diff --git a/dag/extdeps/docker/cli.dag b/dag/extdeps/docker/cli.dag index b3f9716b6ff..e00cd00d800 100644 --- a/dag/extdeps/docker/cli.dag +++ b/dag/extdeps/docker/cli.dag @@ -1,5 +1,6 @@ module extdeps.docker.cli +import v2.std.optional { Present, Absent } import std.types { String, Bool, List, NonEmptyStr, FilePath, Int } import std.nat { Nat } import std.algebra { trim } @@ -11,7 +12,7 @@ import extdeps.languages.json.emit { JsonValue, JsonNull, JsonBool, JsonNumber, import extdeps.languages.json.parse { parse_json_document, JsonDocumentParsed, JsonDocumentUnreadable, json_document_gap_text, json_object_unique_member, JsonMemberFound, JsonMemberAbsent, JsonMemberDuplicated, JsonMemberNotAnObject, - json_string_value_or_empty, + json_string_value_or_empty, json_string_list, } data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority { @@ -296,6 +297,155 @@ fn docker_image_inspect_id_from_stdout(stdout: String) -> DockerImageInspectIdRe } } +// NARROW ENV PROJECTION FROM CONTAINER INSPECT STDOUT. `docker container inspect` prints the whole +// object, including Config.Env values that can carry secrets. This decoder keeps Id (identity) and +// only the requested names from Config.Env. It never returns the rest of the Env list. Duplicate +// requested names refuse rather than last-wins. The transport is docker_container_inspect_command; +// this is a decoder bound to that shape, not a second inspect verb. +type DockerContainerInspectNamedEnvRead + = DockerContainerInspectNamedEnv { + id: NonEmptyStr, + assignments: List, + } + | DockerContainerInspectNamedEnvUnreadable { cause: NonEmptyStr } + +fn docker_env_assignment_from_wire(entry: String) -> DockerEnvAssignment? { + let parts = split(s: entry, delimiter: "=") + match parts |> get(0) { + Absent => none + Present { value: name } => + if name.length() == 0 { + none + } else { + Present { + value: DockerEnvAssignment { + name: name as NonEmptyStr, + value: join(parts.skip(n: 1), "="), + }, + } + } + } +} + +fn docker_named_env_name_requested(name: NonEmptyStr, names: List) -> Bool { + any(names, n => (n as String) == (name as String)) +} + +type DockerNamedEnvAccumulate + = DockerNamedEnvAcc { assignments: List } + | DockerNamedEnvAccUnreadable { cause: NonEmptyStr } + +fn docker_project_named_env(env: List, names: List) -> DockerNamedEnvAccumulate { + fold( + env, + init: DockerNamedEnvAcc { assignments: [] }, + f: (acc, entry) => + match acc { + DockerNamedEnvAccUnreadable { cause: c } => + DockerNamedEnvAccUnreadable { cause: c } + DockerNamedEnvAcc { assignments: accs } => + match docker_env_assignment_from_wire(entry: entry) { + Absent => + DockerNamedEnvAccUnreadable { + cause: "container inspect Config.Env entry is not a KEY or KEY=VALUE assignment" as NonEmptyStr, + } + Present { value: a } => + if !docker_named_env_name_requested(name: a.name, names: names) { + acc + } else if any(accs, x => (x.name as String) == (a.name as String)) { + DockerNamedEnvAccUnreadable { + cause: join(["container inspect Config.Env names ", a.name as String, " more than once"], "") as NonEmptyStr, + } + } else { + DockerNamedEnvAcc { assignments: append(accs, items: [a]) } + } + } + }, + ) +} + +fn docker_container_inspect_named_env_from_object(obj: JsonValue, names: List) -> DockerContainerInspectNamedEnvRead { + match json_object_unique_member(v: obj, key: "Id") { + JsonMemberAbsent => + DockerContainerInspectNamedEnvUnreadable { cause: "docker container inspect JSON names no Id" as NonEmptyStr } + JsonMemberNotAnObject => + DockerContainerInspectNamedEnvUnreadable { cause: "docker container inspect JSON element is not an object" as NonEmptyStr } + JsonMemberDuplicated { count: n } => + DockerContainerInspectNamedEnvUnreadable { + cause: join(["docker container inspect JSON names Id ", to_string(n), " times"], "") as NonEmptyStr, + } + JsonMemberFound { value: idv } => { + let id = json_string_value_or_empty(v: idv) + if id == "" { + DockerContainerInspectNamedEnvUnreadable { cause: "docker container inspect JSON Id is not a nonempty string" as NonEmptyStr } + } else { + match json_object_unique_member(v: obj, key: "Config") { + JsonMemberAbsent => + DockerContainerInspectNamedEnvUnreadable { + cause: "docker container inspect JSON names no Config" as NonEmptyStr, + } + JsonMemberNotAnObject => + DockerContainerInspectNamedEnvUnreadable { cause: "docker container inspect JSON element is not an object" as NonEmptyStr } + JsonMemberDuplicated { count: n } => + DockerContainerInspectNamedEnvUnreadable { + cause: join(["docker container inspect JSON names Config ", to_string(n), " times"], "") as NonEmptyStr, + } + JsonMemberFound { value: cfg } => + match json_object_unique_member(v: cfg, key: "Env") { + JsonMemberAbsent => + DockerContainerInspectNamedEnvUnreadable { + cause: "docker container inspect Config names no Env" as NonEmptyStr, + } + JsonMemberNotAnObject => + DockerContainerInspectNamedEnvUnreadable { cause: "docker container inspect Config is not an object" as NonEmptyStr } + JsonMemberDuplicated { count: n } => + DockerContainerInspectNamedEnvUnreadable { + cause: join(["docker container inspect Config names Env ", to_string(n), " times"], "") as NonEmptyStr, + } + JsonMemberFound { value: envv } => + match envv { + JsonNull => + DockerContainerInspectNamedEnvUnreadable { + cause: "docker container inspect Config.Env is null" as NonEmptyStr, + } + JsonBool { value: _ } => + DockerContainerInspectNamedEnvUnreadable { + cause: "docker container inspect Config.Env is not a list of strings" as NonEmptyStr, + } + JsonNumber { lexeme: _ } => + DockerContainerInspectNamedEnvUnreadable { + cause: "docker container inspect Config.Env is not a list of strings" as NonEmptyStr, + } + JsonString { value: _ } => + DockerContainerInspectNamedEnvUnreadable { + cause: "docker container inspect Config.Env is not a list of strings" as NonEmptyStr, + } + JsonObject { members: _ } => + DockerContainerInspectNamedEnvUnreadable { + cause: "docker container inspect Config.Env is not a list of strings" as NonEmptyStr, + } + JsonArray { elements: _ } => + match json_string_list(v: envv) { + Absent => + DockerContainerInspectNamedEnvUnreadable { + cause: "docker container inspect Config.Env is not a list of strings" as NonEmptyStr, + } + Present { value: env } => + match docker_project_named_env(env: env, names: names) { + DockerNamedEnvAccUnreadable { cause: c } => + DockerContainerInspectNamedEnvUnreadable { cause: c } + DockerNamedEnvAcc { assignments: asg } => + DockerContainerInspectNamedEnv { id: id as NonEmptyStr, assignments: asg } + } + } + } + } + } + } + } + } +} + // THE CONTAINER'S TWO IDENTITY FIELDS, AND NOTHING ELSE OFF THE INSPECT OBJECT. `docker container // inspect` returns the whole object extdeps.docker.container_inspect ContainerInspect models, // including Config.Env, whose values can carry secrets. This reader takes exactly .Id -- the full @@ -322,6 +472,26 @@ fn docker_inspect_nonempty_string_member(obj: JsonValue, key: String) -> String? } } +fn docker_container_inspect_named_env_from_stdout(stdout: String, names: List) -> DockerContainerInspectNamedEnvRead { + match parse_json_document(s: trim(s: stdout)) { + JsonDocumentUnreadable { gap: g } => { + let t = json_document_gap_text(gap: g) + DockerContainerInspectNamedEnvUnreadable { + cause: if t.length() == 0 { "docker container inspect JSON is unreadable" as NonEmptyStr } else { t as NonEmptyStr }, + } + } + JsonDocumentParsed { value: v } => + match docker_inspect_json_first_of_one(v: v) { + Absent => + DockerContainerInspectNamedEnvUnreadable { + cause: "docker container inspect JSON is not a one-element array" as NonEmptyStr, + } + Present { value: obj } => + docker_container_inspect_named_env_from_object(obj: obj, names: names) + } + } +} + fn docker_container_inspect_identity_from_stdout(stdout: String) -> DockerContainerInspectIdentityRead { match parse_json_document(s: trim(s: stdout)) { JsonDocumentUnreadable { gap: g } => diff --git a/dag/extdeps/languages/json/parse.dag b/dag/extdeps/languages/json/parse.dag index f1053b8526d..7e0a6a11e8b 100644 --- a/dag/extdeps/languages/json/parse.dag +++ b/dag/extdeps/languages/json/parse.dag @@ -166,6 +166,40 @@ fn json_string_value_or_empty(v: JsonValue) -> String { } } +// AN ARRAY OF STRINGS, OR NONE. The six JsonValue arms are exhaustive: a non-array, or an array +// whose element is not a string, is unread rather than last-wins or stringify. Docker Config.Env +// and OCI image-config Env are two readers of this one accessor. +fn json_string_list(v: JsonValue) -> List? { + match v { + JsonArray { elements: es } => json_string_list_from(es: es, index: 0, acc: []) + JsonNull => none + JsonBool { value: _ } => none + JsonNumber { lexeme: _ } => none + JsonString { value: _ } => none + JsonObject { members: _ } => none + } +} + +fn json_string_list_from(es: List, index: Int, acc: List) -> List? { + if index >= count(es) { + Present { value: acc } + } else { + match es |> get(index) { + Absent => none + Present { value: el } => + match el { + JsonString { value: s } => + json_string_list_from(es: es, index: index + 1, acc: append(acc, items: [s])) + JsonNull => none + JsonBool { value: _ } => none + JsonNumber { lexeme: _ } => none + JsonArray { elements: _ } => none + JsonObject { members: _ } => none + } + } + } +} + // RFC 8259 permits duplicate names in an object and does not say which one wins, so JsonObject // keeps members as an authored LIST rather than a map. A reader that folds that list into last-wins // silently picks a value the document never committed to - and for an identity field like schema or diff --git a/dag/extdeps/vllm/usage_stats.dag b/dag/extdeps/vllm/usage_stats.dag index 50f0b25deb1..e2a3fbf8aad 100644 --- a/dag/extdeps/vllm/usage_stats.dag +++ b/dag/extdeps/vllm/usage_stats.dag @@ -1,6 +1,7 @@ module extdeps.vllm.usage_stats -import std.types { NonEmptyStr, List } +import v2.std.optional { Present, Absent } +import std.types { NonEmptyStr, List, String } import std.decl_ref { DeclarationRef, WholeDeclaration } import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef } import extdeps.uri { Uri, Https } @@ -97,22 +98,9 @@ type VllmUsageStatsDisableTerm { // no truthiness, no case folding and no "anything non-empty": each of those is a consumer's guess // about a reading this module can state. // -// THIS PREDICATE HAS NO CALL SITE TODAY, AND THAT IS A DECLARED FRONTIER RATHER THAN AN OVERSIGHT -// (DESIGN 3c). Its only consumer was gunbc.spark.first_party_serving spark_lane_disables_usage_stats, -// which folded it over the environment a container is DECLARED to be created with. That fold was -// deleted rather than narrowed, because a deciding standing that still consults a declared -// environment is only postponing the attribution it must not make: agreeing with a declaration does -// not establish what the process that answered actually does. -// -// THE NAMED CONSUMER AND THE TRIGGER. This predicate is what an EFFECTIVE-CONFIGURATION READING -// feeds -- once a producer can read the environment of the running container and bind it to the -// offered launch, the assignments it returns are tested here, by upstream's own reading, and the -// telemetry path resolves. The trigger is that reading, named at gunbc.spark.first_party_serving -// spark_serving_usage_stats_declared_environment_obligation. It is kept rather than deleted because -// what it holds is a CITED UPSTREAM READING -- the exact-equality semantics of envs.py, which -// review 64043 established after a first spelling got the direction wrong in the admitting sense -- -// and re-deriving that from the source a second time is the redundant work DESIGN 2 prices. It is -// not kept because deleting it would be inconvenient: if the reading never lands, this goes with it. +// THE NAMED CONSUMER. gunbc.spark.serving_usage_stats_observe spark_serving_usage_stats_observe +// feeds this predicate the four projected names from a running-container inspect. The exact-equality +// semantics of envs.py stay here (review 64043). fn vllm_usage_stats_assignment_disables(term: VllmUsageStatsDisableTerm, name: NonEmptyStr, value: String) -> Bool { (name as String) == (term.variable as String) && value == (term.disabling_value as String) } @@ -125,6 +113,8 @@ type VllmUsageStatsReporting sole_constructor { service_jurisdiction: VllmUsageStatsServiceJurisdiction collected_fields: List disable_terms: List + vllm_do_not_track_env: NonEmptyStr + do_not_track_fallback_env: NonEmptyStr disable_marker_path: NonEmptyStr established_against: VllmSourceRevision } @@ -149,26 +139,182 @@ data vllm_usage_stats_reporting: VllmUsageStatsReporting = VllmUsageStatsReporti ], disable_terms: [ VllmUsageStatsDisableTerm { variable: "VLLM_NO_USAGE_STATS", disabling_value: "1" }, - VllmUsageStatsDisableTerm { variable: "DO_NOT_TRACK", disabling_value: "1" }, ], + vllm_do_not_track_env: "VLLM_DO_NOT_TRACK", + do_not_track_fallback_env: "DO_NOT_TRACK", disable_marker_path: "~/.config/vllm/do_not_track", established_against: vllm_source_revision_read, } -// THE THIRD TERM OF UPSTREAM'S DISJUNCTION IS THE MARKER FILE, carried above as -// disable_marker_path and deliberately not folded by the launch standing below: a container -// environment cannot answer whether a path exists inside the image or the home directory, and -// guessing would be the same authored reading this module just moved out of the consumer. Its -// absence from the fold errs in the conservative direction -- a fleet that disabled reporting only -// by marker file reads as ENABLED here, which over-declares the egress rather than hiding it -- and -// the honest closure is a filesystem observation, not a bolder predicate. +// THE THIRD TERM OF UPSTREAM'S DISJUNCTION IS THE MARKER FILE. InspectServingContainer does not +// authorize a filesystem read of disable_marker_path. Unread marker is therefore Unread standing, +// never an authored "enabled" default: upstream is +// `_USAGE_STATS_ENABLED = not (do_not_track or no_usage_stats or do_not_track_file)` at +// vllm_source_revision_read (vllm/usage/usage_lib.py). Treating unread-as-absent would admit. +// +// DO_NOT_TRACK IS NOT AN INDEPENDENT TERM. At that same revision, envs.py computes +// `VLLM_DO_NOT_TRACK = (os.environ.get("VLLM_DO_NOT_TRACK") or os.environ.get("DO_NOT_TRACK") or "0") == "1"`. +// Python `or` skips only unset and empty, so VLLM_DO_NOT_TRACK=0 with DO_NOT_TRACK=1 stays enabled. +// VLLM_NO_USAGE_STATS remains an independent exact-equality term (`== "1"`). // -// REPORTING IS ON UNLESS SOMETHING TURNS IT OFF, which is the shape of the upstream check -// (_USAGE_STATS_ENABLED = not (do_not_track or no_usage_stats or do_not_track_file)) and therefore -// the shape of the question a consumer must ask about a particular launch. The arms are what a -// launch's configuration can establish, and the unread arm exists because reading a running host's -// environment is an observation this module cannot make. +// VLLM_USAGE_STATS_SERVER: os.environ.get's default applies only when the name is unset. A present +// empty string stays empty and is not the default server. + +data vllm_usage_stats_empty_server_cause: NonEmptyStr = "VLLM_USAGE_STATS_SERVER is present and empty; os.environ.get's default applies only when the name is unset (extdeps.vllm.usage_stats, vllm/envs.py at vllm_source_revision_read)" as NonEmptyStr + +type VllmDoNotTrackMarkerStanding + = DoNotTrackMarkerPresent + | DoNotTrackMarkerAbsent + | DoNotTrackMarkerUnread { obligation: NonEmptyStr } + +type VllmUsageStatsEnvAssignment { + name: NonEmptyStr + value: String +} + type VllmUsageStatsLaunchStanding = UsageStatsDisabledByLaunch { mechanism: NonEmptyStr } - | UsageStatsEnabledByDefault { basis: NonEmptyStr } + | UsageStatsEnabledByDefault { basis: NonEmptyStr, destination: NonEmptyStr } | UsageStatsLaunchUnread { obligation: NonEmptyStr } + | UsageStatsEnvMalformed { cause: NonEmptyStr } + +fn vllm_usage_stats_inspect_env_names() -> List { + append( + append( + append( + map(vllm_usage_stats_reporting.disable_terms, t => t.variable), + items: [vllm_usage_stats_reporting.vllm_do_not_track_env], + ), + items: [vllm_usage_stats_reporting.do_not_track_fallback_env], + ), + items: [vllm_usage_stats_reporting.server_override_env], + ) +} + +fn vllm_usage_stats_named_value(assignments: List, name: NonEmptyStr) -> String? { + fold(assignments, init: none, f: (acc, a) => + match acc { + Present { value: _ } => acc + Absent => + if (a.name as String) == (name as String) { + Present { value: a.value } + } else { + none + } + }) +} + +fn vllm_usage_stats_python_or_env(first: String?, second: String?) -> String { + match first { + Present { value: a } => + if a.length() == 0 { + match second { + Present { value: b } => if b.length() == 0 { "0" } else { b } + Absent => "0" + } + } else { + a + } + Absent => + match second { + Present { value: b } => if b.length() == 0 { "0" } else { b } + Absent => "0" + } + } +} + +fn vllm_usage_stats_do_not_track_mechanism( + assignments: List, +) -> NonEmptyStr? { + let primary = vllm_usage_stats_named_value( + assignments: assignments, + name: vllm_usage_stats_reporting.vllm_do_not_track_env, + ) + let fallback = vllm_usage_stats_named_value( + assignments: assignments, + name: vllm_usage_stats_reporting.do_not_track_fallback_env, + ) + if vllm_usage_stats_python_or_env(first: primary, second: fallback) == "1" { + match primary { + Present { value: a } => + if a.length() == 0 { + Present { value: vllm_usage_stats_reporting.do_not_track_fallback_env } + } else { + Present { value: vllm_usage_stats_reporting.vllm_do_not_track_env } + } + Absent => + Present { value: vllm_usage_stats_reporting.do_not_track_fallback_env } + } + } else { + none + } +} + +fn vllm_usage_stats_term_disables_from_assignments( + terms: List, + assignments: List, +) -> NonEmptyStr? { + fold(terms, init: none, f: (acc, term) => + match acc { + Present { value: _ } => acc + Absent => + match vllm_usage_stats_named_value(assignments: assignments, name: term.variable) { + Absent => none + Present { value: v } => + if vllm_usage_stats_assignment_disables(term: term, name: term.variable, value: v) { + Present { value: term.variable } + } else { + none + } + } + }) +} + +fn vllm_usage_stats_disable_mechanism_from_assignments( + assignments: List, +) -> NonEmptyStr? { + match vllm_usage_stats_term_disables_from_assignments( + terms: vllm_usage_stats_reporting.disable_terms, + assignments: assignments, + ) { + Present { value: m } => Present { value: m } + Absent => vllm_usage_stats_do_not_track_mechanism(assignments: assignments) + } +} + +fn vllm_usage_stats_standing_from_effective_config( + assignments: List, + marker: VllmDoNotTrackMarkerStanding, +) -> VllmUsageStatsLaunchStanding { + match vllm_usage_stats_disable_mechanism_from_assignments(assignments: assignments) { + Present { value: mechanism } => + UsageStatsDisabledByLaunch { mechanism: mechanism } + Absent => + match marker { + DoNotTrackMarkerPresent => + UsageStatsDisabledByLaunch { mechanism: vllm_usage_stats_reporting.disable_marker_path } + DoNotTrackMarkerUnread { obligation: o } => + UsageStatsLaunchUnread { obligation: o } + DoNotTrackMarkerAbsent => + match vllm_usage_stats_named_value( + assignments: assignments, + name: vllm_usage_stats_reporting.server_override_env, + ) { + Present { value: v } => + if v.length() == 0 { + UsageStatsEnvMalformed { cause: vllm_usage_stats_empty_server_cause } + } else { + UsageStatsEnabledByDefault { + basis: "no disable term equals 1 and the do-not-track marker is absent" as NonEmptyStr, + destination: v as NonEmptyStr, + } + } + Absent => + UsageStatsEnabledByDefault { + basis: "no disable term equals 1 and the do-not-track marker is absent" as NonEmptyStr, + destination: vllm_usage_stats_reporting.default_server, + } + } + } + } +} diff --git a/dag/gunbc/container/registry_image_config.dag b/dag/gunbc/container/registry_image_config.dag index 9d1ea4058ef..11f733f2c2c 100644 --- a/dag/gunbc/container/registry_image_config.dag +++ b/dag/gunbc/container/registry_image_config.dag @@ -34,6 +34,7 @@ import extdeps.languages.json.parse { json_document_gap_text, json_object_unique_member, json_string_value_or_empty, + json_string_list, parse_json_document, } import extdeps.tools.sha256sum @@ -113,37 +114,6 @@ fn check_sha256_hex(subject: NonEmptyStr, expected: NonEmptyStr, observed: NonEm } } -fn json_string_list(v: JsonValue) -> List? { - match v { - JsonArray { elements: es } => json_string_list_from(es: es, index: 0, acc: []) - JsonNull => none - JsonBool { value: _ } => none - JsonNumber { lexeme: _ } => none - JsonString { value: _ } => none - JsonObject { members: _ } => none - } -} - -fn json_string_list_from(es: List, index: Int, acc: List) -> List? { - if index >= count(es) { - Present { value: acc } - } else { - match es |> get(index) { - Absent => none - Present { value: el } => - match el { - JsonString { value: s } => - json_string_list_from(es: es, index: index + 1, acc: append(acc, items: [s])) - JsonNull => none - JsonBool { value: _ } => none - JsonNumber { lexeme: _ } => none - JsonArray { elements: _ } => none - JsonObject { members: _ } => none - } - } - } -} - fn unique_string_member(v: JsonValue, key: String) -> String? { match json_object_unique_member(v: v, key: key) { JsonMemberFound { value: found } => { diff --git a/dag/gunbc/harness/harness_seat.dag b/dag/gunbc/harness/harness_seat.dag index ed51ffa4b4e..8c4e1443ed0 100644 --- a/dag/gunbc/harness/harness_seat.dag +++ b/dag/gunbc/harness/harness_seat.dag @@ -59,7 +59,10 @@ import gunbc.spark.pair_serving_realization { spark_pair_declared_head_digest, } import gunbc.spark.glm_canary_converge { glm_canary_declared_unit_artifact_obligation } -import gunbc.spark.serving_incarnation_observe { observe_endpoint_incarnation, endpoint_incarnation_standing } +import gunbc.spark.serving_incarnation_observe { + observe_endpoint_incarnation, endpoint_incarnation_standing, endpoint_incarnation_usage_stats, + ServingUsageStatsObservation, spark_usage_stats_inspect_unread, +} import gunbc.spark.pair_serving_desired { spark_pair_group_head_host } import gunbc.fleet_ssh_locus { FleetSshContextPreparation, FleetSshContextReady, FleetSshContextRefused, prepare_fleet_ssh_agent_context } import gunbc.serving.turn_admission { @@ -76,6 +79,7 @@ import std.content_hash { content_hash_of_value, serialize_content_hash } import product.fabric.identity { FabricIdentity, DemandKey } import product.fabric.provider_admission { refusal_reason } import gunbc.spark.first_party_serving { SparkServingRealization, spark_first_party_admission, spark_first_party_use_scope } + import gunbc.serving.engine_progress { EngineProgressGate, WithholdRouteNotProgressing, ProgressDoesNotWithhold, engine_progress_read, engine_progress_gate, serving_engine_step_bound, @@ -515,16 +519,24 @@ type HarnessCandidate { // it is admitted, and every later candidate on that same launch -- next round, or a co-located group // on the same engine -- reuses the reading. A restart mints a new launch key, so the memo re-observes // exactly when the engine actually changed, never otherwise. +// One inspect per launch per bind yields BOTH projections; the memo carries both so neither is +// re-observed and neither can be supplied apart from the other. type IncarnationMemoEntry { launch_key: NonEmptyStr standing: EndpointIncarnationStanding + usage_stats: ServingUsageStatsObservation +} + +type HarnessIncarnationRead { + standing: EndpointIncarnationStanding + usage_stats: ServingUsageStatsObservation } -fn incarnation_memo_lookup(memo: List, key: NonEmptyStr) -> EndpointIncarnationStanding? { +fn incarnation_memo_lookup(memo: List, key: NonEmptyStr) -> HarnessIncarnationRead? { fold(memo, init: none, f: (acc, e) => match acc { Present { value: _ } => acc - Absent => if (e.launch_key as String) == (key as String) { Present { value: e.standing } } else { none } + Absent => if (e.launch_key as String) == (key as String) { Present { value: HarnessIncarnationRead { standing: e.standing, usage_stats: e.usage_stats } } } else { none } }) } @@ -572,7 +584,7 @@ fn harness_no_candidate(acc: HarnessCandidates, note: String, retryable: Bool) - // // THE REALIZATION THE HARNESS OFFERS IS BUILT IN ONE PLACE, so a witness can drive the route standing // through exactly what production passes. The incarnation standing is an ARGUMENT: production takes -// it from gunbc.spark.serving_incarnation_observe at candidate time (harness_incarnation_standing +// it from gunbc.spark.serving_incarnation_observe at candidate time (harness_incarnation_read // below), reading the group's head host over the fleet key session at the same instant the endpoint // launch was read, and a witness hands in a fixture observation to drive the arms past the // incarnation refusal. The declared side of the unit comparison is no longer absent: the SHA-256 of @@ -637,16 +649,27 @@ fn harness_declared_unit_from_roster(roster: HarnessDeclaredUnitRoster, group: F // than as a bind refusal: the harness can still enumerate and diagnose routes without host access, // it just cannot name the service, and the route standing says exactly that. A group with no // desired head host has nothing to observe and says so. -fn harness_incarnation_standing(access: FleetSshContextPreparation, group: FabricGroup, launch: VllmEndpointProcessLaunch) -> EndpointIncarnationStanding { +fn harness_incarnation_read(access: FleetSshContextPreparation, group: FabricGroup, launch: VllmEndpointProcessLaunch) -> HarnessIncarnationRead { match access { FleetSshContextRefused { cause: c } => - EndpointIncarnationUnobserved { obligation: join([spark_serving_incarnation_unobserved_obligation as String, " -- this bind holds no fleet ssh context: ", c], "") as NonEmptyStr } + HarnessIncarnationRead { + standing: EndpointIncarnationUnobserved { obligation: join([spark_serving_incarnation_unobserved_obligation as String, " -- this bind holds no fleet ssh context: ", c], "") as NonEmptyStr }, + usage_stats: spark_usage_stats_inspect_unread(), + } FleetSshContextReady { context: context, receipt: _ } => match spark_pair_group_head_host(group: group) { Absent => - EndpointIncarnationUnobserved { obligation: join(["gunbc.spark.pair_serving_desired names no ready head host for ", fabric_group_wire(g: group) as String, ", so there is no host to observe the incarnation on"], "") as NonEmptyStr } - Present { value: head } => - endpoint_incarnation_standing(reading: observe_endpoint_incarnation(context: context, group: group, head: head, endpoint: launch)) + HarnessIncarnationRead { + standing: EndpointIncarnationUnobserved { obligation: join(["gunbc.spark.pair_serving_desired names no ready head host for ", fabric_group_wire(g: group) as String, ", so there is no host to observe the incarnation on"], "") as NonEmptyStr }, + usage_stats: spark_usage_stats_inspect_unread(), + } + Present { value: head } => { + let reading = observe_endpoint_incarnation(context: context, group: group, head: head, endpoint: launch) + HarnessIncarnationRead { + standing: endpoint_incarnation_standing(reading: reading), + usage_stats: endpoint_incarnation_usage_stats(reading: reading), + } + } } } } @@ -654,9 +677,9 @@ fn harness_incarnation_standing(access: FleetSshContextPreparation, group: Fabri // THE ROUTE STANDING IS A SUPPLIED VALUE HERE, computed by the caller from harness_serving_route, // so this one interface can be driven with a fixture route that binds and shown to take the bound // offer INTO admission (test.claim.harness_turn_admission_witness). The incarnation standing is -// supplied beside it (observed per candidate by harness_incarnation_standing, memoized per +// supplied beside it (observed per candidate by harness_incarnation_read, memoized per // collection) because the realization admission is judged on carries it too. -fn harness_bind_candidate(acc: HarnessCandidates, group: FabricGroup, endpoint: ServingRouteEndpoint, launch: VllmEndpointProcessLaunch, availability: ServingFrontDoorAvailabilityVerdict, readback: VllmModelsRouteReadbackStanding, incarnation: EndpointIncarnationStanding, route: SparkServingRoute, subject: HarnessTurnSubject, model: NonEmptyStr, unit: HarnessServingUnit, seats: Nat) -> HarnessCandidates { +fn harness_bind_candidate(acc: HarnessCandidates, group: FabricGroup, endpoint: ServingRouteEndpoint, launch: VllmEndpointProcessLaunch, availability: ServingFrontDoorAvailabilityVerdict, readback: VllmModelsRouteReadbackStanding, incarnation: EndpointIncarnationStanding, usage_stats: ServingUsageStatsObservation, route: SparkServingRoute, subject: HarnessTurnSubject, model: NonEmptyStr, unit: HarnessServingUnit, seats: Nat) -> HarnessCandidates { match bind_spark_serving_offer( principal: "gunbc" as NonEmptyStr, executor: fabric_group_wire(g: group), @@ -674,6 +697,7 @@ fn harness_bind_candidate(acc: HarnessCandidates, group: FabricGroup, endpoint: harness_admit_bound_offer( acc: acc, group: group, endpoint: endpoint, launch: launch, realization: harness_serving_realization(group: group, launch: launch, readback: readback, incarnation: incarnation), + usage_stats: usage_stats, projection: projection, subject: subject, unit: unit, seats: seats, ) } @@ -682,13 +706,18 @@ fn harness_bind_candidate(acc: HarnessCandidates, group: FabricGroup, endpoint: // THE ADMISSION STEP OF A BOUND OFFER, separated so the realization it is judged on is an argument: // production passes harness_serving_realization, and a witness can drive the same step with fixture // evidence and observe exactly which admission arm the turn reached. -fn harness_admit_bound_offer(acc: HarnessCandidates, group: FabricGroup, endpoint: ServingRouteEndpoint, launch: VllmEndpointProcessLaunch, realization: SparkServingRealization, projection: SparkOfferProjection, subject: HarnessTurnSubject, unit: HarnessServingUnit, seats: Nat) -> HarnessCandidates { +// THE USAGE-STATS OBSERVATION ARRIVES BESIDE THE INCARNATION, from the same inspect: the host +// operation in gunbc.spark.serving_incarnation_observe projects both from one authorized +// `docker container inspect` and is the only mint of the sealed evidence, so what reaches admission +// here was observed on the answering container or is typed Unobserved with the operation's refusal. +fn harness_admit_bound_offer(acc: HarnessCandidates, group: FabricGroup, endpoint: ServingRouteEndpoint, launch: VllmEndpointProcessLaunch, realization: SparkServingRealization, usage_stats: ServingUsageStatsObservation, projection: SparkOfferProjection, subject: HarnessTurnSubject, unit: HarnessServingUnit, seats: Nat) -> HarnessCandidates { let offer = projection.offer match bind_candidate( offer: offer, dispatch: serving_dispatch_inputs(offer: offer.id, commitment: PayAsYouGo, receipt: harness_metrics_probe_receipt), admission: spark_first_party_admission( realization: realization, + usage_stats: usage_stats, scope: spark_first_party_use_scope(demand: subject.demand, work: subject.work.id), offer: offer.id, ), @@ -863,12 +892,12 @@ fn harness_add_serving_candidate( let launch_key = vllm_endpoint_process_launch_key(launch: launch) match incarnation_memo_lookup(memo: acc.incarnations, key: launch_key) { Present { value: cached } => - harness_bind_candidate(acc: acc, group: group, endpoint: endpoint, launch: launch, availability: availability, readback: readback, incarnation: cached, route: harness_serving_route(group: group, launch: launch, readback: readback, incarnation: cached, declared_unit: harness_declared_unit_from_roster(roster: declared_units, group: group)), subject: subject, model: model, unit: unit, seats: seats) + harness_bind_candidate(acc: acc, group: group, endpoint: endpoint, launch: launch, availability: availability, readback: readback, incarnation: cached.standing, usage_stats: cached.usage_stats, route: harness_serving_route(group: group, launch: launch, readback: readback, incarnation: cached.standing, declared_unit: harness_declared_unit_from_roster(roster: declared_units, group: group)), subject: subject, model: model, unit: unit, seats: seats) Absent => { - let observed = harness_incarnation_standing(access: access, group: group, launch: launch) + let observed = harness_incarnation_read(access: access, group: group, launch: launch) harness_bind_candidate( - acc: HarnessCandidates { candidates: acc.candidates, notes: acc.notes, retryable: acc.retryable, incarnations: append(acc.incarnations, IncarnationMemoEntry { launch_key: launch_key, standing: observed }) }, - group: group, endpoint: endpoint, launch: launch, availability: availability, readback: readback, incarnation: observed, route: harness_serving_route(group: group, launch: launch, readback: readback, incarnation: observed, declared_unit: harness_declared_unit_from_roster(roster: declared_units, group: group)), subject: subject, model: model, unit: unit, seats: seats) + acc: HarnessCandidates { candidates: acc.candidates, notes: acc.notes, retryable: acc.retryable, incarnations: append(acc.incarnations, IncarnationMemoEntry { launch_key: launch_key, standing: observed.standing, usage_stats: observed.usage_stats }) }, + group: group, endpoint: endpoint, launch: launch, availability: availability, readback: readback, incarnation: observed.standing, usage_stats: observed.usage_stats, route: harness_serving_route(group: group, launch: launch, readback: readback, incarnation: observed.standing, declared_unit: harness_declared_unit_from_roster(roster: declared_units, group: group)), subject: subject, model: model, unit: unit, seats: seats) } } } diff --git a/dag/gunbc/namespace/transition_admission/gunbc_container_registry_image_config_container_image_config_env_from_json_json_string_list.dag b/dag/gunbc/namespace/transition_admission/gunbc_container_registry_image_config_container_image_config_env_from_json_json_string_list.dag new file mode 100644 index 00000000000..abea90650ea --- /dev/null +++ b/dag/gunbc/namespace/transition_admission/gunbc_container_registry_image_config_container_image_config_env_from_json_json_string_list.dag @@ -0,0 +1,22 @@ +module gunbc.namespace.transition_admission.gunbc_container_registry_image_config_container_image_config_env_from_json_json_string_list + +import std.types { NonEmptyStr, List } +import std.integer { UInt32 } +import std.decl_ref { decl_ref } +import gunbc.compiler_frontend_program_interlock { TargetChanged } +import gunbc.namespace.transition_admission { TransitionAdmission, Binding, NotAuthored } + +// gunbc#11441 json_string_list hoist: the spelling in container_image_config_env_from_json now +// binds extdeps.languages.json.parse, where both readers (docker inspect, OCI image config) take it. +// DISSOLVE-ON: gunbc#11441 merging. +data gunbc_container_registry_image_config_container_image_config_env_from_json_json_string_list: TransitionAdmission = TransitionAdmission { + label: "gunbc#11441 json_string_list lives in json.parse" as NonEmptyStr, + subject: Binding { + enclosing: decl_ref("gunbc.container.registry_image_config", "container_image_config_env_from_json"), + spelling: "json_string_list" as NonEmptyStr, + expected_candidates: [decl_ref("extdeps.languages.json.parse", "json_string_list")], + }, + disposition: TargetChanged, + deletion_follow_up: NotAuthored, + owner_pull_request: 11441 as UInt32, +} diff --git a/dag/gunbc/namespace/transition_admission/gunbc_spark_serving_offer_spark_serving_route_standing_DeclaredUnitDigestStanding.dag b/dag/gunbc/namespace/transition_admission/gunbc_spark_serving_offer_spark_serving_route_standing_DeclaredUnitDigestStanding.dag deleted file mode 100644 index b3a7aad8604..00000000000 --- a/dag/gunbc/namespace/transition_admission/gunbc_spark_serving_offer_spark_serving_route_standing_DeclaredUnitDigestStanding.dag +++ /dev/null @@ -1,24 +0,0 @@ -module gunbc.namespace.transition_admission.gunbc_spark_serving_offer_spark_serving_route_standing_DeclaredUnitDigestStanding - -import std.types { NonEmptyStr, List } -import std.integer { UInt32 } -import std.decl_ref { decl_ref } -import gunbc.compiler_frontend_program_interlock { TargetChanged } -import gunbc.namespace.transition_admission { TransitionAdmission, Binding, NotAuthored } - -// gunbc#11440 declared-unit-digest home: DeclaredUnitDigestStanding and its two arms relocate -// verbatim from gunbc.spark.serving_offer to gunbc.spark.pair_serving_realization, the render -// boundary that mints the SHA-256 of the rendered head-unit bytes. A spelling authored on both -// sides whose candidate module changed; the declaration it denotes did not. -// DISSOLVE-ON: gunbc#11440 merging. -data gunbc_spark_serving_offer_spark_serving_route_standing_DeclaredUnitDigestStanding: TransitionAdmission = TransitionAdmission { - label: "gunbc#11440 DeclaredUnitDigestStanding moves to pair_serving_realization" as NonEmptyStr, - subject: Binding { - enclosing: decl_ref("gunbc.spark.serving_offer", "spark_serving_route_standing"), - spelling: "DeclaredUnitDigestStanding" as NonEmptyStr, - expected_candidates: [decl_ref("gunbc.spark.pair_serving_realization", "DeclaredUnitDigestStanding")], - }, - disposition: TargetChanged, - deletion_follow_up: NotAuthored, - owner_pull_request: 11440 as UInt32, -} diff --git a/dag/gunbc/namespace/transition_admission/test_claim_spark_spark_serving_offer_route_witness_test_t_declared_DeclaredUnitDigestStanding.dag b/dag/gunbc/namespace/transition_admission/test_claim_spark_spark_serving_offer_route_witness_test_t_declared_DeclaredUnitDigestStanding.dag deleted file mode 100644 index c4b80926a45..00000000000 --- a/dag/gunbc/namespace/transition_admission/test_claim_spark_spark_serving_offer_route_witness_test_t_declared_DeclaredUnitDigestStanding.dag +++ /dev/null @@ -1,24 +0,0 @@ -module gunbc.namespace.transition_admission.test_claim_spark_spark_serving_offer_route_witness_test_t_declared_DeclaredUnitDigestStanding - -import std.types { NonEmptyStr, List } -import std.integer { UInt32 } -import std.decl_ref { decl_ref } -import gunbc.compiler_frontend_program_interlock { TargetChanged } -import gunbc.namespace.transition_admission { TransitionAdmission, Binding, NotAuthored } - -// gunbc#11440 declared-unit-digest home: DeclaredUnitDigestStanding and its two arms relocate -// verbatim from gunbc.spark.serving_offer to gunbc.spark.pair_serving_realization, the render -// boundary that mints the SHA-256 of the rendered head-unit bytes. A spelling authored on both -// sides whose candidate module changed; the declaration it denotes did not. -// DISSOLVE-ON: gunbc#11440 merging. -data test_claim_spark_spark_serving_offer_route_witness_test_t_declared_DeclaredUnitDigestStanding: TransitionAdmission = TransitionAdmission { - label: "gunbc#11440 DeclaredUnitDigestStanding moves to pair_serving_realization" as NonEmptyStr, - subject: Binding { - enclosing: decl_ref("test.claim.spark.spark_serving_offer_route_witness_test", "t_declared"), - spelling: "DeclaredUnitDigestStanding" as NonEmptyStr, - expected_candidates: [decl_ref("gunbc.spark.pair_serving_realization", "DeclaredUnitDigestStanding")], - }, - disposition: TargetChanged, - deletion_follow_up: NotAuthored, - owner_pull_request: 11440 as UInt32, -} diff --git a/dag/gunbc/namespace/transition_admission/test_claim_spark_spark_serving_offer_route_witness_test_t_unit_unavailable_DeclaredUnitDigestStanding.dag b/dag/gunbc/namespace/transition_admission/test_claim_spark_spark_serving_offer_route_witness_test_t_unit_unavailable_DeclaredUnitDigestStanding.dag deleted file mode 100644 index c47faa17d1e..00000000000 --- a/dag/gunbc/namespace/transition_admission/test_claim_spark_spark_serving_offer_route_witness_test_t_unit_unavailable_DeclaredUnitDigestStanding.dag +++ /dev/null @@ -1,24 +0,0 @@ -module gunbc.namespace.transition_admission.test_claim_spark_spark_serving_offer_route_witness_test_t_unit_unavailable_DeclaredUnitDigestStanding - -import std.types { NonEmptyStr, List } -import std.integer { UInt32 } -import std.decl_ref { decl_ref } -import gunbc.compiler_frontend_program_interlock { TargetChanged } -import gunbc.namespace.transition_admission { TransitionAdmission, Binding, NotAuthored } - -// gunbc#11440 declared-unit-digest home: DeclaredUnitDigestStanding and its two arms relocate -// verbatim from gunbc.spark.serving_offer to gunbc.spark.pair_serving_realization, the render -// boundary that mints the SHA-256 of the rendered head-unit bytes. A spelling authored on both -// sides whose candidate module changed; the declaration it denotes did not. -// DISSOLVE-ON: gunbc#11440 merging. -data test_claim_spark_spark_serving_offer_route_witness_test_t_unit_unavailable_DeclaredUnitDigestStanding: TransitionAdmission = TransitionAdmission { - label: "gunbc#11440 DeclaredUnitDigestStanding moves to pair_serving_realization" as NonEmptyStr, - subject: Binding { - enclosing: decl_ref("test.claim.spark.spark_serving_offer_route_witness_test", "t_unit_unavailable"), - spelling: "DeclaredUnitDigestStanding" as NonEmptyStr, - expected_candidates: [decl_ref("gunbc.spark.pair_serving_realization", "DeclaredUnitDigestStanding")], - }, - disposition: TargetChanged, - deletion_follow_up: NotAuthored, - owner_pull_request: 11440 as UInt32, -} diff --git a/dag/gunbc/namespace/transition_admission/test_claim_spark_spark_serving_offer_route_witness_test_t_unit_unavailable_DeclaredUnitDigestUnavailable.dag b/dag/gunbc/namespace/transition_admission/test_claim_spark_spark_serving_offer_route_witness_test_t_unit_unavailable_DeclaredUnitDigestUnavailable.dag deleted file mode 100644 index ccdc2cc3d50..00000000000 --- a/dag/gunbc/namespace/transition_admission/test_claim_spark_spark_serving_offer_route_witness_test_t_unit_unavailable_DeclaredUnitDigestUnavailable.dag +++ /dev/null @@ -1,24 +0,0 @@ -module gunbc.namespace.transition_admission.test_claim_spark_spark_serving_offer_route_witness_test_t_unit_unavailable_DeclaredUnitDigestUnavailable - -import std.types { NonEmptyStr, List } -import std.integer { UInt32 } -import std.decl_ref { decl_ref } -import gunbc.compiler_frontend_program_interlock { TargetChanged } -import gunbc.namespace.transition_admission { TransitionAdmission, Binding, NotAuthored } - -// gunbc#11440 declared-unit-digest home: DeclaredUnitDigestStanding and its two arms relocate -// verbatim from gunbc.spark.serving_offer to gunbc.spark.pair_serving_realization, the render -// boundary that mints the SHA-256 of the rendered head-unit bytes. A spelling authored on both -// sides whose candidate module changed; the declaration it denotes did not. -// DISSOLVE-ON: gunbc#11440 merging. -data test_claim_spark_spark_serving_offer_route_witness_test_t_unit_unavailable_DeclaredUnitDigestUnavailable: TransitionAdmission = TransitionAdmission { - label: "gunbc#11440 DeclaredUnitDigestStanding moves to pair_serving_realization" as NonEmptyStr, - subject: Binding { - enclosing: decl_ref("test.claim.spark.spark_serving_offer_route_witness_test", "t_unit_unavailable"), - spelling: "DeclaredUnitDigestUnavailable" as NonEmptyStr, - expected_candidates: [decl_ref("gunbc.spark.pair_serving_realization", "DeclaredUnitDigestUnavailable")], - }, - disposition: TargetChanged, - deletion_follow_up: NotAuthored, - owner_pull_request: 11440 as UInt32, -} diff --git a/dag/gunbc/rung_drop/provider_path_jurisdiction_unread_admits.dag b/dag/gunbc/rung_drop/provider_path_jurisdiction_unread_admits.dag index 8d8f1516f1a..10bf82ee659 100644 --- a/dag/gunbc/rung_drop/provider_path_jurisdiction_unread_admits.dag +++ b/dag/gunbc/rung_drop/provider_path_jurisdiction_unread_admits.dag @@ -111,38 +111,10 @@ import gunbc.guarantee_rung { Mitigatable, StructurallyGuaranteed } // // DECLARED 2026-09-11 with the Spark first-party serving route, under review 63995. -// THE POPULATION IS EMPTY AND THAT IS A COUNTED ZERO, NOT AN UNCOUNTED ONE. Nothing reaches -// gunbc.spark.first_party_serving spark_usage_stats_telemetry_path's located arm, because -// spark_serving_usage_stats_standing returns UsageStatsLaunchUnread on every arm, so this row -// admits nothing today. A previous spelling put that sentence INSIDE the list as its sole -// member, which made gunbc.rung_drop rung_drop_declaration_message publish a one-member -// population whose one member denied being a member -- and any consumer counting members got 1. -// A fabricated plausible value is worse than an uninformative one, which is why this is []. -// -// WHAT THE EMPTY LIST COSTS, DECLARED RATHER THAN DISCOVERED: the projection renders -// "Population: " and stops, and DESIGN 4c means this annotation is unreadable to any consumer, -// so the REASON the population is zero does not reach docs/design-rung-drops.md. That is -// uninformative rather than wrong -- nothing plausible is asserted. It is not the -// bottom-as-answer conflation gunbc.guarantee_stall warns about either: that warning is about -// rows whose exposure is UNBOUNDED, where [] would falsely read as "nothing is affected". Here -// nothing IS affected, so in that carrier's vocabulary this row is BoundedPopulation with no -// members and the empty list is the correct value rather than a compromise. -// WHAT THE MERGE WITH #11194 DECIDED HERE, AND WHY THE POPULATION IS STILL EMPTY. That change -// enrolled this drop as an EXECUTED exception: gunbc.spark.first_party_serving -// spark_first_party_posture now carries a JurisdictionDropEnrollment naming this row, with -// path_evidence spark_serving_usage_stats_standing and the undocumented-jurisdiction field. Its -// population member says that path "returns ProviderPathLocated". After this branch's repair it -// does not: spark_serving_usage_stats_standing answers UsageStatsLaunchUnread on every arm, so -// spark_usage_stats_telemetry_path returns ProviderPathUnread for every input and no located path -// with an undocumented jurisdiction is produced. Keeping that member would have reinstated, in the -// projected ledger, the exact claim this branch removed from the code. -// -// SO THE ENROLLMENT IS CURRENTLY UNREACHABLE, WHICH IS #11194'S SUBJECT AND NOT THIS ROW'S TO -// SETTLE. The enrollment is well-formed and its matching rule is keyed to this path rather than to -// a sentinel, which is the stronger design; what it now lacks is an occurrence, because the arm it -// excepts cannot be reached while the telemetry path refuses. It becomes live again by the same -// trigger that repopulates this row -- evidence identifying the deployment that answered -- so the -// two are discharged together rather than separately. +// THE POPULATION STAYS EMPTY IN THIS PR. Inspect standing can now observe a disable and Absent +// the telemetry path, or refuse Unread/malformed/enabled. Enabled egress -- even at the canonical +// default server -- is not Located and is not admitted. That enrollment is a later policy +// decision; this row does not start counting because of the inspect reader. data provider_path_jurisdiction_unread_admits: RungDrop = RungDrop { identity: "provider_path_jurisdiction_unread_admits" as NonEmptyStr, diff --git a/dag/gunbc/spark/first_party_serving.dag b/dag/gunbc/spark/first_party_serving.dag index b81bc1e1804..5579c93cced 100644 --- a/dag/gunbc/spark/first_party_serving.dag +++ b/dag/gunbc/spark/first_party_serving.dag @@ -1,6 +1,6 @@ module gunbc.spark.first_party_serving -import std.types { NonEmptyStr, List, String } +import std.types { NonEmptyStr, List, String, Bool } import v2.std.optional { Present, Absent } import std.decl_ref { DeclarationRef, decl_ref, decl_field_ref } import std.content_hash { as_content_hash_structural, content_hash_atom } @@ -9,7 +9,7 @@ import product.fabric.identity { FabricIdentity, DemandKey, WorkKey, OfferKey } import product.fabric.provider_route { ProviderRoute, CompliancePostureRevision, ProviderRouteFacts, ProviderDataPathClosure, ProviderPathStanding, ProviderPathLocated, - ProviderPathUnread, + ProviderPathUnread, ProviderPathAbsent, DownstreamProviderPopulation, NoDownstreamProviders, PermittedJurisdictionsEnumerated, JurisdictionDropEnrollment, } @@ -17,7 +17,7 @@ import product.fabric.provider_admission { RouteScopeSanction, ProviderUseScope, ProviderUseAdmission, DispositionStanding, DispositionNotEngaged, admit_provider_use, } -import gunbc.spark.fabric_switch_observed { fabric_lane_observations } +import gunbc.spark.fabric_switch_observed { fabric_lane_observations, fabric_group_wire } import gunbc.spark.vllm_observed { VllmModelsRouteReadbackStanding, ModelsRouteRead, VllmModelsRouteReadback, } @@ -26,13 +26,21 @@ import gunbc.spark.pair_serving_realization { } import extdeps.vllm.usage_stats { VllmUsageStatsLaunchStanding, UsageStatsDisabledByLaunch, UsageStatsEnabledByDefault, - UsageStatsLaunchUnread, VllmUsageStatsContentClass, + UsageStatsLaunchUnread, UsageStatsEnvMalformed, VllmUsageStatsContentClass, ConfigurationAndHardwareMetadataOnly, CarriesRequestMaterial, vllm_usage_stats_reporting, } import gunbc.spark.dgx_procurement { OperatorAllocation } -import gunbc.spark.vllm_endpoint_process_launch { VllmEndpointProcessLaunch } -import gunbc.spark.vllm_serving_launch { EndpointIncarnationStanding } +import gunbc.spark.vllm_endpoint_process_launch { + VllmEndpointProcessLaunch, vllm_endpoint_process_launch_key, +} +import gunbc.spark.vllm_serving_launch { + EndpointIncarnationStanding, EndpointIncarnationObserved, EndpointIncarnationUnobserved, + EndpointIncarnationObservation, launch_wire, same_launch, SameLaunch, DifferentLaunch, LaunchContradiction, +} +import gunbc.spark.serving_incarnation_observe { + ServingUsageStatsObservation, ServingUsageStatsObserved, ServingUsageStatsUnobserved, ServingUsageStatsSubject, +} import gunbc.fleet_physical_inventory { operator_site } import gunbc.fleet_intent_network { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8, @@ -204,7 +212,7 @@ data spark_first_party_use_posture: FirstPartySelfUsePosture = FirstPartySelfUse basis: "The operator asserts that the Spark serving groups serve gunbc itself and nobody else as of this date. Attributable assertion, not a measurement: who the served turns are for is a fact about our intent, which no probe can read off a running engine.", }, serves: "gunbc itself. Every turn placed on this route originates inside this repository's own harness and control plane; no turn is served to any party outside gunbc and none crosses an organisational or national boundary.", - data_subject: "our own material. The prompts and responses on this route are gunbc's, held on operator-owned hardware at the operator's own site; no customer data and no third-party data is processed on it. ROUTE MATERIAL STAYS ON SITE AND EXACTLY ONE PATH LEAVES IT: vLLM reports host, build and engine-configuration metadata to https://stats.vllm.ai by upstream default, carrying no request content (extdeps.vllm.usage_stats). WHETHER THAT PATH IS ACTIVE FOR THIS FLEET'S LAUNCH IS UNESTABLISHED and this row does not assert it: gunbc.spark.first_party_serving spark_serving_usage_stats_standing returns UsageStatsLaunchUnread on every arm, so nothing here establishes that the reporter runs, or that it does not. AND THE REMEDY IS NOT A DECLARATION EDIT. An earlier spelling said zero egress was one environment variable away -- VLLM_NO_USAGE_STATS=1 or DO_NOT_TRACK=1 on the serving launch. This module no longer reads the declared launch environment at all, so setting either changes what the launch is DECLARED to do and changes nothing this decision consults; a reader following that advice would observe no change and have no way to learn why. What resolves the route is the evidence named at spark_serving_usage_stats_declared_environment_obligation.", + data_subject: "our own material. The prompts and responses on this route are gunbc's, held on operator-owned hardware at the operator's own site; no customer data and no third-party data is processed on it. ROUTE MATERIAL STAYS ON SITE AND EXACTLY ONE PATH MAY LEAVE IT: vLLM reports host, build and engine-configuration metadata to https://stats.vllm.ai by upstream default, carrying no request content (extdeps.vllm.usage_stats), unless the answering launch disables that reporter. WHETHER THAT PATH IS ACTIVE FOR A GIVEN LAUNCH is gunbc.spark.first_party_serving spark_serving_usage_stats_standing over inspect stdout bound to the offered incarnation (gunbc.spark.serving_usage_stats_observe). DisabledByLaunch only when a disable term the inspect returned equals exactly 1: the observer takes no marker standing (it observes no marker file), so the marker is Unread by construction and a launch with no disabling env term is UsageStatsLaunchUnread rather than EnabledByDefault. Unread also when inspect stdout was not supplied, the incarnation is unobserved, inspect Id disagrees, or Config/Env is unreadable. EnabledByDefault is reachable only at the extdeps fold with a supplied DoNotTrackMarkerAbsent (fixtures); spark_usage_stats_telemetry_path still maps that standing to ProviderPathUnread (spark_usage_stats_enabled_egress_refused_obligation or spark_usage_stats_unmodeled_destination_obligation), not Located. This row does not assert which arm a live fleet presently takes. AND THE REMEDY IS NOT A DECLARATION EDIT. This module still does not read gunbc.spark.pair_serving_realization spark_pair_container_env; setting VLLM_NO_USAGE_STATS on the declared unit changes what the launch is DECLARED to do and changes nothing this decision consults. What it consults is the inspect projection named at spark_serving_usage_stats_declared_environment_obligation.", hardware_custody: "operator-owned and operator-held. There is no third-party agreement governing this route because there is no third party: no hosting contract, no processor, and no service terms stand between us and the hardware.", } @@ -320,13 +328,13 @@ data spark_prohibited_use_not_engaged: UseProgramStanding = UseProgramStanding { data spark_sanctions_not_engaged: UseProgramStanding = UseProgramStanding { program: "sanctions", engagement: "NOT ENGAGED under first-party self-use. This is NOT a sanctions determination and no screening was performed against any list.", - basis: "NO GOOD, SERVICE OR ROUTE MATERIAL IS SUPPLIED TO ANY PARTY OUTSIDE gunbc ON THIS ROUTE: the turn is served on operator-owned hardware at the operator's own site to gunbc itself, so there is no counterparty to a supply and therefore no party to screen. THE ONE THING THAT REACHES A THIRD PARTY IS NAMED RATHER THAN GLOSSED: vLLM's usage-stats reporter is DOCUMENTED to send host, build and engine-configuration metadata to a service upstream publishes the address of and nothing else about (extdeps.vllm.usage_stats). WHETHER IT DOES SO FOR THIS LAUNCH IS NOT ESTABLISHED and this row does not claim it is: gunbc.spark.first_party_serving spark_usage_stats_telemetry_path returns ProviderPathUnread for every input, because attributing a reporter to the deployment that answered needs evidence bound to that launch and none exists. An earlier spelling said that path was CARRIED as this route's telemetry path; that was true of the fold this change deleted and is false now. THE SANCTIONS CONCLUSION IS UNAFFECTED EITHER WAY, which is why it stands: an emission of machine metadata to a recipient is not a supply of a good, service or route material to a counterparty whether or not it is occurring, it carries no request content, and no screening was performed against any list -- this row records that the program has no subject under first-party self-use, not that anybody was cleared. It acquires a subject the moment a turn is served to anyone else." + basis: "NO GOOD, SERVICE OR ROUTE MATERIAL IS SUPPLIED TO ANY PARTY OUTSIDE gunbc ON THIS ROUTE: the turn is served on operator-owned hardware at the operator's own site to gunbc itself, so there is no counterparty to a supply and therefore no party to screen. THE ONE THING THAT MAY REACH A THIRD PARTY IS NAMED RATHER THAN GLOSSED: vLLM's usage-stats reporter is DOCUMENTED to send host, build and engine-configuration metadata to a service upstream publishes the address of and nothing else about (extdeps.vllm.usage_stats). WHETHER IT DOES SO FOR A LAUNCH is spark_usage_stats_telemetry_path over the inspect standing: Absent when the launch disables the reporter; Unread when inspect was not supplied, marker unread with no disabling env, the reporter is enabled, destination is unmodeled, or standing is malformed. It does not construct ProviderPathLocated for enabled standing in this PR (spark_usage_stats_enabled_egress_refused_obligation). This row does not claim which arm a live fleet presently takes. THE SANCTIONS CONCLUSION IS UNAFFECTED EITHER WAY, which is why it stands: an emission of machine metadata to a recipient is not a supply of a good, service or route material to a counterparty whether or not it is occurring, it carries no request content, and no screening was performed against any list -- this row records that the program has no subject under first-party self-use, not that anybody was cleared. It acquires a subject the moment a turn is served to anyone else." } data spark_export_not_engaged: UseProgramStanding = UseProgramStanding { program: "export control", engagement: "NOT ENGAGED under first-party self-use. This is NOT an export determination, classification or licence finding.", - basis: "NO ROUTE MATERIAL LEAVES gunbc AND NONE CROSSES A NATIONAL BOUNDARY, and the scope of that sentence is the point of it. The turns -- the prompts, the responses, the weights they run against -- begin and end inside gunbc on units at one site, which the operator states is his NYC home (gunbc.spark.first_party_serving spark_fleet_site_allocation). With no transfer of route material and no recipient of it, there is no export of it to classify. WHAT DOES LEAVE, STATED HERE RATHER THAN OMITTED because a basis that ignored it would be contradicted by this module's own route facts: vLLM's usage-stats reporter sends host, build and engine-configuration metadata to a third-party service whose jurisdiction upstream does not document (extdeps.vllm.usage_stats documents that reporter and its payload). WHETHER IT RUNS FOR THIS LAUNCH IS NOT ESTABLISHED, and this basis does not claim it is: gunbc.spark.first_party_serving spark_usage_stats_telemetry_path returns ProviderPathUnread for every input, because attributing a reporter to the deployment that answered needs evidence bound to that launch and none exists, so provider-use admission refuses rather than resolving the route. An earlier spelling of this sentence said that path was carried as Located with an unread jurisdiction; that was true of the fold this change deleted and is false now. THE EXPORT CONCLUSION IS UNAFFECTED EITHER WAY, which is why it stands: the documented payload is host, build and engine configuration, it carries no route material, and an unestablished metadata path is still not an export of route material -- there is no transfer of the thing this program is about, whether or not the reporter is running" + basis: "NO ROUTE MATERIAL LEAVES gunbc AND NONE CROSSES A NATIONAL BOUNDARY, and the scope of that sentence is the point of it. The turns -- the prompts, the responses, the weights they run against -- begin and end inside gunbc on units at one site, which the operator states is his NYC home (gunbc.spark.first_party_serving spark_fleet_site_allocation). With no transfer of route material and no recipient of it, there is no export of it to classify. WHAT MAY LEAVE, STATED HERE RATHER THAN OMITTED because a basis that ignored it would be contradicted by this module's own route facts: vLLM's usage-stats reporter sends host, build and engine-configuration metadata to a third-party service whose jurisdiction upstream does not document (extdeps.vllm.usage_stats documents that reporter and its payload). WHETHER IT RUNS FOR A LAUNCH is spark_usage_stats_telemetry_path: Absent when disabled, Unread when enabled or unread -- not ProviderPathLocated. This basis does not claim which arm a live fleet presently takes. THE EXPORT CONCLUSION IS UNAFFECTED EITHER WAY, which is why it stands: the documented payload is host, build and engine configuration, it carries no route material, and a metadata path is still not an export of route material -- there is no transfer of the thing this program is about, whether or not the reporter is running" } fn spark_prohibited_use_disposition() -> DispositionStanding { @@ -428,8 +436,10 @@ fn spark_first_party_downstream() -> DownstreamProviderPopulation { // to disable it before the disabled arm was reached, and that the standing therefore took the worst // case and assessed reporting as on. None of that is performed any more. spark_lane_disables_usage_stats // is deleted, this module no longer imports spark_pair_container_env, and -// spark_serving_usage_stats_standing returns UsageStatsLaunchUnread on every arm -- so there is no -// disabled arm to reach and nothing is assessed either way. +// spark_serving_usage_stats_standing consults gunbc.spark.serving_usage_stats_observe over inspect +// stdout bound to the offered incarnation -- not the declared unit environment. Setting a disable +// term on spark_pair_container_env still changes only the declaration. Setting it on the running +// container, then supplying that inspect stdout, is what the standing reads. // // THEY WERE ALSO WRONG IN THE DIRECTION THAT MATTERS, which is why this note stays instead of the // text simply vanishing. Each one told a reader that setting VLLM_NO_USAGE_STATS=1 or DO_NOT_TRACK=1 @@ -480,9 +490,12 @@ fn spark_first_party_downstream() -> DownstreamProviderPopulation { // takes that standing from gunbc.spark.serving_incarnation_observe -- the producer that binds the // answering endpoint to an engine launch over the fleet key session -- so it carries // EndpointIncarnationObserved on a bind that observed and EndpointIncarnationUnobserved (with the -// specific cause) on one that did not. Only -// gunbc.spark.serving_offer spark_serving_route_standing reads them. The telemetry standing does not, -// and should not: knowing which incarnation answered is not a reading of its effective environment. +// specific cause) on one that did not. gunbc.spark.serving_offer spark_serving_route_standing reads +// it for the route; the telemetry standing reads it only through +// spark_incarnation_observation_agreement -- the same endpoint/group/hosts join +// spark_service_from_observation consumes -- so a usage-stats observation is bound to +// observation.launch only once that join agrees, and a foreign endpoint cannot Absent the path. +// Knowing which incarnation answered is still not a reading of its effective environment. type SparkServingRealization { hosts: List readback: VllmModelsRouteReadbackStanding @@ -490,6 +503,42 @@ type SparkServingRealization { incarnation: EndpointIncarnationStanding } +// THE SAME TWO CHECKS SPARK_SERVICE_FROM_OBSERVATION RUNS before it will name a service. +// An observation is about a process; inspect of that observation's container_id is not +// evidence about a different answering endpoint. Disagreement is unread, never Absent. +type SparkIncarnationObservationAgreement + = ObservationAgreesWithThisRealization + | ObservationNamesAnotherEndpoint { observed: NonEmptyStr, answering: NonEmptyStr } + | ObservationIncarnationOutsideRealization { incarnation: NonEmptyStr } + +fn spark_incarnation_observation_agreement( + realization: SparkServingRealization, + observation: EndpointIncarnationObservation, +) -> SparkIncarnationObservationAgreement { + let observed_key = vllm_endpoint_process_launch_key(launch: observation.endpoint) + let answering_key = vllm_endpoint_process_launch_key(launch: realization.endpoint) + if (observed_key as String) != (answering_key as String) { + ObservationNamesAnotherEndpoint { observed: observed_key, answering: answering_key } + } else if (fabric_group_wire(g: observation.launch.group) as String) != (fabric_group_wire(g: realization.endpoint.group) as String) + || !any(realization.hosts, h => host_identity_eq(a: h, b: observation.launch.head)) { + ObservationIncarnationOutsideRealization { incarnation: launch_wire(i: observation.launch) as NonEmptyStr } + } else { + ObservationAgreesWithThisRealization + } +} + +fn spark_incarnation_observation_unread_obligation( + agreement: SparkIncarnationObservationAgreement, +) -> NonEmptyStr { + match agreement { + ObservationAgreesWithThisRealization => + "spark_incarnation_observation_unread_obligation is not an agree-arm obligation" as NonEmptyStr + ObservationNamesAnotherEndpoint { observed: ob, answering: an } => + join(["the incarnation observation is about endpoint process ", ob as String, ", not the process that answered this route, ", an as String], "") as NonEmptyStr + ObservationIncarnationOutsideRealization { incarnation: i } => + join(["the observed incarnation ", i as String, " is not on this realization's group and hosts"], "") as NonEmptyStr + } +} fn spark_realization_hosts_without_lanes(realization: SparkServingRealization) -> List { filter( @@ -578,35 +627,21 @@ data spark_serving_usage_stats_unread_obligation: NonEmptyStr = "gunbc.spark.fir // refusal asks for is a re-assessment of the route, not a smaller repair: a reporter carrying // request material is route material leaving the site, which is the premise the first-party posture // rests on. -data spark_usage_stats_carrying_request_material_obligation: NonEmptyStr = "extdeps.vllm.usage_stats vllm_usage_stats_reporting now reports CarriesRequestMaterial at its cited source revision, so vLLM's usage-stats reporter no longer carries only host, build and engine configuration. The first-party posture rests on route material staying on site and this is route material leaving it, so the route's telemetry path is unresolved and provider-use admission refuses as ProviderRouteFactsIncomplete. The remedy is NOT to edit the declared launch environment: this module no longer reads gunbc.spark.pair_serving_realization spark_pair_container_env at all, so setting VLLM_NO_USAGE_STATS=1 or DO_NOT_TRACK=1 there changes what the launch is declared to do and changes nothing this decision consults. What resolves the route is evidence of the effective telemetry configuration of the process that answered (spark_serving_usage_stats_declared_environment_obligation); the alternative is to re-assess the posture with the operator, whose 2026-09-11 ruling admitted this path ON the condition that the payload stay metadata-only. Neither remedy makes the telemetry path Absent while the environment is declared rather than read: see spark_serving_usage_stats_declared_environment_obligation." - -// WHY NO ARM OF THIS STANDING MAY LOCATE A PROVIDER PATH, WHICH IS A REPAIR OF THIS PR'S OWN -// DEFECT RATHER THAN OF INHERITED CODE. Until this change the metadata-only arm produced -// ProviderPathLocated, and product.fabric.provider_route first_unresolved_obligation counts a -// Located path as RESOLVED -- so a route whose reported model path matched the declared one, on a -// fully lane-covered host population, ADMITTED. The environment that answer rested on is -// gunbc.spark.pair_serving_realization spark_pair_container_env, which is the environment a -// container is CREATED WITH: a construction, not a reading of a running process. So admission was -// resting on an environment nobody observed THIS deployment to have, which is the fabricated -// evidence this module exists to refuse. -// -// THE TWO HALVES INTERLOCK AND THAT IS WHY NARROWING THE IDENTITY JOIN WOULD NOT HAVE DISCHARGED -// IT. A declared environment is legitimate evidence about a process only once it is established -// that this process was created by that launch; that is exactly the question spark_realization_identity -// leaves open, since matching a configuration is not being the launch that configuration describes. -// Adding comparisons to the join makes the match narrower without making the attribution licensed, -// so every arm refuses while the environment is declared rather than read. -data spark_serving_usage_stats_declared_environment_obligation: NonEmptyStr = "gunbc.spark.first_party_serving: the only environment this repository holds for a serving container is the one gunbc.spark.pair_serving_realization spark_pair_container_env declares it is CREATED with, and no producer anywhere in the corpus reads the environment of a container that is already running. So whether this deployment's reporter is disabled is unknown for THIS deployment, however well its declared configuration matches. THE CAPABILITY THAT DISCHARGES THIS, and nothing smaller does: a reading of the EFFECTIVE TELEMETRY CONFIGURATION OF THE PROCESS THAT ANSWERED, bound to the offered launch, covering BOTH whether the reporter runs AND WHERE IT SENDS. The destination is not a detail: extdeps.vllm.usage_stats vllm_usage_stats_reporting carries server_override_env VLLM_USAGE_STATS_SERVER beside its default_server, so a launch matching our declared model path, served name and context length can still be reporting to a DIFFERENT RECIPIENT, and a payload that stays metadata-only says nothing about who receives it. A second construction function, a wider configuration comparison, or a restatement of the declared environment does NOT discharge it, because none of them observes the process; what is missing is a reading, not a better declaration. THE READING NEEDS ACCESS NOBODY HOLDS: the serving container gunbc.spark.pair_serving_realization spark_pair_container_name is readable only through the docker socket, and the one principal that reaches the Sparks holds no grant to it, so the reader cannot run until gunbc.spark.managed_access_bootstrap InspectServingContainer is installed through gunbc.spark.managed_grant_install. That grant yields Config.Env of the container, which is the environment docker exec hands vllm serve because the pair realization execs it with no added environment; it is still a reading of the container rather than of the process, so the destination half of this obligation stays a claim about the container until a process-grain read exists. Note also that the content class it would be read against is itself bound to a revision by that module's established_against, so it is a fact about the vLLM source that was read and not a timeless property of anything presenting a vLLM-compatible response." +data spark_usage_stats_carrying_request_material_obligation: NonEmptyStr = "extdeps.vllm.usage_stats vllm_usage_stats_reporting now reports CarriesRequestMaterial at its cited source revision, so vLLM's usage-stats reporter no longer carries only host, build and engine configuration. The first-party posture rests on route material staying on site and this is route material leaving it, so the route's telemetry path is unresolved and provider-use admission refuses as ProviderRouteFactsIncomplete. The remedy is NOT to edit the declared launch environment: this module still does not read gunbc.spark.pair_serving_realization spark_pair_container_env, so setting VLLM_NO_USAGE_STATS=1 or DO_NOT_TRACK=1 there changes what the launch is declared to do and changes nothing this decision consults. What the standing consults is gunbc.spark.serving_usage_stats_observe over inspect stdout bound to the offered launch. The alternative is to re-assess the posture with the operator, whose 2026-09-11 ruling admitted this path ON the condition that the payload stay metadata-only." + +// A DECLARED ENVIRONMENT STILL MAY NOT LOCATE A PROVIDER PATH. Until the inspect producer, the +// metadata-only arm produced ProviderPathLocated from spark_pair_container_env, which is the +// environment a container is CREATED WITH. That is the fabricated evidence this module refuses. +// Matching reported configuration is still not being the launch. What locates or absents the +// path now is inspect stdout bound to the offered incarnation, not that declaration. +data spark_serving_usage_stats_declared_environment_obligation: NonEmptyStr = "gunbc.spark.first_party_serving: the declared unit environment gunbc.spark.pair_serving_realization spark_pair_container_env is still not consulted, because a construction is not a reading of the answering process. THE PRODUCER THAT READS THE RUNNING CONTAINER is gunbc.spark.serving_incarnation_observe (the one authorized inspect, whose stdout it hands to gunbc.spark.serving_usage_stats_observe spark_serving_usage_stats_decode over docker_container_inspect_named_env_from_stdout), projecting only the names from extdeps.vllm.usage_stats vllm_usage_stats_inspect_env_names -- VLLM_NO_USAGE_STATS, VLLM_DO_NOT_TRACK, DO_NOT_TRACK and VLLM_USAGE_STATS_SERVER -- bound to the offered VllmServingLaunch container_id. spark_serving_usage_stats_unread_cause must agree the realization with the declared pair-serving configuration and host-lane coverage before that inspect may Absent the path. Unread is when that cause is not TelemetryConfigurationMatchedButUnread, inspect stdout was not supplied (spark_usage_stats_inspect_unread_obligation), the incarnation is unobserved, or inspect Id disagrees with that container_id. A second construction function or a restatement of the declared environment does NOT substitute for that inspect. THE READING IS AUTHORIZED BY gunbc.spark.managed_access_bootstrap InspectServingContainer; until that grant is used to supply stdout, standing stays Unread. The destination half is the inspect projection of VLLM_USAGE_STATS_SERVER or the upstream default_server; it is still a reading of the container rather than of the process. The content class it is read against is bound to a revision by that module's established_against." data spark_serving_usage_stats_unobserved_hosts_obligation: NonEmptyStr = "gunbc.spark.first_party_serving: one or more hosts of the realization that answered has no observed fabric lane, so the telemetry answer would rest on its siblings. Partial evidence is missing evidence, and this arm refuses rather than answering from the observed half. READING THOSE LANES IS NECESSARY AND IS NOT SUFFICIENT: an earlier spelling ended by asking for them as though the path would then resolve. A fully lane-covered realization still refuses, because a lane's DECLARED container environment is not a reading of the process that answered -- see spark_serving_usage_stats_declared_environment_obligation." -// WHY THE CAUSE IS A VALUE AND THE SENTENCE IS DERIVED FROM IT. Every arm of this standing refuses, -// and extdeps.vllm.usage_stats gives the refusal one shape -- UsageStatsLaunchUnread carrying a -// String -- because that is upstream's vocabulary for "we did not read it" and is not ours to -// reshape. Six materially different situations were therefore collapsing into one arm distinguished -// only by the prose inside it, and the consequence showed up in this change's own witnesses: they -// separated the causes with string_contains, which is validation standing exactly where -// construction was available. A case mismatch in that pattern cost a floor run on this branch. +// WHY THE CAUSE IS A VALUE AND THE SENTENCE IS DERIVED FROM IT. The identity-join unread classifier +// still refuses every arm of SparkTelemetryUnreadCause, and extdeps.vllm.usage_stats gives the +// unread standing one shape -- UsageStatsLaunchUnread carrying a String -- because that is +// upstream's vocabulary for "we did not read it". The inspect standing is a different fold. // // SO THE CAUSE IS TYPED, THE OBLIGATION IS RENDERED FROM IT, and a consumer that needs to know WHY // matches a variant rather than grepping a sentence. This is the ceiling the @@ -662,42 +697,133 @@ fn spark_telemetry_unread_obligation(cause: SparkTelemetryUnreadCause) -> NonEmp } } -fn spark_serving_usage_stats_standing(realization: SparkServingRealization) -> VllmUsageStatsLaunchStanding { - UsageStatsLaunchUnread { - obligation: spark_telemetry_unread_obligation( - cause: spark_serving_usage_stats_unread_cause(realization: realization), - ), +// THE IDENTITY JOIN PRECEDES INSPECT ATTRIBUTION. Inspect of a container_id is not a reading of +// which declared configuration answered: a GLM engine and a pair-serving engine can share a +// container Id in a fixture, and attributing pair-serving telemetry to the GLM readback is the +// inheritance this module withdrew. spark_serving_usage_stats_unread_cause must refuse +// TelemetryReportedPathDiffers (and the other unresolved identity arms) before +// the observation's standing may Absent the path. POLICY RECEIVES ONLY THE TYPED +// ServingUsageStatsObservation: raw inspect stdout is consumed and discarded inside the host operation +// gunbc.spark.serving_incarnation_observe, the only mint of the sealed evidence, and the observation +// must name the same launch and container as the agreed incarnation observation. +fn spark_serving_usage_stats_standing( + realization: SparkServingRealization, + usage_stats: ServingUsageStatsObservation, +) -> VllmUsageStatsLaunchStanding { + match usage_stats { + ServingUsageStatsUnobserved { obligation: o } => { + let cause = spark_serving_usage_stats_unread_cause(realization: realization) + match cause { + TelemetryConfigurationMatchedButUnread { configured_model_path: _ } => UsageStatsLaunchUnread { obligation: o } + TelemetryReadbackUnresolved => UsageStatsLaunchUnread { obligation: spark_telemetry_unread_obligation(cause: cause) } + TelemetryDeclaredPathUnpinned => UsageStatsLaunchUnread { obligation: spark_telemetry_unread_obligation(cause: cause) } + TelemetryReportedPathDiffers { reported: _, declared: _ } => UsageStatsLaunchUnread { obligation: spark_telemetry_unread_obligation(cause: cause) } + TelemetryNoHostMembership => UsageStatsLaunchUnread { obligation: spark_telemetry_unread_obligation(cause: cause) } + TelemetryHostsWithoutObservedLanes => UsageStatsLaunchUnread { obligation: spark_telemetry_unread_obligation(cause: cause) } + } + } + ServingUsageStatsObserved { evidence: ev } => + spark_serving_usage_stats_standing_of_subject(realization: realization, subject: ev.subject) + } +} + +// THE JOIN IS A FOLD OVER THE SUBJECT, SEPARATE FROM THE SEAL. What policy consumes is the sealed +// evidence above, minted only by the inspect operation; what this fold decides is whether a subject +// -- a launch, a standing, a receipt -- is a reading of the incarnation that answered this +// realization. Keeping the fold at the subject grain is what lets its refusal arms be driven by +// witnesses with authored subjects (turnover, contradiction, foreign endpoint, foreign hosts, +// unmatched readback) without any of them being able to mint the evidence admission consumes. +fn spark_serving_usage_stats_standing_of_subject( + realization: SparkServingRealization, + subject: ServingUsageStatsSubject, +) -> VllmUsageStatsLaunchStanding { + let cause = spark_serving_usage_stats_unread_cause(realization: realization) + match cause { + TelemetryReadbackUnresolved => + UsageStatsLaunchUnread { obligation: spark_telemetry_unread_obligation(cause: cause) } + TelemetryDeclaredPathUnpinned => + UsageStatsLaunchUnread { obligation: spark_telemetry_unread_obligation(cause: cause) } + TelemetryReportedPathDiffers { reported: _, declared: _ } => + UsageStatsLaunchUnread { obligation: spark_telemetry_unread_obligation(cause: cause) } + TelemetryNoHostMembership => + UsageStatsLaunchUnread { obligation: spark_telemetry_unread_obligation(cause: cause) } + TelemetryHostsWithoutObservedLanes => + UsageStatsLaunchUnread { obligation: spark_telemetry_unread_obligation(cause: cause) } + TelemetryConfigurationMatchedButUnread { configured_model_path: _ } => + match realization.incarnation { + EndpointIncarnationUnobserved { obligation: o } => + UsageStatsLaunchUnread { obligation: o } + EndpointIncarnationObserved { observation: obs } => + match spark_incarnation_observation_agreement(realization: realization, observation: obs) { + ObservationAgreesWithThisRealization => + match same_launch(a: subject.launch, b: obs.launch) { + SameLaunch => subject.standing + DifferentLaunch { left: _, right: _ } => + UsageStatsLaunchUnread { obligation: spark_usage_stats_observation_names_another_launch_obligation } + LaunchContradiction { invocation: _, field: f } => + UsageStatsLaunchUnread { obligation: join([spark_usage_stats_observation_contradicts_launch_obligation as String, " (field: ", f as String, ")"], "") as NonEmptyStr } + } + ObservationNamesAnotherEndpoint { observed: ob, answering: an } => + UsageStatsLaunchUnread { + obligation: spark_incarnation_observation_unread_obligation( + agreement: ObservationNamesAnotherEndpoint { observed: ob, answering: an }, + ), + } + ObservationIncarnationOutsideRealization { incarnation: i } => + UsageStatsLaunchUnread { + obligation: spark_incarnation_observation_unread_obligation( + agreement: ObservationIncarnationOutsideRealization { incarnation: i }, + ), + } + } + } } } -// THE LOCATED ARM IS RETAINED AND IS CURRENTLY UNREACHABLE, DELIBERATELY AND ON THE RECORD. It is -// the right answer for an ESTABLISHED applicable reporter, and the operator's 2026-09-11 ruling -// governs exactly that case: a metadata-only reporter may be admitted despite its undocumented -// jurisdiction. That ruling is not withdrawn here and this change does not overturn it. What the -// ruling never established is the different claim this module was making -- that because ONE upstream -// reporter is documented metadata-only, the telemetry path OF THE LAUNCH THAT ANSWERED is therefore -// established. Attribution is the defect; the located answer is not. -// -// SO NOTHING REACHES THIS ARM TODAY, because spark_serving_usage_stats_standing no longer claims a -// launch is reporting or not reporting from facts about what we declared. It becomes reachable again -// when an admission path carries evidence of the effective telemetry configuration bound to the -// offered launch. The empty population this leaves is recorded where a reader looks for it, at -// gunbc.rung_drop.provider_path_jurisdiction_unread_admits, as EMPTY PENDING that evidence rather -// than as a deleted subject -- the distinction matters, because a drop recorded as deleted would make -// the ruling silently unreachable while its own record went on claiming otherwise. -fn spark_usage_stats_telemetry_path(realization: SparkServingRealization) -> ProviderPathStanding { - match spark_serving_usage_stats_standing(realization: realization) { +// The subject-grain telemetry path, for the same reason: the join's consequences for the path +// (Absent only on a disabled standing of the answering launch; Unread otherwise) are claimed here +// with authored subjects, while spark_usage_stats_telemetry_path takes only sealed evidence. +fn spark_usage_stats_telemetry_path_of_subject( + realization: SparkServingRealization, + subject: ServingUsageStatsSubject, +) -> ProviderPathStanding { + spark_usage_stats_path_from_launch_standing( + standing: spark_serving_usage_stats_standing_of_subject(realization: realization, subject: subject), + ) +} + +data spark_usage_stats_observation_contradicts_launch_obligation: NonEmptyStr = "gunbc.spark.first_party_serving: the usage-stats observation and the incarnation observation name the same launch invocation but disagree about its identity, so neither reading is trusted and the telemetry path stays unread" as NonEmptyStr + +data spark_usage_stats_observation_names_another_launch_obligation: NonEmptyStr = "gunbc.spark.first_party_serving: the usage-stats observation is bound to a launch or container other than the incarnation observed answering this route, so its standing is not a reading of the answering process and cannot Absent the telemetry path." as NonEmptyStr + +data spark_usage_stats_enabled_egress_refused_obligation: NonEmptyStr = "gunbc.spark.first_party_serving: inspect standing shows the usage-stats reporter enabled (metadata-only, destination either the upstream default or an explicit VLLM_USAGE_STATS_SERVER). THIS PR DOES NOT ADMIT THAT EGRESS. Enabled-telemetry admission is a separate operator policy decision; until it is taken, spark_usage_stats_telemetry_path stays ProviderPathUnread rather than ProviderPathLocated, and gunbc.rung_drop.provider_path_jurisdiction_unread_admits population stays empty. Setting a disable term to exactly 1 on the answering container, then supplying that inspect, is the arm that absents the path." as NonEmptyStr + +data spark_usage_stats_unmodeled_destination_obligation: NonEmptyStr = "gunbc.spark.first_party_serving: VLLM_USAGE_STATS_SERVER is set to a nonempty URL that is not extdeps.vllm.usage_stats vllm_usage_stats_reporting.default_server. That recipient is unmodeled: it must not inherit the default-service operator, jurisdiction, or jurisdiction-drop enrollment. The path is ProviderPathUnread." as NonEmptyStr + +// THE LOCATED ARM IS NOT TAKEN IN THIS PR. An observed disable (exact-1 env term or a present +// marker) absents the path. Enabled standing -- even at the canonical default server -- stays +// Unread. An override destination stays Unread on its own obligation so it cannot wear the default +// row. Marker unread with no disabling env is Unread. Attribution is inspect bound to the offered +// incarnation, not spark_pair_container_env. +fn spark_usage_stats_path_from_launch_standing( + standing: VllmUsageStatsLaunchStanding, +) -> ProviderPathStanding { + match standing { UsageStatsLaunchUnread { obligation: _ } => ProviderPathUnread { obligation: decl_ref(module_path: "gunbc.spark.first_party_serving", decl_name: "spark_serving_usage_stats_standing"), consulted: [], } - UsageStatsDisabledByLaunch { mechanism: _ } => + UsageStatsEnvMalformed { cause: _ } => ProviderPathUnread { - obligation: decl_ref(module_path: "gunbc.spark.first_party_serving", decl_name: "spark_serving_usage_stats_declared_environment_obligation"), + obligation: decl_ref(module_path: "gunbc.spark.first_party_serving", decl_name: "spark_serving_usage_stats_standing"), consulted: [], } - UsageStatsEnabledByDefault { basis: _ } => + UsageStatsDisabledByLaunch { mechanism: _ } => + ProviderPathAbsent { + evidence: decl_ref(module_path: "gunbc.spark.first_party_serving", decl_name: "spark_serving_usage_stats_standing"), + } + UsageStatsEnabledByDefault { basis: _, destination: d } => match vllm_usage_stats_reporting.content_class { CarriesRequestMaterial => ProviderPathUnread { @@ -705,21 +831,39 @@ fn spark_usage_stats_telemetry_path(realization: SparkServingRealization) -> Pro consulted: [], } ConfigurationAndHardwareMetadataOnly => - ProviderPathLocated { - operator: decl_ref(module_path: "extdeps.vllm.usage_stats", decl_name: "vllm_usage_stats_reporting"), - jurisdiction: decl_field_ref(module_path: "extdeps.vllm.usage_stats", decl_name: "vllm_usage_stats_reporting", field_name: "service_jurisdiction"), - evidence: decl_ref(module_path: "gunbc.spark.first_party_serving", decl_name: "spark_serving_usage_stats_standing"), + if (d as String) == (vllm_usage_stats_reporting.default_server as String) { + ProviderPathUnread { + obligation: decl_ref(module_path: "gunbc.spark.first_party_serving", decl_name: "spark_usage_stats_enabled_egress_refused_obligation"), + consulted: [], + } + } else { + ProviderPathUnread { + obligation: decl_ref(module_path: "gunbc.spark.first_party_serving", decl_name: "spark_usage_stats_unmodeled_destination_obligation"), + consulted: [], + } } } } } +fn spark_usage_stats_telemetry_path( + realization: SparkServingRealization, + usage_stats: ServingUsageStatsObservation, +) -> ProviderPathStanding { + spark_usage_stats_path_from_launch_standing( + standing: spark_serving_usage_stats_standing(realization: realization, usage_stats: usage_stats), + ) +} + // THE observed_at DATE IS THE ASSERTION'S, AT DATE GRAIN. ProviderRouteFacts takes a Timestamp and // these facts rest on a statement made on a DAY, so the time of day carries nothing and must not be // read as a moment anybody measured; the midnight is the date-grain convention already used by // gunbc.instruments.fabric_control_plane_live_probe, not a reading. The field is named for an // observation because most routes are observed; this one says in every other line that it is not. -fn spark_first_party_route_facts(realization: SparkServingRealization) -> ProviderRouteFacts { +fn spark_first_party_route_facts( + realization: SparkServingRealization, + usage_stats: ServingUsageStatsObservation, +) -> ProviderRouteFacts { ProviderRouteFacts { route: spark_first_party_route(), contract_terms: decl_ref(module_path: "gunbc.spark.first_party_serving", decl_name: "spark_operator_owned_hardware_agreement"), @@ -728,7 +872,7 @@ fn spark_first_party_route_facts(realization: SparkServingRealization) -> Provid durable_storage: spark_first_party_path(), backups: spark_first_party_path(), logs: spark_first_party_path(), - telemetry: spark_usage_stats_telemetry_path(realization: realization), + telemetry: spark_usage_stats_telemetry_path(realization: realization, usage_stats: usage_stats), control_plane: spark_first_party_path(), support_access: spark_first_party_path(), administrative_access: spark_first_party_path(), @@ -776,12 +920,13 @@ fn spark_first_party_use_scope

( // test.claim.spark.spark_first_party_serving_witness_test exercises both arms directly. fn spark_first_party_admission

( realization: SparkServingRealization, + usage_stats: ServingUsageStatsObservation, scope: ProviderUseScope

, offer: FabricIdentity, ) -> ProviderUseAdmission

{ admit_provider_use( roster: spark_first_party_sanction_roster(), - facts: spark_first_party_route_facts(realization: realization), + facts: spark_first_party_route_facts(realization: realization, usage_stats: usage_stats), active: spark_first_party_posture, scope: scope, offer: offer, diff --git a/dag/gunbc/spark/serving_incarnation_observe.dag b/dag/gunbc/spark/serving_incarnation_observe.dag index 818d326c577..750528bb165 100644 --- a/dag/gunbc/spark/serving_incarnation_observe.dag +++ b/dag/gunbc/spark/serving_incarnation_observe.dag @@ -18,6 +18,8 @@ import gunbc.spark.vllm_serving_launch { } import gunbc.spark.pair_serving_realization { spark_pair_container_name, spark_pair_head_unit_name } import gunbc.spark.managed_access_bootstrap { InspectServingContainer, spark_managed_grant_argv, spark_managed_grant_wire } +import extdeps.vllm.usage_stats { VllmUsageStatsLaunchStanding } +import gunbc.spark.serving_usage_stats_observe { spark_serving_usage_stats_decode, spark_usage_stats_inspect_unread_obligation } import extdeps.docker.images.sparkrun_vllm_ds4_gb10 { sparkrun_vllm_ds4_gb10_vllm_binary } import extdeps.crypto.hash { sha256sum_line_digest, sha256_digest_content_hash } import extdeps.docker.cli { @@ -113,8 +115,36 @@ type ServingIncarnationRefusal | IncarnationImageIdNotSha256 { image_id: NonEmptyStr } | IncarnationStartBeforeEpoch { seconds: Int } +// ONE INSPECT, TWO PROJECTIONS, AND THE SEALED ONE IS MINTED HERE. The authorized `docker container +// inspect` this operation executes returns the whole container object (Config.Env included, which +// can carry secrets). Its raw stdout exists only inside incarnation_after_container: the identity +// projection (.Id/.Image) is taken there, the usage-stats projection (the four named env terms, +// gunbc.spark.serving_usage_stats_observe spark_serving_usage_stats_decode) is taken there from the +// same bytes, and the document dies with the call. ServingUsageStatsEvidence is a sole-constructor +// record and this module is its only mint, from that stdout and the launch this operation just +// bound -- so a Disabled standing policy may act on cannot be authored from caller-chosen JSON +// anywhere (side-chat ruling 2026-09-16). The decoder itself is exported and unsealed; what it +// returns is only a standing over whatever bytes it was given. +type ServingUsageStatsSubject { + launch: VllmServingLaunch + standing: VllmUsageStatsLaunchStanding + receipt: ObservationReceiptRef +} + +type ServingUsageStatsEvidence sole_constructor { + subject: ServingUsageStatsSubject +} + +type ServingUsageStatsObservation + = ServingUsageStatsObserved { evidence: ServingUsageStatsEvidence } + | ServingUsageStatsUnobserved { obligation: NonEmptyStr } + +fn spark_usage_stats_inspect_unread() -> ServingUsageStatsObservation { + ServingUsageStatsUnobserved { obligation: spark_usage_stats_inspect_unread_obligation } +} + type ServingIncarnationReading - = IncarnationObserved { observation: EndpointIncarnationObservation } + = IncarnationObserved { observation: EndpointIncarnationObservation, usage_stats: ServingUsageStatsObservation } | IncarnationRefused { refusal: ServingIncarnationRefusal } data serving_incarnation_receipt: ObservationReceiptRef = "gunbc.spark.serving_incarnation_observe" as ObservationReceiptRef @@ -160,9 +190,22 @@ fn serving_incarnation_refusal_text(r: ServingIncarnationRefusal) -> String { } } +// The usage-stats projection of a reading: sealed evidence on the observed arm, Unobserved with +// the operation's refusal on every other, so a consumer holding an unobserved incarnation also +// holds an unread telemetry path rather than a default. +fn endpoint_incarnation_usage_stats(reading: ServingIncarnationReading) -> ServingUsageStatsObservation { + match reading { + IncarnationObserved { observation: _, usage_stats: u } => u + IncarnationRefused { refusal: r } => + ServingUsageStatsUnobserved { + obligation: join(["gunbc.spark.serving_incarnation_observe refused before the inspect projection: ", serving_incarnation_refusal_text(r: r)], "") as NonEmptyStr, + } + } +} + fn endpoint_incarnation_standing(reading: ServingIncarnationReading) -> EndpointIncarnationStanding { match reading { - IncarnationObserved { observation: o } => EndpointIncarnationObserved { observation: o } + IncarnationObserved { observation: o, usage_stats: _ } => EndpointIncarnationObserved { observation: o } IncarnationRefused { refusal: r } => EndpointIncarnationUnobserved { obligation: join(["gunbc.spark.serving_incarnation_observe refused: ", serving_incarnation_refusal_text(r: r)], "") as NonEmptyStr, @@ -322,22 +365,33 @@ fn incarnation_after_container( Present { value: hex } => match sha256_hex_digest(hex: hex) { Absent => IncarnationRefused { refusal: IncarnationImageIdNotSha256 { image_id: image_id } } - Present { value: digest } => + Present { value: digest } => { + let launch = vllm_serving_launch( + group: group, + head: head, + systemd_invocation: invocation, + container_id: container_id, + executable_digest: Sha256Hash(digest), + unit_digest: unit_digest, + started_at: started_at, + ) IncarnationObserved { observation: endpoint_incarnation_observation( endpoint: endpoint, - launch: vllm_serving_launch( - group: group, - head: head, - systemd_invocation: invocation, - container_id: container_id, - executable_digest: Sha256Hash(digest), - unit_digest: unit_digest, - started_at: started_at, - ), + launch: launch, receipt: serving_incarnation_receipt, ), + usage_stats: ServingUsageStatsObserved { + evidence: ServingUsageStatsEvidence { + subject: ServingUsageStatsSubject { + launch: launch, + standing: spark_serving_usage_stats_decode(launch: launch, inspect_stdout: r.stdout), + receipt: serving_incarnation_receipt, + }, + }, + }, } + } } } } diff --git a/dag/gunbc/spark/serving_offer.dag b/dag/gunbc/spark/serving_offer.dag index 8c5dde8b0a2..9fd30dbc8db 100644 --- a/dag/gunbc/spark/serving_offer.dag +++ b/dag/gunbc/spark/serving_offer.dag @@ -19,6 +19,10 @@ import gunbc.spark.first_party_serving { spark_realization_identity, SparkRealizationIdentity, RealizationMatchesPairServingConfiguration, RealizationReportedPathDiffers, RealizationDeclaredPathUnpinned, RealizationReadbackUnresolved, + spark_incarnation_observation_agreement, + ObservationAgreesWithThisRealization, ObservationNamesAnotherEndpoint, + ObservationIncarnationOutsideRealization, + spark_incarnation_observation_unread_obligation, } import gunbc.spark.vllm_endpoint_process_launch { VllmEndpointProcessLaunch, vllm_endpoint_process_launch_key, vllm_endpoint_process_launch_is, @@ -27,14 +31,13 @@ import gunbc.spark.vllm_serving_launch { EndpointIncarnationObservation, EndpointIncarnationObserved, EndpointIncarnationUnobserved, LaunchUnitProvenance, LaunchedFromDeclaredUnit, LaunchedFromDifferentUnit, LaunchUnitDigestsIncomparable, - launch_unit_provenance, launch_wire, + launch_unit_provenance, } import gunbc.spark.pair_serving_realization { spark_pair_head_unit_name, DeclaredUnitDigestStanding, DeclaredUnitDigested, DeclaredUnitDigestUnavailable, } import std.content_hash { ContentHash, serialize_content_hash } -import product.placement_supply { host_identity_eq } import gunbc.serving.serving_availability { ServingAvailability, ServingFrontDoorAvailabilityVerdict, ServingAvailable, ServingUnavailable, ServingAvailabilityUnread, serving_availability_text, } @@ -358,9 +361,13 @@ fn spark_service_identity_cause_text(cause: SparkServiceIdentityCause, realizati ServiceIncarnationUnobserved { configuration: _, obligation: o } => join([o as String, ". The readback, which cannot identify the deployment on its own, reports: ", spark_realization_identity_cause(realization: realization) as String], "") ServiceObservationNamesAnotherEndpoint { observed: ob, answering: an } => - join(["the incarnation observation is about endpoint process ", ob as String, ", not the process that answered this route, ", an as String], "") + spark_incarnation_observation_unread_obligation( + agreement: ObservationNamesAnotherEndpoint { observed: ob, answering: an }, + ) as String ServiceIncarnationOutsideRealization { incarnation: i } => - join(["the observed incarnation ", i as String, " is not on this realization's group and hosts"], "") + spark_incarnation_observation_unread_obligation( + agreement: ObservationIncarnationOutsideRealization { incarnation: i }, + ) as String ServiceDeclaredUnitDigestUnavailable { obligation: o } => o as String ServiceIncarnationNotFromDeclaredUnit { provenance: p } => spark_launch_unit_provenance_text(provenance: p) ServiceConfigurationDisagrees { configuration: _ } => @@ -391,32 +398,30 @@ fn spark_configuration_matches(identity: SparkRealizationIdentity) -> Bool { } fn spark_service_from_observation(realization: SparkServingRealization, declared: ContentHash, observation: EndpointIncarnationObservation) -> SparkServingRoute { - let observed_key = vllm_endpoint_process_launch_key(launch: observation.endpoint) - let answering_key = vllm_endpoint_process_launch_key(launch: realization.endpoint) - if (observed_key as String) != (answering_key as String) { - spark_service_unidentified(realization: realization, cause: ServiceObservationNamesAnotherEndpoint { observed: observed_key, answering: answering_key }) - } else if (fabric_group_wire(g: observation.launch.group) as String) != (fabric_group_wire(g: realization.endpoint.group) as String) - || !any(realization.hosts, h => host_identity_eq(a: h, b: observation.launch.head)) { - spark_service_unidentified(realization: realization, cause: ServiceIncarnationOutsideRealization { incarnation: launch_wire(i: observation.launch) as NonEmptyStr }) - } else { - match launch_unit_provenance(launch: observation.launch, declared: declared) { - LaunchedFromDifferentUnit { observed: o, declared: d } => - spark_service_unidentified(realization: realization, cause: ServiceIncarnationNotFromDeclaredUnit { provenance: LaunchedFromDifferentUnit { observed: o, declared: d } }) - LaunchUnitDigestsIncomparable => - spark_service_unidentified(realization: realization, cause: ServiceIncarnationNotFromDeclaredUnit { provenance: LaunchUnitDigestsIncomparable }) - LaunchedFromDeclaredUnit { declared: _ } => { - let identity = spark_realization_identity(realization: realization) - if spark_configuration_matches(identity: identity) { - ServingRouteOperatorAsserted { - route: spark_first_party_route(), - allocation: spark_fleet_site_allocation.allocation, - answered_by: observation, + match spark_incarnation_observation_agreement(realization: realization, observation: observation) { + ObservationNamesAnotherEndpoint { observed: ob, answering: an } => + spark_service_unidentified(realization: realization, cause: ServiceObservationNamesAnotherEndpoint { observed: ob, answering: an }) + ObservationIncarnationOutsideRealization { incarnation: i } => + spark_service_unidentified(realization: realization, cause: ServiceIncarnationOutsideRealization { incarnation: i }) + ObservationAgreesWithThisRealization => + match launch_unit_provenance(launch: observation.launch, declared: declared) { + LaunchedFromDifferentUnit { observed: o, declared: d } => + spark_service_unidentified(realization: realization, cause: ServiceIncarnationNotFromDeclaredUnit { provenance: LaunchedFromDifferentUnit { observed: o, declared: d } }) + LaunchUnitDigestsIncomparable => + spark_service_unidentified(realization: realization, cause: ServiceIncarnationNotFromDeclaredUnit { provenance: LaunchUnitDigestsIncomparable }) + LaunchedFromDeclaredUnit { declared: _ } => { + let identity = spark_realization_identity(realization: realization) + if spark_configuration_matches(identity: identity) { + ServingRouteOperatorAsserted { + route: spark_first_party_route(), + allocation: spark_fleet_site_allocation.allocation, + answered_by: observation, + } + } else { + spark_service_unidentified(realization: realization, cause: ServiceConfigurationDisagrees { configuration: identity }) } - } else { - spark_service_unidentified(realization: realization, cause: ServiceConfigurationDisagrees { configuration: identity }) } } - } } } diff --git a/dag/gunbc/spark/serving_usage_stats_observe.dag b/dag/gunbc/spark/serving_usage_stats_observe.dag new file mode 100644 index 00000000000..8a65c920c47 --- /dev/null +++ b/dag/gunbc/spark/serving_usage_stats_observe.dag @@ -0,0 +1,85 @@ +module gunbc.spark.serving_usage_stats_observe + +import std.types { List, NonEmptyStr, String } +import extdeps.docker.cli { + DockerEnvAssignment, + DockerContainerInspectNamedEnv, + DockerContainerInspectNamedEnvUnreadable, + docker_container_inspect_named_env_from_stdout, +} +import extdeps.vllm.usage_stats { + VllmUsageStatsLaunchStanding, UsageStatsLaunchUnread, UsageStatsEnvMalformed, + VllmUsageStatsEnvAssignment, VllmDoNotTrackMarkerStanding, DoNotTrackMarkerUnread, + vllm_usage_stats_inspect_env_names, vllm_usage_stats_standing_from_effective_config, +} +import gunbc.spark.vllm_serving_launch { VllmServingLaunch } + +// ACCESS. This read is authorized by gunbc.spark.managed_access_bootstrap InspectServingContainer +// (`docker container inspect `). That grant already returns Config.Env. A second grant +// is not required. WHAT THIS MODULE MUST NOT DO: return, log or persist the rest of Config.Env; +// infer the running environment from a declared unit; widen an identity-only inspect decoder. + +data spark_usage_stats_inspect_unread_obligation: NonEmptyStr = "gunbc.spark.serving_usage_stats_observe: the answering container's inspect stdout was not supplied, so the effective usage-stats configuration is unread. THE GRANT THAT AUTHORIZES THE READ is gunbc.spark.managed_access_bootstrap InspectServingContainer, installed through gunbc.spark.managed_grant_install. The decoder is docker_container_inspect_named_env_from_stdout over VLLM_NO_USAGE_STATS, VLLM_DO_NOT_TRACK, DO_NOT_TRACK and VLLM_USAGE_STATS_SERVER only." as NonEmptyStr + +data spark_usage_stats_marker_unread_obligation: NonEmptyStr = "gunbc.spark.serving_usage_stats_observe: the upstream do-not-track marker file was not observed inside the answering container. InspectServingContainer does not authorize a filesystem read of disable_marker_path. Disable-by-marker is therefore not claimed." as NonEmptyStr + +data spark_usage_stats_container_id_mismatch_obligation: NonEmptyStr = "gunbc.spark.serving_usage_stats_observe: inspect Id does not equal the offered launch container_id, so the env projection is not a reading of the answering incarnation." as NonEmptyStr + +// THE HOST OPERATION BOUNDARY IS gunbc.spark.serving_incarnation_observe. Raw `docker container +// inspect` stdout is the whole container object, every Config.Env entry included, and it is +// secret-bearing. The host operation that executed the authorized inspect holds it, projects the +// container identity from it there, and hands the same stdout to spark_serving_usage_stats_decode +// below for the second projection; only the two typed projections leave that operation and the +// document dies with it. Policy (gunbc.spark.first_party_serving) receives sealed evidence, never +// the document, so the document cannot be retained, printed or re-decoded there. +// +// std.observation IS NOT INHABITED, AND THAT IS A STATED DEPARTURE (DESIGN 3b). std.observation +// ObservationEvent/RecordedObservation are keyed on a compiler-run containment path +// (ObservationSubject: run > batch > entry > module > declaration > phase); the subject here is a +// live serving container on a fleet host, which that path cannot name. The evidence instead joins +// the existing live-host observation vocabulary of this lane: it is bound to a VllmServingLaunch and +// carries a gunbc.product.fabric.demand ObservationReceiptRef, exactly as +// gunbc.spark.vllm_serving_launch EndpointIncarnationObservation does. The standing is upstream's own +// extdeps.vllm.usage_stats VllmUsageStatsLaunchStanding, reused rather than restated. +// +// THIS MODULE IS A DECODER, NOT AN OBSERVER. Its result is an UNSEALED VllmUsageStatsLaunchStanding +// over caller-supplied inspect stdout, and it is exactly as trustworthy as that stdout. The sealed +// evidence -- the thing policy may act on -- is minted only inside the host operation that executed +// the authorized inspect (gunbc.spark.serving_incarnation_observe), from that operation's own +// stdout, beside the incarnation identity it projects from the same document. An earlier spelling +// declared the sealed evidence here and minted it from a String parameter, which made this exported +// function an alternate constructor for a Disabled standing over caller-authored JSON (side-chat +// ruling 2026-09-16, the admitted_call_edge_with_unrestricted_value_egress class). +fn spark_usage_stats_marker_unread() -> VllmDoNotTrackMarkerStanding { + DoNotTrackMarkerUnread { obligation: spark_usage_stats_marker_unread_obligation } +} + +fn docker_assignments_as_vllm(assignments: List) -> List { + map(assignments, a => VllmUsageStatsEnvAssignment { name: a.name, value: a.value }) +} + +// container_id is the container the inspect ADDRESSED, the launch's own. An inspect whose decoded Id +// disagrees is still an observation of that address, and its standing is Unread. The marker is not +// a parameter: nothing the inspect grant observes reads the do-not-track marker file, so it is +// Unread by construction and only an env term the inspect returned can disable. +fn spark_serving_usage_stats_decode( + launch: VllmServingLaunch, + inspect_stdout: String, +) -> VllmUsageStatsLaunchStanding { + match docker_container_inspect_named_env_from_stdout( + stdout: inspect_stdout, + names: vllm_usage_stats_inspect_env_names(), + ) { + DockerContainerInspectNamedEnvUnreadable { cause: c } => + UsageStatsEnvMalformed { cause: c } + DockerContainerInspectNamedEnv { id: id, assignments: asg } => + if (id as String) != (launch.container_id as String) { + UsageStatsLaunchUnread { obligation: spark_usage_stats_container_id_mismatch_obligation } + } else { + vllm_usage_stats_standing_from_effective_config( + assignments: docker_assignments_as_vllm(assignments: asg), + marker: spark_usage_stats_marker_unread(), + ) + } + } +} diff --git a/dag/test/claim/harness_turn_admission_witness_test.dag b/dag/test/claim/harness_turn_admission_witness_test.dag index 0f5bb787a52..54ea7bd4609 100644 --- a/dag/test/claim/harness_turn_admission_witness_test.dag +++ b/dag/test/claim/harness_turn_admission_witness_test.dag @@ -19,6 +19,7 @@ import gunbc.spark.vllm_serving_launch { EndpointIncarnationUnobserved } import gunbc.spark.vllm_observed { ModelsRouteRead, vllm_models_route_readback } import gunbc.spark.pair_serving_realization { spark_pair_model_path_in_container, spark_pair_desired_snapshot } import gunbc.spark.first_party_serving { SparkServingRealization, spark_first_party_admission, spark_first_party_use_scope } +import gunbc.spark.serving_incarnation_observe { spark_usage_stats_inspect_unread } import gunbc.spark.serving_offer { SparkOfferBinding, SparkOfferBound, SparkOfferBindingRefused, ServingRouteObserved, bind_spark_serving_offer, spark_serving_incarnation_unobserved_obligation, @@ -42,10 +43,12 @@ import gunbc.harness.harness_cli { harness_model_request_inputs, harness_worker_ // (a_bound_offer_reaches_admission_through_bind_candidate, over the route seam). The // admitted arm has no positive control yet, and that is stated rather than faked: first-party // admission refuses while the answering launch's usage-stats path is unread, on every fixture this -// corpus can build. DECLARED FRONTIER (DESIGN 3c): the positive CandidateBound control lands when -// spark_first_party_admission takes the narrow ServingUsageStatsObservation (gunbc#11441) and this -// harness threads it through harness_admit_bound_offer -- a fixture Disabled observation on the -// offered launch, a matching declared unit and an observed incarnation then reach the admitted arm. +// corpus can build. The harness threads the narrow ServingUsageStatsObservation through +// harness_admit_bound_offer and passes spark_usage_stats_inspect_unread until a producer exists. +// DECLARED FRONTIER (DESIGN 3c): the positive CandidateBound control lands with that producer +// (gunbc#11362's inspect feeding gunbc.spark.serving_usage_stats_observe) -- a Disabled observation +// on the offered launch, a matching declared unit and an observed incarnation then reach the +// admitted arm. fn t_launch() -> VllmEndpointProcessLaunch { vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "http://10.0.0.1:8000" as NonEmptyStr, process_start_field: "1" as NonEmptyStr) @@ -129,7 +132,7 @@ test fn a_bound_offer_reaches_admission_through_bind_candidate() -> Bool { let subject = t_subject(prompt: "p", attempt: "a-1") let placed = harness_bind_candidate( acc: t_empty(), group: FabricGroupA, endpoint: t_endpoint(), launch: t_launch(), availability: t_ready(), - readback: t_realization().readback, incarnation: t_realization().incarnation, route: ServingRouteObserved { route: t_route() }, subject: subject, + readback: t_realization().readback, incarnation: t_realization().incarnation, usage_stats: spark_usage_stats_inspect_unread(), route: ServingRouteObserved { route: t_route() }, subject: subject, model: "deepseek-v4-flash:iq3s-split" as NonEmptyStr, unit: DeepseekV4FlashOnVllm, seats: 1, ) match t_bound() { @@ -137,6 +140,7 @@ test fn a_bound_offer_reaches_admission_through_bind_candidate() -> Bool { SparkOfferBound { bound: projection } => match spark_first_party_admission( realization: harness_serving_realization(group: FabricGroupA, launch: t_launch(), readback: t_realization().readback, incarnation: t_realization().incarnation), + usage_stats: spark_usage_stats_inspect_unread(), scope: spark_first_party_use_scope(demand: subject.demand, work: subject.work.id), offer: projection.offer.id, ) { @@ -159,11 +163,12 @@ test fn a_bound_offer_refused_by_admission_is_not_a_candidate_and_carries_the_ca SparkOfferBound { bound: projection } => { let placed = harness_admit_bound_offer( acc: t_empty(), group: FabricGroupA, endpoint: t_endpoint(), launch: t_launch(), - realization: t_realization(), projection: projection, subject: subject, + realization: t_realization(), usage_stats: spark_usage_stats_inspect_unread(), projection: projection, subject: subject, unit: DeepseekV4FlashOnVllm, seats: 1, ) match spark_first_party_admission( realization: t_realization(), + usage_stats: spark_usage_stats_inspect_unread(), scope: spark_first_party_use_scope(demand: subject.demand, work: subject.work.id), offer: projection.offer.id, ) { diff --git a/dag/test/claim/serving/serving_availability_bind_wet_witness_test.dag b/dag/test/claim/serving/serving_availability_bind_wet_witness_test.dag index b027cc0be2a..3faa25ec2b4 100644 --- a/dag/test/claim/serving/serving_availability_bind_wet_witness_test.dag +++ b/dag/test/claim/serving/serving_availability_bind_wet_witness_test.dag @@ -21,6 +21,7 @@ import gunbc.spark.vllm_serving_launch { EndpointIncarnationUnobserved } import gunbc.spark.serving_offer { spark_serving_incarnation_unobserved_obligation } import gunbc.spark.pair_serving_realization { DeclaredUnitDigested, DeclaredUnitDigestUnavailable } import gunbc.harness.harness_wire { OpenAiChatCompletionsShape } +import gunbc.spark.serving_incarnation_observe { spark_usage_stats_inspect_unread } import gunbc.harness.harness_seat { HarnessCandidates, HarnessDeclaredUnitRoster, harness_add_serving_candidate, harness_declared_unit_roster, harness_declared_unit_from_roster, @@ -150,6 +151,7 @@ test fn a_ready_route_reaches_the_existing_incarnation_frontier_in_the_product_p group: FabricGroupA, endpoint: w_endpoint, launch: launch, availability: a, readback: w_readback(), incarnation: EndpointIncarnationUnobserved { obligation: spark_serving_incarnation_unobserved_obligation }, + usage_stats: spark_usage_stats_inspect_unread(), route: harness_serving_route( group: FabricGroupA, launch: launch, readback: w_readback(), incarnation: EndpointIncarnationUnobserved { obligation: spark_serving_incarnation_unobserved_obligation }, diff --git a/dag/test/claim/spark/spark_first_party_serving_witness_test.dag b/dag/test/claim/spark/spark_first_party_serving_witness_test.dag index 30ee15de3ff..6f3e38869ee 100644 --- a/dag/test/claim/spark/spark_first_party_serving_witness_test.dag +++ b/dag/test/claim/spark/spark_first_party_serving_witness_test.dag @@ -14,14 +14,11 @@ import product.fabric.provider_admission { DispositionRefused, DispositionUnresolved, refusal_reason, admit_provider_use, } -import extdeps.vllm.usage_stats { - VllmUsageStatsLaunchStanding, UsageStatsDisabledByLaunch, UsageStatsEnabledByDefault, - UsageStatsLaunchUnread, -} import product.placement_supply { HostIdentity } import gunbc.spark.fabric_switch_observed { FabricGroupA } import gunbc.spark.vllm_endpoint_process_launch { VllmEndpointProcessLaunch, vllm_endpoint_process_launch } import gunbc.spark.vllm_serving_launch { EndpointIncarnationStanding, EndpointIncarnationUnobserved } +import gunbc.spark.serving_incarnation_observe { spark_usage_stats_inspect_unread } import gunbc.spark.serving_offer { spark_serving_incarnation_unobserved_obligation } import std.measure { token_count } import v2.std.optional { Present, Absent } @@ -34,7 +31,7 @@ import gunbc.spark.vllm_observed { vllm_models_route_readback, } import gunbc.spark.first_party_serving { - SparkServingRealization, spark_serving_usage_stats_standing, spark_usage_stats_telemetry_path, + SparkServingRealization, spark_usage_stats_telemetry_path, spark_serving_usage_stats_unread_cause, SparkTelemetryUnreadCause, TelemetryReadbackUnresolved, TelemetryReportedPathDiffers, TelemetryDeclaredPathUnpinned, TelemetryNoHostMembership, TelemetryHostsWithoutObservedLanes, @@ -161,6 +158,7 @@ fn t_foreign_realization() -> SparkServingRealization { test fn the_first_party_scope_refuses_while_its_environment_is_declared_not_read() -> Bool { match spark_first_party_admission( realization: t_pair_realization(), + usage_stats: spark_usage_stats_inspect_unread(), scope: spark_first_party_use_scope(demand: t_demand(), work: t_work()), offer: t_offer(), ) { @@ -245,7 +243,7 @@ test fn every_use_program_is_not_engaged_and_names_its_basis() -> Bool { // a telemetry path resolves, it does not reach production, and it is NOT the deferred launch-bound // positive control -- that row remains absent until evidence bound to the offered launch exists. fn t_facts_reaching_the_scope_checks() -> ProviderRouteFacts { - let f = spark_first_party_route_facts(realization: t_pair_realization()) + let f = spark_first_party_route_facts(realization: t_pair_realization(), usage_stats: spark_usage_stats_inspect_unread()) let onsite = f.data_paths.execution ProviderRouteFacts { route: f.route, @@ -308,19 +306,9 @@ test fn a_superseded_posture_makes_the_first_party_sanction_stale() -> Bool { ProviderUseDenied { decision: _, cause: c } => refusal_reason(c: c) == "posture stale" } } -// THE DROP'S POSITIVE CONTROL IS DELETED HERE, AND THE DELETION IS THE HONEST MOVE RATHER THAN A -// GAP. It asserted that the launch leaves usage reporting ON, which is what -// gunbc.rung_drop.provider_path_jurisdiction_unread_admits was declared against. That standing no -// longer exists to assert: the deciding producer does not read the declared environment at all, so -// there is no arm that concludes reporting is on or off for this launch, and the drop's population -// is empty pending attribution evidence. A control whose subject has no producer is not a weak -// control, it is a permanently green one, and DESIGN 4b is explicit that such a check is worse than -// absent because it will be cited as coverage. -// -// WHAT REPLACES IT IS NOT NOTHING. The same input is now driven by the first control below, which -// asserts the opposite and correct result -- that a matching readback establishes no telemetry -// standing at all. The drop keeps its record in its own row; what it does not keep is a witness -// claiming a live population it no longer has. +// THIS FILE STILL DRIVES UNREAD INSPECT. Disabled inspect -> Absent and admit is in +// test.claim.spark.spark_serving_usage_stats_observe_witness_test. Enabled egress is refused there +// too; this PR does not populate gunbc.rung_drop.provider_path_jurisdiction_unread_admits. // THE THREE RESULTS THIS REPAIR HAS TO ESTABLISH, each at the seam that owns it. They are separate @@ -360,7 +348,7 @@ test fn a_matching_readback_is_classified_as_configuration_matched_not_as_a_read // Located -- which product.fabric.provider_route first_unresolved_obligation counts as RESOLVED, so // the route admitted. test fn the_missing_evidence_refusal_produces_an_unread_telemetry_path() -> Bool { - match spark_usage_stats_telemetry_path(realization: t_pair_realization()) { + match spark_usage_stats_telemetry_path(realization: t_pair_realization(), usage_stats: spark_usage_stats_inspect_unread()) { ProviderPathUnread { obligation: _ } => true ProviderPathLocated { operator: _, jurisdiction: _, evidence: _ } => false ProviderPathAbsent { evidence: _ } => false @@ -393,6 +381,7 @@ test fn a_foreign_deployment_on_the_same_hosts_is_unread_not_inherited() -> Bool test fn a_foreign_deployment_refuses_provider_use_admission() -> Bool { match spark_first_party_admission( realization: t_foreign_realization(), + usage_stats: spark_usage_stats_inspect_unread(), scope: spark_first_party_use_scope(demand: t_demand(), work: t_work()), offer: t_offer(), ) { diff --git a/dag/test/claim/spark/spark_serving_usage_stats_evidence_seal_probe_test.dag b/dag/test/claim/spark/spark_serving_usage_stats_evidence_seal_probe_test.dag new file mode 100644 index 00000000000..55f8f8cca98 --- /dev/null +++ b/dag/test/claim/spark/spark_serving_usage_stats_evidence_seal_probe_test.dag @@ -0,0 +1,35 @@ +module test.claim.spark.spark_serving_usage_stats_evidence_seal_probe_test + +import std.types { Bool, String } +import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree } +import gunbc.compile_diagnostic_census { + CompileDiagnosticCensus, CensusObserved, CensusNotRunnable, census_rows_of_class, census_total_count, +} + +data live_tree_disposition: LiveTreeDisposition = ReadsLiveTree + +// THE SEAL ON ServingUsageStatsEvidence, PROBED AT THE SOURCE. gunbc.spark.serving_incarnation_observe +// is the only module that can construct the evidence policy acts on; every other route to a +// Disabled telemetry standing is a caller-authored one, and this probe shows such a route does not +// compile: a foreign module wrapping an authored standing as evidence is a SoleConstructorViolation. +// Egress closure, by enumeration: the exported functions returning a carrier of the evidence are +// spark_usage_stats_inspect_unread (Unobserved arm only), endpoint_incarnation_usage_stats (takes +// a ServingIncarnationReading, whose Observed arm already carries evidence it cannot mint) and +// observe_endpoint_incarnation (takes a fleet ssh context and executes the inspect). None lets a +// caller aim the confined value. +// RED, AT THE SOURCE: caller-authored JSON cannot produce ServingUsageStatsEvidence. A foreign module +// that decodes any stdout and tries to wrap the standing as evidence refuses to compile; the seal is +// on the record, so neither a literal nor a cast reaches the Observed arm. +data forged_evidence_source: String = "module probe_forged_usage_stats_evidence\nimport std.types { NonEmptyStr, String }\nimport product.fabric.demand { ObservationReceiptRef }\nimport gunbc.spark.vllm_serving_launch { VllmServingLaunch }\nimport extdeps.vllm.usage_stats { UsageStatsDisabledByLaunch }\nimport gunbc.spark.serving_incarnation_observe { ServingUsageStatsEvidence, ServingUsageStatsSubject, ServingUsageStatsObservation, ServingUsageStatsObserved }\nfn forged(launch: VllmServingLaunch) -> ServingUsageStatsObservation {\n ServingUsageStatsObserved { evidence: ServingUsageStatsEvidence { subject: ServingUsageStatsSubject { launch: launch, standing: UsageStatsDisabledByLaunch { mechanism: \"VLLM_NO_USAGE_STATS\" as NonEmptyStr }, receipt: \"forged\" as ObservationReceiptRef } } }\n}\n" + +fn census_of(source: String) -> CompileDiagnosticCensus { + compile_dag_diagnostic_census(source) +} + +test fn caller_authored_evidence_refuses_to_compile() -> Bool { + match census_of(source: forged_evidence_source) { + CensusObserved { rows: rows } => census_total_count(rows: census_rows_of_class(rows: rows, wanted: "SoleConstructorViolation")) >= 1 + CensusNotRunnable { cause: _ } => false + } +} + diff --git a/dag/test/claim/spark/spark_serving_usage_stats_observe_witness_test.dag b/dag/test/claim/spark/spark_serving_usage_stats_observe_witness_test.dag new file mode 100644 index 00000000000..648fcbae8e3 --- /dev/null +++ b/dag/test/claim/spark/spark_serving_usage_stats_observe_witness_test.dag @@ -0,0 +1,744 @@ +module test.claim.spark.spark_serving_usage_stats_observe_witness_test + +import std.types { Bool, NonEmptyStr, String, List } +import std.decl_ref { decl_ref, declaration_ref_eq } +import std.content_hash { ContentHash, Sha256Hash, Sha256Digest, Sha256DigestHex } +import product.fabric.identity { FabricIdentity, DemandKey, WorkKey, OfferKey } +import std.process { ProcessExit, ExitSuccess, ExitFailure } +import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly } +import v2.std.optional { Present, Absent } +import extdeps.languages.json.emit { + json_array, json_object, json_kv, json_string, json_null, serialize_json, JsonKeyValue, +} +import extdeps.docker.cli { + DockerContainerInspectNamedEnv, DockerContainerInspectNamedEnvUnreadable, + docker_container_inspect_named_env_from_stdout, +} +import extdeps.vllm.usage_stats { + VllmDoNotTrackMarkerStanding, VllmUsageStatsLaunchStanding, + UsageStatsDisabledByLaunch, UsageStatsEnabledByDefault, UsageStatsLaunchUnread, + UsageStatsEnvMalformed, vllm_usage_stats_inspect_env_names, vllm_usage_stats_reporting, + vllm_usage_stats_standing_from_effective_config, + vllm_usage_stats_assignment_disables, DoNotTrackMarkerPresent, DoNotTrackMarkerAbsent, + VllmUsageStatsDisableTerm, vllm_usage_stats_empty_server_cause, +} +import gunbc.spark.fabric_switch_observed { FabricGroupA, FabricGroupB } +import gunbc.fleet_intent_network { operator_host_srv5, operator_host_srv6, operator_host_srv7 } +import gunbc.spark.vllm_serving_launch { + vllm_serving_launch, VllmServingLaunch, EndpointIncarnationObserved, + endpoint_incarnation_observation, +} +import gunbc.spark.vllm_endpoint_process_launch { vllm_endpoint_process_launch } +import product.fabric.demand { ObservationReceiptRef } +import product.fabric.provider_admission { ProviderUseAdmitted, ProviderUseDenied, refusal_reason } +import product.fabric.provider_route { ProviderPathAbsent, ProviderPathUnread, ProviderPathLocated } +import gunbc.spark.serving_usage_stats_observe { + spark_serving_usage_stats_decode, + spark_usage_stats_marker_unread, spark_usage_stats_container_id_mismatch_obligation, + spark_usage_stats_marker_unread_obligation, docker_assignments_as_vllm, +} +import gunbc.spark.serving_incarnation_observe { + ServingUsageStatsSubject, spark_usage_stats_inspect_unread, endpoint_incarnation_usage_stats, + ServingUsageStatsObservation, ServingUsageStatsObserved, ServingUsageStatsUnobserved, + ServingIncarnationReading, IncarnationRefused, IncarnationNoEngineProcess, +} +import gunbc.spark.vllm_observed { ModelsRouteRead, vllm_models_route_readback } +import gunbc.spark.pair_serving_realization { + spark_pair_model_path_in_container, spark_pair_desired_snapshot, +} +import std.measure { token_count } +import gunbc.spark.first_party_serving { + SparkServingRealization, spark_first_party_use_scope, spark_first_party_admission, + spark_serving_usage_stats_standing, spark_usage_stats_telemetry_path, + spark_usage_stats_path_from_launch_standing, +} + +data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly + +fn t_sha256(hex: String) -> ContentHash { + Sha256Hash(Sha256Digest { hex: hex as Sha256DigestHex }) +} + +data t_container_id: String = "fixture-container-1" + +fn t_launch() -> VllmServingLaunch { + vllm_serving_launch( + group: FabricGroupA, + head: operator_host_srv6, + systemd_invocation: "fixture-invocation-1" as NonEmptyStr, + container_id: t_container_id as NonEmptyStr, + executable_digest: t_sha256(hex: "7777777777777777777777777777777777777777777777777777777777777777"), + unit_digest: t_sha256(hex: "5555555555555555555555555555555555555555555555555555555555555555"), + started_at: 1788907506, + ) +} + +data t_receipt: String = "test.claim.spark.spark_serving_usage_stats_observe_witness_test" + +// A SUBJECT over the decoder: the unsealed reading of caller-supplied stdout for a launch. The +// join rows below drive the policy folds at the subject grain +// (spark_usage_stats_telemetry_path_of_subject); the sealed evidence admission consumes is minted +// only by the inspect operation in gunbc.spark.serving_incarnation_observe and is not authorable +// here -- which is the wall the forgery probe at the end of this file exercises. +fn t_subject(launch: VllmServingLaunch, inspect_stdout: String) -> ServingUsageStatsSubject { + ServingUsageStatsSubject { + launch: launch, + standing: spark_serving_usage_stats_decode(launch: launch, inspect_stdout: inspect_stdout), + receipt: t_receipt as ObservationReceiptRef, + } +} + +fn t_observe(inspect_stdout: String) -> ServingUsageStatsSubject { + t_subject(launch: t_launch(), inspect_stdout: inspect_stdout) +} + +// THE MARKER-SUPPLIED STANDING is driven at the extdeps fold, not through the observer: the +// observer takes no marker (it observes none), so rows that need the marker Absent to reach the +// enabled arms decode the inspect the same way and fold with a supplied marker here. +fn t_observed_standing( + launch: VllmServingLaunch, + inspect_stdout: String, + marker: VllmDoNotTrackMarkerStanding, +) -> VllmUsageStatsLaunchStanding { + match docker_container_inspect_named_env_from_stdout(stdout: inspect_stdout, names: vllm_usage_stats_inspect_env_names()) { + DockerContainerInspectNamedEnvUnreadable { cause: c } => UsageStatsEnvMalformed { cause: c } + DockerContainerInspectNamedEnv { id: id, assignments: asg } => + if (id as String) != (launch.container_id as String) { + UsageStatsLaunchUnread { obligation: spark_usage_stats_container_id_mismatch_obligation } + } else { + vllm_usage_stats_standing_from_effective_config(assignments: docker_assignments_as_vllm(assignments: asg), marker: marker) + } + } +} + +fn t_inspect(env: List, id: String) -> String { + serialize_json(v: json_array(elements: [ + json_object(members: [ + json_kv(key: "Id", value: json_string(s: id)), + json_kv(key: "Config", value: json_object(members: [ + json_kv(key: "Env", value: json_array(elements: map(env, e => json_string(s: e)))), + ])), + ]), + ])) +} + +fn t_inspect_members(members: List) -> String { + serialize_json(v: json_array(elements: [json_object(members: members)])) +} + +fn t_id_only() -> String { + t_inspect_members(members: [json_kv(key: "Id", value: json_string(s: t_container_id))]) +} + +fn t_no_usage_term() -> VllmUsageStatsDisableTerm { + match vllm_usage_stats_reporting.disable_terms |> get(0) { + Present { value: t } => t + Absent => VllmUsageStatsDisableTerm { + variable: "VLLM_NO_USAGE_STATS" as NonEmptyStr, + disabling_value: "1" as NonEmptyStr, + } + } +} + +test fn upstream_disables_only_on_exact_one() -> Bool { + let term = t_no_usage_term() + vllm_usage_stats_assignment_disables(term: term, name: term.variable, value: "1") + && !vllm_usage_stats_assignment_disables(term: term, name: term.variable, value: "true") + && !vllm_usage_stats_assignment_disables(term: term, name: term.variable, value: "yes") +} + +// RED: THE OBSERVER CANNOT BE HANDED A DISABLE. It takes no marker standing, so an inspect with no +// disabling env term is Unread from the observer itself -- there is no argument by which a caller +// could assert the do-not-track marker present and green admission (review 66882). +test fn the_observer_never_disables_without_an_observed_env_term() -> Bool { + match spark_serving_usage_stats_decode(launch: t_launch(), inspect_stdout: t_inspect(env: ["OTHER=1"], id: t_container_id)) { + UsageStatsLaunchUnread { obligation: o } => (o as String) == (spark_usage_stats_marker_unread_obligation as String) + UsageStatsDisabledByLaunch { mechanism: _ } => false + UsageStatsEnabledByDefault { basis: _, destination: _ } => false + UsageStatsEnvMalformed { cause: _ } => false + } +} + +test fn true_does_not_disable_the_launch() -> Bool { + match t_observed_standing( + launch: t_launch(), + inspect_stdout: t_inspect(env: ["VLLM_NO_USAGE_STATS=true", "SECRET=must-not-surface"], id: t_container_id), + marker: spark_usage_stats_marker_unread(), + ) { + UsageStatsLaunchUnread { obligation: o } => + (o as String) == (spark_usage_stats_marker_unread_obligation as String) + UsageStatsEnabledByDefault { basis: _, destination: _ } => false + UsageStatsDisabledByLaunch { mechanism: _ } => false + UsageStatsEnvMalformed { cause: _ } => false + } +} + +test fn exact_one_disables_by_vllm_no_usage_stats() -> Bool { + match t_observed_standing( + launch: t_launch(), + inspect_stdout: t_inspect(env: ["VLLM_NO_USAGE_STATS=1", "SECRET=must-not-surface"], id: t_container_id), + marker: spark_usage_stats_marker_unread(), + ) { + UsageStatsDisabledByLaunch { mechanism: m } => (m as String) == "VLLM_NO_USAGE_STATS" + UsageStatsEnabledByDefault { basis: _, destination: _ } => false + UsageStatsLaunchUnread { obligation: _ } => false + UsageStatsEnvMalformed { cause: _ } => false + } +} + +test fn exact_one_disables_by_do_not_track() -> Bool { + match t_observed_standing( + launch: t_launch(), + inspect_stdout: t_inspect(env: ["DO_NOT_TRACK=1"], id: t_container_id), + marker: spark_usage_stats_marker_unread(), + ) { + UsageStatsDisabledByLaunch { mechanism: m } => + (m as String) == (vllm_usage_stats_reporting.do_not_track_fallback_env as String) + UsageStatsEnabledByDefault { basis: _, destination: _ } => false + UsageStatsLaunchUnread { obligation: _ } => false + UsageStatsEnvMalformed { cause: _ } => false + } +} + +test fn vllm_do_not_track_one_disables() -> Bool { + match t_observed_standing( + launch: t_launch(), + inspect_stdout: t_inspect(env: ["VLLM_DO_NOT_TRACK=1"], id: t_container_id), + marker: spark_usage_stats_marker_unread(), + ) { + UsageStatsDisabledByLaunch { mechanism: m } => + (m as String) == (vllm_usage_stats_reporting.vllm_do_not_track_env as String) + UsageStatsEnabledByDefault { basis: _, destination: _ } => false + UsageStatsLaunchUnread { obligation: _ } => false + UsageStatsEnvMalformed { cause: _ } => false + } +} + +test fn vllm_do_not_track_zero_blocks_do_not_track_fallback() -> Bool { + match t_observed_standing( + launch: t_launch(), + inspect_stdout: t_inspect(env: ["VLLM_DO_NOT_TRACK=0", "DO_NOT_TRACK=1"], id: t_container_id), + marker: DoNotTrackMarkerAbsent, + ) { + UsageStatsEnabledByDefault { basis: _, destination: d } => + (d as String) == (vllm_usage_stats_reporting.default_server as String) + UsageStatsDisabledByLaunch { mechanism: _ } => false + UsageStatsLaunchUnread { obligation: _ } => false + UsageStatsEnvMalformed { cause: _ } => false + } +} + +test fn server_override_is_the_enabled_destination() -> Bool { + match t_observed_standing( + launch: t_launch(), + inspect_stdout: t_inspect(env: ["VLLM_USAGE_STATS_SERVER=https://stats.example.test"], id: t_container_id), + marker: DoNotTrackMarkerAbsent, + ) { + UsageStatsEnabledByDefault { basis: _, destination: d } => + (d as String) == "https://stats.example.test" + UsageStatsDisabledByLaunch { mechanism: _ } => false + UsageStatsLaunchUnread { obligation: _ } => false + UsageStatsEnvMalformed { cause: _ } => false + } +} + +test fn present_empty_server_is_malformed_never_default() -> Bool { + match t_observed_standing( + launch: t_launch(), + inspect_stdout: t_inspect(env: ["VLLM_USAGE_STATS_SERVER="], id: t_container_id), + marker: DoNotTrackMarkerAbsent, + ) { + UsageStatsEnvMalformed { cause: c } => + (c as String) == (vllm_usage_stats_empty_server_cause as String) + UsageStatsEnabledByDefault { basis: _, destination: _ } => false + UsageStatsDisabledByLaunch { mechanism: _ } => false + UsageStatsLaunchUnread { obligation: _ } => false + } +} + +test fn marker_present_disables_when_env_does_not() -> Bool { + match t_observed_standing( + launch: t_launch(), + inspect_stdout: t_inspect(env: [], id: t_container_id), + marker: DoNotTrackMarkerPresent, + ) { + UsageStatsDisabledByLaunch { mechanism: m } => + (m as String) == (vllm_usage_stats_reporting.disable_marker_path as String) + UsageStatsEnabledByDefault { basis: _, destination: _ } => false + UsageStatsLaunchUnread { obligation: _ } => false + UsageStatsEnvMalformed { cause: _ } => false + } +} + +test fn inspect_unread_refuses() -> Bool { + match spark_serving_usage_stats_standing( + realization: t_realization_observed(), + usage_stats: spark_usage_stats_inspect_unread(), + ) { + UsageStatsLaunchUnread { obligation: _ } => true + UsageStatsDisabledByLaunch { mechanism: _ } => false + UsageStatsEnabledByDefault { basis: _, destination: _ } => false + UsageStatsEnvMalformed { cause: _ } => false + } +} + +test fn unreadable_inspect_is_malformed() -> Bool { + match t_observed_standing( + launch: t_launch(), + inspect_stdout: "not-json", + marker: spark_usage_stats_marker_unread(), + ) { + UsageStatsEnvMalformed { cause: _ } => true + UsageStatsLaunchUnread { obligation: _ } => false + UsageStatsDisabledByLaunch { mechanism: _ } => false + UsageStatsEnabledByDefault { basis: _, destination: _ } => false + } +} + +test fn container_id_mismatch_is_unread() -> Bool { + match t_observed_standing( + launch: t_launch(), + inspect_stdout: t_inspect(env: ["VLLM_NO_USAGE_STATS=1"], id: "other-container"), + marker: spark_usage_stats_marker_unread(), + ) { + UsageStatsLaunchUnread { obligation: o } => + (o as String) == (spark_usage_stats_container_id_mismatch_obligation as String) + UsageStatsDisabledByLaunch { mechanism: _ } => false + UsageStatsEnabledByDefault { basis: _, destination: _ } => false + UsageStatsEnvMalformed { cause: _ } => false + } +} + +test fn named_projection_drops_unrequested_env() -> Bool { + match docker_container_inspect_named_env_from_stdout( + stdout: t_inspect(env: ["VLLM_NO_USAGE_STATS=1", "SECRET=must-not-surface", "DO_NOT_TRACK=0"], id: t_container_id), + names: vllm_usage_stats_inspect_env_names(), + ) { + DockerContainerInspectNamedEnvUnreadable { cause: _ } => false + DockerContainerInspectNamedEnv { id: _, assignments: asg } => + !any(asg, a => (a.name as String) == "SECRET") + && any(asg, a => (a.name as String) == "VLLM_NO_USAGE_STATS" && a.value == "1") + && any(asg, a => (a.name as String) == "DO_NOT_TRACK" && a.value == "0") + } +} + +test fn duplicate_requested_name_is_unreadable() -> Bool { + match docker_container_inspect_named_env_from_stdout( + stdout: t_inspect(env: ["VLLM_NO_USAGE_STATS=1", "VLLM_NO_USAGE_STATS=0"], id: t_container_id), + names: vllm_usage_stats_inspect_env_names(), + ) { + DockerContainerInspectNamedEnvUnreadable { cause: _ } => true + DockerContainerInspectNamedEnv { id: _, assignments: _ } => false + } +} + +test fn config_absent_is_unreadable() -> Bool { + match docker_container_inspect_named_env_from_stdout( + stdout: t_id_only(), + names: vllm_usage_stats_inspect_env_names(), + ) { + DockerContainerInspectNamedEnvUnreadable { cause: c } => + (c as String) == "docker container inspect JSON names no Config" + DockerContainerInspectNamedEnv { id: _, assignments: _ } => false + } +} + +test fn config_not_object_is_unreadable() -> Bool { + match docker_container_inspect_named_env_from_stdout( + stdout: t_inspect_members(members: [ + json_kv(key: "Id", value: json_string(s: t_container_id)), + json_kv(key: "Config", value: json_string(s: "not-an-object")), + ]), + names: vllm_usage_stats_inspect_env_names(), + ) { + DockerContainerInspectNamedEnvUnreadable { cause: c } => + (c as String) == "docker container inspect Config is not an object" + DockerContainerInspectNamedEnv { id: _, assignments: _ } => false + } +} + +test fn env_absent_is_unreadable() -> Bool { + match docker_container_inspect_named_env_from_stdout( + stdout: t_inspect_members(members: [ + json_kv(key: "Id", value: json_string(s: t_container_id)), + json_kv(key: "Config", value: json_object(members: [])), + ]), + names: vllm_usage_stats_inspect_env_names(), + ) { + DockerContainerInspectNamedEnvUnreadable { cause: c } => + (c as String) == "docker container inspect Config names no Env" + DockerContainerInspectNamedEnv { id: _, assignments: _ } => false + } +} + +test fn env_null_is_unreadable() -> Bool { + match docker_container_inspect_named_env_from_stdout( + stdout: t_inspect_members(members: [ + json_kv(key: "Id", value: json_string(s: t_container_id)), + json_kv(key: "Config", value: json_object(members: [ + json_kv(key: "Env", value: json_null()), + ])), + ]), + names: vllm_usage_stats_inspect_env_names(), + ) { + DockerContainerInspectNamedEnvUnreadable { cause: c } => + (c as String) == "docker container inspect Config.Env is null" + DockerContainerInspectNamedEnv { id: _, assignments: _ } => false + } +} + +test fn env_not_a_string_list_is_unreadable() -> Bool { + match docker_container_inspect_named_env_from_stdout( + stdout: t_inspect_members(members: [ + json_kv(key: "Id", value: json_string(s: t_container_id)), + json_kv(key: "Config", value: json_object(members: [ + json_kv(key: "Env", value: json_string(s: "not-a-list")), + ])), + ]), + names: vllm_usage_stats_inspect_env_names(), + ) { + DockerContainerInspectNamedEnvUnreadable { cause: c } => + (c as String) == "docker container inspect Config.Env is not a list of strings" + DockerContainerInspectNamedEnv { id: _, assignments: _ } => false + } +} + +test fn empty_env_list_is_valid_empty() -> Bool { + match docker_container_inspect_named_env_from_stdout( + stdout: t_inspect(env: [], id: t_container_id), + names: vllm_usage_stats_inspect_env_names(), + ) { + DockerContainerInspectNamedEnv { id: _, assignments: asg } => count(asg) == 0 + DockerContainerInspectNamedEnvUnreadable { cause: _ } => false + } +} + +fn t_declared_path() -> String { + match spark_pair_model_path_in_container(snapshot: spark_pair_desired_snapshot) { + Present { value: p } => p + Absent => "" + } +} + +fn t_realization_observed() -> SparkServingRealization { + SparkServingRealization { + hosts: [operator_host_srv5, operator_host_srv6], + readback: ModelsRouteRead { + readback: vllm_models_route_readback( + served_model_id: "deepseek-v4-flash:iq3s-split" as NonEmptyStr, + configured_model_path: t_declared_path() as NonEmptyStr, + max_model_len: token_count(count: 1048576), + ), + }, + endpoint: vllm_endpoint_process_launch( + group: FabricGroupA, + endpoint: "http://10.0.0.1:8000" as NonEmptyStr, + process_start_field: "1" as NonEmptyStr, + ), + incarnation: EndpointIncarnationObserved { + observation: endpoint_incarnation_observation( + endpoint: vllm_endpoint_process_launch( + group: FabricGroupA, + endpoint: "http://10.0.0.1:8000" as NonEmptyStr, + process_start_field: "1" as NonEmptyStr, + ), + launch: t_launch(), + receipt: "test.claim.spark.spark_serving_usage_stats_observe_witness_test" as ObservationReceiptRef, + ), + }, + } +} + +fn t_foreign_realization_observed() -> SparkServingRealization { + SparkServingRealization { + hosts: [operator_host_srv5, operator_host_srv6], + readback: ModelsRouteRead { + readback: vllm_models_route_readback( + served_model_id: "deepseek-v4-flash:iq3s-split" as NonEmptyStr, + configured_model_path: "/weights/models--zai-org--GLM-5.3-Flash/snapshots/eb9eb208eb0d988989d07a6a12d0fdeb5f52574a" as NonEmptyStr, + max_model_len: token_count(count: 1048576), + ), + }, + endpoint: vllm_endpoint_process_launch( + group: FabricGroupA, + endpoint: "http://10.0.0.1:8000" as NonEmptyStr, + process_start_field: "1" as NonEmptyStr, + ), + incarnation: EndpointIncarnationObserved { + observation: endpoint_incarnation_observation( + endpoint: vllm_endpoint_process_launch( + group: FabricGroupA, + endpoint: "http://10.0.0.1:8000" as NonEmptyStr, + process_start_field: "1" as NonEmptyStr, + ), + launch: t_launch(), + receipt: "test.claim.spark.spark_serving_usage_stats_observe_witness_test" as ObservationReceiptRef, + ), + }, + } +} + +test fn disabled_launch_is_an_absent_telemetry_path() -> Bool { + match spark_usage_stats_telemetry_path_of_subject( + realization: t_realization_observed(), + subject: t_observe(inspect_stdout: t_inspect(env: ["VLLM_NO_USAGE_STATS=1"], id: t_container_id)), + ) { + ProviderPathAbsent { evidence: _ } => true + ProviderPathUnread { obligation: _, consulted: _ } => false + ProviderPathLocated { operator: _, jurisdiction: _, evidence: _ } => false + } +} + +fn t_demand() -> FabricIdentity { + FabricIdentity { principal: "gunbc" as NonEmptyStr, key: "harness-turn-demand-1" as DemandKey } +} + +fn t_work() -> FabricIdentity { + FabricIdentity { principal: "gunbc" as NonEmptyStr, key: "harness-turn-work-1" as WorkKey } +} + +fn t_offer() -> FabricIdentity { + FabricIdentity { principal: "gunbc" as NonEmptyStr, key: "group-a@http://192.168.1.225:30000@1" as OfferKey } +} + +// THE ADMITTED ARM HAS NO HERMETIC POSITIVE CONTROL, AND THAT IS THE WALL WORKING: the only mint of +// ServingUsageStatsEvidence is the inspect operation in gunbc.spark.serving_incarnation_observe, +// which reads the fleet over ssh, so no fixture can hand spark_first_party_admission a Disabled +// observation. DECLARED FRONTIER (DESIGN 3c): the positive control is the live Group A probe -- +// a real inspect of a launch whose env disables the reporter, carried by the harness into +// admission -- and it lands with the manual end-to-end probe. What IS claimed here: the join that +// decides Absent (disabled_launch_is_an_absent_telemetry_path and its REDs, at the subject grain +// the sealed path delegates to), and that admission over an unobserved telemetry path refuses. +test fn first_party_admission_refuses_while_usage_stats_are_unobserved() -> Bool { + match spark_first_party_admission( + realization: t_realization_observed(), + usage_stats: spark_usage_stats_inspect_unread(), + scope: spark_first_party_use_scope(demand: t_demand(), work: t_work()), + offer: t_offer(), + ) { + ProviderUseAdmitted { permit: _ } => false + ProviderUseDenied { decision: _, cause: c } => refusal_reason(c: c) == "route facts incomplete" + } +} + +// A refused incarnation reading carries an Unobserved telemetry projection with the operation's own +// refusal, never a default standing. +test fn a_refused_incarnation_reading_projects_unobserved_usage_stats() -> Bool { + match endpoint_incarnation_usage_stats(reading: IncarnationRefused { refusal: IncarnationNoEngineProcess { pattern: "vllm" as NonEmptyStr } }) { + ServingUsageStatsUnobserved { obligation: o } => (o as String).contains("no process on the host runs vllm") + ServingUsageStatsObserved { evidence: _ } => false + } +} + +fn t_realization_with_observation_endpoint( + observation_endpoint: String, + process_start: String, + launch: VllmServingLaunch, +) -> SparkServingRealization { + SparkServingRealization { + hosts: [operator_host_srv5, operator_host_srv6], + readback: ModelsRouteRead { + readback: vllm_models_route_readback( + served_model_id: "deepseek-v4-flash:iq3s-split" as NonEmptyStr, + configured_model_path: t_declared_path() as NonEmptyStr, + max_model_len: token_count(count: 1048576), + ), + }, + endpoint: vllm_endpoint_process_launch( + group: FabricGroupA, + endpoint: "http://10.0.0.1:8000" as NonEmptyStr, + process_start_field: "1" as NonEmptyStr, + ), + incarnation: EndpointIncarnationObserved { + observation: endpoint_incarnation_observation( + endpoint: vllm_endpoint_process_launch( + group: FabricGroupA, + endpoint: observation_endpoint as NonEmptyStr, + process_start_field: process_start as NonEmptyStr, + ), + launch: launch, + receipt: "test.claim.spark.spark_serving_usage_stats_observe_witness_test" as ObservationReceiptRef, + ), + }, + } +} + +test fn a_foreign_observation_endpoint_does_not_absent_on_disabled_inspect() -> Bool { + match spark_usage_stats_telemetry_path_of_subject( + realization: t_realization_with_observation_endpoint( + observation_endpoint: "http://10.0.0.1:8001", + process_start: "2", + launch: t_launch(), + ), + subject: t_observe(inspect_stdout: t_inspect(env: ["VLLM_NO_USAGE_STATS=1"], id: t_container_id)), + ) { + ProviderPathAbsent { evidence: _ } => false + ProviderPathUnread { obligation: _, consulted: _ } => true + ProviderPathLocated { operator: _, jurisdiction: _, evidence: _ } => false + } +} + +test fn an_observation_outside_hosts_does_not_absent_on_disabled_inspect() -> Bool { + match spark_usage_stats_telemetry_path_of_subject( + realization: t_realization_with_observation_endpoint( + observation_endpoint: "http://10.0.0.1:8000", + process_start: "1", + launch: vllm_serving_launch( + group: FabricGroupB, + head: operator_host_srv7, + systemd_invocation: "fixture-invocation-1" as NonEmptyStr, + container_id: t_container_id as NonEmptyStr, + executable_digest: t_sha256(hex: "7777777777777777777777777777777777777777777777777777777777777777"), + unit_digest: t_sha256(hex: "5555555555555555555555555555555555555555555555555555555555555555"), + started_at: 1788907506, + ), + ), + subject: t_observe(inspect_stdout: t_inspect(env: ["VLLM_NO_USAGE_STATS=1"], id: t_container_id)), + ) { + ProviderPathAbsent { evidence: _ } => false + ProviderPathUnread { obligation: _, consulted: _ } => true + ProviderPathLocated { operator: _, jurisdiction: _, evidence: _ } => false + } +} + +test fn marker_unread_without_disable_is_unread_never_located() -> Bool { + match spark_usage_stats_telemetry_path_of_subject( + realization: t_realization_observed(), + subject: t_observe(inspect_stdout: t_inspect(env: [], id: t_container_id)), + ) { + ProviderPathUnread { obligation: _, consulted: _ } => true + ProviderPathLocated { operator: _, jurisdiction: _, evidence: _ } => false + ProviderPathAbsent { evidence: _ } => false + } +} + +test fn canonical_enabled_is_refused_never_located() -> Bool { + match spark_usage_stats_path_from_launch_standing( + standing: t_observed_standing( + launch: t_launch(), + inspect_stdout: t_inspect(env: [], id: t_container_id), + marker: DoNotTrackMarkerAbsent, + ), + ) { + ProviderPathUnread { obligation: o, consulted: _ } => + declaration_ref_eq( + a: o, + b: decl_ref( + module_path: "gunbc.spark.first_party_serving", + decl_name: "spark_usage_stats_enabled_egress_refused_obligation", + ), + ) + ProviderPathLocated { operator: _, jurisdiction: _, evidence: _ } => false + ProviderPathAbsent { evidence: _ } => false + } +} + +test fn non_default_destination_cannot_use_default_enrollment() -> Bool { + match spark_usage_stats_path_from_launch_standing( + standing: t_observed_standing( + launch: t_launch(), + inspect_stdout: t_inspect(env: ["VLLM_USAGE_STATS_SERVER=https://stats.example.test"], id: t_container_id), + marker: DoNotTrackMarkerAbsent, + ), + ) { + ProviderPathUnread { obligation: o, consulted: _ } => + declaration_ref_eq( + a: o, + b: decl_ref( + module_path: "gunbc.spark.first_party_serving", + decl_name: "spark_usage_stats_unmodeled_destination_obligation", + ), + ) + ProviderPathLocated { operator: _, jurisdiction: _, evidence: _ } => false + ProviderPathAbsent { evidence: _ } => false + } +} + +fn t_other_launch() -> VllmServingLaunch { + vllm_serving_launch( + group: FabricGroupA, + head: operator_host_srv6, + systemd_invocation: "fixture-invocation-2" as NonEmptyStr, + container_id: "fixture-container-2" as NonEmptyStr, + executable_digest: t_sha256(hex: "7777777777777777777777777777777777777777777777777777777777777777"), + unit_digest: t_sha256(hex: "5555555555555555555555555555555555555555555555555555555555555555"), + started_at: 1788907507, + ) +} + +// RED: a disabled reading of ANOTHER launch's container, handed to policy beside an incarnation +// observation that agrees with the realization, must not Absent the path. The admission fold joins +// the observation's launch and container to the answering incarnation before it trusts the standing. +test fn an_observation_of_another_launch_does_not_absent_the_path() -> Bool { + match spark_usage_stats_telemetry_path_of_subject( + realization: t_realization_observed(), + subject: t_subject(launch: t_other_launch(), inspect_stdout: t_inspect(env: ["VLLM_NO_USAGE_STATS=1"], id: "fixture-container-2")), + ) { + ProviderPathAbsent { evidence: _ } => false + ProviderPathUnread { obligation: _, consulted: _ } => true + ProviderPathLocated { operator: _, jurisdiction: _, evidence: _ } => false + } +} + +// RED: A CONTRADICTING READING OF THE SAME LAUNCH DOES NOT ABSENT THE PATH. Same group, invocation +// and container as the answering incarnation, but a different unit digest: same_launch reports a +// contradiction, not a match, and the disabled standing is not trusted. +test fn a_contradicting_reading_of_the_same_launch_does_not_absent_the_path() -> Bool { + let contradicting = vllm_serving_launch( + group: FabricGroupA, + head: operator_host_srv6, + systemd_invocation: "fixture-invocation-1" as NonEmptyStr, + container_id: t_container_id as NonEmptyStr, + executable_digest: t_sha256(hex: "7777777777777777777777777777777777777777777777777777777777777777"), + unit_digest: t_sha256(hex: "6666666666666666666666666666666666666666666666666666666666666666"), + started_at: 1788907506, + ) + match spark_usage_stats_telemetry_path_of_subject( + realization: t_realization_observed(), + subject: t_subject(launch: contradicting, inspect_stdout: t_inspect(env: ["VLLM_NO_USAGE_STATS=1"], id: t_container_id)), + ) { + ProviderPathAbsent { evidence: _ } => false + ProviderPathUnread { obligation: _, consulted: _ } => true + ProviderPathLocated { operator: _, jurisdiction: _, evidence: _ } => false + } +} + +fn observe_witness_main() -> ProcessExit { + let all_pass = upstream_disables_only_on_exact_one() + && true_does_not_disable_the_launch() + && exact_one_disables_by_vllm_no_usage_stats() + && exact_one_disables_by_do_not_track() + && vllm_do_not_track_one_disables() + && vllm_do_not_track_zero_blocks_do_not_track_fallback() + && server_override_is_the_enabled_destination() + && present_empty_server_is_malformed_never_default() + && marker_present_disables_when_env_does_not() + && inspect_unread_refuses() + && unreadable_inspect_is_malformed() + && container_id_mismatch_is_unread() + && named_projection_drops_unrequested_env() + && duplicate_requested_name_is_unreadable() + && config_absent_is_unreadable() + && config_not_object_is_unreadable() + && env_absent_is_unreadable() + && env_null_is_unreadable() + && env_not_a_string_list_is_unreadable() + && empty_env_list_is_valid_empty() + && disabled_launch_is_an_absent_telemetry_path() + && first_party_admission_refuses_while_usage_stats_are_unobserved() + && a_refused_incarnation_reading_projects_unobserved_usage_stats() + + && a_foreign_observation_endpoint_does_not_absent_on_disabled_inspect() + && an_observation_outside_hosts_does_not_absent_on_disabled_inspect() + && marker_unread_without_disable_is_unread_never_located() + && canonical_enabled_is_refused_never_located() + && non_default_destination_cannot_use_default_enrollment() + && an_observation_of_another_launch_does_not_absent_the_path() + && a_contradicting_reading_of_the_same_launch_does_not_absent_the_path() + && the_observer_never_disables_without_an_observed_env_term() + if all_pass { + ExitSuccess + } else { + ExitFailure { code: 1, reason: "spark serving usage-stats observe witness failed" } + } +}