# Warden Bootstrap Preflight

Use this file before creating the control-plane jail.

## Required host state

- FreeBSD host
- Bastille installed
- `15.0-RELEASE` bootstrapped
- `warden0` exists
- `warden0` has `192.168.100.1/24`
- if jail egress is required immediately, `pf` NAT is already in place

## Canonical planning command

```sh
npx tsx setup/index.ts --step jail --plan-control-plane
```

Expected:
- `STATUS: success`
- `BRIDGE_EXISTS: true`
- `BRIDGE_HAS_GATEWAY: true`
- `RELEASE_BOOTSTRAPPED: true`

