- Crate moves to container/triple-c-agent (inside the image build context);
the Dockerfile's agent-build stage cross-compiles it on $BUILDPLATFORM for
$TARGETARCH (verified: buildx arm64 and the classic builder with the app's
build args both produce static binaries). The app's local build context
embeds the crate's Cargo.toml, Cargo.lock and src/ only.
- entrypoint.sh starts the agent from an env/cwd snapshot taken before the
script exports or cd's anything (minus bash's own PWD/SHLVL/_), so execs
see what `docker exec` would.
- Agent: no TRIPLEC_AGENT_* setting reaches an exec; a token file others can
read is refused (security review); upload symlink handling documented as
deliberate parity (claude has passwordless sudo, so no boundary).
- New ignored live test host::agent::live_tests runs every operation through
ContainerTarget::Docker and ::Agent on the same real container and requires
identical results. It caught a real divergence, now fixed in agent and
spec: docker exec sets only HOME, never USER/LOGNAME.
- CI runs the agent crate's tests in the preview test job.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shadowdaoandClaude Opus 5.5
0f638c7c4e