[ymote]

tools/ci-local.sh --linux-host runs every job whose runs-on is ubuntu (apps services and kernel-security, rom) on the Linux build host configured in ~/.config/octosense/build.env, over ssh, while the macOS jobs keep running on the Mac. It also adds a Linux-only job no workflow runs: the process sandbox's Landlock and seccomp tests (linux-host / sandbox: cargo test --locked -p octosense-shell --lib sandbox::). It comes with any run of a workflow that a change to the shell triggers. Until now those tests have never run (G6 #156, #199, #202, and the Linux part of #178).

How it works

• Shipping. The exact commit goes to the host as a git bundle, incremental after the first run, into ~/octosense-ci/repo.git. It is checked out as ~/octosense-ci/runs/<sha>-<ts>, and the newest five runs are kept. The host runs tools/setup.py itself from the same lock files, with hub clones in ~/octosense-ci/cache/hub.
• Same steps. The host runs that checkout's own tools/ci_local.py, so the run: steps come from the same workflow files. Each job gets its own worker, and the workers run in parallel, each with its own cargo target per slot. At most 4 runs share the host, through mkdir locks there; this is separate from the Mac's 2 slots.
• Results. Remote steps join the same table, marked (linux), and last.json, with "host": "linux" and the sha the host checked out. An unreachable host, a missing result or a result for another commit is a FAIL, never a pass. ci-local-merge.sh accepts remote passes on the PR head and refuses stale remote results.
• Security. Everything runs as the ssh user in ~/octosense-ci only, never with sudo. Remote steps get an allow-listed environment: no tokens, nothing from the Mac. The host's address and key path are scrubbed from the log and last.json.

Verified

tools/ci-local.sh --only apps --linux-host on main 57dc05d plus this commit:

• Every step PASSED: services and kernel-security on Linux (x86_64, 72 CPUs), apps on the Mac.
• Linux sandbox tests: 23 passed, 0 failed. This includes every #[cfg(target_os = "linux")] test: Landlock grant splitting, the seccomp ABI and network rules, a program reached through a link, the read-only build inputs, and the jail. without_landlock_... skips itself because the kernel has Landlock, as designed.
• Cold run (fresh host: bundle, hub clones, octos kernel build): 21 s to ship, 7m06s on the host. Warm run: 4 s to ship, 2m11s on the host. The Mac's own apps job was the critical path both times (11m23s cold, 3m55s warm).
• python3 -m unittest discover -s tools -p 'test_*.py' passes, and so does --check-drift. The new tests cover step selection per runs-on, the merge of remote results into last.json, the stale-sha refusal in ci-local-merge, the scrubbing of the host and key, and the env allow-list.

Not merged here; this goes through the merge captain.

🤖 Generated with Claude Code

[ymote]

Local CI passed on b904bdd (tools/ci-local.sh --only desktop,phone, 16m32s, Darwin arm64).

GitHub would run for this PR: desktop.yml, phone.yml. Merged on this local pass (macOS runner queue); GitHub CI runs on the merge commit on main.

Job	Step	Result	Time
ci-local / drift	The local mapping fits the workflows	PASS	-
desktop.yml / desktop	Prepare the pinned framework sources	PASS	0s
desktop.yml / desktop	Compile the desktop with the shared runtime	PASS	1m32s
desktop.yml / desktop	One copy of every shell source	PASS	-
desktop.yml / desktop	Desktop tools and scripts	PASS	8s
desktop.yml / desktop	One Makepad, App Hub, octos and Rinx in the locked graph	PASS	2s
desktop.yml / desktop	The native apps' generated places match native-apps.json	PASS	0s
phone.yml / home	Prepare pinned sources and the reviewed runtime patch	PASS	0s
phone.yml / home	Compile Home and its bundled modules	PASS	1m32s
phone.yml / home	Verify the single runtime graph	PASS	2s
phone.yml / home	The native apps' generated places match native-apps.json	PASS	0s
phone.yml / home	The pinned octos revision	PASS	-
phone.yml / home	Build octos (unless cached)	PASS	-
phone.yml / home	Build Home, App Hub admission and runtime policy tests	PASS	1m41s
phone.yml / home	Test Home, App Hub admission and runtime policy	PASS	10m43s
phone.yml / home	Two-lane scenario (real kernel, scripted model)	PASS	52s

Notes:

• GitHub runs Python 3.12; this run used Python 3.9.6