box stops knowing about rig — the mint hook, the pin, the stamp and the bootstrapped mark come out, and box new always mints blank

[dan-claude-bot]

Opened at @danmt's direction on #205 (2026-08-21T18:22:49Z): "We can start a new discussion. Just know that I'm willing to sacrifice box new claude-box. You always create a blank box. Shell into the box, install rig and run rig bootstrap claude-box. It's more work but removes the dependency."

#205 is closed; this thread is its successor and carries the whole of the question. Nothing is minted here — this is a discussion, it is the input to triage rather than its output, and when it converges the deliverable is an epic, not one issue (the surface below is bin/box, five seeds, the README, the design doc, the drill and CI).

Everything measured against box main at 1c2f06b. #209 is in flight and not measured in — see "What this does not touch" at the end, which is the one thing to read before anything else here.

The starting position, stated as a position and not a question

box provisions and manages VMs. It does not converge them. A consumer who wants a tenant role installs rig inside the box and runs it, and an operator who wants that automated writes the piping in a wrapper — heavy-duty/crew, whose crew new already wraps box new, so the wrapper's public API survives the change even though what it pipes underneath does not.

Two things this does not reverse, both worth nailing down before the survey:

• #81 stays closed and the roles stay in rig. thin templates — tenant content moves to rig bootstrap roles; templates shrink to creds-free seeds #81 moved tenant content out of box's seeds and into rig's bootstrap roles, and that was right. What changes here is not where the content lives — it is who invokes it. The claude-box role is rig's either way; the question is only whether bin/box runs it for you.
• The rig → box edge is untouched. @danmt: "Rig does still reference box because we need it in servers that host VMs." BOX_RELEASE in rig's bootstrap stays exactly what it is. This thread is about one direction only.

What box would hand back

bin/box matches rig on 112 of its lines, but that number is mostly prose. The load-bearing pieces are four, and they are the whole deliverable:

#	what	where	what dies with it
1	the mint hook — incus exec … rig bootstrap <role>, and the failed-converge recovery hint	bin/box:2302-2313	the one-command agent box
2	the pin resolution — rig_latest_release() / rig_pin_resolve()	:1458, :1490-1496	#150's deliverable, and RIG_REF as a box-level knob
3	the mint stamp — user.box.rig.repo / user.box.rig.ref	:2170-2171	a box's record of which rig it converged against
4	the bootstrapped mark (#130)	:1703-1707	a snapshot label that means "a tenant role converged and nothing has touched the box since"

Plus, outside bin/box: five seeds curl rig's installer through the @RIG_REPO@/@RIG_REF@ pin point (templates/claude-box/user-data.yaml:127 and its four siblings); 40 lines of README and 15 of docs/box-design.md; and the drill's rig pin, which records RIG_REF/RIG_SHA into every record (drill/drill.sh:469-470, emitted at :503).

What the operator does instead

The replacement path is not hypothetical — it is already written down in #159's Interim section, as the thing a released box can already do by hand:

box new --name work            # blank
box shell work
# in the box:
curl -fsSL .../rig/install.sh | bash
sudo rig bootstrap claude-box --user dev

Four steps where there is one today, and the fourth is the only one that ever changes.

What is genuinely lost, priced honestly

This is the part I would not want decided on the strength of the paragraph above.

1. bootstrapped (box: mark bootstrapped after a successful rig hook #130) loses its meaning, not just its code. box can take that mark today because box watched the convergence it ran — the file says so in its own comment at :1700-1702: "box cannot honestly take a mark for a run it did not watch." Once the operator runs rig by hand, no watcher exists. box restore work bootstrapped — "keep the role, undo what you did to it" — either dies or becomes a label the operator takes by hand and box never validates.
2. The failed-converge recovery hint has no caller. #177 repaired exactly that path this month; it is box's only reason to know rig can fail.
3. RIG_REF stops being a box knob. RIG_REF defaults to main — a released box never converges a released rig #150 shipped release-pinning at mint and it is unreleased — it ships in 0.10.0. If the edge goes, RIG_REF defaults to main — a released box never converges a released rig #150's deliverable goes with it, unreleased, and so does the entire question The rig↔box edge has no upper bound — box floats to rig’s latest release, and nothing records which rig it drilled #205 was opened to answer. That is not an argument against; it is the bill.
4. The cold-start promise changes. The README sells box new --name work --template claude-box as "a creds-free coding-agent box (~10 min cold)" (README:262). It becomes a documented four-step path, and the ~10 min becomes the operator's to wait through interactively.
5. The drill's rig pin needs a decision either way. If box does not install rig, does box's drill still converge one? A drill that mints a blank box proves less than today's does — but what it proves is exactly what box would then be responsible for.

The one real fork

@danmt's stated position is the strong form. There is a middle one, and the difference between them is the whole design:

• Strong — box ships nothing rig-shaped. The seeds stop curling rig's installer too. bin/box and templates/ contain the string rig only in prose. Maximum honesty, maximum operator work, and the cleanest walk back to "rig enables a server".
• Middle — rig leaves bin/box but stays in the template. The seed installs rig and runs the role from cloud-init; bin/box knows nothing — no hook, no pin, no stamp, no mark. box provisions VMs; a template that uses rig is a consumer that chose it. Keeps the one-command box, costs the four losses above except feat: drop the claude- instance-name prefix #4, and turns the rig ref into a literal in each seed — a pin, the shape #189 rejected for rotting silently, though a visible one a consumer can edit.

I read @danmt's "if you want to use rig inside box, that's fine but it's a consumer decision" as the strong form, and his "they would have to implement it" about crew as confirming it. But the middle form is also a literal reading of that sentence, and the two produce very different epics.

Questions

1. Strong or middle? Everything else follows from this.
2. bootstrapped (box: mark bootstrapped after a successful rig hook #130): delete, or redefine as an operator-taken label box does not validate? I lean delete — an unvalidated mark that reads like a validated one is worse than no mark.
3. Does the box drill still converge a rig role? If yes, the drill grows an operator step; if no, the drill's scope shrinks to what box now owns and drills/README.md's record shape changes.
4. Window. I would put this after 0.10.0, not in it: #182's board must empty before the tag, its last gate is a real-hardware drill run, and this change would rewrite what that drill proves. 0.10.0 also ships RIG_REF defaults to main — a released box never converges a released rig #150 — which this would then remove — and shipping-then-removing is cheaper than holding the window open. Triage's call, for @danmt to overturn.
5. crew. Not this repo's to file. If crew must absorb the piping before box drops it, that is heavy-duty/crew's issue under @danmt's own cross-repo rule, and its sequencing is a real constraint on question 4.

What this does not touch

#159 is not blocked and #209 merges as specified. It is claimed, built, ready for review, and I am not stopping it on a design that has not started, for a reason beyond timing: #159 moves toward this thread, not against it. It deletes four per-agent seeds, collapses the rig edge from five hand-maintained seeds into one rendered code path, and makes --template mean shape instead of tenant — which is precisely the split that makes a later removal a small cut rather than a rewrite.

The honest tension, named rather than buried: #159 also promotes the rig edge to a first-class flag (--role), so the strong form would delete a flag #209 is about to add. I judge that acceptable — the seed collapse is wanted under every outcome here, and one flag on one code path is the cheapest possible thing to later remove. @danmt merges #209 and overturns that judgement there if he disagrees.

Also untouched: #210 (#159's hardware witness), and every other member of the 0.10.0 window.

[danmt]

1. Strong
2. Delete it
3. No
4. I think we should add this to 0.10.0
5. One 0.10.0 drops, crew should pin it. No issue filing needed

box new --name work            # blank
box shell work
# in the box:
curl -fsSL .../rig/install.sh | bash
sudo rig bootstrap claude-box --user dev

That's all good except that I wouldn't use sudo rig but rather use box root and then rig as root. Rig is meant to be used as root always.

Note: I think the way to access the box as root is using box root this is either in-flight or about to be integrated. If it's some other way, we'll do it that way.

@dan-claude-bot

[dan-claude-bot]

Ruled on all five, so this converges. Accepted — minted as an epic, #212, with three children: #213 → #214 → #215. All three are members of the 0.10.0 window under your ruling 4, which overturns the recommendation this thread made. Recording the five answers where the work can read them:

1. Strong. bin/box and templates/ will contain the string rig only in prose — and that is #214's own acceptance test, asserted by a grep guard rather than by a reviewer's eye.
2. Delete it. #213. pristine survives untouched; box restore <box> bootstrapped stays a name passthrough, so a box that already carries the snapshot is not stranded.
3. No. The drill mints and does not converge; the record drops its rig row and the RIG_REF candidate ref, and drill/README.md states what the drill now proves rather than leaving a reader to notice the absence. The shared run ID stays — it is a record convention, not a rig dependency.
4. 0.10.0. Taken, and priced in #212 rather than glossed. Two consequences worth your eye, both below.
5. crew pins, nothing filed. #214's changelog fragment carries a BREAKING note naming crew new and stating the pin explicitly, since the changelog is now how crew learns.

On box root — it already exists, so there is nothing in flight to wait for. #176 landed it on 2026-08-20 in #188: bin/box:2620, incus exec "$inst" -- bash -l, authorized by the host's Incus socket and needing no sudoers entry in the guest. box's own failed-converge hint already spells the recovery that way (:2304-2313) — which is one of the lines #214 deletes. So the documented path is box root, not sudo rig, throughout. One detail that follows from it and is worth having in the README: box root is a login shell, so $HOME is set and the by-hand install needs no analogue of the seed's HOME=/root workaround. The path the README will teach:

box new --name work --size medium        # a blank box, nothing converged
box root work                            # root inside it, authorized by the host's Incus socket
# then, inside the box, as root:
curl -fsSL https://raw.githubusercontent.com/heavy-duty/rig/<ref>/install.sh \
  | RIG_REPO=heavy-duty/rig RIG_REF=<ref> bash
rig bootstrap claude-box --user dev

--size medium is in that line deliberately: a role never implied a size, so omitting it silently gives 2/2/20 where an agent box used to get 4/8/60.

Two things ruling 4 forced, which this thread did not price

The first is a decision, and it is the one place your ruling made triage choose something you have not seen. #159 item 7 gives the new generic seed "exactly one conditional axis: whether a role was given" — role-given is an unprivileged tenant with shellcheck/python3-venv, a fixed 1GiB /tmp and a 4GiB swapfile; no role is a tenant with sudo and none of those. The strong form deletes --role, which deletes the axis, so box must ship one hygiene rather than two. Triage picked the agent-class one for every box (epic D1), on an asymmetry: a capped /tmp plus swap on a box that did not need them costs disk and surprises nobody, while the stock 50%-of-RAM /tmp with no swap on a box that did need them is the OOM-kill #178 measured — and an unprivileged tenant costs nothing now that box root exists, which is the trade #177 already made and the one your "rig as root" note assumes. The honest argument against it is that four measurements taken in agent boxes are being generalized to every box; #215 is where that generalization gets watched on hardware. Reversible on an unmerged branch and overridable at mint — yours to overturn at merge.

The second is a cost, not a decision. Ruling 4 makes #210 — the hardware witness for the --role mint, minted this afternoon — a witness for a shape that never reaches a tag: 0.10.0 would add --role and remove it inside one release. Triage has not touched it tonight, because #209 has not merged and #159's criteria moved there on an explicit promise that they changed address rather than were softened. The trigger is #214's merge, at which point triage closes it obsolete against #215 or amends it, in the same tick, and records which; a note on #210 says so, so nobody plans a session around it in the meantime. Say the word and it closes tonight instead.

Related: the window's chain is now #159 → #213 → #214 → #215, four deep at one claim at a time, and its last link needs the same real-host session #155, #201, #204, #207 and #210 already wait on. That is the shape of ruling 4 and it is stated so the cut's date is not a surprise.

What was not turned into work, and why

Two build issues rather than one, and rather than seven. The bootstrapped mark is separable — deleting it while the hook still runs is honest at every commit. Everything else is one atomic cut, and that is measured rather than asserted: remove the pin substitution alone and every seed curls a literal @RIG_REPO@, so cloud-init fails and the mint is broken; remove the installer line alone and the hook runs rig bootstrap against a guest with no rig; remove the stamp alone and drill/drill.sh:1166 reads it into the empty string, so the record prints rig @ () — a drill record that quietly reports less than it did, which is the #153 defect exactly.

#81 stays closed, the roles stay in rig, and the rig → box edge is untouched — BOX_RELEASE in rig's bootstrap is exactly what it was. And #209 merges as specified: the thread named the tension, judged it acceptable because collapsing five hand-maintained seeds into one rendered code path is what makes this removal a small cut, and put it in front of you; you ruled without overturning it, so it is settled and both children are specified against the tree it leaves.

Answered.

[dan-claude-bot]

Closing this thread as resolved — the ruling is on the record, the work is minted, and two of the three children have already shipped.

Converged on 2026-08-21T21:14:19Z, when @danmt's five answers were recorded and accepted as epic #212 with children #213 → #214 → #215. The thread was left open past that; its predecessor #205 was closed as resolved the moment it converged, and this one gets the same treatment rather than sitting open with nothing pending in it.

Where it stands, so nobody has to reconstruct it from here:

• bin/box — the bootstrapped mark comes out: box stops labelling a convergence it will no longer watch #213 — the bootstrapped mark comes out. Closed on the merge of PR #216 (90f5cf3) at 2026-08-22T00:02:19Z. pristine survives and box restore <box> bootstrapped stays a name passthrough, exactly as ruling 2 was taken.
• box stops knowing about rig — the mint hook, the pin, the stamp and the seeds’ installer come out, and box new always mints blank #214 — the strong form. Closed on the merge of PR #218 (d92974b) at 2026-08-22T06:22:41Z, every criterion checked. bin/box and templates/ now mention rig in prose only, asserted by a grep guard rather than by eye. templates/ holds tenant and staging-box; a bare box new renders tenant.
• The rig-free box witnessed on real hardware: a blank mint carrying no rig, and box root → install rig → rig bootstrap converging an agent box by hand #215 — the hardware witness. ready since 2026-08-22T06:24:16Z and the last open link. Operator-owned: it runs the README's four-step path verbatim and times the converge against the "~10 min cold" sentence this change replaced. It rides the session #155 manifests.

On the sudo rig line in the ruling — taken as written: the README path uses box root and then rig as root, no sudo. box root already existed (#176, landed 2026-08-20), so nothing waited on it.

One consequence of ruling 4 has since been paid out: #210, the hardware witness for the --role mint, was closed obsolete at 2026-08-22T06:48:51Z under epic D7 — 0.10.0 would have added --role and removed it inside one release, so six of its nine criteria witnessed a shape no user will see. The two criteria nothing else carried moved to #215 first.

Comments still work here if there is more to say, and this can be reopened. Further work belongs on #212 and #215.