feat: CI/devcontainer and workflow updated for Arm64

.devcontainer/Dockerfile

@@ -1,4 +1,5 @@
-FROM ghcr.io/framework-r-d/phlex-dev:2026-07-23
+ARG PHLEX_DEV_IMAGE=ghcr.io/framework-r-d/phlex-dev:latest
+FROM ${PHLEX_DEV_IMAGE}
 
 # Validate Python site-packages symlink.
 # Invoke bash explicitly: the script uses bash features (pipefail, arrays,
@@ -103,7 +104,7 @@ INSTALL_DEV_UTILS
 
 RUN bash <<'INSTALL_NPM_PACKAGES'
 set -euo pipefail
-npm update -g npm@^11.10.0
+npm install -g npm@^11.10.0
 npm config set allow-scripts=@kilocode/cli --location=user
 npm config set min-release-age=3 --location=user
 npm install -g @kilocode/cli
@@ -117,9 +118,12 @@ RUN printf '. /entrypoint.sh\n' >> /root/.bashrc
 # allow GPG agent to function correctly when running as root.
 RUN mkdir -p /run/user/0 && chmod 700 /run/user/0 && chown root:root /run/user/0
 
-COPY gitignore-global /root/.gitignore-global
+COPY .devcontainer/gitignore-global /root/.gitignore-global
 RUN git config --global core.excludesfile '/root/.gitignore-global'
 
 # Install Kilo environment script that sets KILO_CONFIG_CONTENT globally
-COPY kilo-env.sh /etc/profile.d/kilo-env.sh
-RUN chmod +x /etc/profile.d/kilo-env.sh
+# Keep runtime fixes current without rebuilding the expensive Spack base image.
+COPY ci/entrypoint.sh /entrypoint.sh
+COPY .devcontainer/kilo-env.sh /etc/profile.d/kilo-env.sh
+COPY .devcontainer/kilo-env-self-test.sh /usr/local/lib/phlex/kilo-env-self-test.sh
+RUN chmod +x /etc/profile.d/kilo-env.sh /usr/local/lib/phlex/kilo-env-self-test.sh

.devcontainer/README.md

@@ -0,0 +1,21 @@
+# Native macOS Devcontainer
+
+The initializer generates the gitignored `docker-compose.host.yml` before VS Code resolves Compose. On Apple Silicon it requires a running rootless arm64 Podman VM and a locally available Linux/arm64 image, `localhost/phlex-dev:latest` by default. Set `PHLEX_DEV_IMAGE` in the environment launching VS Code to select another image reference. A multi-arch tag or manifest is supported when Podman can resolve its Linux/arm64 member from local storage; the generated Compose service explicitly selects `linux/arm64`. The initializer does not query remote manifests or pull automatically: for a registry image, explicitly run `podman pull --platform linux/arm64 <image-reference>` first. A manifest listing an arm64 member is not sufficient unless that member is available locally. Linux retains the Dockerfile's `ghcr.io/framework-r-d/phlex-dev:latest` default and the engine's native platform selection.
+
+macOS uses pasta networking. Ordinary development does not mount the Podman engine socket or disable SELinux container labeling. Host Kilo configuration and auth inputs are read-only; auth is copied into the container-private data volume when first created.
+
+## Optional Nested Podman
+
+For future in-container `act` use, fully quit VS Code Insiders first, then launch a fresh process from the repository root:
+
+```bash
+PHLEX_ENABLE_NESTED_PODMAN=1 code-insiders .
+```
+
+Run **Dev Containers: Rebuild and Reopen in Container**. The initializer then mounts the VM's rootless Unix socket at `/tmp/podman.sock`, sets `DOCKER_HOST` and `CONTAINER_HOST`, and adds `security_opt: ["label=disable"]`. This explicitly reduces isolation: the devcontainer can control all containers and resources managed by the VM's rootless engine. The read-only bind mount does not make API operations read-only. No TCP API or macOS Unix-socket relay is used.
+
+To restore the default boundary, quit Insiders, launch it without `PHLEX_ENABLE_NESTED_PODMAN`, and rebuild the devcontainer. Do not edit the generated override; initialization replaces it on each launch.
+
+## Self-tests
+
+`kilo-env-self-test.sh` and `ensure-repos.sh` execute their own unit tests when the `--self-test` option is provided. Fixture listeners, assertions, and test cases are loaded by sourcing the appropriate `*-self-test.sh` file, and the tests executed in lieu of each script executing its production code.

.devcontainer/configure-host.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""Persist host choices for Compose; initializeCommand exports cannot reach VS Code."""
+
+from __future__ import annotations
+
+import json
+import os
+import platform
+import subprocess
+import tempfile
+from pathlib import Path
+
+
+def host_service(system: str, home: Path) -> dict:
+    """Use VM paths on macOS, never Unix sockets on the macOS shared filesystem."""
+    service: dict = {"volumes": []}
+    image = os.environ.get("PHLEX_DEV_IMAGE")
+    if system == "Darwin":
+        info = subprocess.check_output(
+            [
+                "podman",
+                "info",
+                "--format",
+                "{{.Host.Arch}} {{.Host.Security.Rootless}} {{.Host.RemoteSocket.Path}}",
+            ],
+            text=True,
+        ).split()
+        if len(info) != 3 or info[:2] != ["arm64", "true"]:
+            raise ValueError(
+                "macOS development requires a running native arm64 rootless Podman VM"
+            )
+        socket = info[2].removeprefix("unix://")
+        if not socket.startswith("/run/user/") or not socket.endswith("/podman/podman.sock"):
+            raise ValueError(f"Unexpected rootless VM socket: {socket}")
+        image = image or "localhost/phlex-dev:latest"
+        # Podman resolves local manifest lists to their native-platform member.
+        image_platform = subprocess.check_output(
+            ["podman", "image", "inspect", "--format", "{{.Os}}/{{.Architecture}}", image],
+            text=True,
+        ).strip()
+        if image_platform != "linux/arm64":
+            raise ValueError(
+                f"{image} does not resolve to a local linux/arm64 image; "
+                "build natively or explicitly pull its linux/arm64 member first"
+            )
+        service["platform"] = "linux/arm64"
+        service["network_mode"] = "pasta"
+        if os.environ.get("PHLEX_ENABLE_NESTED_PODMAN") == "1":
+            # Explicitly opt in to engine control and reduced SELinux isolation.
+            service["volumes"].append(f"{socket}:/tmp/podman.sock:ro")
+            service["security_opt"] = ["label=disable"]
+    else:
+        proxy_socket = home / ".podman-proxy/podman.sock"
+        if proxy_socket.exists():
+            service["volumes"].append(f"{proxy_socket}:/tmp/podman.sock:Z")
+    if service["volumes"]:
+        service["environment"] = {
+            "DOCKER_HOST": "unix:///tmp/podman.sock",
+            "CONTAINER_HOST": "unix:///tmp/podman.sock",
+        }
+    if image:
+        service["build"] = {"args": {"PHLEX_DEV_IMAGE": image}}
+    auth = home / ".local/share/kilo/auth.json"
+    if auth.is_file():
+        service["volumes"].append(f"{auth}:/run/phlex-host-auth.json:ro,Z")
+    return service
+
+
+def main() -> None:
+    """Atomically replace the generated, gitignored Compose override."""
+    target = Path(__file__).with_name("docker-compose.host.yml")
+    service = host_service(platform.system(), Path.home())
+    # JSON is also YAML, and safely quotes paths containing spaces or punctuation.
+    fd, temporary = tempfile.mkstemp(prefix=".compose-host-", dir=target.parent)
+    try:
+        with os.fdopen(fd, "w") as output:
+            output.write(json.dumps({"services": {"phlex-dev": service}}, indent=2) + "\n")
+        os.replace(temporary, target)
+    finally:
+        Path(temporary).unlink(missing_ok=True)
+
+
+if __name__ == "__main__":
+    main()

.devcontainer/devcontainer.json

@@ -1,6 +1,9 @@
 {
     "name": "Phlex CI Dev Container",
-    "dockerComposeFile": "docker-compose.yml",
+    "dockerComposeFile": [
+        "docker-compose.yml",
+        "docker-compose.host.yml"
+    ],
     "service": "phlex-dev",
     "workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}",
     "remoteUser": "root",
@@ -25,7 +28,6 @@
                 "C_Cpp.default.cStandard": "c17",
                 "C_Cpp.default.compileCommands": "${workspaceFolder}/build/compile_commands.json",
                 "C_Cpp.default.cppStandard": "c++23",
-                "C_Cpp.default.intelliSenseMode": "linux-gcc-x64",
                 "files.watcherExclude": {
                     "**/.venv/**": true,
                     "**/py_virtual_env/**": true

.devcontainer/docker-compose.yml

@@ -3,27 +3,25 @@ version: "3.8"
 services:
   phlex-dev:
     build:
-      context: .
-      dockerfile: Dockerfile
+      context: ..
+      dockerfile: .devcontainer/Dockerfile
     volumes:
       - ..:/workspaces/phlex:Z
       - ../../phlex-coding-guidelines:/workspaces/phlex-coding-guidelines:Z
       - ../../phlex-design:/workspaces/phlex-design:Z
       - ../../phlex-examples:/workspaces/phlex-examples:Z
       - ../../phlex-spack-recipes:/workspaces/phlex-spack-recipes:Z
       - ${HOME}/.config/gh:/root/.config/gh:ro,Z
-      - ${HOME}/.config/kilo:/root/.config/kilo:Z
+      - ${HOME}/.config/kilo:/root/.config/kilo:ro,Z
+      - ${PHLEX_RELAY_STATE_DIR:-${HOME}/.phlex-devcontainer-tmp/relays}:/run/phlex-host-relays:ro,Z
       - ${HOME}/.gnupg:/root/.gnupg:ro,Z
-      - ${HOME}/.podman-proxy/podman.sock:/tmp/podman.sock:Z
       - phlex-kilo-data:/root/.local/share/kilo:Z
-      - ${HOME}/.local/share/kilo/auth.json:/root/.local/share/kilo/auth.json:ro,Z
       - phlex-vscode-user-data:/root/.vscode-server-insiders/data/User:Z
     environment:
       - CMAKE_GENERATOR=Ninja
       - GH_CONFIG_DIR=/root/.config/gh
-      - DOCKER_HOST=unix:///tmp/podman.sock
-      - CONTAINER_HOST=unix:///tmp/podman.sock
       - GNUPGHOME=/root/.gnupg
+      - PHLEX_DEFAULT_COMPILER=${PHLEX_DEFAULT_COMPILER:-clang}
     user: root
     tty: true
     stdin_open: true