S001 Acceptance Scenarios

S001-AS-001 Bridge up: happy path [P1]

Given outcalld is running on Linux with CAP_NET_ADMIN And no bridge named outcall0 exists When outcalld starts (or outcall bridge up is called) Then a bridge interface outcall0 is created and brought up And the inet outcall nftables table is created with drop-all forward rules And outcall bridge status reports up and nftables: active.

S001-AS-002 Bridge up: idempotent re-up [P1]

Given the bridge outcall0 is already up with nftables rules active When outcall bridge up is called again Then the daemon attaches to the existing bridge (does not error) And nftables rules are reapplied (clean-slate) And outcall bridge status still reports up.

S001-AS-003 Status: bridge is up [P1]

Given the bridge is up and nftables rules are active When outcall bridge status is called Then the CLI prints the bridge name, status up, interface index, and nftables: active.

S001-AS-004 Status: bridge is down [P1]

Given the bridge has been torn down (or was never created) When outcall bridge status is called Then the CLI prints the bridge name, status down, and nftables: inactive.

S001-AS-005 Teardown: happy path [P1]

Given the bridge is up with nftables rules active When outcall bridge down is called Then the nftables table is deleted And the bridge interface is brought down and removed And ip link show outcall0 fails (interface gone) And nft list table inet outcall fails (table gone).

S001-AS-006 Daemon shutdown preserves enforcement [P1]

Given outcalld is running with the bridge up And a managed container remains attached to the bridge When outcalld receives SIGINT or SIGTERM Then dynamic direct-egress grants are removed And the bridge and strict base nftables policy remain active after the process exits And new direct traffic from the managed container remains blocked And the unix socket files are removed And restarting outcalld re-attaches to the bridge and replaces the ruleset idempotently.

S001-AS-007 Bridge already exists: attach [P1]

Given a bridge named outcall0 already exists (created by Docker or another process) When outcalld starts Then it attaches to the existing bridge (reuses the interface index) And applies nftables rules normally And does not error.

S001-AS-008 CLI: bridge status [P1]

Given outcalld is running When the user runs outcall bridge status Then the CLI connects to the unix socket, sends GET /api/v1/bridge, and prints the status.

S001-AS-009 CLI: bridge up [P1]

Given outcalld is running When the user runs outcall bridge up Then the CLI sends POST /api/v1/bridge/up and prints Bridge is up. on success.

S001-AS-010 CLI: bridge down [P1]

Given outcalld is running When the user runs outcall bridge down Then the CLI sends POST /api/v1/bridge/down and prints Bridge is down. on success.