refactor: extract QEMU/LibreMesh simulation into standalone libremesh-lab repo#3
Open
luandro wants to merge 48 commits into
Open
refactor: extract QEMU/LibreMesh simulation into standalone libremesh-lab repo#3luandro wants to merge 48 commits into
luandro wants to merge 48 commits into
Conversation
… review Review findings addressed (10 CRITICAL, 21 MAJOR, key MINOR): CRITICAL fixes: - Dockerfile COPY paths now preserve directory structure under /build/ - CONFIG_PACKAGE_ccache -> CONFIG_CCACHE in defconfig - Cache hash computed AFTER feed clone (includes vwifi commit) - SSH key properly offered to adapter scripts via GIT_SSH_COMMAND - wait_until_json_gte now polls in loop with sleep - Babel test verifies neighbors not just process running - Node restart after topology removal test - CI cache key includes build-inputs.hash - Firmware upgrade test does actual version change + snapshot rollback - topology-partition.yaml created MAJOR fixes: - vwifi feed commit pinning with VWIFI_FEED_COMMIT - Image size verification >50MB - UCI section creation before setting lime-community values - BatchMode=no for password SSH, BatchMode=yes for key SSH - YAML parser won't match bridge_ip: when looking for ip: - vwifi-server cleanup trap handler - collect-logs.sh warns on missing SSH config - topology-line/star have explicit links: constraints - firmware-policy.yaml schema matches validate-node parser - troubleshooting.md: added vwifi-ctrl and reset sections
…nostics Phase 3 review findings: - Replace GIT_SSH_COMMAND-only approach with PATH-based ssh wrapper (adapter scripts call ssh directly, not via git) - Generate resolved ssh-config from template via sed __REPO_ROOT__ replacement - Send all diagnostic output to stderr (stdout reserved for adapter JSON) - Clean up temp files (ssh wrapper dir, resolved config) in trap handler
…, thisnode loop Phase 2 review findings (3 CRITICAL, 5 MAJOR): - CRITICAL: vwifi UCI uses vwifi.config (not @vwifi[0]) per vwifi_cli_package README - CRITICAL: lime-community sections use type 'lime' (not 'wifi'/'network'/'system') with uci get guards for idempotency against lime-packages defaults - MAJOR: Write PID to lock dir for better error messages - MAJOR: Strip existing CIDR before appending /16 (prevent double /16) - MAJOR: Skip empty PID files in stop-mesh.sh (prevent unbound variable) - MAJOR: Move thisnode.info host config outside per-VM loop (runs once)
Phase 1: Prebuilt image quick fixes - Inject /sbin/service shim into prebuilt image (convert-prebuilt.sh) - Export HOSTALIASES for thisnode.info resolution (common.sh, run-testbed-adapter.sh) - Include test-firmware-upgrade.sh in run-all.sh test suite - Add ip -j fallback for prebuilt images missing ip-full (test-adapters.sh) Phase 2: Source-built image support - Auto-detect bootloader in source-built images (start-mesh.sh) - Skip -kernel args when image has partition table/bootloader Phase 3: Comprehensive adapter tests - Add collect-services adapter contract test (test 5) - Add collect-health adapter contract test (test 6) - Add normalize.py adapter contract test (test 7) - Add uhttpd HTTP API accessibility test (test 8) - Create multi-hop mesh topology test (test-multi-hop.sh) - Add multi-hop test to run-all.sh Phase 4: Documentation - Update QEMU_ADAPTER_TEST_GUIDE.md with all fixes and procedures - Document service shim, HOSTALIASES, ip-j fallback, bootloader detection - Document root device (/dev/sda), SSH config requirements - List all 7 test files and full test suite
Prebuilt LibreRouterOS images lack BMX7 and lime-community, causing test failures. All 7 test suites now pass (0 failures). Changes: - common.sh: has_bmx7() helper, wait_for_bmx7 returns 2 if not installed - validate-node.sh: neighbor check WARN not FAIL, StrictHostKeyChecking accept-new for testbed compatibility - test-validate-node.sh: create lime-community on prebuilt, graceful BMX7 skip, check output not just exit code - test-mesh-protocols.sh: skip BMX7 tests, still test L2 connectivity - test-topology-manipulation.sh: graceful skip when no BMX7 - test-multi-hop.sh: graceful skip when no BMX7 - test-firmware-upgrade.sh: check output for version mismatch detection - configure-vms.sh: use RSA keys for prebuilt dropbear compatibility - ssh-config: reference id_rsa instead of id_ed25519
- tests/run-unit.sh: runs normalize.py and check-drift unit tests - tests/unit/test_check_drift.sh: 4 tests covering MATCH, DRIFT, UNREACHABLE, and text output format using mock validate-node.sh
Tier 3 - Failure paths and lifecycle: - test-failure-paths.sh: 5 tests for timeout, unreachable, partial failure, empty output, missing desired-state - test-testbed-lifecycle.sh: 3 tests for collect-logs, mesh-status, stop-mesh (stop test gated behind RUN_LIFECYCLE_TESTS=1) Tier 4 - Multi-topology and skill scripts: - test-topologies.sh + run-topology-tests.sh: 3 topology convergence tests (line, star, partition) with cleanup trap - test-rollback.sh: rollback integration test with qcow2 snapshot safety - rollback-node.sh: added --yes flag for non-interactive use - test-stage-upgrade.sh: 3 dry-run tests (plan output, no version change, exit 0) - test-rollout.sh: 3 dry-run tests with testbed fixtures - test-server-adapters.sh: 2 host-based tests for collect-health/collect-services - test-maintenance.sh: 3 CRUD tests for maintenance windows - test-mesh-readonly.sh: 2 tests for plan mode and hostname mode Fixtures: - rollout-policy-testbed.yaml: testbed node ring definitions - mesh-nodes-testbed.yaml: testbed node inventory - server-services-fixture.yaml: portable service inventory run-all.sh updated with all new test suites in correct order.
- test-rollout.sh: use local dummy firmware file instead of HTTP URL (run-rollout.sh downloads firmware for checksum verification even in dry-run mode; local path avoids the failed HTTP download) - test-rollout.sh: fix state check to only match non-comment status line (grep for 'in_progress' was matching YAML schema comments) - test-rollback.sh: use scp -O for legacy SCP protocol (prebuilt image lacks sftp-server), add error handling for scp failures - test-rollback.sh: test --yes flag via temp script instead of inline sh -c (piping approach didn't pass args correctly)
The previous build script tried to run 'make' in lime-packages, but lime-packages is an OpenWrt feed (not a standalone build system) and has no top-level Makefile. Fix: Clone OpenWrt buildroot first, then add lime-packages and vwifi as feeds via feeds.conf. This matches the standard OpenWrt build process. Changes: - Step 1: Clone OpenWrt v23.05.5 (shallow, single-branch) - Step 2: Clone lime-packages as a local feed - Step 3: Add both feeds to feeds.conf - Add OPENWRT_VERSION env var (default: v23.05.5) - Better error message on build failure - Dockerfile: add python3-distutils, python3-stdlib, time
The vwifi feed package is named 'vwifi' (not 'vwifi-client'). The binary inside the package is vwifi-client, but the OpenWrt package name is CONFIG_PACKAGE_vwifi. Changes: - libremesh-testbed.defconfig: CONFIG_PACKAGE_vwifi-client -> CONFIG_PACKAGE_vwifi - build-libremesh-image.sh: Step 7 verification checks for vwifi (not vwifi-client)
Some environments have a Pyodide/Emscripten WASM Python in PATH that cannot access the local filesystem, causing ninja and other tools to fail with 'No such file or directory' errors. Changes: - Add Python type detection before defconfig (Step 4.5) - Fix staging_dir/host/bin/python3 symlink after Phase 1 if it points to a WASM binary - Falls back to /usr/bin/python3 or python3.12/3.11
The Phase 1 command was 'tools/install target/compile' but target/compile requires the cross-compiler (x86_64-openwrt-linux-musl-gcc) which is built by toolchain/install. Without it, target/linux fails with 'C compiler not found'.
start-mesh.sh: - Add dnsmasq DHCP server on bridge for source-built images (range 10.99.0.11-20) since source-built OpenWrt defaults to DHCP - Fix bootloader detection: use 'file -L' to follow symlinks (symlink to source-built MBR image was detected as 'symbolic link' instead of 'DOS/MBR boot sector') - Add DHCP server cleanup to trap handler run-testbed-adapter.sh: - Fix SSH key path: id_ed25519 -> id_rsa (matches generated keys)
Source-built OpenWrt images need network and SSH configuration before they can be used in the QEMU testbed. The prebuilt image was configured by convert-prebuilt.sh, but source-built images had no equivalent. New script: scripts/qemu-testbed/configure-source-image.sh - Mounts rootfs partition of source-built combined image - Replaces board.d/99-default_network with DHCP config (so dnsmasq on the bridge can assign IPs) - Injects SSH authorized_keys for root login - Clears root password for initial setup build-libremesh-image.sh updates: - Added package/install step (Phase 2b) before image assembly (without this, rootfs is empty and target/install fails) - Added post-build configure-source-image.sh invocation - Decompresses image and updates symlink automatically start-mesh.sh: - Added 1-second delay after starting dnsmasq to ensure it's listening before VMs start sending DHCP requests
…nodes - test-config-drift.sh: skip both tests if wireless.radio0 doesn't exist (VMs without wireless hardware have no radio config to manipulate) - test-adapters.sh: count reachable nodes instead of requiring all 4 (failure-path tests may reboot nodes, making them temporarily unreachable) - test-mesh-protocols.sh: skip L2 routing test if node-3 is unreachable - start-mesh.sh: kill stale dnsmasq before starting new DHCP server
Add prepare-source-image.sh to inject SSH keys, static network config, empty root password, dropbear config, and /sbin/service shim into the source-built flat image before boot. This eliminates the dropbear blank-password-auth problem that blocked configure-vms.sh from connecting to source-built VMs. Update configure-vms.sh to try key auth first (source-built images) with password auth fallback (prebuilt images). Add mesh convergence phase that waits for BMX7 peers after configuration. Key injection becomes idempotent when keys are pre-baked.
…c IP Critical fix: all 4 VMs share the same base image, so pre-baking a static IP caused IP conflicts. Now: - prepare-source-image.sh: sets DHCP on br-lan instead of static IP - start-mesh.sh: adds --dhcp-host entries to dnsmasq mapping each VM's MAC address to its expected IP (e.g. 52:54:00:00:00:01 -> 10.99.0.11) - configure-vms.sh: removes network restart hack (no longer needed), sets static config for lease persistence without disrupting connectivity Also removes unused variables from start-mesh.sh flagged by shellcheck.
Source-built images have empty root password (cleared in shadow). Added sshpass -p '' as fallback between key auth and interactive password prompt. This allows configure-vms.sh to connect to source-built images even when key auth hasn't been set up yet.
Source-built LibreMesh kernel has e1000 module but no virtio-net module. VMs were booting with no network interface because virtio-net-pci wasn't supported. Changed to e1000 which is available in the image.
virtio-net IS built into the source-built kernel (confirmed by previous working VMs). The e1000 change broke networking because e1000 is a module that loads after netifd tries to configure interfaces. Reverted to virtio-net-pci which works at boot time.
Major improvements to mesh data collection adapters: - Collect neighbor/ARP table (ip neigh show) for IPv6->IPv4 resolution - Implement EUI-64 MAC derivation from IPv6 link-local addresses - Resolve BMX7 neighbor IPs via MAC->ARP lookup chain - Parse BMX7 links/originators tables by detecting column headers instead of relying on fixed column positions (version-portable) - Build shortId->IPv4 map from links for originator resolution - Add fallback parsing for old-style BMX7 output without headers - Parse metric suffixes (K/M/G) in originator output - Handle txRate suffixes (M/K) in links output - Add is_mesh_ip() to accept both IPv4 and IPv6 link-local addresses
- Add IdentitiesOnly=yes to SSH config to prevent unwanted key probing - Add topology type (line) and link definitions to topology.yaml for multi-hop test documentation
Refactor VM configuration for proper vwifi wireless simulation: - Parse MAC addresses from topology.yaml for vwifi-client - Parse vwifi server IP and TCP port from topology.yaml - Add verify_vwifi_server() pre-check before configuration - Start vwifi-client directly (not via service wrapper) with --number, --mac, --port, and server IP arguments - Detect new PHY created by vwifi-client and create wlan0 manually (vwifi-client creates PHY radios, not network interfaces) - Configure IBSS adhoc mesh on wlan0 when available - Start BMX7 on both wlan0 and br-lan (dual-interface mode): wlan0 provides WiFi simulation, br-lan ensures convergence since vwifi IBSS forwards beacons but not data frames - Fall back to br-lan only when wlan0 is unavailable
Add reusable helpers to tests/qemu/common.sh: - bmx7_mesh_dev(): detect whether BMX7 runs on wlan0 or br-lan - ensure_vwifi_client(): start vwifi-client, create wlan0, join IBSS - restart_bmx7(): restart BMX7 with correct dual-interface config - Auto-start bmx7 daemon in wait_for_bmx7() if not running Update all test scripts to use shared helpers: - test-mesh-protocols.sh: use bmx7_mesh_dev() for babel device, restart_bmx7() for clean BMX7 restart, fix while-read loop - test-multi-hop.sh: use ping instead of grepping originators (BMX7 may show IPv6 addresses), relax link count to >= 2 - test-topology-manipulation.sh: stop bmx7 instead of killing QEMU (QEMU runs as root), detect dual-interface mode and skip vwifi-ctrl distance test when BMX7 uses br-lan, use link count instead of node count for removal detection - test-validate-node.sh: use restart_bmx7() for clean restart
… conditions Critical: - Replace unsafe triple-quote string interpolation in collect-topology.sh and collect-nodes.sh with temp file + open() to handle arbitrary data from mesh nodes without Python syntax errors Warnings: - Add sleep 2 after vwifi-client in LibreMesh lime-config path to ensure PHY radio is ready before wifi config runs (race condition fix) - Make post-branch BMX7 restart conditional on bare OpenWrt only — LibreMesh's wifi up already starts bmx7 via proto-bmx7 - Restore link count assertion to >= 3 in test-multi-hop.sh (4-node fully-connected mesh via br-lan should produce at least 3 links) Info: - Add </dev/null to nohup in start-vwifi.sh for clean daemonization
Add gitignore entries for: - testbed/run/ (runtime state: ssh keys, pids, logs) - testbed/config/ssh-config.resolved (generated with absolute paths) - testbed/images/*.img, *.img.gz, *.ext4 (built disk images) - testbed/bin/ (compiled vwifi-server, vwifi-ctrl binaries) - testbed/src/ (cloned third-party source repos) - .deepsec/ (scanner cache)
Add configure-source-vms.sh for configuring LibreMesh VMs that don't have SSH access yet (fresh source-built images): - Connect to QEMU serial console sockets via Python UNIX socket - Auto-detect login prompt and authenticate as root - Set static IP, hostname via UCI commands over serial - Inject SSH public key into authorized_keys and dropbear - Load mac80211_hwsim module and start bmx7 - Wait for SSH to become reachable after network restart - Generate resolved SSH config with absolute paths Fixes: - Remove unused PASSWORD variable (shellcheck SC2034) - Fix login_serial() call passing wrong positional arguments (--sock/--node flags instead of node_id)
Add inject-keys-serial.sh for injecting SSH keys into running VMs that don't have key-based SSH access yet (e.g., prebuilt images): - Connect to QEMU serial console via socat/nc UNIX socket - Log in as root, inject SSH public key - Clear root password and configure dropbear for key auth - Restart dropbear and verify key-based SSH access Must be run as root (sudo) for serial socket access.
…b repo Move all QEMU testbed code, config, tests, and Docker builder into the standalone ../libremesh-lab repository. Mesha keeps thin wrappers only: - scripts/libremesh-lab.sh: delegates to libremesh-lab CLI - tests/qemu/run-all.sh: delegates to lab test suite - tests/qemu/test-adapters.sh: delegates to lab adapter tests - docs/testing/libremesh-lab.md: setup and usage docs Removed: - scripts/qemu-testbed/ (all QEMU lifecycle scripts) - testbed/ (config, inventories, topology fixtures, docs) - tests/qemu/ test files (now live in libremesh-lab) - docker/qemu-builder/Dockerfile - QEMU_ADAPTER_TEST_GUIDE.md (moved to lab docs) - plans/2026-05-04-qemu-test-coverage-expansion-v3.md (lab scope) Updated .gitignore to remove testbed/ entries and add firmware/ exclusions.
Agent orchestration guide for Hermes (manager) role: task difficulty assessment, phase assignments, model selection, git branching, and session quality guidelines.
Progressive iterations of the Mesha agent guardrails plan covering approval gates, risk classification, trust levels, and safe execution boundaries.
Research notes covering automated testing approaches, executive summary, and strategy recommendations for community mesh networks.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
Review Summary by QodoExtract QEMU/LibreMesh simulation to standalone repo with security enhancements and testing infrastructure
WalkthroughsDescription **Major refactor: Extract QEMU/LibreMesh simulation into standalone libremesh-lab repository**
• Removed 7075+ lines of embedded QEMU testbed code (scripts/qemu-testbed/, testbed/,
tests/qemu/) from Mesha
• Created thin wrapper scripts (scripts/libremesh-lab.sh, tests/qemu/run-all.sh,
tests/qemu/test-adapters.sh) that delegate to the sibling libremesh-lab repository
• Added docs/testing/libremesh-lab.md setup guide and README.md updates documenting the new
architecture
**Security enhancements to mesh adapters**
• Refactored collect-topology.sh and collect-nodes.sh to use temporary files instead of unsafe
string interpolation, preventing injection vulnerabilities
• Added IPv6-to-IPv4 resolution via EUI-64 MAC derivation for improved node IP discovery
• Implemented column-based parsing for BMX7 output with fallback logic for version-dependent format
variations
**Mesh rollout improvements**
• Changed SSH StrictHostKeyChecking from yes to accept-new in validate-node.sh to allow
first-time connections
• Downgraded "No mesh neighbors found" check from FAIL to WARN with clarified messaging
• Added --yes flag support to rollback-node.sh for automated/test scenarios with SKIP_CONFIRM
environment variable
**Testing infrastructure**
• New tests/run-unit.sh runner for offline unit tests (Python and bash-based)
• New tests/unit/test_check_drift.sh comprehensive unit test suite for drift detection with TAP
format output
• New GitHub Actions workflow .github/workflows/qemu-integration-test.yml for QEMU integration
testing with firmware caching
**Documentation and research**
• Added HERMES.md orchestrator agent operating instructions
• Created three guardrails implementation plans (plans/2026-04-12-mesha-guardrails-v{1,2,3}.md)
with progressive iterations
• Added comprehensive research documents on LibreMesh QEMU testing automation strategy with 5-phase
implementation roadmap
Diagramflowchart LR
A["Mesha Repo<br/>7075+ lines QEMU code"] -->|Extract| B["libremesh-lab Repo<br/>Standalone simulation"]
A -->|Keep thin wrappers| C["Mesha Wrappers<br/>libremesh-lab.sh<br/>test-adapters.sh<br/>run-all.sh"]
C -->|Delegate to| B
D["Mesh Adapters<br/>collect-topology.sh<br/>collect-nodes.sh"] -->|Security fixes| E["Temp file parsing<br/>IPv6 resolution<br/>Format resilience"]
F["Mesh Rollout Scripts<br/>validate-node.sh<br/>rollback-node.sh"] -->|Improvements| G["SSH key acceptance<br/>Automated rollback<br/>Better messaging"]
H["Testing Infrastructure"] -->|New| I["Unit tests<br/>GitHub Actions<br/>QEMU workflow"]
File Changes1. adapters/mesh/collect-topology.sh
|
Code Review by Qodo
1.
|
CI Feedback 🧐A test triggered by this PR failed. Here is an AI-generated analysis of the failure:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0b2fe89583
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
ApprovabilityVerdict: Needs human review This PR introduces significant new runtime logic in mesh adapters (IPv6-to-IPv4 resolution via EUI-64/MAC lookup) and changes SSH host key verification from strict to accept-new. These behavioral and security-relevant changes warrant human review despite the refactor framing. You can customize Macroscope's approvability policy. Learn more. |
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Code fixes: - collect-topology.sh: store tx_rate/rx_rate in link entries (HIGH #2) - collect-topology.sh: fix header-skip to use exact line matching (#5) - collect-topology.sh: case-insensitive IPv6 regex in is_mesh_ip (#3) - collect-topology.sh: case-insensitive fe80 check in eui64_to_mac (#3) - collect-nodes.sh: fix BMX7 header-skip to use exact line matching (#5) - collect-nodes.sh: case-insensitive fe80 check in eui64_to_mac (#3) - collect-nodes.sh: document ip neigh allow-list addition (#13) - validate-node.sh: revert WARN to FAIL for no mesh neighbors (#9) - validate-node.sh: document accept-new security trade-off (#11) - rollback-node.sh: fix --yes flag parsing with proper shift (#16) - qemu-integration-test.yml: rewrite to use libremesh-lab wrapper (#1/#14/#15) - qemu-integration-test.yml: increase timeout from 60 to 300 minutes (#15) Documentation fixes: - guardrails-v1.md: fix shellcheck severity claim (#4) - guardrails-v1.md: fix pre-commit --from-ref HEAD..HEAD (#7) - research_summary.md: fix ramgs.bzImage typo (#6) - research_summary.md: fix duplicate Strategy heading (#10) - HERMES.md: fix Z.AI 0% usage logic with sentinel (#8) - guardrails-v2.md: move .gitignore gaps to P1 section (#12) - AGENTS.md: add ip neigh to mesh-collector allow-list (#13)
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
- qemu-integration-test.yml: fix glob expansion in cache check (HIGH) - HERMES.md: fix '4 phases' to '6 phases' for hard tasks (LOW) - collect-topology.sh: scale M suffix tx_rate to bits for unit consistency (HIGH)
This comment was marked as off-topic.
This comment was marked as off-topic.
Sorry, something went wrong.
The Babel fallback parser incorrectly used tokens[0] as the IP address, but babeld output starts with 'add neighbour <IP>' or 'Neighbour <IP>', so the IP is never the first token. Fixed to scan for the first token containing '.' or ':' (IP-like), and extract interface from 'dev' keyword.
There was a problem hiding this comment.
Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.
|
Capy auto-review is paused for this organization because the monthly auto-review limit has been reached. Increase the limit or turn it off in billing settings to resume automatic reviews. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extract all QEMU/LibreMesh simulation code into a standalone sibling repository (
libremesh-lab), keeping only thin wrappers in Mesha. Also adds Hermes orchestrator docs, guardrails plans, and research notes.Context
The QEMU testbed grew to 7075+ lines across scripts, tests, config, and Docker tooling — all embedded inside Mesha. This made the lab hard to reuse, version independently, or develop without pulling in the entire Mesha workspace. The split separates concerns: Mesha owns adapters and agent orchestration; the lab owns simulation lifecycle, firmware builds, and topology fixtures.
Changes
Refactor: QEMU/LibreMesh lab extraction
Removed from Mesha:
scripts/qemu-testbed/— 16 QEMU lifecycle scripts (build, start, stop, configure, status, logs, vwifi, adapter runner)testbed/— config, inventories, topology fixtures, SSH config, docstests/qemu/— 17 integration test files (adapters, protocols, rollback, lifecycle, failure paths)docker/qemu-builder/DockerfileQEMU_ADAPTER_TEST_GUIDE.mdplans/2026-05-04-qemu-test-coverage-expansion-v3.mdAdded to Mesha (thin wrappers):
scripts/libremesh-lab.sh— delegates to../libremesh-lab/bin/libremesh-labCLI, supportsLIBREMESH_LAB_ROOToverridetests/qemu/run-all.sh— 6-line wrapper that calls lab test suitetests/qemu/test-adapters.sh— 15-line wrapper that calls lab adapter testsdocs/testing/libremesh-lab.md— setup guide and usage docsCreated standalone
libremesh-labrepo with:bin/libremesh-labCLI entry point (build-image, start, configure, stop, status, logs, test, run-adapter)run-testbed-adapter.shisolation: creates temp workspace with symlinks, never modifies caller's inventories or desired-stateOther additions
HERMES.md— orchestrator instructions for the Hermes (manager) agent roleplans/2026-04-12-mesha-guardrails-v{1,2,3}.md— progressive iterations of agent guardrails plansresearch/— automated testing strategy research and summaries.gitignore— added firmware binary exclusions, removed stale testbed entriesTesting
Links
../libremesh-labdocs/testing/libremesh-lab.mdNote
Extract QEMU/LibreMesh simulation into a standalone sibling repository
libremesh-labsibling repo, accessed viascripts/libremesh-lab.shand compatibility wrappers intests/qemu/.qemu-integration-test.yml) that checks out both repos, builds/caches firmware, boots a QEMU test bed, runs integration tests, and uploads logs.collect-nodes.shandcollect-topology.shto collect the ARP/neighbor table, resolve BMX7 IPv6 link-local addresses to IPv4 via EUI-64 MAC derivation, and support header-based BMX7 parsing.check-drift.shusing mock data, and a--yesflag torollback-node.shto skip interactive confirmation.tests/qemu/scripts now fail fast if the externallibremesh-labrepo is not present at the expected sibling path orLIBREMESH_LAB_ROOTis not set.Macroscope summarized 6a1c37c.