Spark usage-stats: narrow typed observation at the host boundary; raw inspect never reaches policy

[gunbai-bot]

Supersedes #11419 (carries its commits) and repairs the SOURCE HOLD: raw docker container inspect stdout no longer reaches first-party policy.

Boundary

• Host operation boundary: gunbc.spark.serving_usage_stats_observe spark_serving_usage_stats_observe(launch, inspect_stdout, marker, receipt) is the single consumer of raw stdout. It returns only ServingUsageStatsObservation = ServingUsageStatsObserved { launch, container_id, standing: VllmUsageStatsLaunchStanding, receipt: ObservationReceiptRef } | ServingUsageStatsUnobserved { obligation }. The raw document is discarded there.
• Policy: spark_first_party_admission(realization, usage_stats, scope, offer), spark_serving_usage_stats_standing, spark_usage_stats_telemetry_path and spark_first_party_route_facts take the typed observation. The raw carrier ServingContainerInspectStdout is deleted. The fold keeps the spark_incarnation_observation_agreement join, and it also requires the observation's launch and container to equal the agreed incarnation's. If they don't, the result is Unread (spark_usage_stats_observation_names_another_launch_obligation).
• Conformance (§3b): this intentionally does not inhabit std.observation. Its ObservationSubject is a compiler-run containment path and cannot name a live container. Instead the observation follows the lane's existing EndpointIncarnationObservation shape (launch + ObservationReceiptRef), and it reuses upstream's VllmUsageStatsLaunchStanding rather than minting a second standing.
• Declared frontier (§3c): the live producer is the one authorized inspect that Spark fabric integration: live-host observation producers (plan first, access question first) #11362 executes for the endpoint-incarnation observation. That single inspect yields both the incarnation identity and this observation. Trigger: Spark fabric integration: live-host observation producers (plan first, access question first) #11362's live inspect lands and is sufficient to hand its stdout to this function in the same operation. Until then the producer runs only in the witness.

Semantics kept

The decoder projects four env names: VLLM_NO_USAGE_STATS, VLLM_DO_NOT_TRACK, DO_NOT_TRACK, VLLM_USAGE_STATS_SERVER.

• Only an exact "1" disables, and VLLM_DO_NOT_TRACK or DO_NOT_TRACK follows Python-or precedence.
• An unread marker stays unread.
• A present but empty server value is malformed.
• An override destination is preserved.
• Enabled telemetry is refused, and a non-default destination never inherits the default row's enrollment.

Every one of those witness controls is kept.

Grant

Authorized by gunbc.spark.managed_access_bootstrap InspectServingContainer. No new grant.

Test plan

• All existing spark_serving_usage_stats_observe_witness_test arms now go through the typed observation. Admission and telemetry calls receive t_observe(...), never stdout.
• New RED: an_observation_of_another_launch_does_not_absent_the_path.
• Remote observe_witness_main at 3076736 under a cgroup memory.max exited 0 (a first run without a cgroup limit refused with HostBudgetUnreadable before evaluating anything)
• CI floor

🤖 Generated with Claude Code

[gunbai-bot]

Review 66882: both findings fixed at 0e56511. (1) The production caller now composes: harness_admit_bound_offer takes and threads usage_stats into spark_first_party_admission, passing spark_usage_stats_inspect_unread() until #11362's inspect feeds the producer (the witness header names that as the frontier, not the threading). (2) spark_serving_usage_stats_observe no longer takes a marker standing — its grant observes no marker file, so a caller-supplied DoNotTrackMarkerPresent was an unobserved disable; the marker is Unread by construction, the_observer_never_disables_without_an_observed_env_term is the RED, and the rows that need the enabled arm drive the extdeps fold with a supplied marker. The posture prose that asserted the marker was always passed unread now states the construction.

— sent from merry-eagle-325

[gunbai-bot]

Side-chat hold (unrestricted alternate mint) addressed at 22c24ed. gunbc.spark.serving_usage_stats_observe is now only an unsealed decoder; ServingUsageStatsEvidence (sole-constructor record) lives in gunbc.spark.serving_incarnation_observe and is minted only inside incarnation_after_container from the same authorized inspect stdout the .Id/.Image projection reads — one inspect, two projections, the document dies with the call. The harness reads both from one observe_endpoint_incarnation per launch per bind (HarnessIncarnationRead, memoized) and carries the evidence into admission; refusal arms carry Unobserved with the operation's cause. Policy delegates its join to a subject-grain fold so the refusal REDs (turnover, contradiction, foreign endpoint/hosts, unmatched readback) still execute with authored subjects; the admitted positive control is a stated live-only frontier; spark_serving_usage_stats_evidence_seal_probe_test compiles a foreign module that authors evidence and asserts SoleConstructorViolation.

— sent from merry-eagle-325

[gunbai-bot]

Transition-admission migration for gunbc#11704. No action until the operator sequences #11704's landing.

gunbc#11704 moves namespace transition admissions out of the tree. Once it lands, any file under dag/gunbc/namespace/transition_admission/ refuses at this PR's own gate, and the admission has to be carried in a commit message on this branch instead. The block below was derived mechanically from this PR's 1 row file(s) at its current head. The only edits: deletion_follow_up, owner_pull_request and their now-unused imports are dropped, because those fields no longer exist. All 1 blocks load through the production fold (carried_admissions_from_messages) with no refusal.

To migrate (paste + delete), after #11704 is on main and merged into this branch:

git rm \
  dag/gunbc/namespace/transition_admission/gunbc_container_registry_image_config_container_image_config_env_from_json_json_string_list.dag
git commit -F msg.txt   # msg.txt = the text below, verbatim

-F keeps the lines exactly as they are. The squash merge carries the message into the queue run, and nothing lands in the tree. If a row is wrong later, a later block with the same stem supersedes it.

msg.txt

Move transition admissions into the commit message (gunbc#11704)

```transition-admission
module gunbc.namespace.transition_admission.gunbc_container_registry_image_config_container_image_config_env_from_json_json_string_list

import std.types { NonEmptyStr, List }
import std.decl_ref { decl_ref }
import gunbc.compiler_frontend_program_interlock { TargetChanged }
import gunbc.namespace.transition_admission { TransitionAdmission, Binding }

// gunbc#11441 json_string_list hoist: the spelling in container_image_config_env_from_json now
// binds extdeps.languages.json.parse, where both readers (docker inspect, OCI image config) take it.
// DISSOLVE-ON: gunbc#11441 merging.
data gunbc_container_registry_image_config_container_image_config_env_from_json_json_string_list: TransitionAdmission = TransitionAdmission {
  label: "gunbc#11441 json_string_list lives in json.parse" as NonEmptyStr,
  subject: Binding {
    enclosing: decl_ref("gunbc.container.registry_image_config", "container_image_config_env_from_json"),
    spelling: "json_string_list" as NonEmptyStr,
    expected_candidates: [decl_ref("extdeps.languages.json.parse", "json_string_list")],
  },
  disposition: TargetChanged,
}
```