agent-substrate · Benjamin Elder (BenTheElder) · Jul 23, 2026 · Jul 20, 2026 · Jul 20, 2026 · Jul 21, 2026
diff --git a/.github/workflows/pr-workflow.yaml b/.github/workflows/pr-workflow.yaml
@@ -33,6 +33,11 @@ jobs:
       with:
         go-version-file: 'go.mod'
     - run: go test -v ./...
+    # The imagecache consumer half (overlay mounts, whiteout mknod, trusted.*
+    # xattrs) is guarded by root-only tests that skip for the unprivileged
+    # runner user above; run that one package again as root so they execute.
+    - name: imagecache privileged tests
+      run: sudo -E env "PATH=$PATH" go test -v -count=1 ./internal/imagecache/
     - name: verify
       run: hack/verify-all.sh
   # One kind cluster exercises BOTH runtimes. Free x86-64 ubuntu-latest runners

diff --git a/.gitignore b/.gitignore
@@ -50,3 +50,6 @@ Thumbs.db
 
 # Local worktrees
 /.worktrees/
+
+# Stray local build outputs (go build ./tools/... without -o)
+/validate-image-cache
diff --git a/cmd/atelet/internal/memorypullcache/memorypullcache.go b/cmd/atelet/internal/memorypullcache/memorypullcache.go
diff --git a/cmd/atelet/internal/memorypullcache/memorypullcache_test.go b/cmd/atelet/internal/memorypullcache/memorypullcache_test.go