feat(runner): microVM boot canary startup preflight (RIG-3148) - #847

`BootCanary`'s documented contract is that the always-run Remove teardown's error is joined into its return, never discarded — it gates Runner startup, so a silently-swallowed teardown failure would report a canary that leaked a live VMM+virtiofsd as a clean boot, inverting the fail-closed posture on the exact path the gate protects. The `#847` review loop found that contract had zero regression coverage: swallowing both `errors.Join` blocks in `microvm_preflight.go` left the entire hermetic suite green. The named-return + `errors.Join` idiom is precisely what a "tidy the error path" refactor flattens to a plain `defer m.Remove(...)`, and error-swallow discipline is CI-enforced repo law, so the join needs a test that keeps it correct.

`TestBootCanaryTeardownErrorJoined` drives an otherwise-successful canary (boot + echo + nonce all pass) with a guest whose `Shutdown` fails, and asserts `BootCanary` returns a non-nil error carrying the teardown failure while the report is still assembled from what ran before teardown. A `shutdownErr` field on `canaryFakeVM` (threaded through `canaryLaunchRecorder`, mirroring the existing `pssErr` knob) is returned from `Shutdown`, so `Remove`'s own `errors.Join` surfaces it into the named return.

Test-only; `microvm_preflight.go` is unchanged (the production code was already correct). Mutation-verified: gating off the teardown join reddens only this test and leaves the other ten green; restored to green.

Stacked on `#847` (RIG-3148) because it exercises the `BootCanary` teardown code that PR introduces.

Spec-impact: none. Refs RIG-3219
Co-authored-by: Matt Wilkinson <matt@rigel.build>

…gate (RIG-3200)

Round-2 review of the bundle re-scope found the round-1 fix left two findings
partially open plus a widenable low; this closes all three additively.

- ci-matrix darwinAffected (HIGH): the darwin gate body compiled the three
  pure-Go sidecars but its affected-trigger still keyed only on
  go/cmd/compass-app/, the GTK closure, and tools/macos-bundle/ — so a change
  to a sidecar source or the shared go/internal/ tree they import never ran
  the lane, and the release cut was its first execution (proven by #847's
  darwin cross-compile break). Widen the predicate with DARWIN_SIDECAR_PREFIXES
  (the three sidecar cmd dirs + the go/internal/ superset, deliberately broad
  over a drift-prone transitive set), mirror the same paths into the ci.yml
  in-step git-diff list, and add two trigger unit tests.

- macos-bundle collision guard (MEDIUM): assertSidecarBasenamesDistinct keyed
  on basename(--binary), but the shell always stages at the hardcoded literal
  compass-app, so a sidecar named compass-app silently clobbered the shell when
  --binary had a different basename (false negative) and a matching non-shell
  basename wrongly threw (false positive). Introduce SHELL_EXECUTABLE_NAME, key
  the guard on it, thread it through staging + Info.plist so the three uses
  cannot drift, and add two collision regression tests.

- darwin bundle sanity (LOW): the mount gate asserted mere presence for all six
  entries while build.sh's sanity loop asserts executable + `--version` exit 0 +
  version-stamp substring. Split into a BINARIES list (four Contents/MacOS/*
  entries, -x + --version + $dev substring) and a FILES list (Info.plist +
  index.html, -f), preserving rc accumulation and hdiutil detach.

Deferred (non-blocking, routed to Matt at the review gate): the SSOT sidecar
manifest and the permissive empty-sidecars grammar are structural judgment
calls, not correctness gaps.

Refs RIG-3200
Co-authored-by: Matt Wilkinson <matt@rigel.build>

…200)

Close round-3 review of the darwin sidecar gate. The round-2 widening
covered the three sidecar cmd dirs plus go/internal/, but two of the
three bundled sidecars (compass-stack, compass-server) also compile in
go/server, go/events, and go/gen on non-test paths — and go/server is
//go:build unix with a divergent syscall surface (syscall.Umask,
ECONNREFUSED, Stat_t). A PR touching only those roots left darwinAffected
false, re-opening the #847 cross-compile-break class for the sidecars.

`go list -deps ./cmd/<sidecar>` resolves the bundled binaries' non-cmd
first-party roots to exactly {events, gen, internal, server} (go/e2e is
tests-only). Enumerate those package roots in DARWIN_SIDECAR_PREFIXES and
mirror them into the ci.yml in-step pathspec, keeping the two lists in
lockstep. Add a go/server trigger unit test (mutation-verified red-green).

Also fold three review nits: restore the parseArgs docstring clauses the
round-2 edit dropped (duplicate-flag + missing-required-flag throw paths),
refresh the two stale darwin-lane trigger comments (step + job level), and
add the missing blank line between the appended ci-matrix trigger tests.

Spec-impact: none
Ledger-impact: none
Refs RIG-3200
Co-authored-by: Matt Wilkinson <matt@rigel.build>

…er (RIG-3200)

Round-4 review fold on PR #863. Closes the surviving medium and 3 lows
from ReviewT4r4; NEW-1/LOW-2/LOW-4 already closed in round 3.

- MEDIUM: the round-3 job-level darwin comment repair left a third clause
  dropped, leaving an ungrammatical sentence (regression vs the prior head).
  Re-insert "gate guard with the darwin affected gate: on a PR it runs only
  when setup" so the sentence is whole. Comment-only.
- LOW: two of the three widened DARWIN_SIDECAR_PREFIXES entries (go/events,
  go/gen) survived deletion mutation silently. Add a trigger test per root
  (mutation-verified: dropping either now fails exactly its test) so a future
  edit that drops them from the const cannot pass green.
- LOW: the sibling MACOS_BUNDLE_PATH_PREFIX docstring still described only the
  pre-widening go/internal surface, disagreeing with the const below it. Reword
  to defer to DARWIN_SIDECAR_PREFIXES — one source of truth.
- LOW: go/go.mod + go/go.sum did not fire the darwin lane, yet a dependency
  bump or replace directive is a compile input to all four bundled binaries
  that can break the darwin cross-compile the same #847 way. Add both to the
  const and mirror into the ci.yml pathspec (lockstep invariant held).

Gates: bun test ci-matrix+macos-bundle 60 pass/0 fail; biome 0 errors
(2 known pre-existing complexity warnings); bash -n darwin run block clean.

Refs RIG-3200
Co-authored-by: Matt Wilkinson <matt@rigel.build>

…gate (RIG-3200)

Round-2 review of the bundle re-scope found the round-1 fix left two findings
partially open plus a widenable low; this closes all three additively.

- ci-matrix darwinAffected (HIGH): the darwin gate body compiled the three
  pure-Go sidecars but its affected-trigger still keyed only on
  go/cmd/compass-app/, the GTK closure, and tools/macos-bundle/ — so a change
  to a sidecar source or the shared go/internal/ tree they import never ran
  the lane, and the release cut was its first execution (proven by #847's
  darwin cross-compile break). Widen the predicate with DARWIN_SIDECAR_PREFIXES
  (the three sidecar cmd dirs + the go/internal/ superset, deliberately broad
  over a drift-prone transitive set), mirror the same paths into the ci.yml
  in-step git-diff list, and add two trigger unit tests.

- macos-bundle collision guard (MEDIUM): assertSidecarBasenamesDistinct keyed
  on basename(--binary), but the shell always stages at the hardcoded literal
  compass-app, so a sidecar named compass-app silently clobbered the shell when
  --binary had a different basename (false negative) and a matching non-shell
  basename wrongly threw (false positive). Introduce SHELL_EXECUTABLE_NAME, key
  the guard on it, thread it through staging + Info.plist so the three uses
  cannot drift, and add two collision regression tests.

- darwin bundle sanity (LOW): the mount gate asserted mere presence for all six
  entries while build.sh's sanity loop asserts executable + `--version` exit 0 +
  version-stamp substring. Split into a BINARIES list (four Contents/MacOS/*
  entries, -x + --version + $dev substring) and a FILES list (Info.plist +
  index.html, -f), preserving rc accumulation and hdiutil detach.

Deferred (non-blocking, routed to Matt at the review gate): the SSOT sidecar
manifest and the permissive empty-sidecars grammar are structural judgment
calls, not correctness gaps.

Refs RIG-3200
Co-authored-by: Matt Wilkinson <matt@rigel.build>

…200)

Close round-3 review of the darwin sidecar gate. The round-2 widening
covered the three sidecar cmd dirs plus go/internal/, but two of the
three bundled sidecars (compass-stack, compass-server) also compile in
go/server, go/events, and go/gen on non-test paths — and go/server is
//go:build unix with a divergent syscall surface (syscall.Umask,
ECONNREFUSED, Stat_t). A PR touching only those roots left darwinAffected
false, re-opening the #847 cross-compile-break class for the sidecars.

`go list -deps ./cmd/<sidecar>` resolves the bundled binaries' non-cmd
first-party roots to exactly {events, gen, internal, server} (go/e2e is
tests-only). Enumerate those package roots in DARWIN_SIDECAR_PREFIXES and
mirror them into the ci.yml in-step pathspec, keeping the two lists in
lockstep. Add a go/server trigger unit test (mutation-verified red-green).

Also fold three review nits: restore the parseArgs docstring clauses the
round-2 edit dropped (duplicate-flag + missing-required-flag throw paths),
refresh the two stale darwin-lane trigger comments (step + job level), and
add the missing blank line between the appended ci-matrix trigger tests.

Spec-impact: none
Ledger-impact: none
Refs RIG-3200
Co-authored-by: Matt Wilkinson <matt@rigel.build>

…er (RIG-3200)

Round-4 review fold on PR #863. Closes the surviving medium and 3 lows
from ReviewT4r4; NEW-1/LOW-2/LOW-4 already closed in round 3.

- MEDIUM: the round-3 job-level darwin comment repair left a third clause
  dropped, leaving an ungrammatical sentence (regression vs the prior head).
  Re-insert "gate guard with the darwin affected gate: on a PR it runs only
  when setup" so the sentence is whole. Comment-only.
- LOW: two of the three widened DARWIN_SIDECAR_PREFIXES entries (go/events,
  go/gen) survived deletion mutation silently. Add a trigger test per root
  (mutation-verified: dropping either now fails exactly its test) so a future
  edit that drops them from the const cannot pass green.
- LOW: the sibling MACOS_BUNDLE_PATH_PREFIX docstring still described only the
  pre-widening go/internal surface, disagreeing with the const below it. Reword
  to defer to DARWIN_SIDECAR_PREFIXES — one source of truth.
- LOW: go/go.mod + go/go.sum did not fire the darwin lane, yet a dependency
  bump or replace directive is a compile input to all four bundled binaries
  that can break the darwin cross-compile the same #847 way. Add both to the
  const and mirror into the ci.yml pathspec (lockstep invariant held).

Gates: bun test ci-matrix+macos-bundle 60 pass/0 fail; biome 0 errors
(2 known pre-existing complexity warnings); bash -n darwin run block clean.

Refs RIG-3200
Co-authored-by: Matt Wilkinson <matt@rigel.build>

…IG-3200) (#863)

* feat(app-bundle): re-scope the bundle to carry embedded's sidecars (RIG-3200)

Re-adds the three embedded sidecars — `compass-stack`, `compass-server`, `compass-runner` — to both bundle targets, reversing the client-only strip (DL-238 → DL-321). No postgres tooling and no `compass-postgres` sidecar: embedded's postgres is the DL-260 stock `postgres:18` container via rootless podman, so rootless podman (plus podman machine on macOS) is the packaged embedded mode's sole container prerequisite.

`app-bundle/build.sh` (Linux tarball) builds the three sidecars into `bin/` as pure-Go daemons — without the gtk4 tag and the CC/pkg-config closure the shell needs — each stamped with the same one version ldflag, and the sanity loop widens to assert all four binaries carry that version. The gtk4 shell build is unchanged.

`tools/macos-bundle/index.ts` (macOS .app) gains a repeatable `--sidecar <path>` flag: each staged into `Contents/MacOS/` beside the shell, where `resolveStackBin`'s sibling probe finds it and `prependExecDirToPath` threads it onto the supervised stack's PATH. `--sidecar` is optional (zero → a shell-only `.app`) — which binaries a release carries is the release lane's call, not an arg-grammar constant; `release.yml` passes exactly the three. Completeness stays enforced where it belongs: every path is `assertExists`-checked before staging, and the Linux sanity gate asserts all four by name. Parsing stays pure, staging stays in the `import.meta.main` edge; `--sidecar` is exempt from the duplicate-flag check (it accumulates) but a missing value or a following known-flag still fails loud.

`.github/workflows/release.yml`'s `release-assets-macos` job builds the three darwin sidecars (`CGO_ENABLED=0`, same version stamp) and passes them via three `--sidecar` flags. `compass-stack`/`compass-runner` transitively import `internal/runtime/microvm`; its darwin compile is guarded by the merged RIG-3213 orphan-guard split, so these builds compile on the macos-14 lane.

`app-bundle/moon.yml` is comment-only — the `build` task's `/go/**` input already covers the sidecar sources, so a sidecar-source change already reschedules the bundle under per-PR affected detection; no redundant belt added.

Stacks on the T-1/T-2 revival (#844), which carries `resolveStackBin`/`prependExecDirToPath`; the macos-bundle tool it extends landed in #784.

Spec-impact: none. Refs RIG-1662, RIG-3139, RIG-3200.
Co-authored-by: Matt Wilkinson <matt@rigel.build>

* fix(app-bundle): pure-Go sidecars + collision guards + darwin gate (RIG-3200)

Fold the six ReviewT4 findings on PR #863 (T-4 bundle re-scope).

HIGH: the build.sh sidecar loop omitted CGO_ENABLED=0, so on a host with
gcc on PATH (the ubuntu-latest release runner) the three Linux sidecars
built cgo-linked against unpinned system glibc — contradicting the diff's
own pure-Go comment and the §A4/DL-321 contract, and defeating the
tarball's relocatability posture. Add the explicit prefix, matching
release.yml and the pre-retirement form.

MEDIUM: macos-bundle staged each sidecar into Contents/MacOS/<basename>
via cp, which silently overwrites — a sidecar basename colliding with the
shell (or another sidecar) would clobber it with every downstream gate
still green. Add a pure-core guard (assertSidecarBasenamesDistinct) that
fails loud on a shell-collision or a duplicate sidecar basename, derived
from the resolved --binary rather than a hardcoded name; unit-tested.

MEDIUM: no pre-merge CI gate compiled the darwin sidecars, so the release
cut was their first execution. Extend the existing affected-triggered
darwin gate to build (CGO_ENABLED=0), stage (--sidecar x3), and assert
(three Contents/MacOS paths) the same four binaries build.sh ships,
closing the four-surface invariant on the gate side.

LOW: retitle the release.yml Linux bundle step off the stale "client
bundle" phrasing the diff's own de-thin-clienting sweep missed; repurpose
a near-tautological parseArgs test into the real gap (the duplicate check
still fires for single-valued flags) plus two collision-guard tests.

Gates: bun test tools/macos-bundle 25 pass/0 fail; tsc --noEmit clean;
biome clean; bash -n build.sh clean.

Refs RIG-3200
Co-authored-by: Matt Wilkinson <matt@rigel.build>

* fix(app-bundle): close round-2 review findings on the darwin sidecar gate (RIG-3200)

Round-2 review of the bundle re-scope found the round-1 fix left two findings
partially open plus a widenable low; this closes all three additively.

- ci-matrix darwinAffected (HIGH): the darwin gate body compiled the three
  pure-Go sidecars but its affected-trigger still keyed only on
  go/cmd/compass-app/, the GTK closure, and tools/macos-bundle/ — so a change
  to a sidecar source or the shared go/internal/ tree they import never ran
  the lane, and the release cut was its first execution (proven by #847's
  darwin cross-compile break). Widen the predicate with DARWIN_SIDECAR_PREFIXES
  (the three sidecar cmd dirs + the go/internal/ superset, deliberately broad
  over a drift-prone transitive set), mirror the same paths into the ci.yml
  in-step git-diff list, and add two trigger unit tests.

- macos-bundle collision guard (MEDIUM): assertSidecarBasenamesDistinct keyed
  on basename(--binary), but the shell always stages at the hardcoded literal
  compass-app, so a sidecar named compass-app silently clobbered the shell when
  --binary had a different basename (false negative) and a matching non-shell
  basename wrongly threw (false positive). Introduce SHELL_EXECUTABLE_NAME, key
  the guard on it, thread it through staging + Info.plist so the three uses
  cannot drift, and add two collision regression tests.

- darwin bundle sanity (LOW): the mount gate asserted mere presence for all six
  entries while build.sh's sanity loop asserts executable + `--version` exit 0 +
  version-stamp substring. Split into a BINARIES list (four Contents/MacOS/*
  entries, -x + --version + $dev substring) and a FILES list (Info.plist +
  index.html, -f), preserving rc accumulation and hdiutil detach.

Deferred (non-blocking, routed to Matt at the review gate): the SSOT sidecar
manifest and the permissive empty-sidecars grammar are structural judgment
calls, not correctness gaps.

Refs RIG-3200
Co-authored-by: Matt Wilkinson <matt@rigel.build>

* fix(ci): widen darwin sidecar trigger to all first-party roots (RIG-3200)

Close round-3 review of the darwin sidecar gate. The round-2 widening
covered the three sidecar cmd dirs plus go/internal/, but two of the
three bundled sidecars (compass-stack, compass-server) also compile in
go/server, go/events, and go/gen on non-test paths — and go/server is
//go:build unix with a divergent syscall surface (syscall.Umask,
ECONNREFUSED, Stat_t). A PR touching only those roots left darwinAffected
false, re-opening the #847 cross-compile-break class for the sidecars.

`go list -deps ./cmd/<sidecar>` resolves the bundled binaries' non-cmd
first-party roots to exactly {events, gen, internal, server} (go/e2e is
tests-only). Enumerate those package roots in DARWIN_SIDECAR_PREFIXES and
mirror them into the ci.yml in-step pathspec, keeping the two lists in
lockstep. Add a go/server trigger unit test (mutation-verified red-green).

Also fold three review nits: restore the parseArgs docstring clauses the
round-2 edit dropped (duplicate-flag + missing-required-flag throw paths),
refresh the two stale darwin-lane trigger comments (step + job level), and
add the missing blank line between the appended ci-matrix trigger tests.

Spec-impact: none
Ledger-impact: none
Refs RIG-3200
Co-authored-by: Matt Wilkinson <matt@rigel.build>

* fix(ci): restore darwin comment clause + defend widened sidecar trigger (RIG-3200)

Round-4 review fold on PR #863. Closes the surviving medium and 3 lows
from ReviewT4r4; NEW-1/LOW-2/LOW-4 already closed in round 3.

- MEDIUM: the round-3 job-level darwin comment repair left a third clause
  dropped, leaving an ungrammatical sentence (regression vs the prior head).
  Re-insert "gate guard with the darwin affected gate: on a PR it runs only
  when setup" so the sentence is whole. Comment-only.
- LOW: two of the three widened DARWIN_SIDECAR_PREFIXES entries (go/events,
  go/gen) survived deletion mutation silently. Add a trigger test per root
  (mutation-verified: dropping either now fails exactly its test) so a future
  edit that drops them from the const cannot pass green.
- LOW: the sibling MACOS_BUNDLE_PATH_PREFIX docstring still described only the
  pre-widening go/internal surface, disagreeing with the const below it. Reword
  to defer to DARWIN_SIDECAR_PREFIXES — one source of truth.
- LOW: go/go.mod + go/go.sum did not fire the darwin lane, yet a dependency
  bump or replace directive is a compile input to all four bundled binaries
  that can break the darwin cross-compile the same #847 way. Add both to the
  const and mirror into the ci.yml pathspec (lockstep invariant held).

Gates: bun test ci-matrix+macos-bundle 60 pass/0 fail; biome 0 errors
(2 known pre-existing complexity warnings); bash -n darwin run block clean.

Refs RIG-3200
Co-authored-by: Matt Wilkinson <matt@rigel.build>

---------

Co-authored-by: Matt Wilkinson <matt@rigel.build>