test: daemon-starting suites refuse on a developer machine; make verify-full-container

[atlas-from-plumb]

Why

A developer machine should run exactly one plumb daemon: the one its sessions use. Two test suites start plumb daemons of their own:

• cmd/smoke (the integration tag, so part of make verify-full);
• cmd/clientsmoke (the clients, clients_e2e and clients_conformance tags).

Run on a developer machine, they put more daemons beside that one. A leak from a similar harness elsewhere left 64 of them running.

What

• internal/separateenv (foundation) answers one question: may this process start a daemon of its own? It accepts exactly three kinds of evidence:

  • GITHUB_ACTIONS=true, on any OS;
  • Linux with a readable /.dockerenv or /run/.containerenv;
  • Linux with PLUMB_SEPARATE_ENV=vm.

  No CI=true, no override, no case folding. An unreadable marker counts as absent. The test vectors are shared byte-for-byte with the Node copy of the rule in dsh-plumb-identity. This is a guard against accidental runs, not a security boundary.

• cmd/smoke gets a new TestMain, and cmd/clientsmoke's existing TestMain gets the guard first. Both refuse with exit 2 before building or starting anything. An inventory of every test package confirms these are the only two that start a real plumb daemon process; everything else is in-process.

• make verify-full-container (scripts/verify-full-container.sh plus build/docker/verify.Dockerfile) runs make verify-full in a Linux container with pinned Go, golangci-lint, gopls, pyright and the npm language servers.

  • It streams in the working tree as git sees it, then makes a one-commit snapshot so the checks that call git work.
  • It runs with --init --rm.
  • It counts plumb daemon processes by exact argv every 200 ms during the suite, with at most one allowed, and watches for 30 s after the suite, when none may be left.
  • It fails closed if the process table can't be read, and treats the container as gone only when the engine says so.

• Docs: AGENTS.md, CONTRIBUTING.md, docs/contributing.md, the make verify success message, the pre-commit hook text and the PR template all point at make verify-full-container. make docker-integration gains --init. There is a CHANGELOG entry.

CI is unaffected: hosted runners set GITHUB_ACTIONS=true.

Verification

• go test ./internal/separateenv/: 18 shared vectors, real-filesystem marker checks, and a child re-exec that must exit 2.
• On the host, go test -tags=integration ./cmd/smoke/ and -tags=clients ./cmd/clientsmoke/ both print the refusal and exit before building anything. The host daemon count is unchanged.
• The census and the "gone" check were tested in a container against fakes and a real engine.
• Full make verify-full-container: see the follow-up comment.

Part of PLAN-526 (plumb-ops). Reviewed with a peer agent.

🤖 Generated with Claude Code

[golimpio]

Approved under the owner's delegation. Bar met at 56a80d5: independent agent review PASS (should-fixes folded), peer review by serene-antelope, all 10 CI checks green on this exact head, make verify-full-container green on this exact head (uncached; cmd/smoke ran 121 s; at most one plumb daemon; none left; container gone), outer-wrapper SIGTERM control PASS, mutation-tested guard wiring and census.