refactor: single flat manifest.scm, drop container.scm + toggles #10

Merged

pti merged 1 commit from refactor-single-flat-manifest into main

2026-07-07 14:35:36 +02:00

pti commented

2026-07-07 14:33:55 +02:00

Owner

Collapses the toolchain config to one flat manifest.scm, per discussion — no second file, no build-time toggles. Restores a true single source of truth.

What changed

manifest.scm — flat list: go git golangci-lint node + a named %plumbing var (bash coreutils nss-certs). No getenv modes. Used verbatim by dev, CI lint, CI image (guix pack), and the wraptool up container.
Container = the project's own manifest.scm. bringUpGuixContainer runs guix shell --container -m manifest.scm, so the harness gets the same toolchain a developer does and can compile/test/analyze/commit locally — which the old harness-only container.scm couldn't.
Removed: .wraptool/container.scm, --scaffold-guix, the container-manifest lookup/scaffold/template + their tests, and the WRAPTOOL_CI_IMAGE pack toggle.

Security posture (unchanged)

Credential isolation is the mount/user namespace (host $HOME/secrets never shared), not the package set. So git being in the container is fine:

privileged/remote git (push, private fetch) → still must go through wraptool's MCP git tool (only the host has creds);
local non-privileged git (status/diff/commit/branch) → works in-box.

Tradeoff accepted

Dev guix shell is no longer "lean" (now pulls node + plumbing) — simplicity over leanness, and still trivially small next to a polyglot image.

Verified (e2e on Guix)

Container built from manifest.scm has go/git/node/golangci-lint/bash; reaches host wraptool; host $HOME empty, host repo not visible; local git status works. Full go test ./... + golangci-lint clean; YAML valid; manifest evaluates for dev and container. The publish-ci-image workflow is path-filtered on manifest.scm, so merging re-packs the CI image from the flat manifest automatically.

Docs

design/guix-container-runtime.md gets an R2 revision banner superseding the container.scm model (§6.2/§6.4 tagged R1); CLAUDE.md + examples/devcontainer/README.md updated.

🤖 Generated with Claude Code

Collapses the toolchain config to **one flat `manifest.scm`**, per discussion — no second file, no build-time toggles. Restores a true single source of truth. ## What changed - **`manifest.scm`** — flat list: `go git golangci-lint node` + a named `%plumbing` var (`bash coreutils nss-certs`). No `getenv` modes. Used verbatim by dev, CI lint, CI image (`guix pack`), and the `wraptool up` container. - **Container = the project's own `manifest.scm`.** `bringUpGuixContainer` runs `guix shell --container -m manifest.scm`, so the harness gets the **same toolchain a developer does** and can compile/test/analyze/commit locally — which the old harness-only `container.scm` couldn't. - **Removed:** `.wraptool/container.scm`, `--scaffold-guix`, the container-manifest lookup/scaffold/template + their tests, and the `WRAPTOOL_CI_IMAGE` pack toggle. ## Security posture (unchanged) Credential isolation is the **mount/user namespace** (host `$HOME`/secrets never shared), not the package set. So `git` being in the container is fine: - privileged/remote git (push, private fetch) → still **must** go through wraptool's MCP git tool (only the host has creds); - local non-privileged git (status/diff/commit/branch) → works in-box. ## Tradeoff accepted Dev `guix shell` is no longer "lean" (now pulls node + plumbing) — simplicity over leanness, and still trivially small next to a polyglot image. ## Verified (e2e on Guix) Container built from `manifest.scm` has go/git/node/golangci-lint/bash; reaches host wraptool; host `$HOME` **empty**, host repo **not visible**; local `git status` works. Full `go test ./...` + golangci-lint clean; YAML valid; manifest evaluates for dev and container. The publish-ci-image workflow is path-filtered on `manifest.scm`, so merging re-packs the CI image from the flat manifest automatically. ## Docs `design/guix-container-runtime.md` gets an **R2 revision banner** superseding the `container.scm` model (§6.2/§6.4 tagged R1); `CLAUDE.md` + `examples/devcontainer/README.md` updated. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

pti added 1 commit

2026-07-07 14:33:55 +02:00

refactor: single flat manifest.scm, drop container.scm + toggles

Lint / lint (pull_request) Successful in 32s

Details

ffb18871ff

Collapse the toolchain config to ONE flat manifest.scm (go, git, golangci-lint,
node, + a shell/coreutils/nss-certs plumbing var), used verbatim for dev, CI
lint, the CI image, and the wraptool-up guix container. Removes the second file
(.wraptool/container.scm) and both getenv toggles (WRAPTOOL_CI_IMAGE, and the
never-shipped WRAPTOOL_CONTAINER), restoring a single source of truth.

The guix container is now built from the project's own manifest.scm — the same
toolchain a developer uses — so the AI harness can compile/test/analyze/commit
locally, which the old harness-only container.scm could not. git is therefore
present in the container; credential isolation is unchanged because it is the
mount/user namespace (host $HOME/secrets never shared), not the package set:
privileged/remote git (push, private fetch) still routes through wraptool's MCP
git tool (only the host has creds), while local non-privileged git works in-box.

Drops --scaffold-guix and the container-manifest lookup/scaffold code + tests;
bringUpGuixContainer runs `guix shell --container -m manifest.scm`. Publish
workflow drops WRAPTOOL_CI_IMAGE=1 (flat manifest already carries the plumbing).
Design doc gets an R2 revision banner superseding the container.scm model; CLAUDE
and examples updated.

Verified end-to-end: container has go/git/node/golangci-lint, reaches host
wraptool, host $HOME empty / repo not visible, local git works. Full go test
./... + golangci-lint clean; manifest evaluates for dev and container.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

pti merged commit 266f3c0cc9 into main

2026-07-07 14:35:36 +02:00

pti deleted branch refactor-single-flat-manifest

2026-07-07 14:35:37 +02:00

pti referenced this pull request from a commit

2026-07-07 14:35:38 +02:00

Merge pull request 'refactor: single flat manifest.scm, drop container.scm + toggles' (#10) from refactor-single-flat-manifest into main