feat(sec-254): vsock CID allocation and end-to-end tests

.gitignore

@@ -2,6 +2,9 @@
 /target
 /crates/*/target
 
+# Staged emberd binary for image builds (built with `make emberd-image`)
+/images/emberd
+
 # Swift build artifacts
 /ember-vz/.build
 /ember-vz/.swiftpm

Cargo.toml

@@ -1,5 +1,5 @@
 [workspace]
-members = ["crates/ember-core", "crates/ember-linux", "crates/ember-macos"]
+members = ["crates/ember-core", "crates/ember-linux", "crates/ember-macos", "emberd"]
 default-members = ["."]
 
 [workspace.dependencies]
@@ -43,6 +43,9 @@ uuid = { version = "1", features = ["v4", "serde"] }
 # Temporary directories
 tempfile = "3"
 
+# Embedded database (relational allocator state — see SEC-459)
+rusqlite = { version = "0.32", features = ["bundled"] }
+
 [package]
 name = "ember"
 version = "0.1.0"

Makefile

@@ -4,7 +4,7 @@
 
 UNAME := $(shell uname -s)
 
-.PHONY: build release clean fmt check clippy test udeps
+.PHONY: build release clean fmt check clippy test udeps emberd
 
 build:
 	cargo build
@@ -22,23 +22,45 @@ ifeq ($(UNAME),Darwin)
 	cp ember-vz/.build/release/ember-vz target/release/
 endif
 
+# Build emberd (in-VM daemon). Runs inside Linux VMs so the vsock listener
+# only compiles on Linux, but UDS-only mode works on macOS for testing.
+emberd:
+	cargo build -p emberd
+
+emberd-release:
+	cargo build -p emberd --release
+
+# Build emberd for Linux and stage at images/emberd for Dockerfile COPY.
+# Uses Docker (via Colima on macOS) so no cross-compilation toolchain needed.
+emberd-image:
+ifeq ($(UNAME),Linux)
+	cargo build -p emberd --release
+	cp target/release/emberd images/emberd
+else
+	docker run --rm -v "$(CURDIR)":/src -w /src \
+		-e CARGO_TARGET_DIR=/tmp/emberd-target \
+		rust:latest \
+		sh -c 'cargo build -p emberd --release && cp /tmp/emberd-target/release/emberd /src/images/emberd'
+endif
+	@echo "emberd binary staged at images/emberd"
+
 clean:
 	cargo clean
 ifeq ($(UNAME),Darwin)
 	cd ember-vz && swift package clean
 endif
 
 fmt:
-	cargo fmt
+	cargo fmt --all
 
 check:
-	cargo check
+	cargo check --workspace
 
 clippy:
-	cargo clippy -- -D warnings
+	cargo clippy --workspace -- -D warnings
 
 test:
-	cargo test
+	cargo test --workspace
 
 udeps:
 	cargo machete

crates/ember-core/Cargo.toml

@@ -17,3 +17,4 @@ async-trait = { workspace = true }
 tokio = { workspace = true }
 uuid = { workspace = true }
 tempfile = { workspace = true }
+rusqlite = { workspace = true }

crates/ember-core/src/config/vm.rs

@@ -37,6 +37,8 @@ pub struct VmConfig {
     pub ssh: Option<VmSshConfig>,
     /// Custom boot arguments for the kernel.
     pub boot_args: Option<String>,
+    /// Enable vsock device for host-guest communication.
+    pub vsock: Option<bool>,
 }
 
 /// Network configuration within a VM YAML config.
@@ -181,6 +183,17 @@ boot_args: "console=ttyS0 reboot=k panic=1 pci=off"
         assert!(config.boot_args.is_none());
     }
 
+    #[test]
+    fn parse_vsock_config() {
+        let yaml = "image: alpine:latest\nvsock: true\n";
+        let config: VmConfig = serde_yaml::from_str(yaml).unwrap();
+        assert_eq!(config.vsock, Some(true));
+
+        let yaml = "image: alpine:latest\n";
+        let config: VmConfig = serde_yaml::from_str(yaml).unwrap();
+        assert!(config.vsock.is_none());
+    }
+
     #[test]
     fn parse_empty_config() {
         let yaml = "---\n";

crates/ember-core/src/error.rs

@@ -41,6 +41,10 @@ pub enum Error {
     #[error("image: {0}")]
     Image(String),
 
+    /// Vsock CID allocation error.
+    #[error("vsock: {0}")]
+    Vsock(String),
+
     /// SSH connection or command error.
     #[error("ssh: {0}")]
     Ssh(String),
@@ -88,6 +92,10 @@ pub enum Error {
     /// YAML parsing error.
     #[error("yaml: {0}")]
     Yaml(#[from] serde_yaml::Error),
+
+    /// SQLite error from the embedded allocator state DB.
+    #[error("sqlite: {0}")]
+    Sqlite(#[from] rusqlite::Error),
 }
 
 /// Convenience alias used throughout ember.