WORLD-CONVERGE: generalize fleet converge from HostIdentity to a global convergence subject, with the repo ruleset as one subject rather than a second authority

[gunbai-bot]

Auto-opened by session-dashboard for session witty-otter-195.
Pushing to session/witty-otter-195 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T04:26:52.608248Z	07bfa20	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[gunbai-bot]

Closing without a fix, because this PR is a re-opening of retired work and its failures are already repaired elsewhere.

This is session/witty-otter-195 at head 07bfa20bdbc — byte-identical to the head that #10307 carried. #10307 was closed at 03:08:45Z when its owning session went away; this PR was auto-opened on the same branch at 04:16:41Z. Nothing new was pushed. The branch has not moved since 01:37.

The work moved to #10324 on session/merry-ant-509, and I verified the succession by symbol rather than by assumption:

world_converge hub                        present, 7 declarations
converge_apply / converge_apply_fleet     0 occurrences  (host root still cut)
apply_desired_ruleset                     0 occurrences  (deleted at the root)
FixtureDrift / FixtureApplied             8 references   (witness types now exist)

The two failing checks here are the floor reds I diagnosed on #10307 hours ago — undeclared witness fixture types, an optionality error at the fleet_converge_apply match site reported against an innocent line in host_converge.dag, and two body-position annotations. All four are fixed in #10324, which also carries a diagnostic cause-split that #10307 never had. Pushing a fix here would duplicate landed work onto a dead branch and put two sessions on one content — the exact failure the re-home existed to avoid.

The original author reviewed #10324 and confirmed the optionality repair preserved the three-state observation with an explicit HostConverge? wrapper and no narrowing. Their design survives unchanged: the parametric hub with no subject enum, the typed unknown-identity refusal, the three-state observation, and the genuine root cut.

Nothing is lost by closing this. Track #10324.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 07bfa20bdb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve detected ruleset divergences in verification failures

When any live ruleset field drifts, world_repo_ruleset_differences computes the precise RulesetDivergence values, but this parameter discards them and the current admission always returns RepositoryRulesetActuationUnbound. Consequently, verify() now reports only that no actuator is admitted instead of identifying the missing context, enforcement change, bypass grant, or other detected drift as the previous verifier did, leaving operators without the information needed to remediate the failed check. Carry or render these differences in the refusal path.

Useful? React with 👍 / 👎.