test(installtest): 3-OS daemon-path setup-executor engine install leg (waired#835 §9/§11)

[gen16k]

Motivation

The waired#835 §9/§11 setup executor engine install — the resident sudo waired init attaching a management-API lease and installing the engine on the daemon-path first-run (ensureDaemonPathEngine / runSetupEngineInstall, internal/management/setup_handlers.go + cmd/waired/{login_client,setup_install,init_daemon_inference}.go) — was covered only by unit tests. No installtest leg exercised it end to end.

The reason: the two hands-free enrol modes the harness uses — --google-sa-login (oidc) and --bypass-mode — both force the standalone enrol path (cmd/waired/main.go gates the daemon path on !bypassMode && !googleSALogin && !renewing && daemonReachable). On the standalone path the engine, when installed at all, comes from install.sh/configureInference, never the executor. And since #119 the installer starts the daemon before waired init, so a real fresh first-run now takes the daemon path — the exact path the harness never drove.

This is PR-P of the N3 plan.

What this adds

A new --daemon-engine (bash) / -DaemonEngine (PowerShell) leg — its own mode, Tier 2 — on all three drivers, run nightly as a 3-OS job in installtest-inference.yml (a real engine install + tiny model pull is minutes-scale + external-state, exactly the nightly cost profile).

Per OS leg:

1. Service left RUNNING, engine ABSENT — install.sh/install.ps1 keep --skip-ollama, so only the daemon-path executor can put an engine on the host.
2. waired init WITHOUT --google-sa-login (→ daemon path) + --non-interactive (→ awaitBrowserSetup returns at once → the resident executor runs ensureDaemonPathEngine), inference on + a tiny pinned model so the trailing pull is cheap.
3. Hands-free login completion by scraping, not POST /login/start: the id is the login URL's last path segment (lastPathSegment) read from the init transcript, and the host-minted SA id_token is POSTed to the CP's /v1/login/oidc-grant, which completes any waiting session regardless of what created it (internal/controlplane/api/oidc_grant.go).
4. Asserts (via GET /waired/v1/setup/state — a read): the enrol took the daemon path; the OIDC completion succeeded; the executor lease went live (executor_attached) and claimed the ollama install (install_claimed); an engine is present afterward (the regression bar — pre-N3 an engine-less daemon-path host stayed engine-less and engine_install was red forever); the subsystem left no_engine; and no install claim is stuck after init (§9-4).

Two design points worth calling out

• Scrape, don't POST /login/start. The coding-agent TTFT: every turn pays full-context prefill before the first token — measure and design prompt/KV reuse #838 writeGuard refuses mgmt writes on the TCP port (they must use the local IPC socket / named pipe — which plain curl/Invoke-RestMethod can't reach, especially the Windows named pipe). Scraping the transcript and reading /setup/state stay on the allowed read path; the only writes go to the CP (oidc-grant), which has no such guard.
• Assertion scope. Asserting setup-progress engine_install=done / setup_state.engine_installed would require a CP-served desired_engine — a browser-wizard / management-API write the hands-free harness has no auth for. That path stays unit-tested (setup_desired_test.go, setup_handlers_test.go, init_daemon_inference_test.go); this leg proves the resident executor installs the engine on the real daemon-path first-run, observed through executor_attached / install_claimed (lease-derived, no desired_engine needed) + engine presence.

Files

• scripts/dev/lib/installtest-daemon-engine.sh (new) — Linux it_enroll_daemon_path + assert_daemon_engine. Kept separate from installtest-enroll.sh (which has concurrent in-flight edits) to avoid churn/conflict.
• scripts/dev/installtest-run.sh — --daemon-engine flag, validation, memory cap, Tier-2 dispatch.
• scripts/dev/installtest-macos.sh / installtest-windows.ps1 — the same flow mirrored inline (macOS bash / Windows PowerShell Start-Job watcher).
• .github/workflows/installtest-inference.yml — new 3-OS daemon-engine job on the existing legs matrix.

No product code changed; no new internal/ packages (no testnet-gate impact); no user-facing CLI flags (no docs-site change).

Verification

• shellcheck -x (lib clean; run.sh/macos only pre-existing SC2015 info), bash -n, pwsh AST parse (clean), actionlint (only pre-existing findings) — all green locally.
• ⚠️ Cannot be validated locally — it needs real-CP OIDC against app.dev.waired.net, a real engine install, and the self-hosted Windows/macOS runners. Requires a nightly workflow_dispatch run of installtest-inference to shake out. I'll fix any leg that fails there on this same branch before it's merge-ready.

Refs

• Refs waired-ai/waired#835 (epic — must not auto-close)

🤖 Generated with Claude Code