[elezar]

Summary

Run each Podman user-namespace profile as a named Rust test against the tmachine guest’s shared gateway. Each scenario owns sandbox cleanup, exact gateway configuration restoration, and readiness checks, including after assertion failures.

Final unit of the draft stack, based on #4538 (codex/4119-suite-layout). This PR preserves the existing shared-gateway implementation for separate review.

Related Issue

Follow-up to #4119. Part of #3954.

Changes

• Replace the Ansible profile sequence and TOML fixtures with default, auto, keep_id, and private Rust story modules.
• Compare OpenShell UID mappings with direct Podman in the gateway service user’s context and check managed workspace ownership and write access.
• Serialize scenarios with nextest and a guest-side lock covering setup, assertions, cleanup, and restoration.
• Wait for sandbox deletion, restore the exact original gateway configuration, and verify health and sandbox absence. Retain a dirty marker after interruption or failed restoration.
• Keep Ansible responsible for guest preparation, archive installation, registration, one nextest invocation, and failure diagnostics.
• Add pure assertions, an opt-in deliberate-panic recovery scenario, source checks, and fixture documentation.

Testing

• mise run pre-commit passed for this signed-off commit.
• Both pure Podman assertions passed; the test target compiled.
• The tree is identical to the former test(podman): run namespace stories against a shared gateway #4464 head 208144912, which passed the full configured unit suite on 2026-10-13.
• Earlier ARM64 Fedora 44 tmachine validation passed four live profiles and two pure assertions in each rootful/rootless lane. Rootless deliberate-panic recovery restored the gateway and passed a subsequent default-profile test.

Live validation was on 2026-10-07 using QEMU/HVF on ARM64 macOS, runtime artifacts from Actions run 37483726385 at b10ab39f9, and the shared-gateway test archive. Live tests have not been repeated after subsequent main rebases. The fixture requires a disposable tmachine guest, systemd, passwordless sudo, and a dedicated Podman gateway; image preparation and fixture reuse remain follow-ups.

The combined stack at 7e72adc6c passed nix develop --command mise run --jobs 1 ci on 2026-10-14. This covers the configured repository lint, compile/type checks, and unit suites; live gateway/tmachine execution was not repeated during this split.

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Relevant suite and testing guidance updated.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4464.docs.buildwithfern.com/openshell

[github-actions]

This pull request has had no activity for 14 days and is now marked stale.

[elezar]

#5137 runs the Podman user-namespace coverage as per-mode environments, so the shared-gateway fixture, lock and restoration logic are not needed.

Closing as superseded. The conformance suite now lives at tests/suites/conformance on testkit (#4774), and #5137 migrates the features and drivers suites and deletes crates/openshell-conformance, so this stack's layout and runner changes no longer apply.

The one idea worth keeping, cleanup for resources testkit does not track (with a deliberate-panic test), is being discussed in #5137 (comment).

The contributor-guidance points from the old README are listed in #4120.