From a751e544bef580c966f2a908fc939853b5232fbf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?m=C3=BCde?= <git@darkest.space>
Date: Thu, 14 May 2026 23:26:58 +0200
Subject: [PATCH 1/3] =?UTF-8?q?tests:=20approval.sh=20=E2=80=94=20Phase=20?=
 =?UTF-8?q?5c=20end-to-end?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tests/approval.sh | 91 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 91 insertions(+)
 create mode 100755 tests/approval.sh

diff --git a/tests/approval.sh b/tests/approval.sh
new file mode 100755
index 00000000..5848823b
--- /dev/null
+++ b/tests/approval.sh
@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# Phase 5c end-to-end approval flow:
+#   manager edits proposed -> commits -> request_apply_commit
+#   user approves on host -> hive-c0re applies into authoritative repo -> rebuild
+#   sub-agent container has the new package
+#
+# Runs as root on a host with services.hive-c0re enabled and the hm1nd
+# container declared. Idempotent — wipes any prior alice state.
+
+set -euo pipefail
+
+AGENT=alice
+PKG=htop
+
+cleanup() {
+    echo "=== cleanup ==="
+    sudo hive-c0re kill "$AGENT" 2>/dev/null || true
+    sudo nixos-container destroy "h-${AGENT}" 2>/dev/null || true
+    sudo rm -rf \
+        "/var/lib/hyperhive/agents/${AGENT}" \
+        "/var/lib/hyperhive/applied/${AGENT}"
+}
+
+cleanup
+
+echo "=== spawn ${AGENT} ==="
+sudo hive-c0re spawn "$AGENT"
+
+echo "=== two-repo split visible ==="
+echo "  proposed (manager-editable):"
+sudo ls -la "/var/lib/hyperhive/agents/${AGENT}/config/" | sed 's/^/    /'
+echo "  applied (hive-c0re only):"
+sudo ls -la "/var/lib/hyperhive/applied/${AGENT}/" | sed 's/^/    /'
+
+echo "=== manager cannot see the applied repo ==="
+if sudo nixos-container run hm1nd -- ls "/var/lib/hyperhive/applied/${AGENT}" 2>/dev/null; then
+    echo "FAIL: manager can see applied/ — bind-mount leak"
+    exit 1
+fi
+echo "  manager has no path to applied/ ✓"
+
+echo "=== ${PKG} not installed in h-${AGENT} (pre-approve) ==="
+if sudo nixos-container run "h-${AGENT}" -- which "$PKG" 2>/dev/null; then
+    echo "FAIL: ${PKG} already in path"
+    exit 1
+fi
+echo "  not in path ✓"
+
+echo "=== manager: edit agent.nix + commit + request_apply_commit ==="
+sudo nixos-container run hm1nd -- bash -c "
+    set -euo pipefail
+    cd /agents/${AGENT}/config
+    cat > agent.nix <<'EOF'
+{ pkgs, ... }:
+{
+  environment.systemPackages = [ pkgs.${PKG} ];
+}
+EOF
+    git commit -am 'add ${PKG}'
+    SHA=\$(git rev-parse HEAD)
+    echo \"  manager commit SHA=\$SHA\"
+    hive-m1nd request-apply-commit ${AGENT} \$SHA
+"
+
+echo "=== pending approvals ==="
+sudo hive-c0re pending
+
+ID=$(sudo hive-c0re pending \
+    | python3 -c 'import sys,json;print(json.load(sys.stdin)["approvals"][-1]["id"])')
+echo "  using approval id ${ID}"
+
+echo "=== approve ${ID} (advances applied/main + rebuilds h-${AGENT}) ==="
+sudo hive-c0re approve "$ID"
+
+echo "=== verify ${PKG} now in path ==="
+sudo nixos-container run "h-${AGENT}" -- which "$PKG"
+
+echo "=== applied repo git log ==="
+sudo git -C "/var/lib/hyperhive/applied/${AGENT}" log --oneline -5
+
+echo "=== approvals table ==="
+if command -v sqlite3 >/dev/null; then
+    sudo sqlite3 /var/lib/hyperhive/broker.sqlite \
+        "SELECT id, agent, substr(commit_ref,1,12) AS sha, status FROM approvals ORDER BY id DESC LIMIT 5;"
+else
+    echo "  (sqlite3 not on host PATH — skip)"
+fi
+
+echo
+read -r -p "press enter to tear down, Ctrl-C to leave running: "
+cleanup

From e53315465588cece34892e9974b0dba3f2b5ad0a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?m=C3=BCde?= <git@darkest.space>
Date: Thu, 14 May 2026 23:30:04 +0200
Subject: [PATCH 2/3] tests/approval.sh: precheck + auto-start hm1nd

---
 tests/approval.sh | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/tests/approval.sh b/tests/approval.sh
index 5848823b..7e9986a0 100755
--- a/tests/approval.sh
+++ b/tests/approval.sh
@@ -21,6 +21,22 @@ cleanup() {
         "/var/lib/hyperhive/applied/${AGENT}"
 }
 
+echo "=== precheck: hm1nd container is up ==="
+if ! sudo machinectl status hm1nd >/dev/null 2>&1; then
+    echo "  hm1nd is not running. Starting via systemd..."
+    sudo systemctl start "container@hm1nd.service" || {
+        echo "FAIL: could not start container@hm1nd.service."
+        echo "  Did you 'nixos-rebuild switch' after declaring containers.hm1nd in your host config?"
+        exit 1
+    }
+    # wait briefly for it to come up
+    for i in 1 2 3 4 5 6 7 8 9 10; do
+        sudo machinectl status hm1nd >/dev/null 2>&1 && break
+        sleep 0.5
+    done
+fi
+echo "  hm1nd is up ✓"
+
 cleanup
 
 echo "=== spawn ${AGENT} ==="

From 14cb1071251ec98d1f9b427158c09912326f708f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?m=C3=BCde?= <git@darkest.space>
Date: Thu, 14 May 2026 23:32:03 +0200
Subject: [PATCH 3/3] tests/approval.sh: parse id via sed (no python dep)

---
 tests/approval.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tests/approval.sh b/tests/approval.sh
index 7e9986a0..2210d5ab 100755
--- a/tests/approval.sh
+++ b/tests/approval.sh
@@ -82,7 +82,12 @@ echo "=== pending approvals ==="
 sudo hive-c0re pending
 
 ID=$(sudo hive-c0re pending \
-    | python3 -c 'import sys,json;print(json.load(sys.stdin)["approvals"][-1]["id"])')
+    | sed -nE 's/^[[:space:]]*"id":[[:space:]]*([0-9]+).*/\1/p' \
+    | tail -1)
+if [ -z "$ID" ]; then
+    echo "FAIL: could not parse approval id"
+    exit 1
+fi
 echo "  using approval id ${ID}"
 
 echo "=== approve ${ID} (advances applied/main + rebuilds h-${AGENT}) ==="