J1 Container-engine abstraction

Requirements

1. J1-R1draftMUST

   The tool MUST detect the container engines installed on the host and classify each as usable, present-but-unusable, or absent.

   locked by

   0.24.0 ○ open

2. J1-R2draftMUST

   Engine usability MUST be established from a successful round-trip command, not from the mere presence of a socket or binary.

   locked by

   0.24.0 ○ open

3. J1-R3draftMUST

   Bring-up, teardown, inspection, in-container execution, and health reads MUST be expressed once and mapped onto the selected engine.

   locked by

   0.24.0 ○ open

4. J1-R4draftMUST

   The VPN egress proof, the hardlink inode proof, and per-service health checks MUST run identically across every supported engine, with no engine-specific variation in the checks themselves.

   locked by

   0.24.0 ○ open

5. J1-R5draftMUST

   The egress and hardlink proofs MUST pass on each supported engine before that engine is reported as verified.

   locked by

   0.24.0 ○ open

6. J1-R6draftMUST

   Proofs MUST observe the running result — namespaces, addresses, inodes — and MUST NOT be satisfied by reading the compose file or trusting the engine's own report.

   locked by

   0.24.0 ○ open

7. J1-R7draftMUST

   A capability the selected engine cannot express MUST be reported explicitly, and MUST NOT be silently skipped.

   locked by

   0.24.0 ○ open

8. J1-R8draftMUST

   A proof that could not run MUST be distinguished from a proof that ran and passed.

   locked by

   0.24.0 ○ open

9. J1-R9draftMUST

   When more than one engine is usable, the selection MUST be stated and MUST be overridable by the operator.

   locked by

   0.24.0 ○ open

10. J1-R10draftMUST

    When no usable engine is present, the tool MUST say so and MUST NOT silently degrade.

    locked by

    0.24.0 ○ open

11. J1-R11draftMUST

    A divergence in proof results between two engines MUST be surfaced rather than averaged or hidden.

    locked by

    0.24.0 ○ open

12. J1-R12draftMUST

    Engine detection, selection, and running the verification suite against a named engine MUST each be reachable non-interactively.

    locked by

    0.24.0 ○ open

13. J1-R13draftMUST

    Adding support for a further engine MUST NOT require changing the verification suite.

    locked by

    0.24.0 ○ open

14. J1-R14draftMUST

    The operator MUST NOT need to know engine-specific commands to drive the stack through the common interface.

    locked by

    0.24.0 ○ open