Validate v1.2 Dev Containers and Codespaces

[BrettKinny]

This was generated by AI during triage.

Type: HITL

Parent

• Release v1.2.1 from one qualified Candidate #125

What to build

Exercise the v1.2 Dev Container and GitHub Codespaces adapters through their
real orchestration layers. Validate the tagged source build,
postCreateCommand, noninteractive defaults, independent failure semantics,
Workspace alignment, and rebuild persistence.

Record the source tag and SHA, resulting image ID, VS Code Dev Containers or
Codespaces versions, host/runtime, configuration overrides, and evidence. A
source rebuild is not expected to be byte-identical to the published Candidate
digest.

Acceptance criteria

• VS Code Dev Containers builds the tagged source, opens /workspace as dev, and completes the real post-create command.
• GitHub Codespaces runs the same post-create path with documented default AI and SDK Selections.
• Explicitly empty per-tier values opt out and existing user Selections take precedence over defaults.
• Independent setup-section failure returns nonzero without erasing a successful section's observed state.
• Rebuild and reopen preserve Workspace Selection state and Managed-home authentication and toolchains.
• Shell initialization is suppressed only during creation and works in the opened terminal.
• Custom AI, editor, TUI, multiplexer, and SDK defaults reconcile without repeating successful installs or erasing prior choices.
• Results and failures are attached here and reflected in the v1.2 UAT checklist.

Blocked by

• Release v1.2.1 from one qualified Candidate #125

[BrettKinny]

This was generated by AI during triage.

Release-blocking failure reproduced through the real Dev Container CLI.

Environment:

• Source tag/SHA: v1.2.0 / d1b676b7475b855e912f98d51dad136ea4bb9b4b
• Host: physical Arch Linux amd64, Docker Engine 29.6.2
• Dev Container CLI: 0.87.0 (Node 25.2.1)
• Source-build image index: sha256:d8ab4607a67f1e0472c13b469128779c595084c494e81ce6f20da610a6ee461e on initial build (source builds are not expected to match the published Candidate digest)

Passed:

• CLI built the tagged source and opened /workspace as dev UID 1000.
• The real postCreateCommand ran successfully. Explicit empty AI/SDK/editor/TUI values produced the documented no-default-tools opt-out and did not publish Selection files.
• Mounted source resolved to the exact tagged SHA.
• An opened interactive Bash initialized the MOTD, ff, sqrbx-help, eza alias, Starship, Zoxide, and mise.
• Reopening the existing container retained both Workspace and home markers.

Failed:

1. Wrote ~/.squarebox-v12-managed-home and /workspace/.squarebox/v12-selection-marker.
2. Ran devcontainer up --remove-existing-container against the same tagged source.
3. The Workspace Selection marker survived. The Managed-home marker was gone.

The CLI-generated docker run contains the Workspace bind only; .devcontainer/devcontainer.json defines no mount for /home/dev. Therefore authentication and mise toolchains stored in Managed home cannot survive a real container rebuild, violating this issue’s rebuild-persistence criterion.

VS Code UI and Codespaces are still untested on this host, but the configuration-level persistence failure is already sufficient for NO-PROMOTE. A normal fix PR and a new protected final version are required; v1.2.0 cannot be retargeted.

[BrettKinny]

This was generated by AI during triage.

A validated fix is now in draft PR #139: #139

The fix mounts /home/dev from squarebox-home-${devcontainerId} using the Dev Container spec object form. ${devcontainerId} is stable across rebuilds and unique per Box, avoiding credential sharing between unrelated workspaces. Repeated real CLI rebuilds preserved both Workspace and Managed-home markers with dev ownership, and all executable repository test modules pass.

This does not clear the VS Code UI or Codespaces portions of #130, and it cannot repair the protected v1.2.0 Candidate. After normal review/merge, release qualification must restart under a new final version.

[BrettKinny]

This was generated by AI during triage.

v1.2.1-rc1 Codespaces qualification: FAIL

Codespace v121-rc1-uat-100043-97g4rpp4gx2pp7q reached Available on the
2-core basicLinux32gb machine, but both gh codespace ssh and remote log
access failed before source/mount/rebuild checks:

failed to start SSH server:
Please check if an SSH server is installed in the container.

The exact rc1 image digest contains no sshd, and the repository had neither
openssh-server nor a Dev Container SSH Feature. This also invalidated the
README's documented CLI attach path. The exact resource was stopped, force-deleted,
and verified absent; local evidence is retained at
/tmp/squarebox-v1.2.1-rc1-codespaces.OurAXn.

PR #141 fixes the cause with the official SSHD Feature pinned at version 1.1.0
and OCI digest
sha256:f5251b8e4325f68f7280973c6cd65daff414449c66f240621502d4e8e74eb7ee,
with non-loopback gateway forwarding disabled. Local frozen-lock Dev Container
build/up, sshd -t, live-daemon, and configuration checks pass.

This is a NO-PROMOTE result for rc1. Merge #141, create rc2, and rerun every
real Codespaces phase before closing this issue.

[BrettKinny]

This was generated by AI during triage.

v1.2.1-rc2 Codespaces qualification: FAIL

Candidate source c4cece0 and immutable rc2 artifacts passed all automated gates. A fresh 2-core Codespace built the exact source, reached Available, mounted the isolated Managed-home volume, and gh codespace ssh attached successfully through the pinned SSHD Feature.

The real postCreate path then hung for more than two minutes in an interactive Gum picker:

• scripts/devcontainer-postcreate.sh pre-seeded ai-tool=claude and sdks=node
• it invoked setup.sh --rerun ai sdks
• setup.sh launched gum choose with the prompt Select AI coding assistants
• no Claude or Node executable/toolchain was installed

Process evidence showed devcontainer-postcreate.sh, setup.sh --rerun ai sdks, and gum choose all still running. This violates the documented noninteractive default-provisioning criterion. The transient gh create --status SSH authentication error was not the cause; ordinary gh codespace ssh subsequently passed.

The exact Codespace v121-rc2-uat-7vp565gj4j92xqx was stopped, force-deleted, and the repository Codespaces list was verified empty.

Result: rc2 is NO-PROMOTE. Fix the setup invocation/contract with a real default-path regression, merge normally, and qualify a new protected v1.2.1-rc3 Candidate.

[BrettKinny]

This was generated by AI during triage.

Fix-forward draft PR #143 is open for the rc2 postCreate blocker.

It adds a section-scoped, noninteractive Selection reconciliation mode; closes setup stdin; activates mise shims before observing persisted assistants; and requires new Candidate Evidence devcontainer.postcreate-noninteractive.

Validation includes two independent PTY boundaries plus real Dev Container CLI first-create/replacement: Claude 2.1.220 and Node 26.5.1 installed initially, both Workspace and Managed-home markers survived replacement, and both tools were observed and skipped on the second postCreate. All 17 repository test modules pass and disposable Docker resources were removed.

This does not rehabilitate rc2. Merge only after normal CI/review, then create and fully qualify protected v1.2.1-rc3.

[BrettKinny]

This was generated by AI during triage.

v1.2.1-rc3 Codespaces qualification: FAIL

Candidate source 37a5a56e1ff0b909bb4b7958d1fdab4025ad0fa1 and immutable digest
sha256:6e5b8eb8036d996018ed9f5a2d583e00e55ed10aadfd5c869058426a1900e2d1
passed every automated Candidate gate. Real Codespaces qualification then passed:

• exact-source build and SSH attach through the pinned SSHD Feature;
• default Claude 2.1.220 and Node 26.5.1 provisioning with no picker;
• /workspace and dev UID/GID 1000 alignment;
• Workspace Selection plus Managed-home/auth/toolchain persistence across an ordinary rebuild;
• explicit empty tier opt-outs and an explicit Zellij default;
• saved claude, node, and zellij choices taking precedence over conflicting
  codex, python, and herdr defaults;
• a repeated postCreate reconciliation skipping all three already-observed tools.

The earlier gh codespace rebuild --full Managed-home reset is expected Codespaces
behavior, not this failure: GitHub documents that a full rebuild deletes Docker
volumes. The ordinary rebuild retained the same home inode and a fresh control marker.

The release blocker is the real independent-section failure path:

1. With no prior TUI Selection and no elio binary, postCreate was given
   SQUAREBOX_DC_TUIS=elio and SQUAREBOX_TOOLS_YAML=/dev/null so Elio would fail
   deterministically without network access.
2. Existing Claude, Node, and Zellij sections all reconciled successfully; postCreate
   returned nonzero for Elio as required.
3. Setup printed elio installation failed; new Selection was not committed, but
   /workspace/.squarebox/tuis still contained elio while command -v elio failed.

devcontainer-postcreate.sh pre-seeds the file before setup snapshots prior state, so
setup mistakes a new default for an existing user Selection and preserves it on failure.
This violates the observed-state Selection contract and this issue's independent-failure
criterion. rc3 is NO-PROMOTE; fix normally, add a real regression, and qualify rc4.

The test-created TUI file was removed. Codespace
v121-rc3-uat-g47rjrgvw673vvvv was stopped, force-deleted, and the repository
Codespaces list was verified empty.