From c00256c94a64a59677753fddf6750a13f5381357 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 3 Sep 2026 12:39:01 +0000 Subject: [PATCH 1/3] =?UTF-8?q?Mark=20the=20=C2=A75.A=20extdeps.os.id=20ro?= =?UTF-8?q?w=20landed,=20and=20file=20the=20id=5Flookup=5Fargv=20zero-cons?= =?UTF-8?q?umer=20ruling=20request?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The census's §5.A table still read `extdeps.os.id` as a NEW op at `dag/extdeps/os/id.dag` -- the stale row a survey read as "still pending". The op landed on #7194 at its post-#7231 home `dag/extdeps/tools/id.dag` (module `extdeps.tools.id`, service `os.Id`, ops `Uid`/`Gid`/`Lookup`), hermetic witness `test.claim.shell_dag_census_5a_typed_ops_witness` (`witness_os_id_uid_realizes_hermetically`, `witness_os_id_gid_realizes_hermetically`, `witness_os_id_lookup_realizes_hermetically`). The row now says so, cited by module and symbol rather than position, and the consumer column states the true status: `host_effect_realize`'s ssh probes already consume the typed argv rows `id_uid_argv`/`id_gid_argv` (absolute-path variants), and `fleet_posix_accounts` `probe_command` is NOT-a-shell-site (census §4 row) -- authored provenance, live proof `deploy_access_check_observed`. The same PR files a ruling request, not a deletion: `id_lookup_argv` (the `id ` verb) has zero production references -- measured denominator, grep of `dag/` + `src/v2/test/` at `75873c2897`: the definition, the hermetic-witness call, and service-name rows in the effect-plan tests, nothing more. Zero references is not deadness in this repo (env-gated and emitted-path consumers exist that grep does not see), and the row's named consumers are reclassified (`fleet_posix_accounts` -- NOT-a-shell-site) or deferred (`spark/managed_access_apply` create-script bodies -- dissolve-on marker, no operator verdict). Retain-as-reserved or retire is the operator's call; the row records the measured denominator and asks for it. Co-Authored-By: Claude Opus 5 --- docs/plans/shell-to-dag-residual-census-and-arc-completion.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index a4f8b980ec3..1b9af84060b 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -782,10 +782,12 @@ What the trigger does **not** discharge is the **existing** rows: the wall stops | --- | --- | --- | --- | | `extdeps.os.hostname` · ~~`Read`~~ **LANDED** + `Set` | `dag/extdeps/os/hostname.dag` (created) | ~~`hostname -s`~~ **done**; `hostnamectl set-hostname` remains | **Read done** — `os.Hostname.ReadShort` realized via typed cell `HostnameReadOnHost` + `gunbc.hostname_read` (LocalShell → op, SshShell → typed argv); both read consumers dissolved: `host_identity_observation` (`HostIdentityShortHostnameRead`, the `host_identity_short_hostname_script` concat DELETED) and `ci_deploy_target_host` (runtime-present read; the GHA preflight *block* stays E-emit). **Set** (`host_effect_hostname` `SetHostnameCas`, its own `host_effect_set_hostname_cas_script` concat) still pending — reuses this op file with a `SetHostname` op. | | `systemd.Systemctl.ListUnits` | **add to** `dag/extdeps/os/systemctl.dag` | `systemctl list-units --state=active` | `host_converge_slice1` (was `_enumerate_units_script`; now calls `systemctl_list_units_active_services` at `:287`). *The `fleet_show_effective_read` consumer named here — `fleet_runner_width_count_read_script` — was never migrated: it was superseded and left dead, and is deleted by the 2026-07-26 true-up.* | -| `extdeps.os.id` · `Read` (uid/gid/user) | **new** `dag/extdeps/os/id.dag` | `id -u`, `id -g`, `id ` | `host_effect_realize` (ssh probes), `fleet_posix_accounts` (`probe_command`) | +| `extdeps.os.id` · ~~`Read`~~ **LANDED** (uid/gid/user) | `dag/extdeps/tools/id.dag` (created; landed #7194; post-#7231 home) | `id -u`, `id -g`, `id ` — service `os.Id` ops `Uid`/`Gid`/`Lookup` | **Done** — hermetic witness `test.claim.shell_dag_census_5a_typed_ops_witness` (`witness_os_id_uid_realizes_hermetically`, `witness_os_id_gid_realizes_hermetically`, `witness_os_id_lookup_realizes_hermetically`); `host_effect_realize` ssh probes already consume the typed argv rows `extdeps.tools.id.id_uid_argv`/`id_gid_argv` (absolute-path variants). `fleet_posix_accounts` `probe_command` is NOT-a-shell-site (census §4, `probe_command` row). **Ruling request below**: `id_lookup_argv` zero production references. | | `ssh.Session.ExecArgv` | **add to** `dag/extdeps/diagnostic/ssh.dag` | typed argv over ssh (`ssh host -- argv`) | `host_effect_realize` ssh probes — **IN FLIGHT, C5 #6946** | | `systemd.Systemctl.Status` | **add to** `dag/extdeps/os/systemctl.dag` | `systemctl status --no-pager --full ` (models exit-3-for-dead-unit — retires the `\| tail`+`exit 0` absorbing fallback) | `live_deploy/readiness.dag` unit diagnosis | +**RULING REQUEST — `extdeps.tools.id.id_lookup_argv` (`id `) has zero production references (filed 2026-09-03, keen-moth-880).** Measured denominator: grep of `dag/` + `src/v2/test/` at `75873c2897` finds only (1) the definition in `extdeps.tools.id` (`id_lookup_argv`), (2) the hermetic-witness call in `test.claim.shell_dag_census_5a_typed_ops_witness` (`witness_os_id_lookup_realizes_hermetically`), and (3) service-name rows in the effect-plan tests — no production caller. Zero references is NOT filed as deadness: env-gated and emitted-path consumers exist that grep does not see, so this row is a ruling request with a measured denominator, not a deletion. The §5.A row's named consumers for the `id ` verb are reclassified (`fleet_posix_accounts` `probe_command` — NOT-a-shell-site, §4) or deferred (`spark/managed_access_apply` create-script bodies — dissolve-on marker, no operator verdict). Ruling requested: retain `id_lookup_argv` as reserved-for-deferred-consumer, or retire it. Do not delete on this finding alone. + That is the entire new-modeling surface. (A sixth, optional: a typed stdout/receipt emit for the two `echo ` sites, or reuse `Filesystem.Write`.) The healthz probe needs **no** new op — `http.Client.Get` already exists. ### 5.B — CALL AN EXISTING OP (receipt: the op is already modeled on main) From c65f7bb0d7418ebce3d0c6d394b5a3851298a93d Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 3 Sep 2026 19:29:23 +0000 Subject: [PATCH 2/3] =?UTF-8?q?Retire=20id=5Flookup=5Fargv=20on=20structur?= =?UTF-8?q?al=20ruling,=20and=20correct=20the=20overstated=20=C2=A75.A=20r?= =?UTF-8?q?ow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RULING (2026-09-03): retire extdeps.tools.id.id_lookup_argv. No measured production consumer; the semantic os.Id.Lookup already names the intended request; a future consumer should consume IdLookup/IdInvocation and choose an SSH realization, not resurrect a raw List argv helper. Keeping it "reserved" would preserve the lower-level interface the migration exists to make unavailable — a future need is the trigger to add a typed remote realization, not evidence that the helper should survive. Deleted from dag/extdeps/tools/id.dag. The module's sole production import (dag/gunbc/host/host_effect_realize.dag:69) imports id_uid_argv, id_gid_argv and id_binary_path only — no reference to id_lookup_argv exists in the code tree. The witness (test.claim.shell_dag_census_5a_typed_ops_witness, witness_os_id_lookup_realizes_hermetically) exercises os.Id.Lookup, the semantic op — NOT the deleted argv helper — and is unchanged. CORRECTION (second finding): the §5.A row overstated by claiming "Done" when the hermetic operation witnesses had landed but the model-before-implement scope (call-site migration a later lane, the superseded argv/string path still standing, remaining SSH callers dispositioned independently) does not support that word. The row now says honestly: "operation model + hermetic operation witnesses have landed" and explicitly what is NOT done instead of claiming closure. Co-Authored-By: Claude Opus 5 --- dag/extdeps/tools/id.dag | 4 ---- docs/plans/shell-to-dag-residual-census-and-arc-completion.md | 4 ++-- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/dag/extdeps/tools/id.dag b/dag/extdeps/tools/id.dag index 8b44dbfdb17..3f4b454c387 100644 --- a/dag/extdeps/tools/id.dag +++ b/dag/extdeps/tools/id.dag @@ -25,10 +25,6 @@ fn id_gid_argv() -> List { ["id", "-g"] } -fn id_lookup_argv(user: NonEmptyStr) -> List { - ["id", user as String] -} - service os.Id { operation Uid { input {} diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index 1b9af84060b..aae74f657eb 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -782,11 +782,11 @@ What the trigger does **not** discharge is the **existing** rows: the wall stops | --- | --- | --- | --- | | `extdeps.os.hostname` · ~~`Read`~~ **LANDED** + `Set` | `dag/extdeps/os/hostname.dag` (created) | ~~`hostname -s`~~ **done**; `hostnamectl set-hostname` remains | **Read done** — `os.Hostname.ReadShort` realized via typed cell `HostnameReadOnHost` + `gunbc.hostname_read` (LocalShell → op, SshShell → typed argv); both read consumers dissolved: `host_identity_observation` (`HostIdentityShortHostnameRead`, the `host_identity_short_hostname_script` concat DELETED) and `ci_deploy_target_host` (runtime-present read; the GHA preflight *block* stays E-emit). **Set** (`host_effect_hostname` `SetHostnameCas`, its own `host_effect_set_hostname_cas_script` concat) still pending — reuses this op file with a `SetHostname` op. | | `systemd.Systemctl.ListUnits` | **add to** `dag/extdeps/os/systemctl.dag` | `systemctl list-units --state=active` | `host_converge_slice1` (was `_enumerate_units_script`; now calls `systemctl_list_units_active_services` at `:287`). *The `fleet_show_effective_read` consumer named here — `fleet_runner_width_count_read_script` — was never migrated: it was superseded and left dead, and is deleted by the 2026-07-26 true-up.* | -| `extdeps.os.id` · ~~`Read`~~ **LANDED** (uid/gid/user) | `dag/extdeps/tools/id.dag` (created; landed #7194; post-#7231 home) | `id -u`, `id -g`, `id ` — service `os.Id` ops `Uid`/`Gid`/`Lookup` | **Done** — hermetic witness `test.claim.shell_dag_census_5a_typed_ops_witness` (`witness_os_id_uid_realizes_hermetically`, `witness_os_id_gid_realizes_hermetically`, `witness_os_id_lookup_realizes_hermetically`); `host_effect_realize` ssh probes already consume the typed argv rows `extdeps.tools.id.id_uid_argv`/`id_gid_argv` (absolute-path variants). `fleet_posix_accounts` `probe_command` is NOT-a-shell-site (census §4, `probe_command` row). **Ruling request below**: `id_lookup_argv` zero production references. | +| `extdeps.os.id` · `Read` (uid/gid/user) — **ops landed; row NOT done** | `dag/extdeps/tools/id.dag` (created; landed #7194; post-#7231 home) | `id -u`, `id -g`, `id ` — service `os.Id` ops `Uid`/`Gid`/`Lookup` | **Operation model + hermetic operation witnesses have landed** (`test.claim.shell_dag_census_5a_typed_ops_witness`, `witness_os_id_uid_realizes_hermetically`, `witness_os_id_gid_realizes_hermetically`, `witness_os_id_lookup_realizes_hermetically`; declared scope is model-before-implement, call-site migration §5.B a later lane). **NOT "Done"** — that word requires the production consumers to have moved AND the superseded string/argv path to be deleted. Remaining argv/SSH callers are dispositioned independently, not by this row: `host_effect_realize` srv3 probes (raw argv rows `extdeps.tools.id.id_uid_argv`/`id_gid_argv`, absolute-path variants), `fleet_posix_accounts` `probe_command` (NOT-a-shell-site, §4), `spark/managed_access_apply` (deferred, dissolve-on). `id_lookup_argv` RETIRED by ruling (below). | | `ssh.Session.ExecArgv` | **add to** `dag/extdeps/diagnostic/ssh.dag` | typed argv over ssh (`ssh host -- argv`) | `host_effect_realize` ssh probes — **IN FLIGHT, C5 #6946** | | `systemd.Systemctl.Status` | **add to** `dag/extdeps/os/systemctl.dag` | `systemctl status --no-pager --full ` (models exit-3-for-dead-unit — retires the `\| tail`+`exit 0` absorbing fallback) | `live_deploy/readiness.dag` unit diagnosis | -**RULING REQUEST — `extdeps.tools.id.id_lookup_argv` (`id `) has zero production references (filed 2026-09-03, keen-moth-880).** Measured denominator: grep of `dag/` + `src/v2/test/` at `75873c2897` finds only (1) the definition in `extdeps.tools.id` (`id_lookup_argv`), (2) the hermetic-witness call in `test.claim.shell_dag_census_5a_typed_ops_witness` (`witness_os_id_lookup_realizes_hermetically`), and (3) service-name rows in the effect-plan tests — no production caller. Zero references is NOT filed as deadness: env-gated and emitted-path consumers exist that grep does not see, so this row is a ruling request with a measured denominator, not a deletion. The §5.A row's named consumers for the `id ` verb are reclassified (`fleet_posix_accounts` `probe_command` — NOT-a-shell-site, §4) or deferred (`spark/managed_access_apply` create-script bodies — dissolve-on marker, no operator verdict). Ruling requested: retain `id_lookup_argv` as reserved-for-deferred-consumer, or retire it. Do not delete on this finding alone. +**RULING — `extdeps.tools.id.id_lookup_argv` RETIRED and deleted (ruled 2026-09-03).** The retirement is on the ruling, not on the zero-reference count: `os.Id.Lookup` (the semantic operation) already names the intended request, and a future consumer should consume `IdLookup`/`IdInvocation` and choose an SSH realization — not resurrect a raw `List` argv helper because it sat in inventory. Keeping it "reserved" would preserve exactly the lower-level interface the migration exists to make unavailable. The measured denominator (filed 2026-09-03) found no production reference — the §5.A witness calls `os.Id.Lookup`, NOT this helper — but a future need is the trigger to add a typed remote realization, not evidence that the helper should survive. That is the entire new-modeling surface. (A sixth, optional: a typed stdout/receipt emit for the two `echo ` sites, or reuse `Filesystem.Write`.) The healthz probe needs **no** new op — `http.Client.Get` already exists. From cf445a80a13d7614c160ef96fc064fdc850dce88 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Thu, 3 Sep 2026 20:18:47 +0000 Subject: [PATCH 3/3] Fix ruling record: point future consumers at the real canonical symbol MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ruling record directed future consumers to `IdLookup`/`IdInvocation`, neither of which exists in the tree. `os.Id.Lookup` is the actual semantic operation — cite it directly, with the two plausible typed SSH-realization paths (`ssh.Session.ExecArgv` on `id `, or a full `IdLookup` invocation modeled on the `os.Hostname.Set`/`HostnameSetInvocation` pattern) so a migration worker is not left to guess. No changed symbols or fabricated interfaces. DESIGN §3 single-authority and "cite the symbol" rules satisfied. Co-Authored-By: Claude Opus 5 --- docs/plans/shell-to-dag-residual-census-and-arc-completion.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md index aae74f657eb..e7cea7629c0 100644 --- a/docs/plans/shell-to-dag-residual-census-and-arc-completion.md +++ b/docs/plans/shell-to-dag-residual-census-and-arc-completion.md @@ -786,7 +786,7 @@ What the trigger does **not** discharge is the **existing** rows: the wall stops | `ssh.Session.ExecArgv` | **add to** `dag/extdeps/diagnostic/ssh.dag` | typed argv over ssh (`ssh host -- argv`) | `host_effect_realize` ssh probes — **IN FLIGHT, C5 #6946** | | `systemd.Systemctl.Status` | **add to** `dag/extdeps/os/systemctl.dag` | `systemctl status --no-pager --full ` (models exit-3-for-dead-unit — retires the `\| tail`+`exit 0` absorbing fallback) | `live_deploy/readiness.dag` unit diagnosis | -**RULING — `extdeps.tools.id.id_lookup_argv` RETIRED and deleted (ruled 2026-09-03).** The retirement is on the ruling, not on the zero-reference count: `os.Id.Lookup` (the semantic operation) already names the intended request, and a future consumer should consume `IdLookup`/`IdInvocation` and choose an SSH realization — not resurrect a raw `List` argv helper because it sat in inventory. Keeping it "reserved" would preserve exactly the lower-level interface the migration exists to make unavailable. The measured denominator (filed 2026-09-03) found no production reference — the §5.A witness calls `os.Id.Lookup`, NOT this helper — but a future need is the trigger to add a typed remote realization, not evidence that the helper should survive. +**RULING — `extdeps.tools.id.id_lookup_argv` RETIRED and deleted (ruled 2026-09-03).** The retirement is on the ruling, not on the zero-reference count: `os.Id.Lookup` (the semantic operation) already names the intended request; a future consumer should consume `os.Id.Lookup` and choose a typed SSH realization (`ssh.Session.ExecArgv` on the `id` binary with a `{user}` argument, or an `IdLookup` invocation modeled on the `os.Hostname.Set`/`HostnameSetInvocation` pattern) — not resurrect a raw `List` argv helper because it sat in inventory. Keeping it "reserved" would preserve exactly the lower-level interface the migration exists to make unavailable. The measured denominator (filed 2026-09-03) found no production reference — the §5.A witness calls `os.Id.Lookup`, NOT this helper — but a future need is the trigger to add a typed remote realization, not evidence that the helper should survive. That is the entire new-modeling surface. (A sixth, optional: a typed stdout/receipt emit for the two `echo ` sites, or reuse `Filesystem.Write`.) The healthz probe needs **no** new op — `http.Client.Get` already exists.