agent v0.86.0: DR-tier-by-default — capability inactive state (GatedBy/GateActive, pbsdr gate via DRConfigured) + F-3 root-run provision parent ownership

Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN

internal/provision/backhalf_test.go

@@ -157,6 +157,45 @@ func TestProvision_WritesChownsAndAttaches(t *testing.T) {
 
 // F3: the provisioned customer guest must be set onboot:1 so it auto-starts after a host
 // reboot/power-cut (the golden bakes onboot:0 as a template). Assert the exact pct invocation.
+// F-3 (DRILL-day0-vm-2026-07-12): a ROOT-run provision must chown the guests/ + guests/<vmid>/
+// PARENT dirs to the state-dir's owner (chown --reference, NON-recursive — the bootstrap leaf
+// stays the mapped guest-root's). A non-root run must NOT issue it (the dirs are already
+// agent-created). Companion red-proof: remove the geteuid()==0 chown block in Provision → the
+// root case fails (no such invocation recorded); the non-root case alone stays green.
+func TestProvision_RootRunOwnsGuestsParents(t *testing.T) {
+	orig := geteuid
+	defer func() { geteuid = orig }()
+
+	for _, tc := range []struct {
+		name string
+		euid int
+		want bool
+	}{
+		{"root run issues the parent chown", 0, true},
+		{"non-root run does not", 1001, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			geteuid = func() int { return tc.euid }
+			dir := t.TempDir()
+			runner := &recRunner{}
+			bh := NewBackHalf(&mintMinter{token: "T"}, runner, dir, testLogger())
+			if _, err := bh.Provision(context.Background(), newInput()); err != nil {
+				t.Fatalf("provision: %v", err)
+			}
+			guestsDir := filepath.Join(dir, "guests")
+			vmidDir := filepath.Join(guestsDir, "8200")
+			got := runner.hasExact("chown", "--reference="+dir, guestsDir, vmidDir)
+			if got != tc.want {
+				t.Fatalf("parent chown issued=%v want=%v; recorded: %v", got, tc.want, runner.cmds)
+			}
+			// Never recursive — the guest-root bootstrap subtree must stay untouched.
+			if runner.hasExact("chown", "-R", "--reference="+dir, guestsDir, vmidDir) {
+				t.Fatal("parent chown ran recursively")
+			}
+		})
+	}
+}
+
 // Companion red-proof: removing the `b.run(... -onboot 1)` call in Provision makes this FAIL
 // (no such invocation recorded) — re-applying the call turns it green.
 func TestProvision_SetsOnbootOne(t *testing.T) {