From f0454650a20bdc3bc6653d557506e5233745a981 Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Sat, 18 Jul 2026 13:59:02 -0500 Subject: [PATCH] ci: harden soul-contract-gate boot for the Linux runner MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gate booted the soul with `env -i`, which strips the ambient environment — including the library path the dynamically-linked soul needs on the GCE CI runner. The soul never came up there, so the gate failed the build (run 3384) even though the soul is correct (the gate passes locally against the exact published CI runtime). Switch to preserving the ambient env and instead UNSET only the live-service vars (ENGRAM_URL/API keys/ identity) while pointing HOME + snapshot at throwaway paths and axon at a dead port. Isolation is unchanged (verified: no touch of the live soul/engram); the soul now boots on the runner. --- scripts/verify-soul-contract.sh | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/scripts/verify-soul-contract.sh b/scripts/verify-soul-contract.sh index c120920..815df39 100755 --- a/scripts/verify-soul-contract.sh +++ b/scripts/verify-soul-contract.sh @@ -113,9 +113,16 @@ KNOWN_PENDING=( ) # --- boot the soul ----------------------------------------------------------- +# Preserve the ambient environment (PATH, LD_LIBRARY_PATH, TMPDIR) so the +# dynamically-linked soul finds its libs on any runner — using `env -i` here +# stripped the library path on the Linux CI runner and the soul never booted. +# Isolation is still guaranteed by UNSETTING the live-service vars (so it can +# never reach the real engram/axon or make an LLM call) and by pointing HOME + +# the snapshot at throwaway paths and the axon at a dead port. echo "== booting soul: $SOUL on port $PORT (throwaway HOME=$THROW_HOME) ==" -env -i \ - PATH="/usr/bin:/bin:/usr/sbin:/sbin" \ +env \ + -u ENGRAM_URL -u ENGRAM_API_KEY -u SOUL_ENGRAM_URL \ + -u ANTHROPIC_API_KEY -u NEURON_LLM_API_KEY -u SOUL_IDENTITY \ HOME="$THROW_HOME" \ NEURON_PORT="$PORT" \ SOUL_CGI_ID="ntn-contract-$$" \