feat(heimdall): user-drawn pipelines on a canvas, run by the Heimdall engine

config/docker/test-sandbox/Dockerfile

@@ -14,7 +14,6 @@ RUN apt-get update \
     ca-certificates \
     curl \
     dbus-x11 \
-    git \
     gnupg \
     jq \
     libasound2t64 \
@@ -30,6 +29,7 @@ RUN apt-get update \
     libxkbcommon0 \
     libxrandr2 \
     libxss1 \
+    lsof \
     openssh-client \
     procps \
     python3 \
@@ -47,6 +47,19 @@ RUN add-apt-repository -y ppa:fish-shell/release-4 \
   && apt-get install -y --no-install-recommends fish \
   && rm -rf /var/lib/apt/lists/*
 
+# The sandbox's reftable fixtures need Git 2.45+; Noble's archive Git is too old.
+RUN add-apt-repository -y ppa:git-core/ppa \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends git \
+  && rm -rf /var/lib/apt/lists/*
+
+# Fail the image build unless the installed Git actually creates reftable repositories.
+RUN set -eux; \
+  fixture="$(mktemp -d)"; \
+  trap 'rm -rf "$fixture"' EXIT; \
+  git init --bare --ref-format=reftable "$fixture/repo"; \
+  test "$(git -C "$fixture/repo" config --local --get extensions.refStorage)" = reftable
+
 # The git-compatibility matrix and the ssh-docker e2e lanes shell out to docker themselves.
 RUN install -m 0755 -d /etc/apt/keyrings \
   && curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc \

config/docker/test-sandbox/README.md

@@ -21,7 +21,10 @@ and untracked — a fresh clone has to set it before the runner reaches anything
 ## Running
 
 ```sh
-# full unit suite, 16 shards, 8 containers at a time
+# Recommended full unit suite: 16 shards, 2 containers at a time, 2 Vitest workers per container
+pnpm test:sandbox --shards=16 --jobs=2 -- --maxWorkers=2
+
+# Higher container concurrency is available when the host has capacity
 pnpm test:sandbox --shards=16 --jobs=8
 
 # one shard, reusing the already-built image
@@ -30,13 +33,35 @@ pnpm test:sandbox --shards=16 --only=3
 # the real-shell lane CI keeps out of the shards
 pnpm test:sandbox --lane=shell
 
+# Cross-version wire specs against a locally available baseline (one container)
+ORCA_BACKGROUND_LAUNCH=1 pnpm test:sandbox --lane=wire \
+  --baseline-ref=v1.4.216-rc.0.zy03 \
+  --env ORCA_BACKGROUND_LAUNCH=1 -- \
+  tests/e2e/cross-version-wire/fork-heimdall/cross-version-heimdall-wire.unit.test.ts
+
 # Playwright/Electron lane (needs the host Docker socket for the ssh-docker specs)
 pnpm test:sandbox --lane=e2e --shards=4 --docker-socket
 
 # extra vitest arguments pass through after --
 pnpm test:sandbox --shards=16 --only=1 -- --reporter=verbose
 ```
 
+The test image needs Git 2.45 or newer with reftable support because
+`workflow-ref-reachability.test.mjs` unconditionally runs `git init --ref-format=reftable`.
+The image installs Git from the Git Core PPA and verifies reftable support during the image
+build; it fails rather than silently falling back if that feature is unavailable. This sandbox
+image requirement does not change the product Git baseline.
+
+Shard containers use Docker `--init` so orphaned descendants are reaped before process-exit
+assertions. The image also includes `lsof` for real SSH relay socket-holder enumeration.
+
+`--jobs` controls the number of concurrent containers. Vitest worker concurrency is separate;
+the recommended full run passes `--maxWorkers=2` to each container after `--`.
+
+The `wire` lane runs the supplied Vitest files without the unit lane's exclusions and requires
+`--baseline-ref` to name an explicit local branch or tag. Only that ref is transferred in a
+depth-1 bare repository; the source checkout's `.git` directory and credentials are not sent.
+
 Running vitest directly is blocked by a `PreToolUse` hook — see the testing section in
 [`AGENTS.md`](../../../AGENTS.md).
 

config/docker/test-sandbox/entrypoint.sh

@@ -22,11 +22,46 @@ rm -f config/*.tsbuildinfo
 
 # The source arrives as a plain tar, but suites that shell out to git need a real
 # repository. Tree hashes are content-derived, so one synthetic commit satisfies them.
-if [ "${ORCA_SANDBOX_SKIP_GIT:-0}" != "1" ] && [ ! -d .git ]; then
-  git init -q .
-  git add -A
-  git -c user.name=runner -c user.email=runner@sandbox.invalid \
-    commit -q -m 'sandbox snapshot' --no-verify
+baseline_repository=.orca-sandbox/baseline.git
+baseline_ref=refs/orca/cross-version-baseline
+baseline_required="${ORCA_SANDBOX_REQUIRE_BASELINE:-0}"
+
+if [ "$baseline_required" = "1" ] && [ "${ORCA_SANDBOX_SKIP_GIT:-0}" = "1" ]; then
+  echo "orca-test-sandbox: wire lane requires Git support" >&2
+  exit 2
+fi
+if [ "$baseline_required" = "1" ] && [ ! -d "$baseline_repository" ]; then
+  echo "orca-test-sandbox: required baseline repository is missing from the source tar" >&2
+  exit 2
+fi
+
+if [ "${ORCA_SANDBOX_SKIP_GIT:-0}" != "1" ]; then
+  created_git=0
+  if [ ! -d .git ]; then
+    git init -q .
+    created_git=1
+  fi
+
+  if [ -d "$baseline_repository" ]; then
+    if ! git fetch --quiet --no-tags --update-shallow --depth=1 \
+      "$baseline_repository" "$baseline_ref:$baseline_ref"; then
+      echo "orca-test-sandbox: could not fetch required baseline ref $baseline_ref" >&2
+      exit 2
+    fi
+    if ! baseline_commit="$(git rev-parse --verify "${baseline_ref}^{commit}")"; then
+      echo "orca-test-sandbox: fetched baseline ref $baseline_ref is not a commit" >&2
+      exit 2
+    fi
+    echo "orca-test-sandbox: baseline ref $baseline_ref resolved to $baseline_commit"
+    rm -rf "$baseline_repository"
+    export ORCA_CROSS_VERSION_BASELINE_REF="$baseline_ref"
+  fi
+
+  if [ "$created_git" = "1" ]; then
+    git add -A
+    git -c user.name=runner -c user.email=runner@sandbox.invalid \
+      commit -q -m 'sandbox snapshot' --no-verify
+  fi
 fi
 
 baked="$(cat /home/runner/lockfile.sha256)"