Land the CLI-driveability steps from HIVE-ONBOARDING that replace the
first-proof runbook's manual SQLite/raw-socket steps:
- register-tenant TENANT_ID JAIL_ROOT_PATH COLLECTION_ID (client + daemon
RegisterTenant -> store::register_tenant), plus list-tenants. The 1:1:1
tenant=jail=collection map is now socket-driveable. (#101)
- --jail-name / --jail-root on spawn-agent and spawn-local, feeding JailConfig
so a jailed spawn triggers the vault provision hook to write .env into the
jail root. (#102)
- live_socket_check.rs: client-side live socket smoke test.
Drive-by: move colibri-vault validate_key before its #[cfg(test)] mod tests to
clear a pre-existing clippy "items after test module" error that is already red
on origin/main (independent of this branch); fixing it unblocks the
--all-targets gate for this PR.
Verified locally: fmt clean; clippy --workspace --all-targets -D warnings clean;
cargo test --workspace green (0 failed, incl. live_socket_check: 5 passed,
colibri-daemon: 77 passed, colibri-vault: 7 passed).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
