capsem-doctor

capsem-doctor is a pytest-based diagnostic suite that runs inside the guest VM. It verifies sandbox integrity, network isolation, runtime environment, and AI agent functionality. It's the smoke test gate -- every change must pass it before shipping.

Doctor is also an Ironbank input. When doctor is used to close a release-critical VM/security/protocol/package-manager gate, load /ironbank and assert the full ledger through tests/ironbank/: client result, DB rows, structured logs, UDS/HTTP route output, counters, and UI-facing JSON. A doctor exit code or "row exists" check is not enough.

Running

just exec "capsem-doctor"              # Full suite (~10s total including VM boot)
just exec "capsem-doctor -k sandbox"   # Only sandbox tests
just exec "capsem-doctor -k network"   # Only network tests
just exec "capsem-doctor -x"           # Stop on first failure
just exec "capsem-doctor -v"           # Extra verbose