Boot Mt. Collins diskless through modeled operations

[briansrls]

Mt. Collins boots diskless, and the steps that get it there are modeled rather than driven by hand.

The unit has no boot drive. It now boots Ubuntu from an ISO served over NFS from srv2 and presented as virtual media by its MegaRAC controller, and every step of that — fetch the image, verify it, publish it into the export, attach it, hand off the boot device — is a .dag operation with a typed refusal, not a shell script someone ran once.

What each piece does

Fetch (boot_image_fetch, mtcollins1_boot_image_fetch) downloads to a staging path, measures the digest there, and moves into the export only on agreement with the pin extdeps.provisioning.ubuntu_install_media already carries. The staging path is derived from the destination, so the two share a directory and therefore a filesystem, which is what makes the rename atomic. It was previously two independent literals that happened to land on one mount — true on this host, and unenforced. The published bytes are then measured again at the final path rather than carrying the staged digest forward, because those answer different questions.

Attach (megarac_media_attach, extdeps.bmc.megarac) opens a controller session, resolves the image index by name rather than assuming one, starts the media, confirms against the configurations listing, and closes the session on every path including refusals. Success is never an exit status here: this firmware answers HTTP 500 on writes that take effect, so the read-back decides.

Ownership (boot_image_export_ownership, extdeps.tools.coreutils_stat) decides whether the publish may happen at all, at the write boundary, from a real stat.

Boot handoff and the platform/boot receipts record what was actually observed on the unit.

Three defects this found in its own work

A dangerous remedy, retracted. /remote/images enumerates what is available to attach, not what the share holds: attach an image and it leaves that listing for /remote/configurations, and the survivors reindex. I had read this as a stale cache and written the operator-facing remedy "re-assert mount_cd". That remedy appears to work for the worst possible reason — toggling mount_cd detaches everything, returning the image to the available pool. On a host booted from that medium, the advice removes the running root. It also made the operation non-idempotent, which for a converge step is the failure that matters most. Configurations is now read first and the converged case performs no write at all.

A nicknaming join in the confirmation. The index check first read image_index, which is absent from a configurations row, so every genuine attachment reported unconfirmed — caught only because the check failed closed. Re-reading it as media_index passed, and was still wrong: media_index is the virtual CD device slot, beside session_index, not a position in the image enumeration. It agreed only because this unit presents one CD device, so both are 0. The comparison is gone.

Two authorities for one artifact. The fetch module authored a published path ending ubuntu-24.04.3-live-server-arm64.iso; the attach module authored an image name spelling the same thing. Two literals, two files, nothing joining them. Edit one and converge verifies artifact A, publishes A, then asks the controller to present B — every step succeeding, every read-back confirming, and the unit booting bytes nothing checked. There is no arm for it because no single operation is wrong. mtcollins1_boot_artifact now owns the name and the export directory as two atoms, and the path is composed from them.

The ownership requirement now decides something

It previously described who may own the boot export and was consulted by nothing — the publish called mv directly, so the program published whenever the OS permissions happened to allow it, while a probe asserted the policy against fixtures.

The reason it had no causal position is that nothing could observe ownership: there was no modeled stat. There is one now, and its unreadable arm is a refusal rather than an ownership of nobody — collapsing those would make a deleted export the most permissive input the admission accepts. parse_int's Absent arm refuses rather than defaulting to 0, because 0 is root.

The judgment also stopped taking a PosixUser. That carries a login shell, which is a passwd fact, while a directory's owner is a stat fact — so the only way to feed it from a real observation was to invent a shell nothing had seen, in the function deciding who may write to the boot export.

Verification

Executed against the live controller and the live host, not asserted.

• Attach, both directions, one input differing: the real image returns success in three calls with no write; an absent name refuses after the two reads, before start. Session release confirmed by a 401 on the released cookie.
• Ownership observation, four arms on real paths: /srv/bmc admitted, / refused as root-owned, /home/briansrls refused as the operator principal, a missing path refused as unobservable.
• The gate itself: the correct pin against a root-owned export verifies the artifact and is then refused at the write boundary, with the filesystem confirming nothing was published and the staged bytes kept as evidence. The wrong-pin control still refuses on the digest, so the ordering holds.
• Publish chain: a controlled fixture whose content, and therefore digest, was authored rather than measured from the tree — fetched, staged, moved, and re-measured at the destination.

Not claimed

• BootImagePublishedDigestMismatch has no executed red. Producing one needs a concurrent writer or a mocked move, so it is a reachable-but-unoccupied guard rather than a decoration, and the module says so with its next-rung trigger.
• The boot is diskless, not RAM-resident. Casper's toram is absent from the observed command line, so the read-only lower layer is read from the presented media on demand. An earlier revision of the receipt claimed the root was in RAM; it does not follow from what was observed, and the difference decides whether the host depends on the boot server for as long as it runs.
• Controller credential rotation is still open. The admin/admin default stands; IPMI Set User Password is refused by this firmware and the REST path returned "attempt to set previous password" against a policy-conforming secret. The spare account is contained (Enabled User IDs: 1).
• The unit runs on one AC path. Recorded as accepted with its revisit trigger — this machine acquiring dependents — rather than left as an open finding.

🤖 Generated with Claude Code

https://claude.ai/code/session_01D7PLjw5FMYdZ2GWn3FeMpR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-06T00:20:56.222713Z	69f6048	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 69f6048592

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Treat the observed HTTP 500 stop as indeterminate

On the Mt. Collins firmware recorded by this same commit, a successful stop-media returns HTTP 500/body code 1411. Local curl --help all documents --fail-with-body as “Fail on HTTP errors but save the body,” so this command exits nonzero and the following exit map reports failure before a workflow can perform the required read-back. Model this response as indeterminate and determine success from GetRemoteConfigurations, rather than making the known successful response a terminal refusal.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

URL-encode session credential fields

When either credential contains form delimiters such as &, +, %, or =, passing username={username} and password={password} through -d changes the submitted form fields and causes authentication to fail despite valid credentials. Local curl --help all identifies --data-urlencode as the option for URL-encoded POST data; use it for both named fields instead of raw -d values.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Add the missing media-configuration write

When the BMC has no mounted share, or when the newly recorded image-cache failure requires mount_cd to be reasserted, this service cannot establish media because its only operation for /api/settings/media/general is a GET. A repo-wide search for that endpoint finds no other executable PUT transport, while the existing contract row says the PUT supplies the server address, source path, share type, and mount_cd; therefore a workflow still cannot reproduce the attach flow this service is intended to expose.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Do not infer a RAM-resident squashfs from overlayfs

The recorded command line contains no toram option, and the cited boot messages establish only a read-only squashfs lower layer plus an overlayfs upper layer; they do not show that Casper copied the squashfs off the virtual CD into RAM. In the ordinary live-media path the writable upper is memory-backed while the squashfs remains backed by the live medium, so this receipt overstates what the evidence establishes even though the machine is still diskless.

Useful? React with 👍 / 👎.

[briansrls]

Verdict: REQUEST CHANGES / HOLD at exact head c1203c9419829360ac928bcb651e14a02ac9b152. Recorded as COMMENT because this connection acts as the PR author and GitHub will not accept a native blocking review. No merge authorization.

First, the operational finding outranks the source review: PSU2 is installed but reports AC lost, 0 W, and 0 RPM while PSU1 carries the machine. Freeze further power-cycle/load work and do not make this host a production boot dependency until someone at the rack restores and verifies the second feed without disturbing PSU1. Ampere's current Mt. Collins GSG calls for both power cables to appropriate power sources.

There is real progress worth preserving: the host-side systemd marker closes “did the aarch64 image execute”; detached media attach is stronger than a no-op; wrong-pin publication refusal is a useful executed discriminator; deferring mksquashfs and reusing FleetAccountAutomation are both the right direction. The following boundaries remain open.

R1 / P1 — The modeled media path reproduces the session leak that just saturated the controller, and its authentication transport is not valid for the password policy. megarac_attach_remote_image opens a session and every outcome returns without DELETE /api/session. The only policy wrapper uses one fixed /tmp/gunbc-mtcollins1-megarac-jar, so the source comment that the jar is attempt-owned is false; concurrent or repeated attempts can overwrite/reuse one bearer file. OpenSession also sends password={password} through raw -d: form delimiters in a valid punctuated password change the submitted field, and the secret appears in argv. -k additionally provides no controller certificate identity. Model one session adapter: attempt-owned owner-only jar, correctly URL-encoded password read from a materialized file, bound controller trust posture, close on every handled exit, verify invalidation, then remove the jar. Session creation or cleanup with an indeterminate transport result needs its own outcome; do not retry a write automatically.

R2 / P1 — Fetch, attach, and boot are three callable surfaces, not one artifact-bound chain. BootImageAdmitted { path, digest } is rendered to bare ProcessExit; mtcollins1_attach_diskless_image independently selects a filename, and the boot handoff independently selects CD-ROM. Nothing makes a successful verified publication a precondition of attaching those bytes, or proves the later boot used that admitted artifact. Carry a sealed attempt/unit/artifact binding from final-path digest readback through exact media configuration and into boot/host acceptance. An independently callable attach of a pre-existing same-named file must not satisfy that chain.

The attach readback itself can fabricate success: it ignores GetRemoteConfigurations.success, substring-searches the raw body for the filename, does not require active redirection_status or the resolved index/session, and returns image_index: 0 regardless of the index it actually selected. A stopped/stale row or an error body containing the name can therefore produce MegaRacAttached. Parse the configurations document, require one exact active binding to the selected image/index, and return that observed index. Malformed/wrong-shaped image JSON is currently collapsed into MegaRacImageListingEmpty; keep unreadable separate from an actual empty cache. A nonzero start response followed by no immediate confirmation is indeterminate/pending on this firmware, not terminal MegaRacStartRefused.

R3 / P1 — The bytes hashed are not structurally the bytes published. Fetch uses one fixed /var/tmp path, hashes it, then calls plain mv to /srv/bmc, with no ownership lock and no digest readback at the destination. Another attempt/process can replace the staging bytes between hash and move. The model also does not establish same-filesystem rename; across filesystems mv may expose a partially copied destination to the controller. Use attempt-owned staging on the same established filesystem but outside the exported namespace, failure-atomic no-replace/authorized replacement, and hash the final path before minting the admitted artifact. The wrong-pin control proves the current branch decision; it does not test this race/publication boundary.

R4 / P1 — Export ownership is declared but neither observed nor enforced. BootImageExportOwnershipRequirement names FleetAccountAutomation and carries owner/group/other write policy, but publish_verified_boot_image never consumes it. export_ownership_standing receives no file mode and never reads those three booleans; its probe is fixture-only. Thus root, an interactive principal, or a group/world-writable export can still publish whenever mv succeeds. Bind an actual stat/effective-principal receipt to the exact export path and require that admission before the first publication write. The source also still says /srv/bmc is root-owned and today's fetch refuses, while the later commit/report says it is now gunbc-fleet:gunbc-fleet mode 755 and publication succeeds; synchronize the live source and evidence rather than leaving both claims active.

R5 / P2 — Four earlier review findings are still open at this head. StopMedia still maps the observed HTTP-500/took-effect response to command failure; there is still no PUT operation for /api/settings/media/general, even though the caller says an empty cache is repaired by reasserting mount_cd; session fields are still not URL-encoded; and the boot receipt/body still infer “root is in RAM” from squashfs + overlayfs without toram or a successful media-detach test. The boot is genuinely diskless and reached systemd. What is not established is independence from the virtual CD/NFS after boot.

R6 / P2 — The newly promoted platform facts have no preserved evidence binding and one predicate overclaims. mtcollins1_platform_observation contains current PSU values and the second-interface identity as authored data but no raw-capture digest/path/attempt. Preserve the actual sensor/SEL and both-endpoint identity responses. power_supplies_redundant proves only that two supplies are present and have AC input; it does not establish health, capacity, or a redundancy state, so rename it to the narrower fact or add the missing inputs. Device ID 32 plus firmware 0.32 is not independently identifying proof that two IPs are the same controller; use a unit-unique FRU/serial or controller-side interface inventory.

Also remove the copied Ubuntu URL/hash authority: this tree already has the artifact row, filename/mirror constructors, and content pin; the Mt. Collins policy should select a mirror and consume that row rather than restating its digest. Update the PR body, which still says Media has no caller and ISO fetch is unmodeled despite the later commits.

Required discriminators include: zero leaked sessions on every result arm; two concurrent attach attempts with distinct jars; punctuation-bearing credential success without secret-in-argv; stale/stopped/wrong-index configuration refusing; final published-path digest bound to the attach; a publication race/cross-filesystem refusal; and zero writes for wrong principal or permissive group/other modes.

Validation boundary: exact-head static source/consumer review plus inspection of the committed/reported execution records. I did not operate the controller or reproduce the boot. Exact-head witnesses run 34009053965 was still in progress when reviewed.

[briansrls]

Verdict: REQUEST CHANGES / HOLD at exact head e43eb5508621cc6c4dee5f6d11574b2afb72fc50. This connection acts as the PR author, so GitHub cannot record a native blocking review; this COMMENT carries the request-changes verdict. No merge authorization.

Exact-head run 34028505967 is green, including build, clippy, floor, and the aggregate job. GitHub reports the PR mergeable/clean. That is useful standing, but the changed set adds no test-claim file for these pure judgments, and current main advanced after this run; more importantly, the substantive boundaries below remain open.

Disposition of review 5124032031. There is material progress. Configuration-first lookup makes the converged attach path read-only; attachment confirmation now parses an exact active name/media row instead of substring-searching; the selected image index is no longer fabricated as zero; staging and destination are derived onto one filesystem; the final path is re-hashed; real stat is consulted at the write boundary; the fetch and attach policy share one image-name atom; and the PR body plus .dag receipt now distinguish diskless from RAM-resident. Those portions of the prior review are closed or substantially narrowed. The following are not.

R1 / P1 — Session ownership is still not total, and the new path can still leak exactly the resource that saturated the controller. OpenSession can succeed and return a body whose CSRF token is unreadable; that branch returns SessionReleaseNotAttempted and never calls CloseSession. The session was opened. Conversely, a lost/HTTP-error response from either POST or DELETE does not establish whether the remote allocation/effect occurred. The prose says SessionReleaseUncertain exists, but the type has no such arm; CloseSession.success == false is called Refused even though this firmware is already measured applying writes while returning HTTP 500. The production renderer also drops cleanup failure whenever the attach outcome itself failed (other => other).

The reported live 401 after DELETE is good execution evidence, but the modeled operation does not perform that invalidation readback and never removes the local jar. The attempt is an arbitrary NonEmptyStr, not a safe/exclusive path allocation, and the jar's owner-only mode is unestablished. OpenSession also still sends the password through raw -d password={password}, in argv, under -k; the existing URL-encoding finding remains open and is now more consequential because valid policy-conforming passwords contain punctuation. Build one session-scope adapter: safe attempt identity, create-new owner-only jar, file-backed URL-encoded credential, bound TLS posture, cleanup on every allocated/possibly-allocated path, protected-read invalidation check, and local removal. Preserve release unknown separately from released/refused.

R2 / P1 — The ownership gate observes the directory owner label, not the declared publication authority. coreutils.Stat returns uid/gid and names, but no mode; the admission ignores gid, all three writable_by_* fields, and requirement.export_path. It also never observes the effective principal performing the move. Therefore a root-running process targeting a gunbc-fleet-owned export is admitted; a 0777 export owned by gunbc-fleet is admitted; and an unrelated gunbc-fleet-owned path is admitted despite the requirement naming /srv/bmc. This does not enforce “only FleetAccountAutomation may publish”; it only recognizes one target owner spelling.

Bind the exact non-symlink directory identity, mode/ACL posture, and effective writer to the admission consumed at the first write. Add controls where target ownership is right but actor, path, group-write, or other-write is wrong. Also remove the now-false source paragraph saying nothing consumes this requirement—the later code does consume it, just incompletely.

R3 / P1 — Same-filesystem rename is repaired, but concurrent publication can still put unverified bytes into the live export. Every attempt for one destination uses the same <published>.gunbc-staging path and plain replacing mv. There is no create-new attempt ownership or exclusive publication boundary. A second writer can replace staging after the first hash; the first move can then publish those different bytes. The final-path re-hash will detect the mismatch, but only after the wrong bytes have occupied the controller-visible filename—the safety property was already violated. The staging file is itself inside the exported namespace; “this firmware did not enumerate this suffix in one observation” is not the same as structurally keeping partial bytes out of the export.

Use attempt-owned staging on the same established filesystem but outside the exported namespace, then one authorized/exclusive no-replace or compare-and-swap publication effect. Final-path readback remains valuable, but detection after exposure is not publication admission. The wrong-pin control exercises the ordinary branch; it does not exercise this race.

R4 / P1 — The verified publication still does not causally reach attach or boot. BootImageAdmitted { path, digest } is immediately erased to ProcessExit. Attach consumes only the shared filename, and boot independently selects CD-ROM. Centralizing the name closes the two-literal drift, but it does not make successful publication a prerequisite: a pre-existing or post-verification replacement with that name can be attached and booted without any BootImageAdmitted value ever existing.

Carry a sealed (unit, attempt, upstream artifact identity, final path, final observed digest, export identity) value into attach; carry the exact active media binding into the boot handoff and host acceptance receipt. A shared string is an authority repair, not an effect-chain binding.

R5 / P1 — Attach still turns observed indeterminacy into a terminal refusal and can write over an unreadable configuration state. The source comment correctly says a nonzero start followed by no immediate confirmation is pending, not refused. The implementation still returns MegaRacStartRefused in exactly that case. On this firmware, HTTP 500 can accompany a successful asynchronous write, so that false terminal can provoke a retry against state that already moved.

Also, configurations_confirm_attachment maps malformed or wrong-shaped configuration JSON to false; the caller then consults available images and may issue StartMedia over an unknown presented-media state. Parse and classify the configuration document before any write. A nonzero start with no bounded confirmation needs an indeterminate/pending arm, never Refused solely from curl status. The earlier StopMedia HTTP-500 contract and the missing executable PUT /api/settings/media/general also remain unresolved surfaces introduced by this PR.

R6 / P1 — The evidence receipt no longer identifies the evidence file, and the file carries mutually contradictory live claims. artifacts/bmc/mtcollins1-diskless-boot.json was modified to append the detach observation, but mtcollins1_diskless_boot_capture_digest and mtcollins1_diskless_boot_byte_count remain cefdf6… / 4361. The receipt therefore cannot name the current bytes absent a hash collision. Preserve the original immutable capture and add a separately hashed correction/observation, or recompute the identity and make the provenance change explicit.

The current JSON still says “casper runs the squashfs from RAM” and still records the image list as a stale cache repaired by reasserting mount_cd; later fields in that same file retract both readings. The .dag receipt likewise still carries the stale-cache interpretation while the attach authority says that diagnosis was backwards and its remedy detaches media. A correction appended beside an active contradictory claim does not remove the claim. Separate raw observations from interpretations and leave one current conclusion.

R7 / P2 — One artifact authority is still authored three times. The policy still hard-codes the Ubuntu URL and SHA, and mtcollins1_boot_artifact hard-codes the filename, although extdeps.provisioning.ubuntu_install_media already owns the selected artifact row, filename derivation, mirror URL construction, and content pin. Select the upstream artifact plus mirror and derive all three values; do not retain a local copy while saying the upstream row is authoritative.

The platform rows also still need preserved sensor/SEL and controller-interface evidence. power_supplies_redundant establishes only two present AC inputs, not health/capacity redundancy, and Device ID 32 plus firmware 0.32 is not a unit-unique proof that both addresses are one controller. The accepted one-feed risk can remain an operator decision, but the observations it accepts still need evidence and appropriately narrow names.

Required discriminators before re-review: token-unreadable and ambiguous-open paths cannot disappear as “nothing to release”; cleanup failure is visible beside every attach outcome; released-cookie invalidation and jar deletion; punctuation-bearing file-backed login with no secret in argv; right-owner/wrong-actor and permissive-mode publication refusals; two concurrent publishers cannot expose one another's bytes; attach cannot run without the exact admitted artifact; malformed presented-media JSON causes zero writes; HTTP-500/no-confirmation remains indeterminate; and the committed evidence digest resolves to the actual current bytes. Add durable pure tests for these parsers/folds rather than relying only on reported live invocations.

Validation boundary: exact-head static source/consumer review plus the committed execution records and exact-head CI status. I did not operate the controller or reproduce the wet runs. Current main has advanced since run 34028505967, so required-CI freshness and exact merge composition must be re-established after substantive repair.

[briansrls]

P1: OpenSession already succeeded here, so SessionReleaseNotAttempted is not “nothing was opened.” This path never calls CloseSession and recreates the leak when the response is valid enough to allocate a session but its CSRF payload is unreadable. Carry allocated-but-unreleasable/unknown explicitly and invoke the session-scope cleanup/recovery path.

[briansrls]

P1: This contradicts the immediately preceding contract. On the measured firmware, a nonzero HTTP result can accompany an applied asynchronous write; no immediate confirmation therefore means pending/indeterminate, not StartRefused. A caller may otherwise retry a write that already took effect.

[briansrls]

P1: This admits solely from the target owner's mapped role. requirement.export_path, gid/mode policy, and the effective writer are not consulted. A root process or a process targeting a 0777 gunbc-fleet-owned directory passes even though the stated authority forbids both. Bind exact path + mode/ACL + effective principal at this write boundary.

[briansrls]

P1: This is one shared staging pathname per destination, not an attempt-owned file. Concurrent calls can replace it after another call hashes it; final rehash detects only after different bytes have been moved into the live exported name. Use create-new attempt-owned staging plus an exclusive/conditional atomic publish.

[briansrls]

P1: This erases the only final-path/digest binding. The attach and boot entry points can then succeed using a same-named pre-existing or replaced file without consuming a successful publication. Preserve a sealed BootImageAdmitted-derived value through attach and boot instead of reducing it to ProcessExit.

[briansrls]

P1: This active field still asserts the squashfs is in RAM, while the appended correction says the lower layer remains media-backed. This file was also modified without updating the receipt's declared SHA-256/4361-byte identity. Keep raw evidence immutable and carry corrections in separately identified evidence, or update one non-contradictory artifact and its identity.

[briansrls]

Verdict: REQUEST CHANGES / RECUT at exact head e43eb5508621cc6c4dee5f6d11574b2afb72fc50. GitHub records this as COMMENT because this connection acts as the PR author and cannot submit a native blocking review. Exact-head witnesses run 34028505967 is green; this is still not approval or merge authorization.

I agree with the operator's organizational diagnosis. This should not be merged and followed by a cleanup. The branch has produced valuable evidence and several useful mechanisms, but its root decomposition is wrong: reusable MegaRAC realization, generic artifact publication, srv2 staging policy, one-unit observations, operator risk acceptance, and the final Mt. Collins integration are authored together under gunbc.machine_intake. The problem is not the directory spelling by itself; it is that those facts now reach across one another as globals and duplicate authorities that already exist.

Use this branch as quarry and recut before merge.

R1 / P1 — The publisher is ambient-local while claiming to target srv2

gunbc.machine_intake_boot_image_fetch.fetch_verified_boot_image hard-codes LocalExec; mtcollins1_fetch_boot_image carries no staging-host or transport identity. It therefore writes /srv/bmc on whichever machine happens to execute the function, not structurally on srv2. The ownership layer then interprets that local machine's account names through srv2_account_key_for_name.

This bypasses the existing gunbc.machine_intake_staging authority, which explicitly says srv2 is only a candidate realization of an abstract staging service and still records today's realization as StagingUnobserved. A caller's current working host is an undeclared global, not a staging realization.

The reusable publisher must consume an admitted staging realization/host transport and the selected artifact. The srv2 endpoint, export, principal realization and observation belong together in the fleet/staging realization; they must not be imported by the generic operation.

R2 / P1 — A parallel boot-delivery authority was built instead of completing the existing one

gunbc.boot_artifact already owns BootArtifact. gunbc.boot_artifact_delivery already declares itself the one solver and carries the exact target, artifact, staging offer and MegaRacShareOffer. This PR instead adds BootImageFetchOutcome, mtcollins1_boot_artifact, independent fetch/attach entry points, and strings for name/path/digest.

mtcollins1_boot_artifact only centralizes the image name and export directory; it is not the content-addressed artifact. mtcollins1_boot_image_fetch still re-authors the Ubuntu URL and SHA-256 even though extdeps.provisioning.ubuntu_install_media already supplies the artifact, filename/mirror constructors and pin. It then renders BootImageAdmitted { path, digest } down to ProcessExit. The attach path imports only the name, and boot handoff is independent again. A pre-existing or replaced same-named file can therefore be attached without consuming the verified publication result.

Delete the parallel root. Extend the canonical delivery path so a sealed, target/attempt/artifact-bound publication receipt is consumed by MegaRAC attach, whose exact attachment is then consumed by boot handoff and host acceptance. Centralizing two literals is not the same as preserving execution provenance across the chain.

R3 / P1 — The ownership gate does not enforce its own requirement

BootImageExportOwnershipRequirement carries the required path plus owner/group/other write policy, but coreutils.Stat.PathOwnership observes only uid/gid/names, and export_ownership_standing checks only the owner key. It never checks:

• that the observed path equals requirement.export_path;
• owner/group/other mode bits;
• the effective principal performing the publication;
• the host on which the observation was made.

Thus a gunbc-fleet-owned world-writable directory, a different gunbc-fleet-owned path, or a root process publishing into an automation-owned directory can be admitted. The fixture probe cannot close fields the production observation does not carry.

Bind host + exact path/filesystem identity + owner/group/mode + effective publisher into one observation, evaluate an explicit policy supplied to the publisher, and carry the admitted context through the first write. The generic operation must not import one global /srv/bmc requirement.

R4 / P1 — Session cleanup still misses an allocated-session path, and the client contract is not safe for the credential policy

After OpenSession succeeds, a missing/unparseable CSRFToken returns SessionReleaseNotAttempted; no CloseSession is issued. The Mt. Collins renderer then labels that arm “session was never opened,” which is false on exactly this path. This can reproduce the leak that saturated the controller. A lost/ambiguous session-open response is also not equivalent to “nothing allocated.”

SessionReleased is minted from DELETE's exit status alone even though the PR's own acceptance used a subsequent protected read returning 401; that invalidation is not in the modeled operation. The local cookie jar is not deleted, and its path is derived from a free String/NonEmptyStr, not a path-safe attempt identity or create-new owner-only allocation. The negative-control wrapper does not even reject an empty attempt.

OpenSession still sends raw -d password={password} and uses -k. A valid punctuation-bearing rotated password can change form decoding, the password remains in argv, and the TLS peer is not bound to the enrolled controller.

Extract one reusable MegaRAC session realization: path-safe attempt ownership, owner-only/create-new jar, file-backed URL-encoded credential input, explicit controller trust posture, allocation-uncertain and release-unverified outcomes, close on every path on which a session may exist, protected-read invalidation, and local cleanup. The curl cookie-jar realization does not belong in the upstream API authority.

R5 / P1 — An unreadable presented-media document is treated as “not attached,” permitting a write over unknown state

configurations_confirm_attachment collapses JSON parse failure or a non-array document to false. megarac_attach_with_token then reads the available-images list and may call StartMedia. MegaRacConfigurationsUnreadable covers transport failure only, despite the operator-facing text claiming malformed presented state refuses before a write.

Return a typed parse/shape standing and refuse before start whenever current attachment state is unknown. Also, redirection_status != 0 is not an established active-state decoder, and the comment saying “non-zero start followed by no confirmation is pending, not refused” is contradicted by the implementation, which still returns MegaRacStartRefused when start.success == false. The fresh-controller path remains incomplete as well: there is still no modeled PUT for /api/settings/media/general, so this code can reuse an already configured share but cannot establish one.

R6 / P1 — Hash/readback improvements detect a race after publication; they do not prevent exposure

Deriving staging beside the destination and rehashing the final path are improvements over the previous head. The staging path is nevertheless deterministic, shared by every attempt for that destination, and placed inside the exported namespace. Two callers can overwrite the same staging file between fetch, hash and move. A conflicting writer can put wrong bytes at the published path before the final digest detects them, during which the controller may observe them. The claim that .gunbc-staging is unofferable is inferred from one zip not appearing in one listing, not a structural contract.

Use an attempt-owned create-new staging object on the established same filesystem but outside the exported namespace, then an exclusive/expected-current publication boundary and final readback. A lock/CAS/no-replace guard is appropriate here as protection around one legitimate effect writer; it must not be used to excuse two semantic owners. Replacing an artifact already attached to a running host also needs an explicit consumer/current-state decision.

R7 / P1 — The active evidence and the typed interpretation contradict one another

artifacts/bmc/mtcollins1-diskless-boot.json still says Casper runs the squashfs from RAM and still carries the retracted “stale share cache / reassert mount_cd” interpretation. The corrected .dag receipt says diskless, not RAM-resident, yet that same receipt also retains the old cache paragraph. The later appended correction does not make the earlier live fields stop asserting the opposite. Because this artifact is cited by digest as evidence, this is not harmless history; it is one evidence object with mutually incompatible interpretations.

Split immutable raw responses from interpretation receipts. Preserve raw bytes unchanged, author one current interpretation, and let superseded readings live in commit/review history rather than as simultaneously true fields.

The access/capability provenance also needs a clean attempt boundary: mtcollins1_evidence_manifest_digest explicitly covers the earlier read and boot-control write pair, while CapabilityOemRemoteMedia is added from the later diskless-boot artifact; successful_write_surfaces still names only boot control. Create a later observation/receipt or compose the manifests explicitly rather than silently broadening the earlier observation.

R8 / P2 — mtcollins1_platform_observation is four authorities in one file

This module combines PSU sensor observations, controller-interface inventory, an operator risk decision, and fixture checks, with no raw-capture digest/path/attempt. AcceptedPowerRisk is policy, not sensor evidence; the PR contains no evidence reference for the claimed operator decision. If an external operator acceptance exists, bind that receipt explicitly. power_supplies_redundant proves only that two present supplies report AC input; it does not establish health, capacity, independent feeds, or redundancy. The second-interface sameness claim is based on a common device ID/version rather than a unit-unique controller/FRU binding.

Keep the per-attempt boot/access receipt in machine intake. Put physical state into the fleet/placement observation authority, network-controller identity into the access/network observation, and risk acceptance into its decision authority. Do not merely move this mixed module under a different directory.

Recommended recut

1. Evidence-only slice: preserve raw captures and author corrected, target/attempt-bound receipts for the diskless boot, MegaRAC behavior and access capability. No generic actuators. Split PSU/interface/risk facts by authority.
2. Reusable MegaRAC realization: upstream API shapes stay in extdeps.bmc.megarac; curl/session/media state machinery lives in a BMC realization module with a complete session lifecycle and fail-closed decoders. No Mt. Collins constants.
3. Staging/publication realization: extend gunbc.machine_intake_staging, gunbc.boot_artifact, and gunbc.boot_artifact_delivery; bind a real staging host/transport, explicit publication policy and failure-atomic artifact receipt. No srv2 globals in the generic publisher.
4. Mt. Collins integration: one small policy/composition slice selects the existing Ubuntu artifact and MegaRAC share offer for the exact unit/attempt, then carries publication → attachment → boot handoff → host marker without dropping to ProcessExit between stages.

The earlier review's final-path readback, ownership-at-boundary, exact attachment parsing, session close, and RAM-residency corrections have all advanced in this head, but only partially; the remaining findings above are why the green run does not authorize placement. Recut at the semantic roots rather than accumulating another repair layer on this branch.