replace(
-                plan.git_gate_plan,
-                upstreams=(GitGateUpstream(
-                    name="bot-bottle",
-                    upstream_url="ssh://git@host/repo.git",
-                    upstream_host="host",
-                    upstream_port="22",
-                    identity_file="/tmp/key",
-                    known_host_key="",
-                ),),
-            ),
-        )
-        with patch.object(_launch._bundle, "bundle_host_port", return_value="9420"):
-            stamped = _launch._discover_urls(plan, "127.0.0.16")
-        self.assertEqual("127.0.0.16:9420", stamped.agent_git_gate_host)
-
-    def test_supervise_url_set_when_supervise_present(self):
-        plan = _plan(supervise=True)
-        with patch.object(_launch._bundle, "bundle_host_port", return_value="55556"):
-            stamped = _launch._discover_urls(plan, "127.0.0.16")
-        self.assertEqual("http://127.0.0.16:55556/", stamped.agent_supervise_url)
-
-
 if __name__ == "__main__":
    unittest.main()
@@ -79,7 +79,7 @@ class TestArgvShapes(unittest.TestCase):
        with self._patch_run() as m:
            machine_create("agent-xyz")
        self.assertEqual(
-            ["smolvm", "machine", "create", "--name", "agent-xyz"],
+            ["smolvm", "machine", "create", "agent-xyz"],
            m.call_args.args[0],
        )

@@ -103,8 +103,7 @@ class TestArgvShapes(unittest.TestCase):
        self.assertIn("192.168.50.2/32", argv)
        self.assertIn("-e", argv)
        self.assertIn("HTTPS_PROXY=http://192.168.50.2:8888", argv)
-        self.assertIn("--name", argv)
-        self.assertIn("agent-xyz", argv)
+        self.assertEqual("agent-xyz", argv[-1])

    def test_machine_create_omits_net_when_no_allow_cidrs(self):
        with self._patch_run() as m:
@@ -128,13 +127,13 @@ class TestArgvShapes(unittest.TestCase):
            m.call_args.args[0],
        )

-    def test_machine_delete_uses_name_flag_and_force(self):
-        # delete uses --name flag; -f required so no interactive
+    def test_machine_delete_uses_positional_name_and_force(self):
+        # delete NAME is positional; -f required so no interactive
        # confirmation blocks teardown.
        with self._patch_run() as m:
            machine_delete("agent-xyz")
        self.assertEqual(
-            ["smolvm", "machine", "delete", "--name", "agent-xyz", "-f"],
+            ["smolvm", "machine", "delete", "-f", "agent-xyz"],
            m.call_args.args[0],
        )

@@ -56,14 +56,9 @@ class TestBundleSubnet(unittest.TestCase):

 class TestPreflight(unittest.TestCase):
    def test_smolvm_present_returns_none(self):
-        # Pin macOS so the Linux KVM gate doesn't fire on a CI runner
-        # (ubuntu, no /dev/kvm) — this test isolates the PATH check.
        with patch(
            "bot_bottle.backend.smolmachines.util.shutil.which",
            return_value="/usr/local/bin/smolvm",
-        ), patch(
-            "bot_bottle.backend.smolmachines.util.platform.system",
-            return_value="Darwin",
        ):
            self.assertIsNone(smolmachines_preflight())

@@ -93,63 +88,5 @@ class TestPreflight(unittest.TestCase):
            self.assertIn("BOT_BOTTLE_BACKEND=docker", msg)


-class TestKvmPreflight(unittest.TestCase):
-    """Linux-only KVM gate: smolvm needs /dev/kvm present and
-    accessible. macOS skips this entirely (Hypervisor.framework)."""
-
-    def _run(self, *, system: str, exists: bool, access: bool) -> None:
-        with patch(
-            "bot_bottle.backend.smolmachines.util.shutil.which",
-            return_value="/usr/bin/smolvm",
-        ), patch(
-            "bot_bottle.backend.smolmachines.util.platform.system",
-            return_value=system,
-        ), patch(
-            "bot_bottle.backend.smolmachines.util.os.path.exists",
-            return_value=exists,
-        ), patch(
-            "bot_bottle.backend.smolmachines.util.os.access",
-            return_value=access,
-        ):
-            return smolmachines_preflight()
-
-    def test_macos_skips_kvm_check(self):
-        # Even with /dev/kvm absent, macOS must not run the gate.
-        self.assertIsNone(self._run(system="Darwin", exists=False, access=False))
-
-    def test_linux_ok_returns_none(self):
-        self.assertIsNone(self._run(system="Linux", exists=True, access=True))
-
-    def test_linux_missing_device_dies(self):
-        with self.assertRaises(SystemExit):
-            self._run(system="Linux", exists=False, access=False)
-
-    def test_linux_no_access_dies(self):
-        with self.assertRaises(SystemExit):
-            self._run(system="Linux", exists=True, access=False)
-
-    def test_linux_missing_device_message(self):
-        import io
-        import sys
-        captured = io.StringIO()
-        with patch.object(sys, "stderr", captured):
-            with self.assertRaises(SystemExit):
-                self._run(system="Linux", exists=False, access=False)
-        msg = captured.getvalue()
-        self.assertIn("/dev/kvm", msg)
-        self.assertIn("kvm-intel", msg)
-
-    def test_linux_no_access_message(self):
-        import io
-        import sys
-        captured = io.StringIO()
-        with patch.object(sys, "stderr", captured):
-            with self.assertRaises(SystemExit):
-                self._run(system="Linux", exists=True, access=False)
-        msg = captured.getvalue()
-        self.assertIn("kvm", msg)
-        self.assertIn("group", msg)
-
-
 if __name__ == "__main__":
    unittest.main()