feat(aigw): overlay-patch tool, ai-assist source env, caproni staging license

Andrew Dunnrequested to merge
andunn/aigw-overlay-tooling into main

What

Three additions proven during live upstream AIGW fix validation (2026-07), promoted from scratch tooling into the skill, plus the standard they serve:

  1. gce/fixtures/overlay_patch.py -- the strict find-exactly-once overlay patcher that gce/aigw.md has described in prose since the pattern landed. TOML spec in (absolute container paths, one [[patch]] per find/replace), thin overlay image out; anchor drift hard-fails instead of silently mispatching.
  2. just aigw dev [BRANCH] -- ai-assist source env on the VM (python3.12 toolchain + poetry + disposable depth-1 clone, or a pre-placed tree at ~/ai-assist). Fills the source-dev gap for the gateway: the skill had a dev base for gitlab-org/gitlab only. Documented in aigw.md's new source-dev section with the detached-run pattern.
  3. configure_staging_subscription caproni arm -- staging license files previously activated only on omnibus (the function warned and skipped otherwise). The caproni arm sets CUSTOMER_PORTAL_URL + GITLAB_LICENSE_MODE=test on the three Rails deployments and waits out the rollouts before the license step proceeds.
  4. The evidence standard (aigw.md) -- the red/green bullet generalized into the five-step standard the tooling exists to serve: red first, green plus the project's own lint gates, shipped-image E2E, mutation-discrimination for guard tests, negative path.

Validation

  • just ci green locally (shellcheck warning+, bash -n, ruby -c, py_compile, frontmatter, sims-check).
  • Live proof on a throwaway caproni sim (2026-07-14), driven from this branch's justfile end to end:
    • Overlay build (positive): the documented find-based path discovery located /home/aigateway/app/lib/context/llm_operations.py (correcting a guessed /app/... -- the doc step earns its place); the tool patched the file and built the overlay; a content check inside the image confirms the patched line present and the old block gone.
    • Anchor-drift guard (negative): a one-comment perturbation of the find block hard-failed with the drift message, exit 1, no image tagged.
    • Overlay boots via the skill path: SIM_AIGW_IMAGE=localhost/aigw-proof:dev just aigw start -> healthy in 9s, Rails wired.
    • just aigw dev: detached bootstrap to === READY === (python3.12 toolchain, poetry env, depth-1 clone, install --with test,lint).
    • Caproni staging license: SIM_LICENSE_MODE=staging just license <file> duo_enterprise -> license activated: plan=ultimate; all three deployments verified carrying GITLAB_LICENSE_MODE=test + the staging CUSTOMER_PORTAL_URL; License.current confirmed in Rails.
    • Teardown verified (zero running instances).
  • Observed pre-existing wrinkle (not this branch): the addon-seat step after activation raises addon catalog entry missing on a fresh instance -- filed as #4.

Closes #3 (closed)

Merge request reports