R-861 (a) A1 + (b) B2: the image ref goes to a root verb that checks it; the agent's in-guest tee grant is gone; felhom-op's pct lines are exact (09 §3 decision 165)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/localapi/controllerswap_test.go

@@ -23,7 +23,7 @@ type fakeGuestExec struct {
 	present       map[string]bool // images pulled into the guest
 	good          map[string]bool // images that report healthy when running
 	containerImg  string          // image the running container currently has
-	teeStdin      []string        // raw bytes piped into each `tee` write (the swap's write vector)
+	teeStdin      []string        // image refs handed to WriteControllerImage (the root verb, R-861 (a) A1)
 	failRestart   bool
 	noHealthBlock bool // if set, .State.Health is absent ("none")
 	restartCount  int  // F1: .RestartCount reported by docker inspect (a crash-looper has >0)
@@ -75,20 +75,15 @@ func (f *fakeGuestExec) GuestExec(_ context.Context, _ int, args ...string) (str
 	return "", fmt.Errorf("fake: unexpected exec %v", args)
 }
 
-// GuestExecStdin models the swap's write vector: `tee /etc/felhom-controller-image` with the image
-// piped on stdin. It records the raw stdin bytes and sets the modeled file content (newline-stripped,
-// as the bootstrap's `IMAGE=$(cat …)` read would see it).
-func (f *fakeGuestExec) GuestExecStdin(_ context.Context, _ int, stdin io.Reader, args ...string) (string, error) {
+// WriteControllerImage models the swap's write: the root verb `felhom-priv-apply controller-image <vmid>` (R-861
+// (a) A1). It records the ref and sets the modeled file content, as the bootstrap's `IMAGE=$(cat …)` would read it.
+func (f *fakeGuestExec) WriteControllerImage(_ context.Context, _ int, image string) error {
 	f.mu.Lock()
 	defer f.mu.Unlock()
-	f.calls = append(f.calls, args)
-	b, _ := io.ReadAll(stdin)
-	if len(args) >= 2 && args[0] == "tee" && args[1] == controllerImageFile {
-		f.teeStdin = append(f.teeStdin, string(b))
-		f.imageFile = strings.TrimSpace(string(b))
-		return string(b), nil // tee echoes stdin to stdout
-	}
-	return "", fmt.Errorf("fake: unexpected exec-stdin args=%v stdin=%q", args, string(b))
+	f.calls = append(f.calls, []string{"felhom-priv-apply", "controller-image", image})
+	f.teeStdin = append(f.teeStdin, image+"\n")
+	f.imageFile = image
+	return nil
 }
 
 // wrote reports whether the image was written via the stdin `tee` vector with the exact `image\n`
@@ -162,7 +157,7 @@ func TestControllerSwap_Happy(t *testing.T) {
 
 // The write vector must be the stdin `tee` with byte-identical `image\n` and NO shell — the
 // controllerswap.go writeImage rewrite. This would FAIL on the pre-change `bash -c "printf … >"` impl.
-func TestControllerSwap_WriteViaStdinTee_NoShell(t *testing.T) {
+func TestControllerSwap_WriteViaRootVerb_NoShell(t *testing.T) {
 	fe := &fakeGuestExec{
 		imageFile: prevImg,
 		present:   map[string]bool{newImg: true},
@@ -173,22 +168,15 @@ func TestControllerSwap_WriteViaStdinTee_NoShell(t *testing.T) {
 		t.Fatalf("state = %q, want done", st.State)
 	}
 	if !fe.wrote(newImg) {
-		t.Errorf("expected a tee write of %q+\\n; teeStdin=%q", newImg, fe.teeStdin)
+		t.Errorf("expected the root verb to write %q; writes=%q", newImg, fe.teeStdin)
 	}
-	sawTee := false
 	for _, c := range fe.calls {
-		if len(c) >= 2 && c[0] == "tee" {
-			sawTee = true
-			if c[1] != controllerImageFile {
-				t.Errorf("tee target = %q, want fixed %q", c[1], controllerImageFile)
-			}
+		if len(c) >= 1 && c[0] == "tee" {
+			t.Errorf("the swap still uses an in-guest tee (R-861 (a) A1 removed that grant): %v", c)
 		}
 	}
-	if !sawTee {
-		t.Error("no tee call recorded — writeImage did not use the stdin tee vector")
-	}
 	if fe.usedShell() {
-		t.Errorf("swap used a shell vector (bash/-c/printf) — must be stdin tee only; calls=%v", fe.calls)
+		t.Errorf("swap used a shell vector (bash/-c/printf); calls=%v", fe.calls)
 	}
 }
 
@@ -300,9 +288,7 @@ func (s *inspectScript) GuestExec(_ context.Context, _ int, args ...string) (str
 	}
 	return "", nil
 }
-func (s *inspectScript) GuestExecStdin(_ context.Context, _ int, _ io.Reader, _ ...string) (string, error) {
-	return "", nil
-}
+func (s *inspectScript) WriteControllerImage(context.Context, int, string) error { return nil }
 
 func fastSwapper(exec GuestExecutor) *ControllerSwapper {
 	s := NewControllerSwapper(exec, "", discardLogger())