chore(dev): add mise Guix and Wolfi Podman environments

.containerignore

@@ -0,0 +1,16 @@
+# SPDX-License-Identifier: MPL-2.0
+.git
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+secrets
+.cache
+.local
+target
+build
+dist
+out
+node_modules
+*.log

.machine_readable/descriptiles/STATE.a2ml

@@ -7,7 +7,7 @@ project = "echidnabot"
 version = "0.1.0"
 last-updated = "2026-10-09"
 status = "active"
-session = "Issue #173: re-point shared trust kernel to echidna-core 0.2.0 on upstream main; local slug and contract parser retained. Build and test blocked: Cargo is not installed in this sandbox; draft PR pending verification."
+session = "Issue #173 follow-up: owner-requested fresh-checkout tooling via mise, Guix and rootless Podman/Wolfi. Offline shell checks pass; installation and real Rust/container/Guix validation blocked by sandbox tooling and network restrictions. PR #174 merged separately; development-environment follow-up pending verification."
 
 [project-context]
 name = "Echidnabot"
@@ -454,3 +454,21 @@ changes = [
 validation = "cargo build and cargo test both attempted, exit 127: cargo: command not found. Trust unit tests not run."
 coordination = "#166 remains open, but this checkout already pins tracing-opentelemetry 0.34 and rustls 0.23.45. No OTel or TLS dependency changes made; no security or CI pass claimed."
 follow-up = "Run cargo build and cargo test with repository-pinned Rust 1.99.0, confirm lockfile resolution and trust unit tests before marking draft PR ready."
+
+[session-2026-10-09-development-environment]
+request = "Owner explicitly requested tool installation and repo-integrated mise, Guix environment settings and a Podman environment on Chainguard Wolfi; Guix provided as an explicit opt-in despite older deprecation guidance."
+changes = [
+  "Replace generic mise template with Just 1.58.0, rust-toolchain.toml discovery and Cargo tasks; bootstrap checksum-pins mise 2026.10.6 for Linux x86_64/aarch64.",
+  "Wire real Cargo build/test/format/lint/fetch and development-container Just recipes; add fresh-checkout documentation and README entry point.",
+  "Add authenticated pinned Guix channel plus native-prerequisite manifest, with documented FHS shell for downloaded Rust tools.",
+  "Use Chainguard Wolfi for development, builder and runtime Containerfile stages; add rootless Podman wrapper, named build caches and build-context exclusions.",
+  "Add offline script control-flow tests; no new .a2ml files.",
+]
+validation = "PASS: bash -n on all three shell scripts, tests/dev-tools.sh (mock install, failed download/checksum, Podman arguments and missing-image failure), git diff --check."
+blockers = [
+  "Mise and Just GitHub binary downloads fail at release-assets.githubusercontent.com; static.rust-lang.org and cgr.dev are unreachable under sandbox allowlist. No tools successfully installed.",
+  "Bootstrap preflight also finds CMake missing; pkg-config, Cargo, Just, Guix and Podman are absent. Rust build/tests and real container/Guix evaluation remain unverified.",
+  "Wolfi image digest cannot be verified here; rolling tag/APK repositories documented explicitly, not claimed fully reproducible.",
+  "PR #174 at 0896185 reports Cargo check failure (exit 101), Cargo test skipped; log download blocked at actions log host, so cause remains undiagnosed. Do not claim CI green or assume #166 caused it.",
+]
+follow-up = "Run bootstrap, cargo build/test and trust tests, Guix FHS environment and Podman build/run on an unrestricted host; inspect the failed Cargo check logs from merged PR #174 before readying the environment follow-up."

Containerfile

@@ -1,40 +1,45 @@
 # SPDX-License-Identifier: MPL-2.0
-# Build stage
-FROM docker.io/library/rust:1.83-slim AS builder
-
-WORKDIR /build
-
-# Install build dependencies
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    pkg-config \
-    libsqlite3-dev \
-    && rm -rf /var/lib/apt/lists/*
-
-# Copy source
-COPY . .
-
-# Build release binary
-RUN cargo build --release
-
-# Runtime stage
-FROM cgr.dev/chainguard/wolfi-base:latest
-
+# Override WOLFI_IMAGE with cgr.dev/chainguard/wolfi-base@sha256:<digest>
+# for a reviewed, immutable release build. Never invent an unverified digest.
+ARG WOLFI_IMAGE=cgr.dev/chainguard/wolfi-base:latest
+FROM ${WOLFI_IMAGE} AS development
+
+RUN apk add --no-cache bash ca-certificates curl git build-base cmake \
+    pkgconf sqlite-dev tar gzip xz coreutils libstdc++
+
+ENV MISE_DATA_DIR=/opt/mise \
+    MISE_CONFIG_DIR=/opt/mise-config \
+    MISE_CACHE_DIR=/tmp/mise-cache \
+    RUSTUP_HOME=/opt/rustup \
+    CARGO_HOME=/opt/cargo \
+    MISE_BIN_DIR=/usr/local/bin
+ENV PATH="/opt/cargo/bin:/opt/mise/shims:${PATH}"
+WORKDIR /workspace
+COPY mise.toml rust-toolchain.toml ./
+COPY scripts/bootstrap.sh scripts/bootstrap.sh
+RUN bash scripts/bootstrap.sh \
+    && ln -s "$(mise which just)" /usr/local/bin/just \
+    && chmod -R a+rX /opt/rustup /opt/cargo /opt/mise \
+    && adduser -D -u 1000 dev \
+    && mkdir -p /home/dev/.cargo /workspace/target \
+    && chown -R dev:dev /home/dev /workspace
+
+ENV CARGO_HOME=/home/dev/.cargo HOME=/home/dev
+USER dev
+CMD ["bash"]
+
+FROM development AS builder
+COPY --chown=dev:dev . .
+RUN cargo build --locked --release
+
+FROM ${WOLFI_IMAGE} AS runtime
 LABEL org.opencontainers.image.source="https://github.com/hyperpolymath/echidnabot"
 LABEL org.opencontainers.image.description="Proof-aware CI bot that orchestrates ECHIDNA for theorem proof verification"
 LABEL org.opencontainers.image.licenses="MPL-2.0"
-
-# Install runtime dependencies
-RUN apk add --no-cache sqlite-libs ca-certificates
-
-# Copy binary from builder
-COPY --from=builder /build/target/release/echidnabot /usr/local/bin/echidnabot
-
-# Create non-root user
-RUN adduser -D -u 1000 echidna
+RUN apk add --no-cache sqlite-libs ca-certificates libstdc++ \
+    && adduser -D -u 1000 echidna
+COPY --from=builder /workspace/target/release/echidnabot /usr/local/bin/echidnabot
 USER echidna
-
 WORKDIR /home/echidna
-
 EXPOSE 8080
-
 ENTRYPOINT ["/usr/local/bin/echidnabot"]

Justfile

@@ -20,9 +20,9 @@ set positional-arguments := true
 import? "build/contractile.just"
 
 # Project metadata — customize these
-project := "rsr-template-repo"
+project := "echidnabot"
 OWNER := "hyperpolymath"
-REPO := "rsr-template-repo"
+REPO := "echidnabot"
 version := "0.1.0"
 tier := "infrastructure"  # 1 | 2 | infrastructure
 
@@ -83,24 +83,11 @@ import? "build/just/assess.just"
 
 # Build the project (debug mode)
 build *args:
-    @echo "Building {{project}} (debug)..."
-    # TODO: Replace with your build command
-    # Examples:
-    #   cargo build {{args}}                    # Rust
-    #   mix compile {{args}}                    # Elixir
-    #   zig build {{args}}                      # Zig
-    #   deno task build {{args}}                # Deno/AffineScript
-    @echo "Build complete"
+    cargo build --locked {{args}}
 
 # Build in release mode with optimizations
 build-release *args:
-    @echo "Building {{project}} (release)..."
-    # TODO: Replace with your release build command
-    # Examples:
-    #   cargo build --release {{args}}
-    #   MIX_ENV=prod mix compile {{args}}
-    #   zig build -Doptimize=ReleaseFast {{args}}
-    @echo "Release build complete"
+    cargo build --locked --release {{args}}
 
 # Build and watch for changes (requires entr or similar)
 build-watch:
@@ -127,24 +114,15 @@ clean-all: clean
 
 # Run all tests
 test *args:
-    @echo "Running tests..."
-    # TODO: Replace with your test command
-    # Examples:
-    #   cargo test {{args}}
-    #   mix test {{args}}
-    #   zig build test {{args}}
-    #   deno test {{args}}
-    @echo "Tests passed!"
+    cargo test --locked {{args}}
 
 # Run tests with verbose output
 test-verbose:
-    @echo "Running tests (verbose)..."
-    # TODO: Replace with verbose test command
+    cargo test --locked -- --nocapture
 
 # Smoke test
 test-smoke:
-    @echo "Smoke test..."
-    # TODO: Add basic sanity checks
+    cargo test --locked --test smoke
 
 # Run end-to-end tests (full pipeline: build → run → verify)
 e2e:
@@ -227,31 +205,15 @@ fix: fmt
 
 # Format all source files [reversible: git checkout]
 fmt:
-    @echo "Formatting source files..."
-    # TODO: Replace with your formatter
-    # Examples:
-    #   cargo fmt
-    #   mix format
-    #   gleam format
-    #   deno fmt
+    cargo fmt --all
 
 # Check formatting without changes
 fmt-check:
-    @echo "Checking formatting..."
-    # TODO: Replace with your format check
-    # Examples:
-    #   cargo fmt --check
-    #   mix format --check-formatted
-    #   gleam format --check
+    cargo fmt --all -- --check
 
 # Run linter
 lint:
-    @echo "Linting source files..."
-    # TODO: Replace with your linter
-    # Examples:
-    #   cargo clippy -- -D warnings
-    #   mix credo --strict
-    #   gleam check
+    cargo clippy --locked --all-targets -- -D warnings
 
 # ═══════════════════════════════════════════════════════════════════════════════
 # RUN & EXECUTE
@@ -278,13 +240,7 @@ install: build-release
 
 # Install/check all dependencies
 deps:
-    @echo "Checking dependencies..."
-    # TODO: Replace with your dependency check
-    # Examples:
-    #   cargo check
-    #   mix deps.get
-    #   gleam deps download
-    @echo "All dependencies satisfied"
+    cargo fetch --locked
 
 # Audit dependencies for vulnerabilities
 deps-audit:
@@ -426,19 +382,7 @@ container-init:
 
 # Build container image via cerro-torre pipeline
 container-build *args:
-    #!/usr/bin/env bash
-    if [ -f "container/ct-build.sh" ]; then
-        cd container && ./ct-build.sh {{args}}
-    elif [ -f "container/Containerfile" ]; then
-        podman build -t {{project}}:latest -f container/Containerfile .
-    elif [ -f "build/Containerfile" ]; then
-        podman build -t {{project}}:latest -f build/Containerfile .
-    elif [ -f "Containerfile" ]; then
-        podman build -t {{project}}:latest -f Containerfile .
-    else
-        echo "No Containerfile found in container/, build/, or project root"
-        exit 1
-    fi
+    podman build -t localhost/echidnabot:latest -f Containerfile {{args}} .
 
 # Verify compose configuration
 container-verify:
@@ -779,3 +723,24 @@ handover-human path=".":
 
 secret-scan-trufflehog:
     @command -v trufflehog >/dev/null && trufflehog filesystem . --only-verified || true
+
+# Install the repository-pinned mise, Rust/Cargo and Just tools
+bootstrap:
+    bash scripts/bootstrap.sh
+
+# Build the Chainguard Wolfi development image (requires only Podman)
+dev-container-build:
+    podman build --target development -t localhost/echidnabot-dev -f Containerfile .
+
+# Open a rootless development shell, or execute a command in it
+dev-container *args:
+    bash scripts/dev-container.sh {{args}}
+
+# Run both trust-module unit test paths
+trust-test:
+    cargo test --locked --lib trust::
+
+# Offline control-flow tests for development setup scripts (not real tool builds)
+dev-tools-test:
+    bash -n scripts/bootstrap.sh scripts/dev-container.sh tests/dev-tools.sh
+    bash tests/dev-tools.sh

README.adoc

@@ -29,6 +29,13 @@ Part of the https://github.com/hyperpolymath/gitbot-fleet[gitbot-fleet]
 (Tier-1 Verifier role), coordinated by
 https://github.com/hyperpolymath/hypatia[Hypatia].
 
+=== Build and development setup
+
+See link:docs/DEVELOPMENT.adoc[Development environment] for a fresh-checkout
+setup using pinned mise/Rust/Just tools, a Guix build environment, or a
+rootless Podman development container based on Chainguard Wolfi.
+The setup requires internet access; toolchain binaries are not vendored.
+
 === Why does it exist?
 
 You’re writing formally verified software — proofs in Coq, Lean, Agda,