feat(run)!: remove --sidecar-config and the ./firma_sidecar.toml tier

The autostarted Sidecar now inherits its [sidecar] section from the resolved
unified firma.toml (--config / FIRMA_CONFIG / discovered .firma/firma.toml).
When no config is resolved (only reachable via firma-run library callers, since
firma run always discovers or scaffolds a firma.toml), a minimal UDS-only config
is synthesized.

The --sidecar-config flag and the ./firma_sidecar.toml working-directory
fallback had no documented use case distinct from --config: both let an operator
point the sidecar at a separate file, which firma run never needs. Removing them
collapses template selection to two states: the resolved firma.toml (Explicit)
or Minimal.

BREAKING CHANGE: the `--sidecar-config` flag on `firma run` is removed, along
with the `./firma_sidecar.toml` autostart fallback. Put the `[sidecar]` section
in the firma.toml selected by --config / FIRMA_CONFIG / discovery instead.

Author: luca-iachini

crates/firma-run/src/config.rs

@@ -1500,7 +1500,6 @@ mod tests {
             preserve_host_user: false,
             print_effective_config: false,
             no_autostart: false,
-            sidecar_template_path: None,
             sidecar_startup_timeout_secs: 10,
             command: vec!["echo".to_string(), "ok".to_string()],
             authority_cli: crate::authority::AuthorityCli::Unset,

crates/firma-run/src/routing.rs

@@ -915,15 +915,9 @@ fn prepare_run_components(
             })?;
         let firma_exe = std::env::current_exe()
             .map_err(|error| RunError::Internal(format!("resolve current executable: {error}")))?;
-        let cwd_template = std::env::current_dir()
-            .ok()
-            .map(|cwd| cwd.join("firma_sidecar.toml"));
         let mut sidecar_template = owns_sidecar
             .then(|| {
-                crate::sidecar::config::resolve_template_sources(
-                    flags.template_path.as_deref(),
-                    cwd_template.as_deref(),
-                )
+                crate::sidecar::config::resolve_template_sources(flags.template_path.as_deref())
             })
             .transpose()?;
         let mut authority_launch = None;

crates/firma-run/src/runtime/mod.rs

@@ -52,8 +52,6 @@ pub struct RunInput {
     /// When set, never autostart — fail with a typed error if the
     /// configured endpoint is unreachable. CI / production safety net.
     pub no_autostart: bool,
-    /// Optional explicit template path for the autostarted sidecar config.
-    pub sidecar_template_path: Option<PathBuf>,
     /// Seconds to wait for the autostarted sidecar's `ready` line.
     pub sidecar_startup_timeout_secs: u64,
     /// Wrapped command and args.
@@ -192,10 +190,10 @@ pub fn execute_run(args: &RunInput, hooks: &LaunchHooks<'_>) -> Result<i32, RunE
             );
         }
 
-        let sidecar_template_path = resolve_sidecar_template_path(
-            args.sidecar_template_path.as_deref(),
-            user_config_path.as_deref(),
-        );
+        // The autostarted Sidecar inherits its template from the resolved
+        // unified `firma.toml` when it exists on disk; a missing file falls
+        // through to the minimal tier during synthesis.
+        let sidecar_template_path = resolve_sidecar_template_path(user_config_path.as_deref());
         let mut flags = AutostartFlags {
             sidecar_autostart: matches!(
                 profile.sidecar_selection,
@@ -363,15 +361,14 @@ pub fn execute_run(args: &RunInput, hooks: &LaunchHooks<'_>) -> Result<i32, RunE
     combine_run_and_teardown_results(run_result, teardown_result)
 }
 
-fn resolve_sidecar_template_path(
-    sidecar_template_path: Option<&Path>,
-    user_config_path: Option<&Path>,
-) -> Option<PathBuf> {
-    sidecar_template_path.map(Path::to_path_buf).or_else(|| {
-        user_config_path
-            .filter(|p| p.is_file())
-            .map(Path::to_path_buf)
-    })
+/// Select the autostarted Sidecar's config template.
+///
+/// The template is the resolved unified `firma.toml` when it exists on disk;
+/// a missing file yields `None`, deferring to minimal synthesis.
+fn resolve_sidecar_template_path(user_config_path: Option<&Path>) -> Option<PathBuf> {
+    user_config_path
+        .filter(|p| p.is_file())
+        .map(Path::to_path_buf)
 }
 
 fn log_run_start(identity: &RunIdentity, profile: &ResolvedProfile) {
@@ -1317,7 +1314,6 @@ mod tests {
             preserve_host_user: false,
             print_effective_config: false,
             no_autostart: false,
-            sidecar_template_path: None,
             sidecar_startup_timeout_secs: 10,
             command: vec!["echo".to_string(), "ok".to_string()],
             authority_cli: crate::authority::AuthorityCli::Unset,
@@ -1728,27 +1724,30 @@ mod tests {
     }
 
     #[test]
-    fn resolve_sidecar_template_prefers_explicit_sidecar_config() {
-        let resolved = super::resolve_sidecar_template_path(
-            Some(PathBuf::from("/tmp/from-sidecar-config.toml").as_path()),
-            Some(PathBuf::from("/tmp/user.toml").as_path()),
-        );
-        assert_eq!(
-            resolved,
-            Some(PathBuf::from("/tmp/from-sidecar-config.toml"))
-        );
-    }
-
-    #[test]
-    fn resolve_sidecar_template_falls_back_to_user_config_when_present() {
+    fn resolve_sidecar_template_uses_user_config_when_present() {
         let tmp = tempfile::tempdir().unwrap_or_else(|e| panic!("{e}"));
         let user_cfg = tmp.path().join(CONFIG_FILE_NAME);
         fs::write(&user_cfg, "[sidecar]\n").unwrap_or_else(|e| panic!("{e}"));
 
-        let resolved = super::resolve_sidecar_template_path(None, Some(user_cfg.as_path()));
+        let resolved = super::resolve_sidecar_template_path(Some(user_cfg.as_path()));
         assert_eq!(resolved, Some(user_cfg));
     }
 
+    #[test]
+    fn resolve_sidecar_template_is_none_without_config() {
+        assert_eq!(super::resolve_sidecar_template_path(None), None);
+    }
+
+    #[test]
+    fn resolve_sidecar_template_is_none_when_config_missing() {
+        let tmp = tempfile::tempdir().unwrap_or_else(|e| panic!("{e}"));
+        let missing = tmp.path().join(CONFIG_FILE_NAME);
+        assert_eq!(
+            super::resolve_sidecar_template_path(Some(missing.as_path())),
+            None
+        );
+    }
+
     #[test]
     fn enforce_network_proof_is_structural_for_bwrap() {
         let backend = crate::backend::build_backend(crate::backend::BackendKind::Bwrap);
@@ -1838,7 +1837,6 @@ mod tests {
             preserve_host_user: false,
             print_effective_config: false,
             no_autostart: false,
-            sidecar_template_path: None,
             sidecar_startup_timeout_secs: 10,
             command: vec!["echo".to_string(), "ok".to_string()],
             authority_cli: crate::authority::AuthorityCli::Unset,

crates/firma-run/src/sidecar/config.rs

@@ -359,8 +359,11 @@ pub struct SynthesizeRequest<'a> {
 #[doc(hidden)]
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum TemplateSource {
+    /// The resolved unified `firma.toml` (`--config` / `FIRMA_CONFIG` /
+    /// discovery) was selected as the template.
     Explicit(PathBuf),
-    Cwd(PathBuf),
+    /// No template file was available; a minimal `[sidecar]` document is
+    /// synthesized.
     Minimal,
 }
 
@@ -495,21 +498,6 @@ fn override_authority_agent_id(
     Ok(())
 }
 
-fn select_template(
-    explicit_template: Option<&Path>,
-    cwd_template: Option<&Path>,
-) -> TemplateSource {
-    if let Some(path) = explicit_template {
-        return TemplateSource::Explicit(path.to_path_buf());
-    }
-    if let Some(path) = cwd_template
-        && path.is_file()
-    {
-        return TemplateSource::Cwd(path.to_path_buf());
-    }
-    TemplateSource::Minimal
-}
-
 fn parse_template(path: &Path) -> Result<toml::Value, RunError> {
     let text = std::fs::read_to_string(path).map_err(|error| RunError::ConfigParse {
         path: path.to_path_buf(),
@@ -536,18 +524,22 @@ fn parse_template(path: &Path) -> Result<toml::Value, RunError> {
 
 /// Select and validate one template snapshot without writing runtime artifacts.
 ///
+/// `template_path` is the resolved unified `firma.toml` when one exists on
+/// disk; otherwise a minimal `[sidecar]` document is synthesized.
+///
 /// # Errors
 ///
 /// Returns a path-bearing configuration error when the selected template is
 /// unreadable or does not match the unified Sidecar schema.
 #[doc(hidden)]
 pub fn resolve_template_sources(
-    explicit_template: Option<&Path>,
-    cwd_template: Option<&Path>,
+    template_path: Option<&Path>,
 ) -> Result<ResolvedTemplate, RunError> {
-    let source = select_template(explicit_template, cwd_template);
+    let source = template_path.map_or(TemplateSource::Minimal, |path| {
+        TemplateSource::Explicit(path.to_path_buf())
+    });
     let (value, template_dir) = match &source {
-        TemplateSource::Explicit(path) | TemplateSource::Cwd(path) => {
+        TemplateSource::Explicit(path) => {
             let abs = std::path::absolute(path).unwrap_or_else(|_| path.clone());
             (parse_template(path)?, abs.parent().map(Path::to_path_buf))
         }
@@ -1196,8 +1188,7 @@ mod tests {
             agent_id: &crate::identity::test_agent_id(),
             execution_profile: firma_config_loader::AgentProfile::Vscode,
             session_id: "sess_001",
-            template: resolve_template_sources(None, None)
-                .unwrap_or_else(|error| panic!("{error}")),
+            template: resolve_template_sources(None).unwrap(),
             socket_path: &tmp.path().join("sidecar.sock"),
             listen_addr: Some(
                 "127.0.0.1:18080"

crates/firma-run/tests/integration/backend_selection.rs

@@ -23,7 +23,6 @@ fn run_input_inner(backend: Option<BackendKind>, config: Option<PathBuf>) -> Run
         preserve_host_user: false,
         print_effective_config: false,
         no_autostart: false,
-        sidecar_template_path: None,
         sidecar_startup_timeout_secs: 10,
         command: vec!["echo".to_string(), "ok".to_string()],
         authority_cli: firma_run::authority::AuthorityCli::Unset,

crates/firma-run/tests/integration/capability_config.rs

@@ -24,7 +24,6 @@ fn run_input(config: &Path) -> RunInput {
         preserve_host_user: false,
         print_effective_config: false,
         no_autostart: false,
-        sidecar_template_path: None,
         sidecar_startup_timeout_secs: 10,
         command: vec!["echo".to_string(), "ok".to_string()],
         authority_cli: firma_run::authority::AuthorityCli::Unset,

crates/firma-run/tests/integration/config_paths.rs

@@ -15,7 +15,6 @@ fn run_input(config: PathBuf) -> RunInput {
         preserve_host_user: false,
         print_effective_config: false,
         no_autostart: false,
-        sidecar_template_path: None,
         sidecar_startup_timeout_secs: 10,
         command: vec!["echo".to_string(), "ok".to_string()],
         authority_cli: firma_run::authority::AuthorityCli::Unset,

crates/firma-run/tests/integration/profile_alias.rs

@@ -14,7 +14,6 @@ fn run_input(profile: &str, config: PathBuf) -> RunInput {
         preserve_host_user: false,
         print_effective_config: false,
         no_autostart: false,
-        sidecar_template_path: None,
         sidecar_startup_timeout_secs: 10,
         command: vec!["echo".to_string(), "ok".to_string()],
         authority_cli: firma_run::authority::AuthorityCli::Unset,