velocious 1.0.604 → 1.0.605

package/scripts/bootstrap-provider-runtime.sh

@@ -0,0 +1,249 @@
+#!/usr/bin/env bash
+# Bootstrap durable provider homes and immutable agent-context discovery links.
+set -euo pipefail
+
+fail() {
+  printf 'Provider runtime bootstrap failed: %s\n' "$1" >&2
+  exit 1
+}
+
+if (($# < 4)); then
+  fail "usage: $0 <home> <provider-runtime> <agent-context> <command> [args...]"
+fi
+
+dev_home=$1
+provider_runtime=$2
+agent_context=$3
+shift 3
+
+for required_path in "$dev_home" "$provider_runtime" "$agent_context"; do
+  if [[ $required_path != /* ]]; then
+    fail "Required path must be absolute: $required_path"
+  fi
+
+  if [[ ! -d $required_path ]]; then
+    fail "Required directory does not exist: $required_path"
+  fi
+done
+
+if [[ ! -w $dev_home ]]; then
+  fail "Development home is not writable: $dev_home"
+fi
+
+if [[ ! -w $provider_runtime ]]; then
+  fail "Provider runtime is not writable: $provider_runtime"
+fi
+
+if [[ ! -f $agent_context/AGENTS.md || ! -d $agent_context/skills ]]; then
+  fail "Agent context must contain AGENTS.md and skills/: $agent_context"
+fi
+
+umask 077
+backup_directory=
+
+ensure_writable_parent() {
+  local parent_path=$1
+
+  if [[ -L $parent_path ]]; then
+    fail "Required parent directory must be lane-local, not a symlink: $parent_path"
+  fi
+
+  if [[ -e $parent_path && ! -d $parent_path ]]; then
+    fail "Required parent path is not a directory: $parent_path"
+  fi
+
+  if [[ ! -d $parent_path ]] && ! mkdir -p -- "$parent_path"; then
+    fail "Could not create required parent directory; verify ownership: $parent_path"
+  fi
+
+  if [[ ! -w $parent_path ]]; then
+    fail "Required parent directory is not writable; verify ownership: $parent_path"
+  fi
+}
+
+backup_relative_path() {
+  local target_path=$1
+
+  case $target_path in
+    "$dev_home"/*)
+      printf '%s\n' "${target_path#"$dev_home"/}"
+      ;;
+    "$provider_runtime"/*)
+      printf '%s\n' "provider-runtime/${target_path#"$provider_runtime"/}"
+      ;;
+    *)
+      fail "Refusing to migrate a path outside the development home or provider runtime: $target_path"
+      ;;
+  esac
+}
+
+preserve_conflict() {
+  local target_path=$1
+  local relative_path
+  local backup_path
+
+  if [[ -z $backup_directory ]]; then
+    ensure_writable_parent "$dev_home/.provider-runtime-migration-backups"
+
+    if ! backup_directory=$(mktemp -d "$dev_home/.provider-runtime-migration-backups/$(date -u +%Y%m%dT%H%M%SZ)-XXXXXX"); then
+      fail "Could not create a timestamped migration backup under $dev_home/.provider-runtime-migration-backups"
+    fi
+  fi
+
+  relative_path=$(backup_relative_path "$target_path")
+  backup_path="$backup_directory/$relative_path"
+
+  if [[ -e $backup_path || -L $backup_path ]]; then
+    fail "Migration backup target already exists: $backup_path"
+  fi
+
+  if ! mkdir -p -- "$(dirname -- "$backup_path")"; then
+    fail "Could not create migration backup parent: $(dirname -- "$backup_path")"
+  fi
+
+  if ! mv -- "$target_path" "$backup_path"; then
+    fail "Could not preserve conflicting path at $backup_path: $target_path"
+  fi
+
+  printf 'Provider runtime bootstrap preserved %s at %s\n' "$target_path" "$backup_path" >&2
+}
+
+ensure_real_directory() {
+  local directory_path=$1
+
+  ensure_writable_parent "$(dirname -- "$directory_path")"
+
+  if [[ -L $directory_path || (-e $directory_path && ! -d $directory_path) ]]; then
+    preserve_conflict "$directory_path"
+  fi
+
+  if [[ ! -d $directory_path ]] && ! mkdir -- "$directory_path"; then
+    fail "Could not create required directory: $directory_path"
+  fi
+
+  if [[ ! -w $directory_path ]]; then
+    fail "Required directory is not writable; verify ownership: $directory_path"
+  fi
+}
+
+ensure_exact_link() {
+  local target_path=$1
+  local source_path=$2
+
+  ensure_writable_parent "$(dirname -- "$target_path")"
+
+  if [[ -L $target_path ]] && [[ $(readlink -- "$target_path") == "$source_path" ]]; then
+    return
+  fi
+
+  if [[ -e $target_path || -L $target_path ]]; then
+    preserve_conflict "$target_path"
+  fi
+
+  if ! ln -s -- "$source_path" "$target_path"; then
+    fail "Could not create required symlink: $target_path -> $source_path"
+  fi
+}
+
+require_real_runtime_directory() {
+  local directory_path=$1
+
+  if [[ -L $directory_path || ! -d $directory_path ]]; then
+    fail "Provider runtime directory must be a real directory: $directory_path"
+  fi
+}
+
+require_exact_runtime_alias() {
+  local alias_path=$1
+  local expected_link=$2
+  local resolved_directory=$3
+  local resolved_alias_path
+  local resolved_directory_path
+
+  if [[ ! -L $alias_path ]] || [[ $(readlink -- "$alias_path") != "$expected_link" ]]; then
+    fail "Provider runtime alias must be exact: $alias_path -> $expected_link"
+  fi
+
+  if [[ -L $resolved_directory || ! -d $resolved_directory ]]; then
+    fail "Provider runtime alias target must be an existing real directory: $resolved_directory"
+  fi
+
+  if ! resolved_alias_path=$(realpath -e -- "$alias_path"); then
+    fail "Provider runtime alias does not resolve: $alias_path"
+  fi
+
+  if ! resolved_directory_path=$(realpath -e -- "$resolved_directory"); then
+    fail "Provider runtime alias target does not resolve: $resolved_directory"
+  fi
+
+  if [[ $resolved_alias_path != "$resolved_directory_path" ]]; then
+    fail "Provider runtime alias must resolve to $resolved_directory: $alias_path"
+  fi
+
+  if [[ ! -w $resolved_directory ]]; then
+    fail "Provider runtime alias target is not writable; verify ownership: $resolved_directory"
+  fi
+}
+
+validate_runtime_aliases() {
+  require_real_runtime_directory "$provider_runtime/.local"
+  require_real_runtime_directory "$provider_runtime/.local/share"
+  require_exact_runtime_alias "$provider_runtime/.codex" "codex" "$provider_runtime/codex"
+  require_exact_runtime_alias "$provider_runtime/.kimi-code" "kimi-code" "$provider_runtime/kimi-code"
+  require_exact_runtime_alias "$provider_runtime/.opencode" "opencode" "$provider_runtime/opencode"
+  require_exact_runtime_alias "$provider_runtime/.local/share/opencode" "../../opencode" "$provider_runtime/opencode"
+}
+
+validate_runtime_aliases
+
+if ! exec {provider_lock_fd}<"$provider_runtime"; then
+  fail "Could not open the provider runtime for shared-link locking: $provider_runtime"
+fi
+
+if ! flock --exclusive "$provider_lock_fd"; then
+  fail "Could not lock shared provider links: $provider_runtime"
+fi
+
+validate_runtime_aliases
+
+for provider_home in \
+  "$provider_runtime/codex" \
+  "$provider_runtime/kimi-code"; do
+  ensure_exact_link "$provider_home/AGENTS.md" "$agent_context/AGENTS.md"
+  ensure_exact_link "$provider_home/CLAUDE.md" "$agent_context/AGENTS.md"
+  ensure_exact_link "$provider_home/skills" "$agent_context/skills"
+done
+
+if ! flock --unlock "$provider_lock_fd"; then
+  fail "Could not unlock shared provider links: $provider_runtime"
+fi
+
+exec {provider_lock_fd}<&-
+
+for lane_parent in \
+  "$dev_home/.config" \
+  "$dev_home/.local" \
+  "$dev_home/.local/share" \
+  "$dev_home/.local/state" \
+  "$dev_home/.cache"; do
+  ensure_writable_parent "$lane_parent"
+done
+
+for lane_directory in \
+  "$dev_home/.config/opencode" \
+  "$dev_home/.local/share/opencode" \
+  "$dev_home/.local/state/opencode" \
+  "$dev_home/.cache/opencode"; do
+  ensure_real_directory "$lane_directory"
+done
+
+ensure_exact_link "$dev_home/.codex" "$provider_runtime/.codex"
+ensure_exact_link "$dev_home/.kimi-code" "$provider_runtime/.kimi-code"
+ensure_exact_link "$dev_home/.opencode" "$provider_runtime/.opencode"
+ensure_exact_link "$dev_home/.local/share/opencode/auth.json" "$provider_runtime/.local/share/opencode/auth.json"
+
+ensure_exact_link "$dev_home/.config/opencode/AGENTS.md" "$agent_context/AGENTS.md"
+ensure_exact_link "$dev_home/.config/opencode/CLAUDE.md" "$agent_context/AGENTS.md"
+ensure_exact_link "$dev_home/.config/opencode/skills" "$agent_context/skills"
+
+exec "$@"

package/scripts/verify-docker-dev-environment.js

@@ -3,10 +3,11 @@
  * Static contract verifier for the canonical Docker development environment.
  *
  * Dependency-free: checks the tracked Dockerfile, compose.yml, .env.example,
- * .dockerignore, .gitignore, and scripts/docker-run.sh against the canonical
- * development-environment contract, then runs negative probes derived from
- * the real files to prove the checks actually catch regressions (for example
- * a standalone project `npm install` or a `COPY` of project source).
+ * .dockerignore, .gitignore, and development bootstrap scripts against the
+ * canonical development-environment contract, then runs negative probes
+ * derived from the real files to prove the checks actually catch regressions
+ * (for example a standalone project `npm install` or a `COPY` of project
+ * source).
  */
 
 import fs from "node:fs"
@@ -280,7 +281,8 @@ function composeServiceNames(content) {
 }
 
 /**
- * Extracts the volume entries of the first service-level volumes block.
+ * Extracts normalized volume entries from the first service-level volumes
+ * block.
  *
  * @param {string} content - The compose.yml content.
  * @returns {string[]} - The volume entries.
@@ -289,6 +291,8 @@ function composeServiceVolumes(content) {
   const lines = content.split("\n")
   const volumes = []
   let volumesIndent = null
+  /** @type {string[] | null} */
+  let currentVolume = null
 
   for (const line of lines) {
     if (volumesIndent === null) {
@@ -301,16 +305,27 @@ function composeServiceVolumes(content) {
 
     const entryMatch = line.match(/^(\s+)-\s+(.+?)\s*$/u)
 
-    if (entryMatch && entryMatch[1].length > volumesIndent) {
-      volumes.push(entryMatch[2])
+    if (entryMatch && entryMatch[1].length == volumesIndent + 2) {
+      if (currentVolume) volumes.push(currentVolume.join("\n"))
+
+      currentVolume = [`- ${entryMatch[2]}`]
       continue
     }
 
     if (line.trim() == "" || line.trimStart().startsWith("#")) continue
 
+    const indentation = line.match(/^\s*/u)?.[0].length || 0
+
+    if (currentVolume && indentation > volumesIndent + 2) {
+      currentVolume.push(line.trim())
+      continue
+    }
+
     break
   }
 
+  if (currentVolume) volumes.push(currentVolume.join("\n"))
+
   return volumes
 }
 
@@ -337,10 +352,6 @@ function verifyCompose(content) {
     problems.push(`compose.yml must not contain credential values (matched: ${content.match(COMPOSE_CREDENTIAL_VALUE_PATTERN)?.[0].trim()})`)
   }
 
-  if (/threadwire/iu.test(content)) {
-    problems.push("compose.yml must not couple the development service to Threadwire")
-  }
-
   if (!/^\s+init:\s*true\s*$/mu.test(content)) {
     problems.push("The dev service must set init: true")
   }
@@ -353,24 +364,44 @@ function verifyCompose(content) {
     problems.push("The dev service must set working_dir /home/dev/velocious")
   }
 
-  for (const envLine of ["GH_CONFIG_DIR: /home/dev/.config/gh", "HOME: /home/dev", "NODE_ENV: development"]) {
+  for (const envLine of [
+    "GH_CONFIG_DIR: /home/dev/.config/gh",
+    "HOME: /home/dev",
+    "KIMI_CODE_HOME: /home/dev/.kimi-code",
+    "NODE_ENV: development",
+    "THREADWIRE_CODEX_BIN: /usr/local/bin/codex",
+    "THREADWIRE_KIMI_BIN: /usr/local/bin/kimi",
+    "THREADWIRE_OPENCODE_BIN: /usr/local/bin/opencode"
+  ]) {
     if (!content.includes(envLine)) {
       problems.push(`The dev service is missing environment entry: ${envLine}`)
     }
   }
 
   const expectedVolumes = [
-    "${DEV_HOME_PATH:-/home/dev}:/home/dev",
-    "${GH_CONFIG_SOURCE_PATH:?Set GH_CONFIG_SOURCE_PATH in .env}:/home/dev/.config/gh:ro"
+    "- type: bind\nsource: ${DEV_HOME_PATH:-/home/dev}\ntarget: /home/dev\nbind:\ncreate_host_path: false",
+    "- type: bind\nsource: ${AI_PROVIDER_RUNTIME_SOURCE_PATH:?Set AI_PROVIDER_RUNTIME_SOURCE_PATH in .env}\ntarget: /opt/hermes-dind-shared/auth/provider-runtime\nbind:\ncreate_host_path: false",
+    "- type: bind\nsource: ${AGENT_CONTEXT_SOURCE_PATH:?Set AGENT_CONTEXT_SOURCE_PATH in .env}\ntarget: /opt/hermes-agent-context\nread_only: true\nbind:\ncreate_host_path: false",
+    "- type: bind\nsource: ${GH_CONFIG_SOURCE_PATH:?Set GH_CONFIG_SOURCE_PATH in .env}\ntarget: /home/dev/.config/gh\nread_only: true\nbind:\ncreate_host_path: false"
   ]
   const actualVolumes = composeServiceVolumes(content)
 
   if (actualVolumes.length != expectedVolumes.length || !expectedVolumes.every((volume) => actualVolumes.includes(volume))) {
-    problems.push(`The dev service must mount exactly the development-home and read-only GH config binds (found: ${actualVolumes.join(", ") || "none"})`)
+    problems.push(`The dev service must mount exactly the development home, provider runtime, immutable agent context, and read-only GH config binds (found: ${actualVolumes.join(" | ") || "none"})`)
+  }
+
+  const expectedEntrypoint = "    entrypoint: [\"/home/dev/velocious/scripts/bootstrap-provider-runtime.sh\", \"/home/dev\", \"/opt/hermes-dind-shared/auth/provider-runtime\", \"/opt/hermes-agent-context\"]"
+
+  if (!content.includes(expectedEntrypoint)) {
+    problems.push("The dev service must use the provider runtime bootstrap as its entrypoint so Compose command overrides remain bootstrapped")
   }
 
   if (!/^\s+command:\s*(\[\s*"sleep",\s*"infinity"\s*\]|sleep\s+infinity)\s*$/mu.test(content)) {
-    problems.push("The dev service must run sleep infinity")
+    problems.push("The dev service must run sleep infinity by default")
+  }
+
+  if (/\.npmrc|NPM_CONFIG_USERCONFIG/iu.test(content)) {
+    problems.push("The normal dev service must not mount or configure npm credentials")
   }
 
   if (/container_name:/u.test(content)) {
@@ -401,6 +432,14 @@ function verifyEnvExample(content) {
     problems.push(".env.example must document GH_CONFIG_SOURCE_PATH")
   }
 
+  if (!content.includes("AI_PROVIDER_RUNTIME_SOURCE_PATH")) {
+    problems.push(".env.example must document AI_PROVIDER_RUNTIME_SOURCE_PATH")
+  }
+
+  if (!content.includes("AGENT_CONTEXT_SOURCE_PATH")) {
+    problems.push(".env.example must document AGENT_CONTEXT_SOURCE_PATH")
+  }
+
   if (!content.includes("DEV_HOME_PATH")) {
     problems.push(".env.example must document DEV_HOME_PATH")
   }
@@ -459,8 +498,79 @@ function verifyDockerRunSh(content) {
     problems.push("scripts/docker-run.sh must execute commands through docker compose run")
   }
 
-  if (/threadwire/iu.test(content)) {
-    problems.push("scripts/docker-run.sh must not reference Threadwire: it stays parent orchestration")
+  return problems
+}
+
+/**
+ * Verifies the documented source-path preflight.
+ *
+ * @param {string} content - The Docker development guide content.
+ * @returns {string[]} - The problems found.
+ */
+function verifyDockerDevelopmentDocs(content) {
+  const problems = []
+
+  for (const containmentCheck of [
+    'case "$agent_context_source/" in "$provider_runtime_source/"*) exit 1;; esac',
+    'case "$provider_runtime_source/" in "$agent_context_source/"*) exit 1;; esac'
+  ]) {
+    if (!content.includes(containmentCheck)) {
+      problems.push(`Docker preflight must reject bidirectional provider-runtime/agent-context containment: ${containmentCheck}`)
+    }
+  }
+
+  return problems
+}
+
+/**
+ * Verifies that the provider bootstrap preserves the canonical runtime aliases.
+ *
+ * @param {string} content - The bootstrap script content.
+ * @returns {string[]} - The problems found.
+ */
+function verifyProviderBootstrap(content) {
+  const problems = []
+  const firstAliasValidation = content.indexOf('require_exact_runtime_alias "$provider_runtime/.codex"')
+
+  for (const requiredParent of [
+    'require_real_runtime_directory "$provider_runtime/.local"',
+    'require_real_runtime_directory "$provider_runtime/.local/share"'
+  ]) {
+    const parentValidation = content.indexOf(requiredParent)
+
+    if (parentValidation == -1 || firstAliasValidation == -1 || parentValidation > firstAliasValidation) {
+      problems.push(`scripts/bootstrap-provider-runtime.sh must validate the real runtime parent before aliases: ${requiredParent}`)
+    }
+  }
+
+  for (const requiredAlias of [
+    'require_exact_runtime_alias "$provider_runtime/.codex" "codex" "$provider_runtime/codex"',
+    'require_exact_runtime_alias "$provider_runtime/.kimi-code" "kimi-code" "$provider_runtime/kimi-code"',
+    'require_exact_runtime_alias "$provider_runtime/.opencode" "opencode" "$provider_runtime/opencode"',
+    'require_exact_runtime_alias "$provider_runtime/.local/share/opencode" "../../opencode" "$provider_runtime/opencode"'
+  ]) {
+    if (!content.includes(requiredAlias)) {
+      problems.push(`scripts/bootstrap-provider-runtime.sh must validate canonical provider runtime alias: ${requiredAlias}`)
+    }
+  }
+
+  for (const resolutionCheck of [
+    'resolved_alias_path=$(realpath -e -- "$alias_path")',
+    'resolved_directory_path=$(realpath -e -- "$resolved_directory")',
+    'if [[ $resolved_alias_path != "$resolved_directory_path" ]]; then'
+  ]) {
+    if (!content.includes(resolutionCheck)) {
+      problems.push(`scripts/bootstrap-provider-runtime.sh must verify canonical provider runtime aliases resolve to their target: ${resolutionCheck}`)
+    }
+  }
+
+  for (const lockOperation of [
+    'flock --exclusive "$provider_lock_fd"',
+    'flock --unlock "$provider_lock_fd"'
+  ]) {
+    if (!content.includes(lockOperation)) {
+      problems.push(`scripts/bootstrap-provider-runtime.sh must serialize shared provider-link mutations: ${lockOperation}`)
+    }
   }
 
   return problems
@@ -470,7 +580,7 @@ function verifyDockerRunSh(content) {
  * Builds negative probes derived from the real files. Each probe mutates the
  * real content with a regression and must be caught by the matching verifier.
  *
- * @param {{dockerfile: string, compose: string}} contents - The real file contents.
+ * @param {{dockerDocs: string, dockerfile: string, compose: string, providerBootstrap: string}} contents - The real file contents.
  * @returns {{name: string, problems: string[], expected: string}[]} - The probes.
  */
 function negativeProbes(contents) {
@@ -502,7 +612,7 @@ function negativeProbes(contents) {
     },
     {
       name: "compose credential mount regression",
-      problems: verifyCompose(contents.compose.replace("    command:", "      - $" + "{HOME}/.kimi:/home/dev/.kimi\n    command:")),
+      problems: verifyCompose(contents.compose.replace("    entrypoint:", "      - type: bind\n        source: $" + "{HOME}/.kimi\n        target: /home/dev/.kimi\n    entrypoint:")),
       expected: "mount exactly"
     },
     {
@@ -511,14 +621,74 @@ function negativeProbes(contents) {
       expected: "credential values"
     },
     {
-      name: "compose Threadwire coupling regression",
-      problems: verifyCompose(contents.compose.replace("      HOME: /home/dev", "      HOME: /home/dev\n      THREADWIRE_TOKEN: secret")),
-      expected: "Threadwire"
+      name: "compose stale provider runtime target regression",
+      problems: verifyCompose(contents.compose.replace("target: /opt/hermes-dind-shared/auth/provider-runtime", "target: /run/ai-provider-runtime")),
+      expected: "mount exactly"
+    },
+    {
+      name: "compose mutable agent context source regression",
+      problems: verifyCompose(contents.compose.replace("${AGENT_CONTEXT_SOURCE_PATH:?Set AGENT_CONTEXT_SOURCE_PATH in .env}", "/opt/hermes-dind-shared/agent-context/current")),
+      expected: "mount exactly"
+    },
+    {
+      name: "compose stale agent context target regression",
+      problems: verifyCompose(contents.compose.replaceAll("/opt/hermes-agent-context", "/opt/agent-context")),
+      expected: "mount exactly"
+    },
+    {
+      name: "compose npm credential mount regression",
+      problems: verifyCompose(contents.compose.replace("    entrypoint:", "      - type: bind\n        source: $" + "{HOME}/.npmrc\n        target: /home/dev/.npmrc\n        read_only: true\n    entrypoint:")),
+      expected: "npm credentials"
+    },
+    {
+      name: "compose bootstrap entrypoint regression",
+      problems: verifyCompose(contents.compose.replace("    entrypoint:", "    x-entrypoint:")),
+      expected: "command overrides"
     },
     {
       name: "compose second service regression",
       problems: verifyCompose(`${contents.compose}\n  worker:\n    image: ubuntu\n`),
       expected: "dev"
+    },
+    {
+      name: "provider runtime alias regression",
+      problems: verifyProviderBootstrap(contents.providerBootstrap.replace(
+        'require_exact_runtime_alias "$provider_runtime/.local/share/opencode" "../../opencode" "$provider_runtime/opencode"',
+        'require_exact_runtime_alias "$provider_runtime/.local/share/opencode" "opencode" "$provider_runtime/opencode"'
+      )),
+      expected: "canonical provider runtime alias"
+    },
+    {
+      name: "provider runtime alias resolution regression",
+      problems: verifyProviderBootstrap(contents.providerBootstrap.replace(
+        'resolved_alias_path=$(realpath -e -- "$alias_path")',
+        'resolved_alias_path=$(realpath -e -- "$resolved_directory")'
+      )),
+      expected: "resolve to their target"
+    },
+    {
+      name: "provider runtime real parent regression",
+      problems: verifyProviderBootstrap(contents.providerBootstrap.replace(
+        'require_real_runtime_directory "$provider_runtime/.local/share"',
+        'require_real_runtime_directory "$provider_runtime/.local-share"'
+      )),
+      expected: "real runtime parent"
+    },
+    {
+      name: "provider runtime serialization regression",
+      problems: verifyProviderBootstrap(contents.providerBootstrap.replace(
+        'flock --exclusive "$provider_lock_fd"',
+        'flock --shared "$provider_lock_fd"'
+      )),
+      expected: "serialize shared provider-link mutations"
+    },
+    {
+      name: "provider runtime and agent context containment regression",
+      problems: verifyDockerDevelopmentDocs(contents.dockerDocs.replace(
+        'case "$agent_context_source/" in "$provider_runtime_source/"*) exit 1;; esac',
+        ""
+      )),
+      expected: "bidirectional provider-runtime/agent-context containment"
     }
   ]
 }
@@ -558,17 +728,37 @@ function main() {
   }
 
   const dockerRunPath = path.join(repoRoot, "scripts", "docker-run.sh")
+  const dockerDocsPath = path.join(repoRoot, "docs", "docker-development-environment.md")
+  const providerBootstrapPath = path.join(repoRoot, "scripts", "bootstrap-provider-runtime.sh")
+  const dockerDocs = fs.existsSync(dockerDocsPath) ? fs.readFileSync(dockerDocsPath, "utf8") : null
+  const providerBootstrap = fs.existsSync(providerBootstrapPath) ? fs.readFileSync(providerBootstrapPath, "utf8") : null
+
+  if (dockerDocs === null) {
+    problems.push("Missing required file: docs/docker-development-environment.md")
+  } else {
+    problems.push(...verifyDockerDevelopmentDocs(dockerDocs))
+  }
+
+  if (providerBootstrap === null) {
+    problems.push("Missing required file: scripts/bootstrap-provider-runtime.sh")
+  } else {
+    problems.push(...verifyProviderBootstrap(providerBootstrap))
+  }
 
-  if (fs.existsSync(dockerRunPath) && process.platform != "win32") {
-    const mode = fs.statSync(dockerRunPath).mode
+  if (process.platform != "win32") {
+    for (const executablePath of [dockerRunPath, providerBootstrapPath]) {
+      if (!fs.existsSync(executablePath)) continue
 
-    if ((mode & 0o111) == 0) {
-      problems.push("scripts/docker-run.sh must be executable")
+      const mode = fs.statSync(executablePath).mode
+
+      if ((mode & 0o111) == 0) {
+        problems.push(`${path.relative(repoRoot, executablePath)} must be executable`)
+      }
     }
   }
 
-  if (dockerfile !== null && compose !== null) {
-    for (const probe of negativeProbes({dockerfile, compose})) {
+  if (dockerDocs !== null && dockerfile !== null && compose !== null && providerBootstrap !== null) {
+    for (const probe of negativeProbes({dockerDocs, dockerfile, compose, providerBootstrap})) {
       if (!probe.problems.some((problem) => problem.toLowerCase().includes(probe.expected.toLowerCase()))) {
         problems.push(`Negative probe was not caught by the verifier: ${probe.name}`)
       }

package/src/cli/commands/test/timing-manifest/merge.js

@@ -0,0 +1,14 @@
+// @ts-check
+
+import BaseCommand from "../../../base-command.js"
+
+/** CLI command for merging complete rich test-profile shards into timing history. */
+export default class TestTimingManifestMerge extends BaseCommand {
+  /**
+   * Runs execute.
+   * @returns {Promise<ReturnType<typeof JSON.parse>>} - Resolves with the merged manifest.
+   */
+  async execute() {
+    return await this.getConfiguration().getEnvironmentHandler().cliCommandsTestTimingManifestMerge(this)
+  }
+}

package/src/environment-handlers/base.js

@@ -406,6 +406,15 @@ export default class VelociousEnvironmentHandlerBase {
     throw new Error("cliCommandsTest not implemented")
   }
 
+  /**
+   * Runs cli commands test timing manifest merge.
+   * @param {import("../cli/base-command.js").default} _command - Command.
+   * @returns {Promise<ReturnType<typeof JSON.parse>>} - Resolves with the command result.
+   */
+  async cliCommandsTestTimingManifestMerge(_command) {
+    throw new Error("cliCommandsTestTimingManifestMerge not implemented")
+  }
+
   /**
    * Runs cli commands background jobs main.
    * @param {import("../cli/base-command.js").default} _command - Command.