@@ -14,9 +14,10 @@ The Release Canary (`.github/workflows/release-canary.yml`) smoke-tests the arti
 | Job | Runner | Verifies |
 |---|---|---|
 | `macos` | `macos-latest-xlarge` | Installs the dev Homebrew artifacts, reaches the VM gateway, and creates, executes in, and deletes a sandbox. |
-| `ubuntu` | `ubuntu-latest` | Installs the dev Debian package, reaches the Docker gateway, and creates, executes in, and deletes a sandbox. |
+| `ubuntu-deb` | `ubuntu-latest` | Installs the dev Debian package, reaches the Docker gateway, and creates, executes in, and deletes a sandbox. |
 | `fedora` | `fedora:latest` container | Installs the dev RPM packages, reaches the Podman gateway, and creates, executes in, and deletes a sandbox. |
-| `ubuntu-snap` | `ubuntu-latest` | Installs the Release Dev Snap, connects its interfaces, reaches the Docker gateway, and creates, executes in, and deletes a sandbox. |
+| `ubuntu-snap-system-docker` | `ubuntu-latest` | Uses `install.sh` to install the snap from `latest/edge`, reuses system Docker, reaches the Docker gateway, and creates, executes in, and deletes a sandbox, and verifies that the Docker snap is not installed. |
+| `ubuntu-snap-provisions-docker` | `ubuntu-latest` | Uses `install.sh` to install the Docker and OpenShell snaps, waits for Docker, reaches the Docker gateway, and creates, executes in, and deletes a sandbox. |
 | `kubernetes` | `ubuntu-latest` + kind | Installs the dev Helm chart, reaches the in-cluster gateway, and creates, executes in, and deletes a sandbox using the published runtime images. |
 
 All canary jobs disable anonymous OpenShell telemetry. Host package jobs inject
@@ -25,8 +26,11 @@ Kubernetes job installs with `server.telemetryEnabled=false`, so smoke traffic
 does not contribute to product usage metrics.
 
 The workflow sets `OPENSHELL_VERSION=dev`, so every `install.sh` job consumes the
-rolling dev release produced by the triggering workflow. Kubernetes pins the
-matching `0.0.0-dev` chart and `:dev` images.
+rolling dev release produced by the triggering workflow. Both snap lanes track
+`latest/edge`; one reuses system Docker while the other verifies automatic
+Docker snap provisioning. The Debian and Kubernetes CLI lanes remove snapd so
+they continue to exercise the dev Debian package. Kubernetes pins the matching
+`0.0.0-dev` chart and `:dev` images.
 
 The host-package jobs exercise fresh installs, not upgrades from a persisted
 schema-v1 gateway config. Validate Homebrew and RPM exact-default migration with
@@ -50,7 +54,7 @@ on:
 ```
 
 - **Automatic.** Every successful `Release Dev` run (on `main` or a manual dispatch of Release Dev) fires the canary. Each job gates on `github.event.workflow_run.conclusion == 'success'` so a failed Release Dev does not run the canary.
-- **Manual.** `workflow_dispatch` lets you run the canary on demand against any branch's workflow definition. To include `ubuntu-snap`, supply `release-dev-run-id` for a successful Release Dev run whose Snap artifact should be tested; without it, that job is skipped because no artifact is available.
+- **Manual.** `workflow_dispatch` lets you run the canary on demand against any branch's workflow definition.
 
 When dispatched manually, `github.event.workflow_run.head_sha` is empty and the workflow falls back to `github.sha` (the branch tip) for the `install.sh` URL.
 
@@ -62,13 +66,6 @@ Run the canary as-is on the current branch:
 gh workflow run release-canary.yml --ref "$(git branch --show-current)"
 ```
 
-To exercise the Ubuntu Snap job, pass the successful Release Dev run ID:
-
-```shell
-gh workflow run release-canary.yml --ref "$(git branch --show-current)" \
-  -f release-dev-run-id=<release-dev-run-id>
-```
-
 Watch the run that starts:
 
 ```shell
@@ -87,7 +84,7 @@ gh run view <run-id> --log-failed
 
 When you change `release-canary.yml` on a branch, a manual dispatch on that branch tests *your branch's workflow logic* against *main's published dev artifacts* (`0.0.0-dev` chart, `:dev` images, and the `dev` GitHub release). This is what you want for iterating on the canary — you're validating that the canary still works against known-good artifacts.
 
-Note `install.sh` is pulled from `raw.githubusercontent.com/NVIDIA/OpenShell/${head_sha}/install.sh`, so changes to `install.sh` on your branch *are* exercised even though the binaries it downloads are from the latest public tag.
+Note `install.sh` is pulled from `raw.githubusercontent.com/NVIDIA/OpenShell/${head_sha}/install.sh`, so changes to `install.sh` on your branch *are* exercised even though packages come from the latest public dev release and the snap comes from `latest/edge`.
 
 ## Testing artifacts from a specific SHA
 
@@ -137,10 +134,11 @@ Loopback registration auto-derives the gateway name to `openshell` if `--name` i
 
 | Symptom | Likely cause | Where to look |
 |---|---|---|
-| `macos`/`ubuntu`/`fedora` job fails on `install.sh` | Dev release missing an asset, checksum mismatch, or `install.sh` regression on this branch. | Job log around the `curl … install.sh \| sh` step. |
+| `macos`/`ubuntu-deb`/`fedora` job fails on `install.sh` | Dev release missing an asset, checksum mismatch, or `install.sh` regression on this branch. | Job log around the `curl … install.sh \| sh` step. |
 | Sandbox create or exec fails | Published sandbox and supervisor artifacts are missing, incompatible, or cannot establish the protected runtime channel. | Gateway logs plus Docker, Podman, VM, Snap, or Kubernetes runtime diagnostics for the job. |
-| `macos`/`ubuntu`/`fedora` job fails on `openshell status` | Local gateway service did not start (systemd/brew/podman). Often a driver issue. | Service logs in the job log; `OPENSHELL_COMPUTE_DRIVER` env in the "Ensure …" step. |
-| `ubuntu-snap` fails after interface connection | The gateway did not recover after Docker became available, or did not become reachable within the 30-second bound. | Failure diagnostics dump Snap service/connection/change state, gateway and snapd journals, Snap logs, and port 17670 listeners. |
+| `macos`/`ubuntu-deb`/`fedora` job fails on `openshell status` | Local gateway service did not start (systemd/brew/podman). Often a driver issue. | Service logs in the job log; `OPENSHELL_COMPUTE_DRIVER` env in the "Ensure …" step. |
+| `ubuntu-snap-system-docker` fails during `install.sh` | System Docker was unavailable, the edge revision or automatic interfaces were unavailable, or the gateway did not become reachable. | Failure diagnostics dump system Docker, snap service/connection/change state, gateway and snapd journals, snap logs, and port 17670 listeners. |
+| `ubuntu-snap-provisions-docker` fails during `install.sh` | The Docker snap was not installed or did not become ready before OpenShell installation, or the gateway did not become reachable. | Failure diagnostics also dump the Docker snap service and journal. |
 | `kubernetes` job fails on `helm install --wait` | Chart did not deploy in 5 min — usually image pull failure or readiness probe failing. | "Diagnostics on failure" step dumps `helm status`, manifest, pod describe, pod logs. |
 | `kubernetes` job fails on `kubectl wait` | Gateway pod stuck `CrashLoopBackOff` or `ImagePullBackOff`. | Diagnostics dump; check `:dev` image existence at `ghcr.io/nvidia/openshell/gateway`. |
 | `kubernetes` job fails on `openshell gateway add` or `status` | Port-forward not reachable, or CLI/gateway proto mismatch. | `port-forward.log` and `openshell gateway list` in the diagnostics dump. |
 
@@ -2,11 +2,6 @@ name: Release Canary
 
 on:
   workflow_dispatch:
-    inputs:
-      release-dev-run-id:
-        description: "Successful Release Dev run ID whose Snap artifact to test"
-        required: false
-        type: string
   workflow_run:
     workflows: ["Release Dev"]
     types: [completed]
@@ -58,12 +53,22 @@ jobs:
             fi
           done
 
-  ubuntu:
-    name: Ubuntu Docker
+  ubuntu-deb:
+    name: Ubuntu DEB
     if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
+      - name: Remove snapd
+        run: |
+          set -euo pipefail
+          snaps=$(snap list 2>/dev/null | awk 'NR > 1 { print $1 }')
+          if [ -n "$snaps" ]; then
+            sudo snap remove $snaps
+          fi
+          sudo apt-get -y --purge remove snapd
+          ! command -v snap >/dev/null 2>&1
+
       - name: Ensure Docker
         run: |
           if ! command -v docker >/dev/null 2>&1; then
@@ -186,9 +191,9 @@ jobs:
         run: |
           docker rm -f "${FEDORA_CANARY_CONTAINER}" >/dev/null 2>&1 || true
 
-  ubuntu-snap:
-    name: Ubuntu Snap
-    if: ${{ github.event.workflow_run.conclusion == 'success' || inputs.release-dev-run-id != '' }}
+  ubuntu-snap-system-docker:
+    name: Ubuntu Snap with system Docker
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -201,54 +206,100 @@ jobs:
           sudo systemctl start snapd
           sudo snap wait system seed.loaded
 
-      - name: Install Docker snap
+      - name: Ensure Docker
         run: |
           set -euo pipefail
-          sudo snap install docker
-
-      - name: Download snap from release-dev artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          github-token: ${{ github.token }}
-          run-id: ${{ inputs.release-dev-run-id || github.event.workflow_run.id }}
-          pattern: snap-linux-amd64
-          path: release/
-          merge-multiple: true
+          if ! command -v docker >/dev/null 2>&1; then
+            sudo apt-get update
+            sudo apt-get install -y docker.io
+          fi
+          sudo systemctl start docker || sudo service docker start
+          docker info
 
-      - name: Install snap (dangerous — from release, not store)
+      - name: Install and check status
         run: |
           set -euo pipefail
           sudo systemctl set-environment \
             "OPENSHELL_TELEMETRY_ENABLED=${OPENSHELL_TELEMETRY_ENABLED}"
-          sudo snap install ./release/*.snap --dangerous
+          curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/${{ github.event.workflow_run.head_sha || github.sha }}/install.sh | sh
+          sudo snap list openshell
+          if sudo snap list docker >/dev/null 2>&1; then
+            echo "install.sh unexpectedly installed the Docker snap" >&2
+            exit 1
+          fi
+          snap info openshell | grep -E '^tracking: +latest/edge$'
+          docker info
+          sudo snap connections openshell | grep -E '^docker +openshell:docker +:docker +'
+          openshell --version
+          sudo snap services openshell
+          openshell status
 
-      - name: Connect interfaces
+      - name: Create and exercise a sandbox
         run: |
           set -euo pipefail
-          sudo snap connect openshell:docker docker:docker-daemon
-          sudo snap connect openshell:log-observe
-          sudo snap connect openshell:system-observe
+          sandbox="rc-system-docker-${GITHUB_RUN_ID}"
+          openshell sandbox create --name "$sandbox" --detach
+          openshell sandbox exec --name "$sandbox" --no-tty -- true
+          openshell sandbox delete "$sandbox"
 
-      - name: Register snap gateway and check status
+      - name: Collect Snap diagnostics
+        if: failure()
+        run: |
+          set +e
+          docker info
+          sudo systemctl status docker.service --no-pager
+          sudo journalctl -b -u docker.service --no-pager -n 300
+          sudo snap services openshell
+          sudo snap connections openshell
+          sudo snap changes
+          sudo systemctl status snap.openshell.gateway.service --no-pager
+          sudo journalctl -b -u snap.openshell.gateway.service --no-pager -n 300
+          sudo journalctl -b -u snapd.service --no-pager -n 300
+          sudo snap logs openshell.gateway -n=300
+          sudo ss -ltnp '( sport = :17670 )'
+
+  ubuntu-snap-provisions-docker:
+    name: Ubuntu Snap provisions Docker
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Install snapd
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install -y snapd
+          sudo systemctl enable --now snapd.socket
+          sudo systemctl start snapd
+          sudo snap wait system seed.loaded
+
+      - name: Remove system Docker
+        run: |
+          set -euo pipefail
+          sudo systemctl stop docker.service docker.socket 2>/dev/null || true
+          sudo apt-get -y --purge remove docker-ce docker-ce-cli containerd.io \
+            docker-buildx-plugin docker-compose-plugin docker.io 2>/dev/null || true
+          ! command -v docker >/dev/null 2>&1
+
+      - name: Install and check status
         run: |
           set -euo pipefail
+          sudo systemctl set-environment \
+            "OPENSHELL_TELEMETRY_ENABLED=${OPENSHELL_TELEMETRY_ENABLED}"
+          curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/${{ github.event.workflow_run.head_sha || github.sha }}/install.sh | sh
+          sudo snap list docker
+          sudo snap list openshell
+          snap info openshell | grep -E '^tracking: +latest/edge$'
+          sudo docker info
+          sudo snap connections openshell | grep -E '^docker +openshell:docker +:docker +'
           openshell --version
           sudo snap services openshell
-          openshell gateway add http://127.0.0.1:17670 --local --name snap-docker
-          openshell gateway select snap-docker
-          for _ in $(seq 1 30); do
-            if openshell status; then
-              exit 0
-            fi
-            sleep 1
-          done
-          echo "Gateway did not become ready within 30 seconds" >&2
-          exit 1
+          openshell status
 
       - name: Create and exercise a sandbox
         run: |
           set -euo pipefail
-          sandbox="rc-${GITHUB_RUN_ID}"
+          sandbox="rc-provisions-docker-${GITHUB_RUN_ID}"
           openshell sandbox create --name "$sandbox" --detach
           openshell sandbox exec --name "$sandbox" --no-tty -- true
           openshell sandbox delete "$sandbox"
@@ -257,10 +308,13 @@ jobs:
         if: failure()
         run: |
           set +e
-          sudo snap services openshell
+          sudo docker info
+          sudo snap services docker openshell
           sudo snap connections openshell
           sudo snap changes
+          sudo systemctl status snap.docker.dockerd.service --no-pager
           sudo systemctl status snap.openshell.gateway.service --no-pager
+          sudo journalctl -b -u snap.docker.dockerd.service --no-pager -n 300
           sudo journalctl -b -u snap.openshell.gateway.service --no-pager -n 300
           sudo journalctl -b -u snapd.service --no-pager -n 300
           sudo snap logs openshell.gateway -n=300
@@ -336,6 +390,16 @@ jobs:
           cat port-forward.log >&2
           exit 1
 
+      - name: Remove snapd
+        run: |
+          set -euo pipefail
+          snaps=$(snap list 2>/dev/null | awk 'NR > 1 { print $1 }')
+          if [ -n "$snaps" ]; then
+            sudo snap remove $snaps
+          fi
+          sudo apt-get -y --purge remove snapd
+          ! command -v snap >/dev/null 2>&1
+
       - name: Install OpenShell CLI
         run: |
           set -euo pipefail
 
@@ -399,7 +399,7 @@ These workflows run after merge to publish dev/tagged artifacts and verify them.
 |---|---|
 | `.github/workflows/release-dev.yml` | Publishes the rolling `dev` build on every push to `main`. Builds gateway, sandbox, and supervisor images and binaries, packages, wheels, and pushes the Helm chart as `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev` (plus an immutable `0.0.0-dev.<sha>` pin). Also dispatchable manually. |
 | `.github/workflows/release-tag.yml` | Publishes tagged stable releases and manually dispatched pre-releases. Its automatic tag trigger excludes `-pre.*`. Security and integration failures do not block pre-release artifact publication. Stable publication requires the currently implemented qualification profile to pass; the summary identifies the remaining RFC 0014 coverage. |
-| `.github/workflows/release-canary.yml` | Smoke-tests published dev artifacts on `macos`, `ubuntu`, `fedora`, and `kubernetes` (kind + Helm) runners. Each job reaches its gateway and creates, exercises, and deletes a sandbox. It runs automatically after `Release Dev` succeeds and supports manual dispatch (`gh workflow run release-canary.yml --ref <branch>`). See the `test-release-canary` skill for the playbook and local kind reproduction. |
+| `.github/workflows/release-canary.yml` | Smoke-tests published dev artifacts in the `macos`, `ubuntu-deb`, `ubuntu-snap-system-docker`, `ubuntu-snap-provisions-docker`, `fedora`, and `kubernetes` (kind + Helm) jobs. Each job reaches its gateway and creates, exercises, and deletes a sandbox. The Snap jobs cover both an existing system Docker daemon and automatic Docker snap provisioning. It runs automatically after `Release Dev` succeeds and supports manual dispatch (`gh workflow run release-canary.yml --ref <branch>`). See the `test-release-canary` skill for the playbook and local kind reproduction. |
 
 ## Required status contexts
 
 
@@ -318,6 +318,18 @@ configure the gateway to use them. The Ubuntu `deb` installer consumes
 for direct executable installation on every environment. Release Dev and
 Release Tag run Ubuntu conformance through the Debian package, while Fedora
 continues using direct executable installation until RPM coverage is available.
+The release canary separately exercises the public installer on Ubuntu. Its Snap
+lanes install the rolling development release from the Snap Store with both an
+existing system Docker daemon and a host where the installer must provision and
+wait for the Docker snap. Its Debian lane removes snapd before running the
+installer so Snap precedence cannot change the package under test.
+Snapd runs the gateway as a root-owned system service. Its generated client
+certificates reside in root-owned snap state and are unavailable to ordinary CLI
+users, so the Snap uses plaintext loopback transport and enables unauthenticated
+local users by default. Debian and RPM packages instead run systemd user services
+and use user-owned mTLS material. Bootstrap creates the default configuration
+only when it is missing. Sandbox-to-gateway sessions remain authenticated with
+gateway-minted JWTs.
 The Debian qualification profile keeps candidate-image overrides outside the
 operator-owned gateway configuration: it writes a harness-owned file under
 `/var/lib/openshell-qualification` and selects it through the packaged systemd