acceptance:container scenario pins the one-line self-host: fresh host, …

[warren-forge-bnnl24]

Summary

seeds: sync 2026-08-17

Run

• Warren run: run_09e0axf41qm2
• Agent: pi
• Cost: $1.78 (89.9k in / 23.6k out / 3.9M cache-r)

Seeds

• warren-1a5a — acceptance:container scenario pins the one-line self-host: fresh host, one docker run, two secrets, no security flags, dispatch succeeds; quickstart README rewrite

Commits (3)

• 64f19cc seeds: sync 2026-08-17
• 55a2e71 mulch: update expertise
• 1ee3046 acceptance: pin the one-line self-host claim end to end (warren-1a5a)

Files changed

.github/workflows/acceptance.yml                   |   9 +-
 README.md                                          |  29 ++-
 package.json                                       |   2 +-
 scripts/acceptance/lib/self-host-docker.ts         | 106 ++++++++
 scripts/acceptance/run.ts                          |   2 +
 .../acceptance/scenarios/42-self-host-one-liner.ts | 281 +++++++++++++++++++++
 6 files changed, 413 insertions(+), 16 deletions(-)

Prompt

Show prompt

Work seeds issue warren-1a5a. First run `sd show warren-1a5a --json` from the repo root — the issue body is the spec; this summary is only a digest.

CONTEXT: Plan pl-3007, phase-4 exit pin — the campaign's headline deliverable. Already MERGED on main: first-boot WARREN_API_TOKEN minting (warren-ef6e), supervisor burrow-token removal (warren-8071 then warren-9a26 removed the channel entirely), the full burrow excision (warren-ea0a), and the DockerProvider (warren-3732, WARREN_RUNTIME=docker — container boundary as sandbox, no security flags needed). The local-topology nightly scenario 41 (warren-0f18) and its stub-agent PATH-shim lib are the closest prior art — follow its patterns.

SCOPE DIGEST: New acceptance:container scenario that falsifies the headline claim end-to-end: fresh host, ONE docker run with exactly two secrets (ANTHROPIC_API_KEY, GITHUB_TOKEN), NO security_opt flags, NO cap_add, NO burrow tokens → boot, first-boot token mint observed in the logs, project add, dispatch, run reaches terminal success, branch pushed. Deterministic, idempotent, cleans up after itself (acceptance harness rules; use the stub-agent patterns so no real provider spend). Wire into the NIGHTLY acceptance workflow — PR CI stays fast. Then rewrite the README quickstart so the one-line docker run is the PRIMARY install path.
FILE SET: scripts/acceptance/scenarios/<new>.ts (+ additive helpers under scripts/acceptance/lib/), .github/workflows nightly acceptance wiring, package.json scripts entry if needed (acceptance:container exists — verify it points at your scenario), README.md quickstart. Do NOT touch scenarios 04/05/07/09/10/11 (another agent owns them), scenario 39, src/runtime/k8s/, src/registry/builtins/, schema files, .warren/triggers.yaml, docs/CONSTITUTION.md. README prose must pass check:prose (no semicolons, active voice, sentences ≤25 words).
Conventions: kebab-case filenames, strict TS (no any, handle noUncheckedIndexedAccess), verb-led test names without "should". New files ≤500 lines (check:size).

QUALITY GATES ARE TERMINAL: `bun run check:all` must be fully green before you commit and report done.

WHEN DONE: Close the issue with `sd close warren-1a5a --reason "<one-line evidence>"`, then commit everything (code + .seeds changes).

---

🤖 Opened by warren run run_09e0axf41qm2