GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Refs #1968 (register T60, living document Part 5). This is the first slice. The issue stays open for the rest (listed under "Remaining").

Why

Each docker_e2e_* suite carried its own copy of the container scaffolding. 9 copies of cov_docker_args and 8 of assert_vex_agent_attested were byte-identical (md5-checked), and skip_if_no_image had drifted: 7 copies never read the required switch, and deno read SOCKET_PATCH_REQUIRE_DOCKER, which nothing sets.

Changes (test-only)

• New tests/docker_common/mod.rs, the one home for:
  • cov_docker_args, with sbt's SOCKET_PATCH_DOCKER_BIN branch folded in;
  • skip_if_no_image(image) / skip_or_require_image, moved from docker_vendor_common;
  • run_container(image, script);
  • assert_vex_agent_attested(stdout, purl, ghsa).
• Deleted per-suite copies:
  • cov_docker_args ×10, counting docker_vendor_common and sbt's binary_mounts;
  • skip_if_no_image ×10, counting npm's skip_if_no_docker_image and sbt's required();
  • run_container ×5 and npm's run_in_container;
  • the inline docker run blocks in cargo, golang and maven;
  • assert_vex_agent_attested ×8;
  • plain_sha256 ×3 and pypi's sha256_hex (use common::sha256_hex).
• Other deletions:
  • deno's SOCKET_PATCH_REQUIRE_DOCKER gate;
  • the dead docker_vendor_common::run_in_image;
  • npm's unused Duration import and its const _ suppressor.
• docker_vendor_common builds its docker run on crate::docker_common::cov_docker_args. Its includers (5 vendor suites, docker_e2e_npm, tests/vendor/main.rs) also declare docker_common. The selftest imports skip_or_require_image from there.

Diff: +260 / −1,113, all in tests (net −853). No production lines change.

Behavior

• The required gate. Every agent suite now honours SOCKET_PATCH_DOCKER_E2E_REQUIRED=1 the way sbt and the vendor capstones already did. The variable is set only for:

  • the sbt) arm of both docker jobs;
  • composer-compatibility.yml, which runs only docker_e2e_vendor_composer;
  • scripts/sbt-compat-matrix.sh, which runs only docker_e2e_sbt.

  So no CI leg changes outcome.

• SOCKET_PATCH_DOCKER_BIN. It now overrides the binary in every suite, not only in sbt. Only sbt-compat-matrix.sh sets it.

• Skip messages. Their wording is now uniform. npm's no-docker message no longer mentions SOCKET_PATCH_TEST_HOST, which the module doc still documents.

Verification

• All 15 docker_e2e_* binaries build and pass with --features docker-e2e. Without images, the container tests skip and the host-side tests run: 17–31 per binary.
• tests/vendor's docker_vendor_common selftests pass 8/8, including a_required_docker_suite_fails_on_a_missing_image.
• cargo clippy --workspace --all-features -- -D warnings is clean.
• The containers themselves only run in the coverage-docker / e2e-docker jobs, so this needs a full-scope CI dispatch to prove them.

/code-review high

It raised 10 findings. None were fixed, for these reasons:

1. Deno lost SOCKET_PATCH_REQUIRE_DOCKER. This is intended (Share one docker test harness: cov_docker_args ×10, skip_if_no_image ×11 and assert_vex_agent_attested ×8 are copied, and 8 docker suites never honour SOCKET_PATCH_DOCKER_E2E_REQUIRED #1968, step 3): nothing sets the variable, and the shared gate reads SOCKET_PATCH_DOCKER_E2E_REQUIRED.
2. SOCKET_PATCH_DOCKER_BIN now applies everywhere and skips the coverage mounts. Its only setter runs sbt alone, so it keeps sbt's precedence.
3. Agent suites now honour REQUIRED. This is intended, and as shown above no runner sets it across suites.
4. npm's host-mode hint is gone from the skip message. The module doc still documents host mode.
5. run_container takes no extra args. Folding in sbt (-m 2g, -e), docker_vendor_common::docker_command and npm's vlt smoke needs an extra parameter. That is left for the follow-up, together with items 6 and 7.
6. host.docker.internal URL ×15 and api_url_for_container ×2: follow-up.
7. assert_api_path_exercised ×4, drifted: follow-up, as the issue's assert_api_exercised.
8. crate::docker_common is a crate-root requirement. A missing declaration fails compilation at that line.
9. A docker image inspect runs per test. That was already the case and is cheap.
10. A ci.yml comment names the per-suite files. ci.yml is left alone because ci-janitor PRs Retry pinned bundler installs in the e2e legs #1854 and Annotate failing tests in macOS/Windows test legs #1890 change it.

Remaining on #1968

• export REQUIRED for every docker leg in ci.yml;
• the shared assert_api_exercised and container URL;
• the GIT_SHA256_FN copies ×3 → git_blob_sha;
• the bash "applied": 1 greps → assert_summary (gem matches 10);
• run_container with extra args.

Risk

Low to medium. The change is test-only and compile-checked, but the docker containers can't run in this sandbox.

🤖 Generated with Claude Code

https://claude.ai/code/session_011f9aeP9dHgNGnDr1A5rmCp

Generated by Claude Code