test(app): run broker mux tests against the production layout

commit: 52bb3d7232f3f6bb9abd3aa220475c7a2c0d8bdd
author: brice · 29d ago · 2026-09-23 15:10 UTC
parent: 352658c
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +109 -106

M internal/app/broker_offline_mux_test.go +102 -105


@@ -21,6 +21,8 @@ import (
21	21
22	22		"github.com/bnema/vev/internal/adapters/brokerconfig"
23	23		"github.com/bnema/vev/internal/adapters/brokeripc"
	24	+	"github.com/bnema/vev/internal/adapters/daemonmux"
	25	+	"github.com/bnema/vev/internal/adapters/ipc"
24	26		"github.com/bnema/vev/internal/adapters/quic"
25	27		"github.com/bnema/vev/internal/adapters/sshstdio"
26	28		"github.com/bnema/vev/internal/ports"

@@ -37,20 +39,25 @@ import (
37	39		// round trip proves pin, token, nonce, and daemonmux handshake all compose.
38	40
39	41		const (
40		-	fakeSSHArgsEnv = "VEV_TEST_SSH_ARGS"
41		-	fakeSSHReadyEnv = "VEV_TEST_SSH_READY"
42		-	fakeSSHPIDEnv = "VEV_TEST_SSH_PID"
43		-	fakeSSHBinEnv = "VEV_TEST_SSH_BIN"
44		-	fakeSSHModeEnv = "VEV_TEST_SSH_MODE"
45		-	fakeSSHRootEnv = "VEV_TEST_SSH_REMOTE_ROOT"
	42	+	fakeSSHArgsEnv = "VEV_TEST_SSH_ARGS"
	43	+	fakeSSHReadyEnv = "VEV_TEST_SSH_READY"
	44	+	fakeSSHPIDEnv = "VEV_TEST_SSH_PID"
	45	+	fakeSSHBinEnv = "VEV_TEST_SSH_BIN"
	46	+	fakeSSHModeEnv = "VEV_TEST_SSH_MODE"
	47	+	fakeSSHRuntimeEnv = "VEV_TEST_SSH_REMOTE_RUNTIME"
	48	+	fakeSSHStateEnv = "VEV_TEST_SSH_REMOTE_STATE"
	49	+	fakeSSHConfigEnv = "VEV_TEST_SSH_REMOTE_CONFIG"
46	50		)
47	51
48	52		// fakeSSHExecHelper is an owned test ssh: it records its exact argv and then
49	53		// re-executes this test binary as the named hidden mux helper against an
50		-	// isolated remote sandbox. Its stdin/stdout remain the carriage pipes.
	54	+	// isolated remote production XDG layout. Its stdin/stdout remain the carriage pipes.
51	55		const fakeSSHExecHelper = `#!/bin/sh
52	56		printf '%s\n' "$@" > "$` + fakeSSHArgsEnv + `"
53		-	exec "$` + fakeSSHBinEnv + `" "$` + fakeSSHModeEnv + `" --offline-root "$` + fakeSSHRootEnv + `"
	57	+	export XDG_RUNTIME_DIR="$` + fakeSSHRuntimeEnv + `"
	58	+	export XDG_STATE_HOME="$` + fakeSSHStateEnv + `"
	59	+	export XDG_CONFIG_HOME="$` + fakeSSHConfigEnv + `"
	60	+	exec "$` + fakeSSHBinEnv + `" "$` + fakeSSHModeEnv + `" --production
54	61		`
55	62
56	63		// fakeSSHEmitReadiness prints one controlled readiness line and exits, so a

@@ -111,23 +118,42 @@ func installFakeSSH(t *testing.T, script string) string {
111	118		// muxTestEnv isolates production XDG roots and records every detached mux
112	119		// helper so no test leaks a process.
113	120		type muxTestEnv struct {
114		-	t *testing.T
115		-	prodRuntime, prodState string
116		-	recordDir string
	121	+	t *testing.T
	122	+	recordDir string
117	123		}
118	124
119	125		func newMuxTestEnv(t testing.T) muxTestEnv {
120	126		t.Helper()
121		-	_, prodRuntime, prodState := isolateSandboxEnv(t)
	127	+	emptyProductionBrokerLayout(t, "")
122	128		recordDir := filepath.Join(shortTempDir(t, "vevm"), "r")
123	129		require.NoError(t, os.MkdirAll(recordDir, 0o700))
124	130		t.Setenv(brokerHelperEnv, "1")
125	131		t.Setenv(brokerHelperRecordDirEnv, recordDir)
126		-	env := &muxTestEnv{t: t, prodRuntime: prodRuntime, prodState: prodState, recordDir: recordDir}
	132	+	env := &muxTestEnv{t: t, recordDir: recordDir}
127	133		t.Cleanup(env.cleanup)
128	134		return env
129	135		}
130	136
	137	+	// remoteMuxFixture runs the SSH-side mux helper with a distinct production
	138	+	// XDG environment and a fixture listening at that environment's daemon path.
	139	+	func remoteMuxFixture(t testing.T, policy ports.BrokerPolicy) brokerMuxFixture {
	140	+	t.Helper()
	141	+	localRuntime, localState, localConfig := os.Getenv("XDG_RUNTIME_DIR"), os.Getenv("XDG_STATE_HOME"), os.Getenv("XDG_CONFIG_HOME")
	142	+	remoteRuntime, remoteState, remoteConfig := shortTempDir(t, "vb"), shortTempDir(t, "vb"), shortTempDir(t, "vb")
	143	+	t.Setenv("XDG_RUNTIME_DIR", remoteRuntime)
	144	+	t.Setenv("XDG_STATE_HOME", remoteState)
	145	+	t.Setenv("XDG_CONFIG_HOME", remoteConfig)
	146	+	path := daemonmux.SocketPath(ipc.SocketDir())
	147	+	fixture := newBrokerMuxFixtureAt(t, policy, path)
	148	+	t.Setenv("XDG_RUNTIME_DIR", localRuntime)
	149	+	t.Setenv("XDG_STATE_HOME", localState)
	150	+	t.Setenv("XDG_CONFIG_HOME", localConfig)
	151	+	t.Setenv(fakeSSHRuntimeEnv, remoteRuntime)
	152	+	t.Setenv(fakeSSHStateEnv, remoteState)
	153	+	t.Setenv(fakeSSHConfigEnv, remoteConfig)
	154	+	return fixture
	155	+	}
	156	+
131	157		// cleanup kills every recorded mux helper process.
132	158		func (e *muxTestEnv) cleanup() {
133	159		for _, role := range []string{brokerMuxStdioCommand, brokerMuxQUICBootstrapCommand, brokerMuxQUICProxyCommand} {

@@ -148,17 +174,16 @@ func (e *muxTestEnv) cleanup() {
148	174		}
149	175		}
150	176
151		-	// writeMuxRoot writes one marker-valid sandbox root carrying a single
152		-	// registration with the supplied route object.
153		-	func writeMuxRoot(t *testing.T, route any) string {
	177	+	// writeMuxRoot provisions one pinned host route in this test's production
	178	+	// broker.json and returns the production layout for its reader.
	179	+	func writeMuxRoot(t *testing.T, route any) brokerconfig.Layout {
154	180		t.Helper()
155		-	root := filepath.Join(shortTempDir(t, "vevx"), "s")
156		-	require.NoError(t, os.MkdirAll(root, 0o700))
157		-	writeSandboxConfig(t, root, sandboxRegistrationDocument(route))
158		-	return root
	181	+	layout := emptyProductionBrokerLayout(t, "")
	182	+	writeProductionBrokerDocument(t, sandboxRegistrationDocument(route))
	183	+	return layout
159	184		}
160	185
161		-	// loadTestRoute loads one sandbox configuration and returns the route its
	186	+	// loadTestRoute loads one production broker configuration and returns the route its
162	187		// resolver publishes, so a test can inspect a parsed route without the
163	188		// unexported brokerconfig fields.
164	189		func loadTestRoute(t *testing.T, route any) brokerconfig.Route {

@@ -167,15 +192,13 @@ func loadTestRoute(t *testing.T, route any) brokerconfig.Route {
167	192		return parsed
168	193		}
169	194
170		-	// loadTestRouteAndConfig loads one sandbox configuration and returns both the
	195	+	// loadTestRouteAndConfig loads one production broker configuration and returns both the
171	196		// immutable configuration and the route its resolver publishes, so a test can
172	197		// dial the route the way the broker does: with the whole resolved target.
173	198		func loadTestRouteAndConfig(t testing.T, route any) (brokerconfig.Config, brokerconfig.Route) {
174	199		t.Helper()
175		-	root := writeMuxRoot(t, route)
176		-	layout, err := offlineLayout(root)
177		-	require.NoError(t, err)
178		-	config, err := brokerconfig.Load(layout)
	200	+	layout := writeMuxRoot(t, route)
	201	+	config, err := brokerconfig.LoadProduction(layout, productionBrokerConfigPath(), "", localDaemonPolicy(), daemonmux.SocketPath(ipc.SocketDir()))
179	202		require.NoError(t, err)
180	203		resolved, err := config.Resolver().ResolveDialTarget(context.Background(), ports.BrokerOpenStreamRequest{
181	204		Purpose: ports.BrokerStreamControl,

@@ -209,7 +232,7 @@ func testMuxDialTarget(t testing.T, config brokerconfig.Config, route brokerco
209	232		return resolved
210	233		}
211	234
212		-	// loadTestRouteTarget loads one sandbox configuration and returns both the
	235	+	// loadTestRouteTarget loads one production broker configuration and returns both the
213	236		// parsed route and the exact resolved dial target the broker would publish for
214	237		// it, so a test can call dialBrokerRoute exactly as the pool does.
215	238		func loadTestRouteTarget(t *testing.T, route any) (brokerconfig.Route, ports.BrokerDialTarget) {

@@ -226,17 +249,14 @@ func TestParseBrokerMuxArgs(t *testing.T) {
226	249		wantErr string
227	250		want brokerMuxOptions
228	251		}{
229		-	{name: "valid", args: []string{"--offline-root", "/srv/sandbox"}, want: brokerMuxOptions{offlineRoot: "/srv/sandbox", startMode: ports.BrokerDaemonExistingOnly}},
230		-	{name: "explicit existing-only", args: []string{"--offline-root", "/srv/sandbox", brokerDaemonStartArg, "existing-only"}, want: brokerMuxOptions{offlineRoot: "/srv/sandbox", startMode: ports.BrokerDaemonExistingOnly}},
231		-	{name: "explicit if-needed", args: []string{"--offline-root", "/srv/sandbox", brokerDaemonStartArg, "if-needed"}, want: brokerMuxOptions{offlineRoot: "/srv/sandbox", startMode: ports.BrokerDaemonStartIfNeeded}},
232		-	{name: "missing root", args: nil, wantErr: "requires --offline-root"},
233		-	{name: "empty root", args: []string{"--offline-root", ""}, wantErr: "requires a path"},
234		-	{name: "duplicate root", args: []string{"--offline-root", "/a", "--offline-root", "/b"}, wantErr: "duplicate"},
235		-	{name: "unknown flag", args: []string{"--idle-grace", "1m"}, wantErr: "unknown flag"},
236		-	{name: "positional", args: []string{"--offline-root", "/a", "extra"}, wantErr: "positional"},
237		-	{name: "missing daemon-start value", args: []string{"--offline-root", "/a", brokerDaemonStartArg}, wantErr: "requires a value"},
238		-	{name: "duplicate daemon-start", args: []string{"--offline-root", "/a", brokerDaemonStartArg, "if-needed", brokerDaemonStartArg, "existing-only"}, wantErr: "duplicate"},
239		-	{name: "unknown daemon-start", args: []string{"--offline-root", "/a", brokerDaemonStartArg, "always"}, wantErr: "unknown daemon start mode"},
	252	+	{name: "valid", args: []string{"--production"}, want: brokerMuxOptions{production: true, startMode: ports.BrokerDaemonExistingOnly}},
	253	+	{name: "explicit existing-only", args: []string{"--production", brokerDaemonStartArg, "existing-only"}, want: brokerMuxOptions{production: true, startMode: ports.BrokerDaemonExistingOnly}},
	254	+	{name: "explicit if-needed", args: []string{"--production", brokerDaemonStartArg, "if-needed"}, want: brokerMuxOptions{production: true, startMode: ports.BrokerDaemonStartIfNeeded}},
	255	+	{name: "unknown flag", args: []string{"--production", "--idle-grace", "1m"}, wantErr: "unknown flag"},
	256	+	{name: "positional", args: []string{"--production", "extra"}, wantErr: "positional"},
	257	+	{name: "missing daemon-start value", args: []string{"--production", brokerDaemonStartArg}, wantErr: "requires a value"},
	258	+	{name: "duplicate daemon-start", args: []string{"--production", brokerDaemonStartArg, "if-needed", brokerDaemonStartArg, "existing-only"}, wantErr: "duplicate"},
	259	+	{name: "unknown daemon-start", args: []string{"--production", brokerDaemonStartArg, "always"}, wantErr: "unknown daemon start mode"},
240	260		}
241	261		for _, tt := range tests {
242	262		t.Run(tt.name, func(t *testing.T) {

@@ -264,10 +284,10 @@ func TestBrokerMuxHelpersHiddenFromPublicHelp(t *testing.T) {
264	284		{brokerMuxQUICProxyCommand, kindBrokerMuxQUICProxy},
265	285		} {
266	286		require.NotContains(t, usageText, tt.name)
267		-	command, err := parseArgs([]string{tt.name, "--offline-root", "/srv/sandbox"})
	287	+	command, err := parseArgs([]string{tt.name, "--production"})
268	288		require.NoError(t, err)
269	289		require.Equal(t, tt.kind, command.kind)
270		-	require.Equal(t, "/srv/sandbox", command.brokerMux.offlineRoot)
	290	+	require.True(t, command.brokerMux.production)
271	291		}
272	292		// Ordinary commands are untouched by the new hidden entries.
273	293		attach, err := parseArgs(nil)

@@ -282,11 +302,11 @@ func TestBrokerMuxHelpersHiddenFromPublicHelp(t *testing.T) {
282	302		// the option terminator, and the quoted remote argv, splices only the explicit
283	303		// trust inputs, and never disables host-key verification.
284	304		func TestSSHMuxCommandSpecPreservesTrustAndNoPTY(t *testing.T) {
285		-	isolateSandboxEnv(t)
	305	+	emptyProductionBrokerLayout(t, "")
286	306		route := loadTestRoute(t, map[string]any{
287	307		"kind": "ssh-stdio",
288	308		"target": "user@host:2222",
289		-	"argv": []any{"vev", brokerMuxStdioCommand, "--offline-root", "/srv/remote"},
	309	+	"argv": []any{"vev", brokerMuxStdioCommand, "--production"},
290	310		"trust": map[string]any{"knownHostsFile": "/etc/ssh/known_hosts", "connectTimeout": "30s"},
291	311		})
292	312		spec, err := sshMuxCommandSpec(route, ports.BrokerDaemonStartIfNeeded)

@@ -314,7 +334,7 @@ func TestSSHMuxCommandSpecPreservesTrustAndNoPTY(t *testing.T) {
314	334		plain := loadTestRoute(t, map[string]any{
315	335		"kind": "ssh-quic",
316	336		"target": "host",
317		-	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", "/srv/remote"},
	337	+	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
318	338		})
319	339		plainSpec, err := sshMuxCommandSpec(plain, ports.BrokerDaemonExistingOnly)
320	340		require.NoError(t, err)

@@ -327,11 +347,11 @@ func TestSSHMuxCommandSpecPreservesTrustAndNoPTY(t *testing.T) {
327	347		// unreadable start authorization: an unknown mode is refused instead of
328	348		// defaulting the helper to a permissive one.
329	349		func TestSSHMuxCommandSpecRefusesUnknownStartMode(t *testing.T) {
330		-	isolateSandboxEnv(t)
	350	+	emptyProductionBrokerLayout(t, "")
331	351		route := loadTestRoute(t, map[string]any{
332	352		"kind": "ssh-stdio",
333	353		"target": "host",
334		-	"argv": []any{"vev", brokerMuxStdioCommand, "--offline-root", "/srv/remote"},
	354	+	"argv": []any{"vev", brokerMuxStdioCommand, "--production"},
335	355		})
336	356		_, err := sshMuxCommandSpec(route, ports.BrokerDaemonStartMode(0))
337	357		require.Error(t, err)

@@ -340,17 +360,17 @@ func TestSSHMuxCommandSpecRefusesUnknownStartMode(t *testing.T) {
340	360		// TestSSHMuxCommandSpecTargetQuotesSpacesInsideArgv proves a remote argv word
341	361		// with a space stays one quoted word and never becomes a second option.
342	362		func TestSSHMuxCommandSpecTargetQuotesSpacesInsideArgv(t *testing.T) {
343		-	isolateSandboxEnv(t)
	363	+	emptyProductionBrokerLayout(t, "")
344	364		route := loadTestRoute(t, map[string]any{
345	365		"kind": "ssh-stdio",
346	366		"target": "host",
347		-	"argv": []any{"vev", "_broker-mux-stdio", "--offline-root", "/srv/with space"},
	367	+	"argv": []any{"vev", "_broker-mux-stdio", "--production", "with space"},
348	368		})
349	369		spec, err := sshMuxCommandSpec(route, ports.BrokerDaemonExistingOnly)
350	370		require.NoError(t, err)
351	371		// The whole remote command stays one quoted argv word, so the space-bearing
352	372		// path is still one word and never becomes a second option.
353		-	require.Contains(t, spec.Args[len(spec.Args)-1], `'/srv/with space'`)
	373	+	require.Contains(t, spec.Args[len(spec.Args)-1], `'with space'`)
354	374		require.Contains(t, spec.Args[len(spec.Args)-1], "'"+brokerDaemonStartArg+"' 'existing-only'")
355	375		}
356	376

@@ -382,9 +402,9 @@ func TestBrokerQUICPeerAddr(t *testing.T) {
382	402		}
383	403
384	404		func TestBrokerMuxHelperReturnsTypedNoDaemonExit(t *testing.T) {
385		-	isolateSandboxEnv(t)
386		-	root := writeMuxRoot(t, map[string]any{"kind": "unix", "path": filepath.Join(t.TempDir(), "missing-mux.sock")})
387		-	parsed, err := parseBrokerMuxArgs(brokerMuxStdioCommand, kindBrokerMuxStdio, []string{"--offline-root", root})
	405	+	emptyProductionBrokerLayout(t, "")
	406	+	emptyProductionBrokerLayout(t, "")
	407	+	parsed, err := parseBrokerMuxArgs(brokerMuxStdioCommand, kindBrokerMuxStdio, []string{"--production"})
388	408		require.NoError(t, err)
389	409		err = runBrokerMuxStdioCommand(context.Background(), parsed.brokerMux)
390	410		var coded *exitCoded

@@ -395,11 +415,9 @@ func TestBrokerMuxHelperReturnsTypedNoDaemonExit(t *testing.T) {
395	415		// TestBrokerMuxConnectorRejectsUnknownAddress proves the transport selector
396	416		// refuses any address the immutable configuration did not produce.
397	417		func TestBrokerMuxConnectorRejectsUnknownAddress(t *testing.T) {
398		-	isolateSandboxEnv(t)
399		-	root := writeMuxRoot(t, map[string]any{"kind": "unix", "path": "/tmp/unused-mux.sock"})
400		-	layout, err := offlineLayout(root)
401		-	require.NoError(t, err)
402		-	config, err := brokerconfig.Load(layout)
	418	+	emptyProductionBrokerLayout(t, "")
	419	+	layout := writeMuxRoot(t, map[string]any{"kind": "unix", "path": "/tmp/unused-mux.sock"})
	420	+	config, err := brokerconfig.LoadProduction(layout, productionBrokerConfigPath(), "", localDaemonPolicy(), daemonmux.SocketPath(ipc.SocketDir()))
403	421		require.NoError(t, err)
404	422		connector, err := brokerMuxConnector(config, slog.New(slog.NewTextHandler(io.Discard, nil)))
405	423		require.NoError(t, err)

@@ -415,70 +433,62 @@ func TestBrokerMuxConnectorRejectsUnknownAddress(t *testing.T) {
415	433		// stdio route: the broker dials the fake ssh child, the hidden helper bridges
416	434		// its stdio to a real unix daemonmux fixture, and a typed Ping returns a Pong.
417	435		func TestBrokerServeSSHStdioRouteRoundTrip(t *testing.T) {
418		-	env := newMuxTestEnv(t)
	436	+	newMuxTestEnv(t)
419	437		policy := brokerTestPolicy()
420		-	fixture := newBrokerMuxFixture(t, policy)
421		-	remoteRoot := writeMuxRoot(t, map[string]any{"kind": "unix", "path": fixture.route})
	438	+	fixture := remoteMuxFixture(t, policy)
422	439		argsFile := installFakeSSH(t, fakeSSHExecHelper)
423	440		t.Setenv(fakeSSHModeEnv, brokerMuxStdioCommand)
424		-	t.Setenv(fakeSSHRootEnv, remoteRoot)
425		-	localRoot := writeMuxRoot(t, map[string]any{
	441	+	writeMuxRoot(t, map[string]any{
426	442		"kind": "ssh-stdio",
427	443		"target": "user@muxhost:2222",
428		-	"argv": []any{"vev", brokerMuxStdioCommand, "--offline-root", remoteRoot},
429		-	"trust": map[string]any{"knownHostsFile": "/etc/ssh/known_hosts", "connectTimeout": "5s"},
	444	+	"argv": []any{"vev", brokerMuxStdioCommand, "--production"},
430	445		})
431	446
432		-	socketPath, stop := startMuxBrokerServe(t, localRoot)
	447	+	socketPath, stop := startMuxBrokerServe(t)
433	448		defer stop()
434	449		requireBrokerPing(t, socketPath)
435	450		require.Positive(t, fixture.streams.Load())
436	451
437		-	// The exact ssh argv was built by BuildCommandForMux plus the trust inputs.
	452	+	// The exact ssh argv was built by BuildCommandForMux with OpenSSH trust policy.
438	453		argv := readFileString(t, argsFile)
439	454		require.Contains(t, argv, "-T\n")
440	455		require.Contains(t, argv, "--\nuser@muxhost:2222\n")
441	456		require.Contains(t, argv, brokerMuxStdioCommand)
442		-	require.Contains(t, argv, "UserKnownHostsFile=/etc/ssh/known_hosts")
443		-	require.Contains(t, argv, "ConnectTimeout=5")
	457	+	require.NotContains(t, argv, "UserKnownHostsFile=")
444	458		require.NotContains(t, argv, "StrictHostKeyChecking")
445	459		require.NotContains(t, argv, "BatchMode")
446	460
447	461		stop()
448		-	env.requireProductionUntouched(t)
449	462		}
450	463
451	464		// TestBrokerServeSSHQUICRouteRoundTrip drives the full broker path over an
452	465		// SSH-authenticated QUIC route with a real loopback QUIC server and a real
453	466		// one-time credential.
454	467		func TestBrokerServeSSHQUICRouteRoundTrip(t *testing.T) {
455		-	env := newMuxTestEnv(t)
	468	+	newMuxTestEnv(t)
456	469		policy := brokerTestPolicy()
457		-	fixture := newBrokerMuxFixture(t, policy)
458		-	remoteRoot := writeMuxRoot(t, map[string]any{"kind": "unix", "path": fixture.route})
	470	+	fixture := remoteMuxFixture(t, policy)
459	471		installFakeSSH(t, fakeSSHExecHelper)
460	472		t.Setenv(fakeSSHModeEnv, brokerMuxQUICBootstrapCommand)
461		-	t.Setenv(fakeSSHRootEnv, remoteRoot)
462		-	localRoot := writeMuxRoot(t, map[string]any{
	473	+	writeMuxRoot(t, map[string]any{
463	474		"kind": "ssh-quic",
464	475		"target": "127.0.0.1",
465		-	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", remoteRoot},
	476	+	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
466	477		})
467	478
468		-	socketPath, stop := startMuxBrokerServe(t, localRoot)
	479	+	socketPath, stop := startMuxBrokerServe(t)
469	480		defer stop()
470	481		requireBrokerPing(t, socketPath)
471	482		require.Positive(t, fixture.streams.Load())
472	483
473	484		stop()
474		-	env.requireProductionUntouched(t)
475	485		}
476	486
477	487		// TestBrokerMuxQUICRejectsBadPinWithoutLeakingSecret proves the pinned dial
478	488		// fails closed on a wrong certificate pin and that the one-time credential
479	489		// never appears in the returned error.
480	490		func TestBrokerMuxQUICRejectsBadPinWithoutLeakingSecret(t *testing.T) {
481		-	isolateSandboxEnv(t)
	491	+	emptyProductionBrokerLayout(t, "")
482	492		installFakeSSH(t, fakeSSHEmitReadiness)
483	493
484	494		server, readiness, err := quic.NewServer()

@@ -492,7 +502,7 @@ func TestBrokerMuxQUICRejectsBadPinWithoutLeakingSecret(t *testing.T) {
492	502		route, target := loadTestRouteTarget(t, map[string]any{
493	503		"kind": "ssh-quic",
494	504		"target": "127.0.0.1",
495		-	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", "/srv/remote"},
	505	+	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
496	506		})
497	507		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
498	508		defer cancel()

@@ -504,7 +514,7 @@ func TestBrokerMuxQUICRejectsBadPinWithoutLeakingSecret(t *testing.T) {
504	514		// TestBrokerMuxQUICRejectsExpiredReadiness proves client-side parsing refuses
505	515		// an implausibly old credential before dialing and never echoes its secret.
506	516		func TestBrokerMuxQUICRejectsExpiredReadiness(t *testing.T) {
507		-	isolateSandboxEnv(t)
	517	+	emptyProductionBrokerLayout(t, "")
508	518		installFakeSSH(t, fakeSSHEmitReadiness)
509	519
510	520		token := base64.StdEncoding.EncodeToString([]byte(strings.Repeat("A", 32)))

@@ -522,7 +532,7 @@ func TestBrokerMuxQUICRejectsExpiredReadiness(t *testing.T) {
522	532		route, target := loadTestRouteTarget(t, map[string]any{
523	533		"kind": "ssh-quic",
524	534		"target": "127.0.0.1",
525		-	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", "/srv/remote"},
	535	+	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
526	536		})
527	537		_, err := dialBrokerRoute(context.Background(), route, target, slog.New(slog.NewTextHandler(io.Discard, nil)))
528	538		require.Error(t, err)

@@ -534,7 +544,7 @@ func TestBrokerMuxQUICRejectsExpiredReadiness(t *testing.T) {
534	544		// the bootstrap wait, a cancellation returns promptly, and the bootstrap child
535	545		// is killed and reaped rather than leaked.
536	546		func TestBrokerMuxDialCancellationReapsBootstrap(t *testing.T) {
537		-	isolateSandboxEnv(t)
	547	+	emptyProductionBrokerLayout(t, "")
538	548		installFakeSSH(t, fakeSSHSleep)
539	549		pidFile := filepath.Join(t.TempDir(), "ssh.pid")
540	550		t.Setenv(fakeSSHPIDEnv, pidFile)

@@ -542,7 +552,7 @@ func TestBrokerMuxDialCancellationReapsBootstrap(t *testing.T) {
542	552		route, target := loadTestRouteTarget(t, map[string]any{
543	553		"kind": "ssh-quic",
544	554		"target": "127.0.0.1",
545		-	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", "/srv/remote"},
	555	+	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
546	556		})
547	557		ctx, cancel := context.WithTimeout(context.Background(), 150*time.Millisecond)
548	558		defer cancel()

@@ -562,7 +572,7 @@ func TestBrokerMuxDialCancellationReapsBootstrap(t *testing.T) {
562	572		// under -race with -count>1, this fails if the os/exec copy goroutine is ever
563	573		// observed while it is still writing the sink.
564	574		func TestBrokerMuxDialFloodedStderrIsReapedAndSanitized(t *testing.T) {
565		-	isolateSandboxEnv(t)
	575	+	emptyProductionBrokerLayout(t, "")
566	576		installFakeSSH(t, fakeSSHFloodStderr)
567	577		pidFile := filepath.Join(t.TempDir(), "ssh.pid")
568	578		t.Setenv(fakeSSHPIDEnv, pidFile)

@@ -570,7 +580,7 @@ func TestBrokerMuxDialFloodedStderrIsReapedAndSanitized(t *testing.T) {
570	580		route, target := loadTestRouteTarget(t, map[string]any{
571	581		"kind": "ssh-quic",
572	582		"target": "127.0.0.1",
573		-	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", "/srv/remote"},
	583	+	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
574	584		})
575	585
576	586		var logs bytes.Buffer

@@ -602,7 +612,7 @@ func TestBrokerMuxDialFloodedStderrIsReapedAndSanitized(t *testing.T) {
602	612		// bound, and its child is killed and reaped. It is deterministic because the
603	613		// effective bound is narrowed to a test value instead of the production one.
604	614		func TestBrokerMuxDialStalledBootstrapUsesSetupTimeout(t *testing.T) {
605		-	isolateSandboxEnv(t)
	615	+	emptyProductionBrokerLayout(t, "")
606	616		installFakeSSH(t, fakeSSHStallNeverReady)
607	617		pidFile := filepath.Join(t.TempDir(), "ssh.pid")
608	618		t.Setenv(fakeSSHPIDEnv, pidFile)

@@ -614,7 +624,7 @@ func TestBrokerMuxDialStalledBootstrapUsesSetupTimeout(t *testing.T) {
614	624		route, target := loadTestRouteTarget(t, map[string]any{
615	625		"kind": "ssh-quic",
616	626		"target": "127.0.0.1",
617		-	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", "/srv/remote"},
	627	+	"argv": []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
618	628		})
619	629		start := time.Now()
620	630		_, err := dialBrokerRoute(context.Background(), route, target, slog.New(slog.NewTextHandler(io.Discard, nil)))

@@ -631,26 +641,25 @@ func TestBrokerMuxDialStalledBootstrapUsesSetupTimeout(t *testing.T) {
631	641		// TestBrokerServeUnixRouteRoundTrip proves the transport selector also handles
632	642		// the explicit unix route variant, not just the legacy path string.
633	643		func TestBrokerServeUnixRouteRoundTrip(t *testing.T) {
634		-	env := newMuxTestEnv(t)
	644	+	newMuxTestEnv(t)
635	645		fixture := newBrokerMuxFixture(t, brokerTestPolicy())
636		-	localRoot := writeMuxRoot(t, map[string]any{"kind": "unix", "path": fixture.route})
	646	+	writeMuxRoot(t, map[string]any{"kind": "unix", "path": fixture.route})
637	647
638		-	socketPath, stop := startMuxBrokerServe(t, localRoot)
	648	+	socketPath, stop := startMuxBrokerServe(t)
639	649		defer stop()
640	650		requireBrokerPing(t, socketPath)
641	651		require.Positive(t, fixture.streams.Load())
642	652
643	653		stop()
644		-	env.requireProductionUntouched(t)
645	654		}
646	655
647		-	// startMuxBrokerServe starts one offline broker over localRoot and returns its
	656	+	// startMuxBrokerServe starts one production broker and returns its
648	657		// socket path plus an idempotent stop.
649		-	func startMuxBrokerServe(t *testing.T, localRoot string) (string, func()) {
	658	+	func startMuxBrokerServe(t *testing.T) (string, func()) {
650	659		t.Helper()
651	660		deps, ready := testBrokerServeDeps(newSandboxClock())
652	661		ctx, cancel := context.WithCancel(context.Background())
653		-	done := runSandbox(ctx, brokerServeOptions{offlineRoot: localRoot}, deps)
	662	+	done := runSandbox(ctx, brokerServeOptions{production: true}, deps)
654	663		socketPath := awaitSandboxReady(t, ready, done)
655	664		var once bool
656	665		stop := func() {

@@ -720,18 +729,6 @@ func requireBrokerErrorHasNoReadiness(t *testing.T, err error, readiness quic.Re
720	729		require.NotContains(t, message, "nonce")
721	730		}
722	731
723		-	// requireProductionUntouched asserts no production runtime or state entry was
724		-	// created by the composition or its helpers.
725		-	func (e muxTestEnv) requireProductionUntouched(t testing.T) {
726		-	t.Helper()
727		-	requireProductionUntouched(t, e.prodRuntime, e.prodState)
728		-	entries, err := os.ReadDir(e.prodRuntime)
729		-	require.NoError(t, err)
730		-	for _, entry := range entries {
731		-	require.NotContains(t, entry.Name(), "daemon.sock", "helpers must never start an ordinary daemon")
732		-	}
733		-	}
734		-
735	732		func mustJSON(t *testing.T, value any) []byte {
736	733		t.Helper()
737	734		raw, err := json.Marshal(value)

 	"github.com/bnema/vev/internal/adapters/brokerconfig"
 	"github.com/bnema/vev/internal/adapters/brokeripc"
+	"github.com/bnema/vev/internal/adapters/daemonmux"
+	"github.com/bnema/vev/internal/adapters/ipc"
 	"github.com/bnema/vev/internal/adapters/quic"
 	"github.com/bnema/vev/internal/adapters/sshstdio"
 	"github.com/bnema/vev/internal/ports"
 // round trip proves pin, token, nonce, and daemonmux handshake all compose.
 const (
-	fakeSSHArgsEnv  = "VEV_TEST_SSH_ARGS"
+	fakeSSHArgsEnv    = "VEV_TEST_SSH_ARGS"
-	fakeSSHReadyEnv = "VEV_TEST_SSH_READY"
+	fakeSSHReadyEnv   = "VEV_TEST_SSH_READY"
-	fakeSSHPIDEnv   = "VEV_TEST_SSH_PID"
+	fakeSSHPIDEnv     = "VEV_TEST_SSH_PID"
-	fakeSSHBinEnv   = "VEV_TEST_SSH_BIN"
+	fakeSSHBinEnv     = "VEV_TEST_SSH_BIN"
-	fakeSSHModeEnv  = "VEV_TEST_SSH_MODE"
+	fakeSSHModeEnv    = "VEV_TEST_SSH_MODE"
-	fakeSSHRootEnv  = "VEV_TEST_SSH_REMOTE_ROOT"
+	fakeSSHRuntimeEnv = "VEV_TEST_SSH_REMOTE_RUNTIME"
+	fakeSSHStateEnv   = "VEV_TEST_SSH_REMOTE_STATE"
+	fakeSSHConfigEnv  = "VEV_TEST_SSH_REMOTE_CONFIG"
 )
 // fakeSSHExecHelper is an owned test ssh: it records its exact argv and then
 // re-executes this test binary as the named hidden mux helper against an
-// isolated remote sandbox. Its stdin/stdout remain the carriage pipes.
+// isolated remote production XDG layout. Its stdin/stdout remain the carriage pipes.
 const fakeSSHExecHelper = `#!/bin/sh
 printf '%s\n' "$@" > "$` + fakeSSHArgsEnv + `"
-exec "$` + fakeSSHBinEnv + `" "$` + fakeSSHModeEnv + `" --offline-root "$` + fakeSSHRootEnv + `"
+export XDG_RUNTIME_DIR="$` + fakeSSHRuntimeEnv + `"
+export XDG_STATE_HOME="$` + fakeSSHStateEnv + `"
+export XDG_CONFIG_HOME="$` + fakeSSHConfigEnv + `"
+exec "$` + fakeSSHBinEnv + `" "$` + fakeSSHModeEnv + `" --production
 `
 // fakeSSHEmitReadiness prints one controlled readiness line and exits, so a
 // muxTestEnv isolates production XDG roots and records every detached mux
 // helper so no test leaks a process.
 type muxTestEnv struct {
-	t                      *testing.T
+	t         *testing.T
-	prodRuntime, prodState string
+	recordDir string
-	recordDir              string
 }
 func newMuxTestEnv(t *testing.T) *muxTestEnv {
 	t.Helper()
-	_, prodRuntime, prodState := isolateSandboxEnv(t)
+	emptyProductionBrokerLayout(t, "")
 	recordDir := filepath.Join(shortTempDir(t, "vevm"), "r")
 	require.NoError(t, os.MkdirAll(recordDir, 0o700))
 	t.Setenv(brokerHelperEnv, "1")
 	t.Setenv(brokerHelperRecordDirEnv, recordDir)
-	env := &muxTestEnv{t: t, prodRuntime: prodRuntime, prodState: prodState, recordDir: recordDir}
+	env := &muxTestEnv{t: t, recordDir: recordDir}
 	t.Cleanup(env.cleanup)
 	return env
 }
+// remoteMuxFixture runs the SSH-side mux helper with a distinct production
+// XDG environment and a fixture listening at that environment's daemon path.
+func remoteMuxFixture(t *testing.T, policy ports.BrokerPolicy) *brokerMuxFixture {
+	t.Helper()
+	localRuntime, localState, localConfig := os.Getenv("XDG_RUNTIME_DIR"), os.Getenv("XDG_STATE_HOME"), os.Getenv("XDG_CONFIG_HOME")
+	remoteRuntime, remoteState, remoteConfig := shortTempDir(t, "vb"), shortTempDir(t, "vb"), shortTempDir(t, "vb")
+	t.Setenv("XDG_RUNTIME_DIR", remoteRuntime)
+	t.Setenv("XDG_STATE_HOME", remoteState)
+	t.Setenv("XDG_CONFIG_HOME", remoteConfig)
+	path := daemonmux.SocketPath(ipc.SocketDir())
+	fixture := newBrokerMuxFixtureAt(t, policy, path)
+	t.Setenv("XDG_RUNTIME_DIR", localRuntime)
+	t.Setenv("XDG_STATE_HOME", localState)
+	t.Setenv("XDG_CONFIG_HOME", localConfig)
+	t.Setenv(fakeSSHRuntimeEnv, remoteRuntime)
+	t.Setenv(fakeSSHStateEnv, remoteState)
+	t.Setenv(fakeSSHConfigEnv, remoteConfig)
+	return fixture
+}
 // cleanup kills every recorded mux helper process.
 func (e *muxTestEnv) cleanup() {
 	for _, role := range []string{brokerMuxStdioCommand, brokerMuxQUICBootstrapCommand, brokerMuxQUICProxyCommand} {
 	}
 }
-// writeMuxRoot writes one marker-valid sandbox root carrying a single
+// writeMuxRoot provisions one pinned host route in this test's production
-// registration with the supplied route object.
+// broker.json and returns the production layout for its reader.
-func writeMuxRoot(t *testing.T, route any) string {
+func writeMuxRoot(t *testing.T, route any) brokerconfig.Layout {
 	t.Helper()
-	root := filepath.Join(shortTempDir(t, "vevx"), "s")
+	layout := emptyProductionBrokerLayout(t, "")
-	require.NoError(t, os.MkdirAll(root, 0o700))
+	writeProductionBrokerDocument(t, sandboxRegistrationDocument(route))
-	writeSandboxConfig(t, root, sandboxRegistrationDocument(route))
+	return layout
-	return root
 }
-// loadTestRoute loads one sandbox configuration and returns the route its
+// loadTestRoute loads one production broker configuration and returns the route its
 // resolver publishes, so a test can inspect a parsed route without the
 // unexported brokerconfig fields.
 func loadTestRoute(t *testing.T, route any) brokerconfig.Route {
 	return parsed
 }
-// loadTestRouteAndConfig loads one sandbox configuration and returns both the
+// loadTestRouteAndConfig loads one production broker configuration and returns both the
 // immutable configuration and the route its resolver publishes, so a test can
 // dial the route the way the broker does: with the whole resolved target.
 func loadTestRouteAndConfig(t *testing.T, route any) (*brokerconfig.Config, brokerconfig.Route) {
 	t.Helper()
-	root := writeMuxRoot(t, route)
+	layout := writeMuxRoot(t, route)
-	layout, err := offlineLayout(root)
+	config, err := brokerconfig.LoadProduction(layout, productionBrokerConfigPath(), "", localDaemonPolicy(), daemonmux.SocketPath(ipc.SocketDir()))
-	require.NoError(t, err)
-	config, err := brokerconfig.Load(layout)
 	require.NoError(t, err)
 	resolved, err := config.Resolver().ResolveDialTarget(context.Background(), ports.BrokerOpenStreamRequest{
 		Purpose:      ports.BrokerStreamControl,
 	return resolved
 }
-// loadTestRouteTarget loads one sandbox configuration and returns both the
+// loadTestRouteTarget loads one production broker configuration and returns both the
 // parsed route and the exact resolved dial target the broker would publish for
 // it, so a test can call dialBrokerRoute exactly as the pool does.
 func loadTestRouteTarget(t *testing.T, route any) (brokerconfig.Route, ports.BrokerDialTarget) {
 		wantErr string
 		want    brokerMuxOptions
 	}{
-		{name: "valid", args: []string{"--offline-root", "/srv/sandbox"}, want: brokerMuxOptions{offlineRoot: "/srv/sandbox", startMode: ports.BrokerDaemonExistingOnly}},
+		{name: "valid", args: []string{"--production"}, want: brokerMuxOptions{production: true, startMode: ports.BrokerDaemonExistingOnly}},
-		{name: "explicit existing-only", args: []string{"--offline-root", "/srv/sandbox", brokerDaemonStartArg, "existing-only"}, want: brokerMuxOptions{offlineRoot: "/srv/sandbox", startMode: ports.BrokerDaemonExistingOnly}},
+		{name: "explicit existing-only", args: []string{"--production", brokerDaemonStartArg, "existing-only"}, want: brokerMuxOptions{production: true, startMode: ports.BrokerDaemonExistingOnly}},
-		{name: "explicit if-needed", args: []string{"--offline-root", "/srv/sandbox", brokerDaemonStartArg, "if-needed"}, want: brokerMuxOptions{offlineRoot: "/srv/sandbox", startMode: ports.BrokerDaemonStartIfNeeded}},
+		{name: "explicit if-needed", args: []string{"--production", brokerDaemonStartArg, "if-needed"}, want: brokerMuxOptions{production: true, startMode: ports.BrokerDaemonStartIfNeeded}},
-		{name: "missing root", args: nil, wantErr: "requires --offline-root"},
+		{name: "unknown flag", args: []string{"--production", "--idle-grace", "1m"}, wantErr: "unknown flag"},
-		{name: "empty root", args: []string{"--offline-root", ""}, wantErr: "requires a path"},
+		{name: "positional", args: []string{"--production", "extra"}, wantErr: "positional"},
-		{name: "duplicate root", args: []string{"--offline-root", "/a", "--offline-root", "/b"}, wantErr: "duplicate"},
+		{name: "missing daemon-start value", args: []string{"--production", brokerDaemonStartArg}, wantErr: "requires a value"},
-		{name: "unknown flag", args: []string{"--idle-grace", "1m"}, wantErr: "unknown flag"},
+		{name: "duplicate daemon-start", args: []string{"--production", brokerDaemonStartArg, "if-needed", brokerDaemonStartArg, "existing-only"}, wantErr: "duplicate"},
-		{name: "positional", args: []string{"--offline-root", "/a", "extra"}, wantErr: "positional"},
+		{name: "unknown daemon-start", args: []string{"--production", brokerDaemonStartArg, "always"}, wantErr: "unknown daemon start mode"},
-		{name: "missing daemon-start value", args: []string{"--offline-root", "/a", brokerDaemonStartArg}, wantErr: "requires a value"},
-		{name: "duplicate daemon-start", args: []string{"--offline-root", "/a", brokerDaemonStartArg, "if-needed", brokerDaemonStartArg, "existing-only"}, wantErr: "duplicate"},
-		{name: "unknown daemon-start", args: []string{"--offline-root", "/a", brokerDaemonStartArg, "always"}, wantErr: "unknown daemon start mode"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 		{brokerMuxQUICProxyCommand, kindBrokerMuxQUICProxy},
 	} {
 		require.NotContains(t, usageText, tt.name)
-		command, err := parseArgs([]string{tt.name, "--offline-root", "/srv/sandbox"})
+		command, err := parseArgs([]string{tt.name, "--production"})
 		require.NoError(t, err)
 		require.Equal(t, tt.kind, command.kind)
-		require.Equal(t, "/srv/sandbox", command.brokerMux.offlineRoot)
+		require.True(t, command.brokerMux.production)
 	}
 	// Ordinary commands are untouched by the new hidden entries.
 	attach, err := parseArgs(nil)
 // the option terminator, and the quoted remote argv, splices only the explicit
 // trust inputs, and never disables host-key verification.
 func TestSSHMuxCommandSpecPreservesTrustAndNoPTY(t *testing.T) {
-	isolateSandboxEnv(t)
+	emptyProductionBrokerLayout(t, "")
 	route := loadTestRoute(t, map[string]any{
 		"kind":   "ssh-stdio",
 		"target": "user@host:2222",
-		"argv":   []any{"vev", brokerMuxStdioCommand, "--offline-root", "/srv/remote"},
+		"argv":   []any{"vev", brokerMuxStdioCommand, "--production"},
 		"trust":  map[string]any{"knownHostsFile": "/etc/ssh/known_hosts", "connectTimeout": "30s"},
 	})
 	spec, err := sshMuxCommandSpec(route, ports.BrokerDaemonStartIfNeeded)
 	plain := loadTestRoute(t, map[string]any{
 		"kind":   "ssh-quic",
 		"target": "host",
-		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", "/srv/remote"},
+		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
 	})
 	plainSpec, err := sshMuxCommandSpec(plain, ports.BrokerDaemonExistingOnly)
 	require.NoError(t, err)
 // unreadable start authorization: an unknown mode is refused instead of
 // defaulting the helper to a permissive one.
 func TestSSHMuxCommandSpecRefusesUnknownStartMode(t *testing.T) {
-	isolateSandboxEnv(t)
+	emptyProductionBrokerLayout(t, "")
 	route := loadTestRoute(t, map[string]any{
 		"kind":   "ssh-stdio",
 		"target": "host",
-		"argv":   []any{"vev", brokerMuxStdioCommand, "--offline-root", "/srv/remote"},
+		"argv":   []any{"vev", brokerMuxStdioCommand, "--production"},
 	})
 	_, err := sshMuxCommandSpec(route, ports.BrokerDaemonStartMode(0))
 	require.Error(t, err)
 // TestSSHMuxCommandSpecTargetQuotesSpacesInsideArgv proves a remote argv word
 // with a space stays one quoted word and never becomes a second option.
 func TestSSHMuxCommandSpecTargetQuotesSpacesInsideArgv(t *testing.T) {
-	isolateSandboxEnv(t)
+	emptyProductionBrokerLayout(t, "")
 	route := loadTestRoute(t, map[string]any{
 		"kind":   "ssh-stdio",
 		"target": "host",
-		"argv":   []any{"vev", "_broker-mux-stdio", "--offline-root", "/srv/with space"},
+		"argv":   []any{"vev", "_broker-mux-stdio", "--production", "with space"},
 	})
 	spec, err := sshMuxCommandSpec(route, ports.BrokerDaemonExistingOnly)
 	require.NoError(t, err)
 	// The whole remote command stays one quoted argv word, so the space-bearing
 	// path is still one word and never becomes a second option.
-	require.Contains(t, spec.Args[len(spec.Args)-1], `'/srv/with space'`)
+	require.Contains(t, spec.Args[len(spec.Args)-1], `'with space'`)
 	require.Contains(t, spec.Args[len(spec.Args)-1], "'"+brokerDaemonStartArg+"' 'existing-only'")
 }
 }
 func TestBrokerMuxHelperReturnsTypedNoDaemonExit(t *testing.T) {
-	isolateSandboxEnv(t)
+	emptyProductionBrokerLayout(t, "")
-	root := writeMuxRoot(t, map[string]any{"kind": "unix", "path": filepath.Join(t.TempDir(), "missing-mux.sock")})
+	emptyProductionBrokerLayout(t, "")
-	parsed, err := parseBrokerMuxArgs(brokerMuxStdioCommand, kindBrokerMuxStdio, []string{"--offline-root", root})
+	parsed, err := parseBrokerMuxArgs(brokerMuxStdioCommand, kindBrokerMuxStdio, []string{"--production"})
 	require.NoError(t, err)
 	err = runBrokerMuxStdioCommand(context.Background(), parsed.brokerMux)
 	var coded *exitCoded
 // TestBrokerMuxConnectorRejectsUnknownAddress proves the transport selector
 // refuses any address the immutable configuration did not produce.
 func TestBrokerMuxConnectorRejectsUnknownAddress(t *testing.T) {
-	isolateSandboxEnv(t)
+	emptyProductionBrokerLayout(t, "")
-	root := writeMuxRoot(t, map[string]any{"kind": "unix", "path": "/tmp/unused-mux.sock"})
+	layout := writeMuxRoot(t, map[string]any{"kind": "unix", "path": "/tmp/unused-mux.sock"})
-	layout, err := offlineLayout(root)
+	config, err := brokerconfig.LoadProduction(layout, productionBrokerConfigPath(), "", localDaemonPolicy(), daemonmux.SocketPath(ipc.SocketDir()))
-	require.NoError(t, err)
-	config, err := brokerconfig.Load(layout)
 	require.NoError(t, err)
 	connector, err := brokerMuxConnector(config, slog.New(slog.NewTextHandler(io.Discard, nil)))
 	require.NoError(t, err)
 // stdio route: the broker dials the fake ssh child, the hidden helper bridges
 // its stdio to a real unix daemonmux fixture, and a typed Ping returns a Pong.
 func TestBrokerServeSSHStdioRouteRoundTrip(t *testing.T) {
-	env := newMuxTestEnv(t)
+	newMuxTestEnv(t)
 	policy := brokerTestPolicy()
-	fixture := newBrokerMuxFixture(t, policy)
+	fixture := remoteMuxFixture(t, policy)
-	remoteRoot := writeMuxRoot(t, map[string]any{"kind": "unix", "path": fixture.route})
 	argsFile := installFakeSSH(t, fakeSSHExecHelper)
 	t.Setenv(fakeSSHModeEnv, brokerMuxStdioCommand)
-	t.Setenv(fakeSSHRootEnv, remoteRoot)
+	writeMuxRoot(t, map[string]any{
-	localRoot := writeMuxRoot(t, map[string]any{
 		"kind":   "ssh-stdio",
 		"target": "user@muxhost:2222",
-		"argv":   []any{"vev", brokerMuxStdioCommand, "--offline-root", remoteRoot},
+		"argv":   []any{"vev", brokerMuxStdioCommand, "--production"},
-		"trust":  map[string]any{"knownHostsFile": "/etc/ssh/known_hosts", "connectTimeout": "5s"},
 	})
-	socketPath, stop := startMuxBrokerServe(t, localRoot)
+	socketPath, stop := startMuxBrokerServe(t)
 	defer stop()
 	requireBrokerPing(t, socketPath)
 	require.Positive(t, fixture.streams.Load())
-	// The exact ssh argv was built by BuildCommandForMux plus the trust inputs.
+	// The exact ssh argv was built by BuildCommandForMux with OpenSSH trust policy.
 	argv := readFileString(t, argsFile)
 	require.Contains(t, argv, "-T\n")
 	require.Contains(t, argv, "--\nuser@muxhost:2222\n")
 	require.Contains(t, argv, brokerMuxStdioCommand)
-	require.Contains(t, argv, "UserKnownHostsFile=/etc/ssh/known_hosts")
+	require.NotContains(t, argv, "UserKnownHostsFile=")
-	require.Contains(t, argv, "ConnectTimeout=5")
 	require.NotContains(t, argv, "StrictHostKeyChecking")
 	require.NotContains(t, argv, "BatchMode")
 	stop()
-	env.requireProductionUntouched(t)
 }
 // TestBrokerServeSSHQUICRouteRoundTrip drives the full broker path over an
 // SSH-authenticated QUIC route with a real loopback QUIC server and a real
 // one-time credential.
 func TestBrokerServeSSHQUICRouteRoundTrip(t *testing.T) {
-	env := newMuxTestEnv(t)
+	newMuxTestEnv(t)
 	policy := brokerTestPolicy()
-	fixture := newBrokerMuxFixture(t, policy)
+	fixture := remoteMuxFixture(t, policy)
-	remoteRoot := writeMuxRoot(t, map[string]any{"kind": "unix", "path": fixture.route})
 	installFakeSSH(t, fakeSSHExecHelper)
 	t.Setenv(fakeSSHModeEnv, brokerMuxQUICBootstrapCommand)
-	t.Setenv(fakeSSHRootEnv, remoteRoot)
+	writeMuxRoot(t, map[string]any{
-	localRoot := writeMuxRoot(t, map[string]any{
 		"kind":   "ssh-quic",
 		"target": "127.0.0.1",
-		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", remoteRoot},
+		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
 	})
-	socketPath, stop := startMuxBrokerServe(t, localRoot)
+	socketPath, stop := startMuxBrokerServe(t)
 	defer stop()
 	requireBrokerPing(t, socketPath)
 	require.Positive(t, fixture.streams.Load())
 	stop()
-	env.requireProductionUntouched(t)
 }
 // TestBrokerMuxQUICRejectsBadPinWithoutLeakingSecret proves the pinned dial
 // fails closed on a wrong certificate pin and that the one-time credential
 // never appears in the returned error.
 func TestBrokerMuxQUICRejectsBadPinWithoutLeakingSecret(t *testing.T) {
-	isolateSandboxEnv(t)
+	emptyProductionBrokerLayout(t, "")
 	installFakeSSH(t, fakeSSHEmitReadiness)
 	server, readiness, err := quic.NewServer()
 	route, target := loadTestRouteTarget(t, map[string]any{
 		"kind":   "ssh-quic",
 		"target": "127.0.0.1",
-		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", "/srv/remote"},
+		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
 	})
 	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
 	defer cancel()
 // TestBrokerMuxQUICRejectsExpiredReadiness proves client-side parsing refuses
 // an implausibly old credential before dialing and never echoes its secret.
 func TestBrokerMuxQUICRejectsExpiredReadiness(t *testing.T) {
-	isolateSandboxEnv(t)
+	emptyProductionBrokerLayout(t, "")
 	installFakeSSH(t, fakeSSHEmitReadiness)
 	token := base64.StdEncoding.EncodeToString([]byte(strings.Repeat("A", 32)))
 	route, target := loadTestRouteTarget(t, map[string]any{
 		"kind":   "ssh-quic",
 		"target": "127.0.0.1",
-		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", "/srv/remote"},
+		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
 	})
 	_, err := dialBrokerRoute(context.Background(), route, target, slog.New(slog.NewTextHandler(io.Discard, nil)))
 	require.Error(t, err)
 // the bootstrap wait, a cancellation returns promptly, and the bootstrap child
 // is killed and reaped rather than leaked.
 func TestBrokerMuxDialCancellationReapsBootstrap(t *testing.T) {
-	isolateSandboxEnv(t)
+	emptyProductionBrokerLayout(t, "")
 	installFakeSSH(t, fakeSSHSleep)
 	pidFile := filepath.Join(t.TempDir(), "ssh.pid")
 	t.Setenv(fakeSSHPIDEnv, pidFile)
 	route, target := loadTestRouteTarget(t, map[string]any{
 		"kind":   "ssh-quic",
 		"target": "127.0.0.1",
-		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", "/srv/remote"},
+		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
 	})
 	ctx, cancel := context.WithTimeout(context.Background(), 150*time.Millisecond)
 	defer cancel()
 // under -race with -count>1, this fails if the os/exec copy goroutine is ever
 // observed while it is still writing the sink.
 func TestBrokerMuxDialFloodedStderrIsReapedAndSanitized(t *testing.T) {
-	isolateSandboxEnv(t)
+	emptyProductionBrokerLayout(t, "")
 	installFakeSSH(t, fakeSSHFloodStderr)
 	pidFile := filepath.Join(t.TempDir(), "ssh.pid")
 	t.Setenv(fakeSSHPIDEnv, pidFile)
 	route, target := loadTestRouteTarget(t, map[string]any{
 		"kind":   "ssh-quic",
 		"target": "127.0.0.1",
-		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", "/srv/remote"},
+		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
 	})
 	var logs bytes.Buffer
 // bound, and its child is killed and reaped. It is deterministic because the
 // effective bound is narrowed to a test value instead of the production one.
 func TestBrokerMuxDialStalledBootstrapUsesSetupTimeout(t *testing.T) {
-	isolateSandboxEnv(t)
+	emptyProductionBrokerLayout(t, "")
 	installFakeSSH(t, fakeSSHStallNeverReady)
 	pidFile := filepath.Join(t.TempDir(), "ssh.pid")
 	t.Setenv(fakeSSHPIDEnv, pidFile)
 	route, target := loadTestRouteTarget(t, map[string]any{
 		"kind":   "ssh-quic",
 		"target": "127.0.0.1",
-		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--offline-root", "/srv/remote"},
+		"argv":   []any{"vev", brokerMuxQUICBootstrapCommand, "--production"},
 	})
 	start := time.Now()
 	_, err := dialBrokerRoute(context.Background(), route, target, slog.New(slog.NewTextHandler(io.Discard, nil)))
 // TestBrokerServeUnixRouteRoundTrip proves the transport selector also handles
 // the explicit unix route variant, not just the legacy path string.
 func TestBrokerServeUnixRouteRoundTrip(t *testing.T) {
-	env := newMuxTestEnv(t)
+	newMuxTestEnv(t)
 	fixture := newBrokerMuxFixture(t, brokerTestPolicy())
-	localRoot := writeMuxRoot(t, map[string]any{"kind": "unix", "path": fixture.route})
+	writeMuxRoot(t, map[string]any{"kind": "unix", "path": fixture.route})
-	socketPath, stop := startMuxBrokerServe(t, localRoot)
+	socketPath, stop := startMuxBrokerServe(t)
 	defer stop()
 	requireBrokerPing(t, socketPath)
 	require.Positive(t, fixture.streams.Load())
 	stop()
-	env.requireProductionUntouched(t)
 }
-// startMuxBrokerServe starts one offline broker over localRoot and returns its
+// startMuxBrokerServe starts one production broker and returns its
 // socket path plus an idempotent stop.
-func startMuxBrokerServe(t *testing.T, localRoot string) (string, func()) {
+func startMuxBrokerServe(t *testing.T) (string, func()) {
 	t.Helper()
 	deps, ready := testBrokerServeDeps(newSandboxClock())
 	ctx, cancel := context.WithCancel(context.Background())
-	done := runSandbox(ctx, brokerServeOptions{offlineRoot: localRoot}, deps)
+	done := runSandbox(ctx, brokerServeOptions{production: true}, deps)
 	socketPath := awaitSandboxReady(t, ready, done)
 	var once bool
 	stop := func() {
 	require.NotContains(t, message, "nonce")
 }
-// requireProductionUntouched asserts no production runtime or state entry was
-// created by the composition or its helpers.
-func (e *muxTestEnv) requireProductionUntouched(t *testing.T) {
-	t.Helper()
-	requireProductionUntouched(t, e.prodRuntime, e.prodState)
-	entries, err := os.ReadDir(e.prodRuntime)
-	require.NoError(t, err)
-	for _, entry := range entries {
-		require.NotContains(t, entry.Name(), "daemon.sock", "helpers must never start an ordinary daemon")
-	}
-}
 func mustJSON(t *testing.T, value any) []byte {
 	t.Helper()
 	raw, err := json.Marshal(value)

M internal/app/broker_offline_test.go +7 -1


@@ -478,7 +478,13 @@ func newBrokerMuxFixture(t testing.T, policy ports.BrokerPolicy) brokerMuxFixt
478	478		t.Helper()
479	479		routeDir := t.TempDir()
480	480		require.NoError(t, os.Chmod(routeDir, 0o700))
481		-	route := filepath.Join(routeDir, "mux.sock")
	481	+	return newBrokerMuxFixtureAt(t, policy, filepath.Join(routeDir, "mux.sock"))
	482	+	}
	483	+
	484	+	// newBrokerMuxFixtureAt binds at a caller-chosen production daemonmux path.
	485	+	func newBrokerMuxFixtureAt(t testing.T, policy ports.BrokerPolicy, route string) brokerMuxFixture {
	486	+	t.Helper()
	487	+	require.NoError(t, os.MkdirAll(filepath.Dir(route), 0o700))
482	488		listener, err := ipc.ListenMux(route)
483	489		require.NoError(t, err)
484	490

 	t.Helper()
 	routeDir := t.TempDir()
 	require.NoError(t, os.Chmod(routeDir, 0o700))
-	route := filepath.Join(routeDir, "mux.sock")
+	return newBrokerMuxFixtureAt(t, policy, filepath.Join(routeDir, "mux.sock"))
+}
+// newBrokerMuxFixtureAt binds at a caller-chosen production daemonmux path.
+func newBrokerMuxFixtureAt(t *testing.T, policy ports.BrokerPolicy, route string) *brokerMuxFixture {
+	t.Helper()
+	require.NoError(t, os.MkdirAll(filepath.Dir(route), 0o700))
 	listener, err := ipc.ListenMux(route)
 	require.NoError(t, err)