test(scale): qualify Fly filesystem exact path

.dockerignore

@@ -0,0 +1,12 @@
+.git
+.venv
+target
+bazel-*
+build
+dist
+node_modules
+*.env
+.env*
+*.pem
+*.key
+fly-qualification-evidence.json

.github/workflows/test.yml

@@ -77,6 +77,9 @@ jobs:
       - name: Test CodSpeed nightly policy
         run: python3 scripts/ci/test-codspeed-nightly.py
 
+      - name: Test Fly qualification safety contract
+        run: python3 scripts/ci/test-fly-filesystem-safety-contract.py
+
       - name: Test Repository Policy suite classifier
         run: scripts/ci/test-classify-policy-suites.sh
 

BUILD.bazel

@@ -166,7 +166,10 @@ build_test(
 # Deterministic CI target groups (#8 / #1 step 5).
 test_suite(
     name = "unit_tests",
-    tests = [":first_party_lib_tests"],
+    tests = [
+        ":first_party_lib_tests",
+        "//crates/graphforge-api:graphforge_fly_filesystem_smoke_test",
+    ],
 )
 
 test_suite(

containers/fly-filesystem-qualification/Dockerfile

@@ -0,0 +1,12 @@
+FROM rust:1.90-bookworm AS build
+WORKDIR /source
+COPY . .
+RUN cargo build --locked --release -p graphforge-api --bin graphforge-fly-filesystem-smoke
+
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates coreutils \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=build /source/target/release/graphforge-fly-filesystem-smoke /usr/local/bin/graphforge-fly-filesystem-smoke
+COPY containers/fly-filesystem-qualification/run-smoke.sh /usr/local/bin/run-fly-filesystem-smoke
+RUN chmod 0555 /usr/local/bin/run-fly-filesystem-smoke /usr/local/bin/graphforge-fly-filesystem-smoke
+ENTRYPOINT ["/usr/local/bin/run-fly-filesystem-smoke"]

containers/fly-filesystem-qualification/run-smoke.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+set -eu
+
+evidence=/work/fly-qualification-evidence.json
+ack=/work/controller-ack
+temporary=/work/.fly-qualification-evidence.json.tmp
+if [ "$(stat -c %d /work)" = "$(stat -c %d /)" ]; then
+  echo "qualification work root is not an attached mount" >&2
+  exit 3
+fi
+rm -f "$ack" "$evidence" "$temporary"
+export TMPDIR=/work
+
+# Budget chain: 900s probe, 930s TERM backstop plus 30s KILL grace, then a
+# 300s evidence-ack wait. The controller retrieval window must cover the probe
+# and grace; cleanup remains the final bounded backstop.
+set +e
+timeout --signal=TERM --kill-after=30s 930s \
+  /usr/local/bin/graphforge-fly-filesystem-smoke \
+  --work-root /work --evidence-out "$evidence" --timeout-s 900
+status=$?
+set -e
+
+# Keep the auto-destroy Machine available only long enough for retrieval.
+remaining=300
+while [ ! -f "$ack" ] && [ "$remaining" -gt 0 ]; do
+  sleep 1
+  remaining=$((remaining - 1))
+done
+exit "$status"

crates/graphforge-api/BUILD.bazel

@@ -600,3 +600,16 @@ build_test(
     name = "api_example_bins",
     targets = [":%s" % name for name in _EXAMPLE_NAMES],
 )
+
+gf_rust_binary(
+    name = "graphforge-fly-filesystem-smoke",
+    srcs = ["src/bin/graphforge-fly-filesystem-smoke.rs"],
+    deps = _API_DEPS + [":graphforge_api"],
+)
+
+gf_rust_integration_test(
+    name = "graphforge_fly_filesystem_smoke_test",
+    srcs = ["src/bin/graphforge-fly-filesystem-smoke.rs"],
+    crate = ":graphforge_api",
+    deps = _API_DEPS,
+)