Compare every change with an unmodified node before keeping it

.dockerignore

@@ -8,6 +8,9 @@
 build
 build_*
 .vibes
+dist
+reports
+research_notes
 depends/work
 depends/built
 depends/sources

.github/PULL_REQUEST_TEMPLATE.md

@@ -11,17 +11,27 @@
 ### How you tested it
 
 <!-- Be specific and be honest. Both of these are good answers:
-     "Ran ./vibes --engine mock, issued a decree, diff rendered, node restarted."
+     "Ran ./vibes --engine mock, ran a ready-made experiment, comparison rendered."
      "Didn't run it — docs only." -->
 
 ### Checklist
 
 - [ ] I ran it, or I said above that I didn't
-- [ ] Console touched? `python3 -m py_compile contrib/vibes/bitcoin-vibes`
-- [ ] Installer touched? `sh -n contrib/vibes/install.sh`
+- [ ] `python3 -m unittest discover -s contrib/vibes/tests` passes
 - [ ] UI touched? Still readable at 375px and usable by keyboard
+- [ ] User-facing claims (README, manual, console text) match what the code does
 - [ ] **`src/` touched?** A fresh install still ships stock Bitcoin Core
-      consensus — 21M cap, 50 BTC subsidy, upstream rules untouched
+      consensus: `src/` differs from the upstream base in `clientversion.cpp` only
 
-<!-- That last one is the rule we are strict about. Your own node can become
+### Review
+
+This project asks its operators to read a change before they apply it. It holds
+itself to the same rule.
+
+- [ ] Someone other than the author has read the diff. If no person is
+      available, an independent AI review is attached as a comment; that is
+      advice for the author, not approval
+- [ ] CI is green on the exact commit being merged
+
+<!-- The src/ rule is the one we are strict about. Your own node can become
      anything you like; the default that strangers install cannot. -->

.github/workflows/docker.yml

@@ -0,0 +1,61 @@
+# Build the Docker image whenever something it is made from changes.
+#
+# The image compiles the node, so this is slow and runs only when it has to.
+# It builds and discards: nothing is pushed anywhere.
+name: Docker image
+
+on:
+  pull_request:
+    paths:
+      - contrib/vibes/Dockerfile
+      - contrib/vibes/docker-compose.yml
+      - contrib/vibes/docker-entrypoint.sh
+      - .dockerignore
+      - .github/workflows/docker.yml
+  push:
+    branches: [master]
+    paths:
+      - contrib/vibes/Dockerfile
+      - contrib/vibes/docker-compose.yml
+      - contrib/vibes/docker-entrypoint.sh
+      - .dockerignore
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docker-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  image:
+    name: Image builds and the console starts
+    runs-on: ubuntu-latest
+    timeout-minutes: 180
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - name: Compose file is valid
+        run: docker compose -f contrib/vibes/docker-compose.yml config --quiet
+
+      - name: Build the image
+        run: docker compose -f contrib/vibes/docker-compose.yml build
+
+      # Start it with the mock engine and no node, and ask the console whether
+      # it is alive. This exercises the entrypoint: first-start copy into the
+      # volume, the git history it creates, and running as an unprivileged user.
+      - name: The console starts as an unprivileged user and keeps its working copy
+        run: |
+          set -e
+          run() { docker compose -f contrib/vibes/docker-compose.yml run --rm -T --entrypoint sh vibes -c "$1"; }
+          test "$(run 'id -u')" != "0" || { echo "::error::the container runs as root"; exit 1; }
+          docker compose -f contrib/vibes/docker-compose.yml up -d
+          trap 'docker compose -f contrib/vibes/docker-compose.yml logs --tail 60; docker compose -f contrib/vibes/docker-compose.yml down' EXIT
+          for i in $(seq 1 60); do
+            curl -fsS http://127.0.0.1:21212/api/ping >/dev/null 2>&1 && break
+            sleep 2
+          done
+          curl -fsS http://127.0.0.1:21212/api/ping
+          run 'git -C "$HOME/work" log --oneline -1'
+          run 'test "$VIBES_SANDBOX" = container'