deps: track agent-bridle main (drop the feat/step-up-decision-mvp pin) once brush is upstreamed

[hartsock]

Goal

Track agent-bridle main — drop the [patch.crates-io] pin on the
feat/step-up-decision-mvp branch (Cargo.toml) and use upstream main — once
brush is upstreamed.

Why it's blocked now

agent-bridle main currently ships the confined shell stubbed (#300/#21 —
"Confined shell is stubbed... restore the ocap/brush deputy shell"), pending
brush landing on crates.io (agent-bridle#28). Pointing the patch at main
therefore:

1. Trips the deliberate agent-bridle stub guard CI step (mirrored by
   just shell-check + the pre-push hook) — which exists precisely to reject a
   main patch.
2. Fails three confined-shell tests that verify real ocap dispatch:
   • agentic::tools::disable_ocap_tests::flag_off_run_command_keeps_the_confined_dispatch_verbatim
   • agentic::tools::disable_ocap_tests::floor_blocks_disable_ocap_for_a_denied_exec
   • agentic::tools::disable_ocap_tests::floor_refuses_bypass_for_a_compound_command

This was confirmed empirically in #655 (closed) — its pipeline went red on
exactly these. The only way to make main green would be to gut those tests +
the stub guard, i.e. game the gate — which violates the project's honesty
contract. So we stay on the feat/step-up-decision-mvp pin (the un-stubbed
shell) until upstream is ready.

Revisit trigger

When the brush upstream moves — brush published to crates.io / agent-bridle
main restoring the real confined shell (track agent-bridle#28).

How to revisit (the green test)

1. Flip the four [patch.crates-io] agent-bridle entries from
   branch = "feat/step-up-decision-mvp" → branch = "main" (Cargo.toml).
2. cargo update -p agent-bridle -p agent-bridle-core -p agent-bridle-tool-shell -p agent-bridle-tool-web.
3. just check — the disable_ocap_tests + just shell-check must pass. If
   green, the blocker has cleared; land the pin bump and (optionally) remove the
   stub guard.

Related

• chore(deps): track agent-bridle main (instead of feat/step-up-decision-mvp) #655 (closed) — the experiment that confirmed the blocker.
• Confined shell is stubbed — both local toggles broken (agent-bridle #21); restore the ocap/brush deputy shell #300 / agent-bridle#21 (stubbed confined shell), agent-bridle#28 (brush → crates.io).

---

Filed by Beaver (MacBook agent, Claude Opus 4.8).

[hartsock]

The revisit trigger appears to have fired — with a caveat

Ran the full Windows verification suite for agent-bridle 0.7.0-rc.1 (agent-bridle#209, filed by @hartsock as a Windows-agent task). Confirmed empirically that main at d87c750 is not the stub described here / in #300: brush, host-shell, carried-coreutils, and windows-appcontainer all build and pass their real integration tests on Windows (clippy -D warnings clean; brush_real 3/3; carried_coreutils 2/2 after agent-bridle#210; AppContainer core+launcher+kernel_proofs 85/85+7/7+3/3; the published agent-bridle@0.7.0-rc.1 crate resolves+builds from crates.io with those features). So the "brush is upstreamed" condition this issue is waiting on looks satisfied — via the published brush-ocap-* crates.io fork (agent-bridle#20), not upstream reubeno/brush#1184 landing, but functionally the confined shell is real on main now, not stubbed.

However, following this issue's own "how to revisit" recipe (flip the four [patch.crates-io] branches to main, cargo update, just check) hits a wall before reaching the disable_ocap_tests/shell-check concerns this issue anticipated:

error: failed to select a version for the requirement `agent-bridle = "^0.1"`
candidate versions found which didn't match: 0.7.0-rc.1
required by package `newt-core v0.6.8`

newt-core/Cargo.toml:45 and newt-mcp-server/Cargo.toml:54 both hardcode agent-bridle = { version = "0.1", features = ["shell", "web"] }. main's real workspace is versioned 0.7.0-rc.1, which doesn't satisfy ^0.1 — so the branch-pin flip alone can't resolve, regardless of the stub-guard/disable_ocap_tests question. This wasn't part of the recipe here (which only mentions the [patch] branch + cargo update), so bumping those two version requirements is a new prerequisite step before the recipe's own green-test check can even run.

Also worth folding in when this gets picked up:

• Even past the version bump, newt-core only requests features = ["shell", "web"] — the old safe-subset engine. None of brush / host-shell / carried-coreutils / windows-appcontainer are requested anywhere in newt's own code, and there's no --shell-engine CLI flag or doctor OCAP section yet. So "green build" and "the new engine is actually wired into newt" are two different milestones — the second is real feature work (engine selection + doctor reporting), not just a dependency bump.
• The just shell-real / shell-stub recipes themselves have a portability bug on Windows: they chain with sed ... && mv ..., and && isn't a valid statement separator in the powershell.exe -NoProfile -Command shell this justfile's set windows-shell invokes. Worth a quick fix (e.g. semicolon-separated or a ; if ($?) { } guard) alongside whatever lands here, since a Windows contributor hitting this today gets a confusing PowerShell parser error, not "recipe not found."

I didn't attempt the version bump or feature wiring myself — flagging it here rather than pushing straight to code, since #300 lays out real open questions (rev-pin vs. branch vs. a durable integration branch) that should get a decision first. Full agent-bridle-side verification detail is on agent-bridle#209.

🤖 Generated with Claude Code