feat(simulation): qualify D-only stock rover smoke

src/k1link/simulation/s0.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import hashlib
+import os
 import platform
 import re
 import shutil
@@ -42,8 +43,10 @@ class DoctorVerdict(StrEnum):
 class TargetHost:
     windows_release: str
     virtualization: str
+    wsl_distribution: str
     linux_distribution: str
     architecture: str
+    container_runtime: str
 
 
 @dataclass(frozen=True, slots=True)
@@ -308,22 +311,34 @@ def _parse_target_host(value: object) -> TargetHost:
         required={
             "windows_release",
             "virtualization",
+            "wsl_distribution",
             "linux_distribution",
             "architecture",
+            "container_runtime",
         },
         context="target_host",
     )
     target = TargetHost(
         windows_release=_string(data["windows_release"], "target_host.windows_release"),
         virtualization=_string(data["virtualization"], "target_host.virtualization"),
+        wsl_distribution=_string(
+            data["wsl_distribution"],
+            "target_host.wsl_distribution",
+        ),
         linux_distribution=_string(
             data["linux_distribution"],
             "target_host.linux_distribution",
         ),
         architecture=_string(data["architecture"], "target_host.architecture"),
+        container_runtime=_string(
+            data["container_runtime"],
+            "target_host.container_runtime",
+        ),
     )
     if target.windows_release != "windows-11" or target.virtualization != "wsl2":
         raise S0ProfileError("S0 target must remain the reviewed Windows 11 WSL2 worker")
+    if target.wsl_distribution != "MissionCore-Sim" or target.container_runtime != "none":
+        raise S0ProfileError("S0 must use the dedicated Docker-free MissionCore-Sim distro")
     if target.linux_distribution != "ubuntu-24.04" or target.architecture != "x86_64":
         raise S0ProfileError("S0 target Linux distribution or architecture drifted")
     return target
@@ -583,7 +598,12 @@ def _parse_ports(value: object) -> tuple[PortBinding, ...]:
         owner = _safe_id(data["owner"], f"ports[{index}].owner")
         if protocol not in {"tcp", "udp"}:
             raise S0ProfileError(f"port {identifier!r} has unsupported protocol")
-        if bind != "127.0.0.1":
+        if bind == "0.0.0.0":
+            if host_scope != "loopback-only-netns":
+                raise S0ProfileError(
+                    f"port {identifier!r} wildcard bind requires loopback-only-netns scope"
+                )
+        elif bind != "127.0.0.1":
             raise S0ProfileError(f"port {identifier!r} must remain loopback-only in S0")
         if not 1 <= port <= 65535:
             raise S0ProfileError(f"port {identifier!r} is outside 1..65535")
@@ -666,15 +686,17 @@ def _target_host_match(target: TargetHost) -> tuple[bool, str]:
         os_release.get("id") == "ubuntu" and os_release.get("version_id") == "24.04"
     )
     architecture_match = machine in {"x86_64", "amd64"}
-    matched = is_wsl2 and distribution_match and architecture_match
+    distro_name_match = os.environ.get("WSL_DISTRO_NAME") == target.wsl_distribution
+    matched = is_wsl2 and distribution_match and architecture_match and distro_name_match
     if matched:
         return True, (
             f"matched {target.windows_release}/{target.virtualization}/"
-            f"{target.linux_distribution}/{target.architecture}"
+            f"{target.wsl_distribution}/{target.linux_distribution}/{target.architecture}"
         )
     return False, (
         "doctor is not running inside the reviewed Windows 11 WSL2 Ubuntu 24.04 "
-        f"x86_64 target (observed system={system!r}, machine={machine!r})"
+        f"x86_64 MissionCore-Sim target (observed system={system!r}, machine={machine!r}, "
+        f"wsl_distribution={os.environ.get('WSL_DISTRO_NAME')!r})"
     )
 
 
@@ -822,10 +844,7 @@ def _evidence_check(
             if artifact_candidate.is_symlink():
                 raise S0ProfileError(f"evidence artifact {identifier!r} cannot be a symlink")
             artifact = artifact_candidate.resolve(strict=True)
-            if (
-                not artifact.is_relative_to(evidence_root)
-                or not artifact.is_file()
-            ):
+            if not artifact.is_relative_to(evidence_root) or not artifact.is_file():
                 raise S0ProfileError(f"evidence artifact {identifier!r} is not a regular file")
             expected_sha256 = _string(
                 entry["sha256"],
@@ -966,8 +985,7 @@ def _tool_list(value: object, context: str) -> tuple[str, ...]:
 
 def _string_list(value: object, context: str) -> tuple[str, ...]:
     result = tuple(
-        _string(item, f"{context}[{index}]")
-        for index, item in enumerate(_sequence(value, context))
+        _string(item, f"{context}[{index}]") for index, item in enumerate(_sequence(value, context))
     )
     if len(set(result)) != len(result):
         raise S0ProfileError(f"{context} values must be unique")