Prove the coordination bridge inside a real container - #62
Merged
ilovecrayons merged 2 commits intoSep 4, 2026
Merged
Conversation
The coordination E2E only ran on the in-process runtime, because under `go test` /proc/self/exe is the test binary and has no mcp subcommand, so nothing could stage a bridge a container could execute. That left the container half unproven: the two mounts were asserted as fields on a runtime.Spec rather than as realized binds, the staged 0555 binary was never executed as /opt/aether/aether-server mcp, and no non-root user ever traversed the 0755 directory, read the 0444 config, or connected to the 0666 socket. The failure would have been silent - a run that cannot reach the bridge degrades to notice-only, which is a legal state. - scheduler.Config.ServerBinary names the binary the stager copies, replacing the unexported package var, and server.Config passes it through so a test can point it at a binary it built. - TestIntegrationCoordinationInContainer builds an aether-server and a fixture agent, installs the agent as the claude executable of a non-root image, and asserts both the daemon's view of the two realized read-only binds and the agent's own status/send/inbox round trip through the staged binary. - docs/mcp-bridge.md loses the gap note; docs/testing.md describes what the new scenario proves and the two seams it needs.
Review follow-ups on the scenario added in the previous commit. The image cleanup ran before the runtime's container sweep, because cleanups run last-in-first-out and the image was built after the runtime. Removing an image a live container still holds only untags it, so every run left its layers behind. The daemon probe is now its own helper that registers nothing, so the skip decision can be made before the image is built and the image's cleanup outlives the sweep. The /opt/aether write probe proved nothing about the bind: the image has no /opt, Docker creates the directory root-owned 0755, and the refusal was a mode-bit EACCES. Nor can a write to the staged binary itself separate the two, since it is 0555 and the agent is not root. The fixture now reads the kernel's own mount record for both targets and requires each to be a mount point carrying "ro", which is the fact a mode bit cannot imitate, and keeps a write probe only where the answer is unambiguous: the coordination directory, where it must be EROFS. The single edit before the diff watch existed was a race - the watch is fsnotify-driven and registered after the attach, so a missed event cost the scenario its whole two-minute poll. The agent now rewrites the file while it waits for a peer, on an interval that leaves the watch its quiet period: rewriting on every poll is sustained churn, and held off the snapshot until the watch's own ceiling, taking the scenario from 8s to 55s. Also: a 3-minute test context rather than 10, which equalled the default go test timeout, and slices.Sort in the fixture.
not-varram
deleted the
varram/sup-59-prove-the-coordination-bridge-in-a-container
branch
September 4, 2026 04:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes SUP-59. The coordination E2E was pinned to the in-process runtime because under
go testthe binary at/proc/self/exeis the test binary and has nomcpsubcommand, so the two bind mounts, the staged0555binary and a non-root agent reaching the0666socket were never exercised in real Docker. That failure would be silent: a wrong mount degrades every Claude Code run to notice-only, which is a legal state.selfExeis nowscheduler.Config.ServerBinary(default/proc/self/exe, unreachable from any flag or config key), passed fromserver.Config.ServerBinary.TestIntegrationCoordinationInContainerbuilds a realaether-serverwithCGO_ENABLED=0and a fixture agent, builds a busybox image where the fixture is theclaudeexecutable running as a non-root user, launches two overlapping runs on the shipped claude profile, and asserts from both sides: the daemon's view (both binds realized, read-only, the staged binary named by the built binary's sha256, non-root user) and the agent's report over a real SSH attach (the--mcp-configargument, uid, the0755directory,0444config,0666socket, both mount targets present in/proc/self/mountinfoasro, and a status/send/inbox round trip through/opt/aether/aether-server mcp).Validation
-count=3); the fullmake test-integrationpasses (41 packages).make fmt-check vet lint test test-scripts public-auditpass.🤖 Generated with Claude Code
https://claude.ai/code/session_019irxg6aWWKmn2w3QsJR5CJ