Repository navigation

approval loop D: converge materialization, loopback bind, mtcollins1_boot mode - #11484

Merged

briansrls merged 78 commits into

mainfrom

session/tidy-wren-372-approval-loop-d

Sep 20, 2026

Merged

approval loop D: converge materialization, loopback bind, mtcollins1_boot mode#11484
briansrls merged 78 commits into
mainfrom
session/tidy-wren-372-approval-loop-d

Commits on Sep 18, 2026
- File Mt. Collins boot through the approval store, and converge the srv1 keyring.
  
  Brian Searls
  and
  cursoragent
  committed
  c5dedfd
- Align the approval filer with part C's wire: nested request string, kv status, POST line.
  
  Brian Searls
  and
  cursoragent
  committed
  c2752a4
- Match the optional BMC username before interpolating ipmitool SOL.
  
  Brian Searls
  and
  cursoragent
  committed
  42ca23d
- Give the boot a real approval window and refuse an unread GET standing.
  
  Brian Searls
  and
  cursoragent
  committed
  aa216f1
- Consume the BMC secret pin and the keyring digest wall from their owners.
  
  Brian Searls
  and
  cursoragent
  committed
  ea1bcbf
- Serve POST /approvals and GET /approvals/{id}, and pass the grant into the attach.
  
  Brian Searls
  and
  cursoragent
  committed
  9beccad
- Consume C's minted submission MAC pin instead of wrapping an unpinned ref.
  
  Brian Searls
  and
  cursoragent
  committed
  89fa365
- Derive loopback origin and keyring host from their existing authorities.
  
  Brian Searls
  and
  cursoragent
  committed
  80166ba
- Keep the keyring off fleet_converge_receipt so ci_spec stays acyclic.
  
  Brian Searls
  and
  cursoragent
  committed
  f0f79a5
- Hold SOL by a live ipmitool pid, and refuse clock-unreadable as an expiry instant.
  
  Brian Searls
  and
  cursoragent
  committed
  534ee8c
- Emit fleet-converge modes and pin SOL activate to the BMC password file.
  
  Brian Searls
  and
  cursoragent
  committed
  772c1b6
- Install the approval keyring over fleet SSH as the administrator, not local sudo.
  
  Brian Searls
  and
  cursoragent
  committed
  0afbcef
- Admit the host-env-name rebind and name String's declaring module in edac.
  
  Brian Searls
  and
  cursoragent
  committed
  1c1b696
- Own keyring chown from fleet POSIX accounts and drop the duplicated SOL hold check.
  
  Brian Searls
  and
  cursoragent
  committed
  ac724f6
- Drop consumed #11440 wave rows and bind edac Unit to std.types.
  
  Brian Searls
  and
  cursoragent
  committed
  b453b08
- Admit the boot from GET decision fields, not the 0600 store.
  
  Brian Searls
  and
  cursoragent
  committed
  3063119
- Share the env-path read and size the boot step from the poll window.
  
  Brian Searls
  and
  cursoragent
  committed
  8900cd4
- Track TimestampAdd on the same offset-Nat dissolve-on as TimestampOffset.
  
  Brian Searls
  and
  cursoragent
  committed
  0697a7b
- Name the HTTP grant client on the frontier and refuse boot off srv1.
  
  Brian Searls
  and
  cursoragent
  committed
  6c8f1ce
- Digest both staged MAC keys before install and name the boot POST bound as Second.
  
  Brian Searls
  and
  cursoragent
  committed
  5da0c3f
- Claim the Mt. Collins boot grant on the durable slot before any controller write.
  
  Brian Searls
  and
  cursoragent
  committed
  820f674
- Route staged MAC-key digest checks through the role standing folds.
  
  Brian Searls
  and
  cursoragent
  committed
  494e260
- Refuse non-canonical stored instants and duplicate kv standing lines.
  
  Brian Searls
  and
  cursoragent
  committed
  67b6ec3
- Delete approval_issuance_frontier now that issue_links signs and publishes.
  
  Brian Searls
  and
  cursoragent
  committed
  d81ee9b
- One MAC-key digest standing fold, and cite the pin instead of its hex.
  
  Brian Searls
  and
  cursoragent
  committed
  0dde6bb
- Put POST filed-token and GET standing on one kv grammar.
  
  Brian Searls
  and
  cursoragent
  committed
  bd5004f
- Carry request authority into admit_submission; drop the tautological POST-success poll wrapper.
  
  Brian Searls
  and
  cursoragent
  committed
  bdad98a
- Do not file or admit poll when no approval capability can be minted.
  
  Brian Searls
  and
  cursoragent
  committed
  f19badf
- Remove unattached and in-body // annotations that fail parse.
  
  Brian Searls
  and
  cursoragent
  committed
  7dd61ba
- Recheck SOL hold immediately before the BMC write.
  
  Brian Searls
  and
  cursoragent
  committed
  ee458e1
- Align hermetic floor claims with loopback emit and unmocked Filesystem.Read.
  
  Brian Searls
  and
  cursoragent
  committed
  798e28c
- Mark the approval-keyring and Mt. Collins boot GHA runners as bash-emit scaffolds.
  
  Brian Searls
  and
  cursoragent
  committed
  6eba64e
- Reclaim a stale BMC SOL session before activate.
  
  Brian Searls
  and
  cursoragent
  committed
  4d4d976
- Create /var/lib/gunbc/approvals for the unit user during keyring converge.
  
  Brian Searls
  and
  cursoragent
  committed
  fb48eef
- Discriminate a live ipmitool SOL pid from a nonempty capture in the witness.
  
  Brian Searls
  and
  cursoragent
  committed
  0753f2e
- Import NonEmptyStr for the SOL ipmitool prefix.
  
  Brian Searls
  and
  cursoragent
  committed
  b48a34e
- Admit the unit user to gunbc-ntfy instead of retaking the publisher token.
  
  Brian Searls
  and
  cursoragent
  committed
  31ee49d
- Retry a transient unreadable approval status inside the poll window.
  
  Brian Searls
  and
  cursoragent
  committed
  b15308d
- Drop the unreadable-status re-poll.
  
  Brian Searls
  and
  cursoragent
  committed
  8cf0d03
- Carry approval authority on the claims, not StoredApprovalRequest.
  
  Brian Searls
  and
  cursoragent
  committed
  8197df7
- Stop claiming srv1-live binds every interface.
  
  Brian Searls
  and
  cursoragent
  committed
  22874ea
- Seal keyring files at 640 and stop claiming the claim root namespaces workflows.
  
  Brian Searls
  and
  cursoragent
  committed
  a1a6948
- Re-authorize the boot grant on the claim clock before attach.
  
  Brian Searls
  and
  cursoragent
  committed
  86705a1
- Drop the foreign-authority witness that still named a field C does not store.
  
  Brian Searls
  and
  cursoragent
  committed
  f0b9e25
- Regenerate fleet-converge.yml after the rebase onto C.
  
  Brian Searls
  and
  cursoragent
  committed
  b2669db
- Create the authorization-claim store as ghrunner-owned 0700 on keyring converge.
  
  Brian Searls
  and
  cursoragent
  committed
  64cb8b9
- Stop polling un-approvable slots and bind the boot grant to a complete subject.
  
  Brian Searls
  and
  cursoragent
  committed
  8434042
- Delete consumed namespace-wave admissions on the roster this change already touches.
  
  Brian Searls
  and
  cursoragent
  committed
  8f6d88f
- Observe the SOL lease from the collector this run holds, not from sol info.
  
  Brian Searls
  and
  cursoragent
  committed
  0ee1bc6
- Move SOL process-hold out of the IPMI interface onto a marked gunbc scaffold.
  
  Brian Searls
  and
  cursoragent
  committed
  1ea2fde
- Refuse an unreadable MegaRAC session GET instead of treating it as released.
  
  Brian Searls
  and
  cursoragent
  committed
  d09e88e
- Stop naming uncited MegaRAC wires as refusals, and match firmware readback to the expected mode.
  
  Brian Searls
  and
  cursoragent
  committed
  2c79dc0
- Drive reset from the roster row's boot options and parameter-5 expectation.
  
  Brian Searls
  and
  cursoragent
  committed
  dcead2f
- Keep the boot-step timeout as a Minute carrier until the GHA field.
  
  Brian Searls
  and
  cursoragent
  committed
  67af974
- Do not treat a sentinel CSRF 401 as a released MegaRAC session.
  
  Brian Searls
  and
  cursoragent
  committed
  0d93fa3
- Read RUNNER_TEMP from the Actions environment authority.
  
  Brian Searls
  and
  cursoragent
  committed
  ccfebdb
- Keep escalation HTTP status exhaustive over EscalationSlot.
  
  Brian Searls
  and
  cursoragent
  committed
  760eb65
- Merge origin/main; drop consumed #11549 namespace admission and bind String via std.string_type.
  
  Brian Searls
  and
  cursoragent
  committed
  681d5f6
- Keep the CD selector measurement on the selector, not the other param-5 axes.
  
  Brian Searls
  and
  cursoragent
  committed
  488168b
- Bind Unit from std.types in coreutils_stat.
  
  Brian Searls
  and
  cursoragent
  committed
  748106a
- Observe the SOL pid file once for the lease verdict.
  
  Brian Searls
  and
  cursoragent
  committed
  ae7c1d5
- Wait for the host-capture terminal, stamp it now, and consume IpmiBootSelection.
  
  Brian Searls
  and
  cursoragent
  committed
  57552d1
- Read the boot-terminal oracle from the census, EDAC, and Ubuntu media authorities.
  
  Brian Searls
  and
  cursoragent
  committed
  39b6297
- Project IpmiBootSelection through ChassisBootDevWithOptions and apply the grant's selection.
  
  Brian Searls
  and
  cursoragent
  committed
  e73145f
- Drop unused IpmiBootSelection.options_wire.
  
  Brian Searls
  and
  cursoragent
  committed
  5901fb4
- Put the IpmiBootSelection data rows on one line.
  
  Brian Searls
  and
  cursoragent
  committed
  42d6140
- Require a section-bound EDAC/nproc host-capture verdict before completing the boot claim.
  
  Brian Searls
  and
  cursoragent
  committed
  85c45f8
- Escape curl's %{http_code} in MegaRAC GetSession so the argv is not an unbound interpolation.
  
  Brian Searls
  and
  cursoragent
  committed
  b9a7ca8
- Anchor the host-capture envelope to the marker line and derive the IPMI device word.
  
  Brian Searls
  and
  cursoragent
  committed
  a379908
- Derive ipmitool parameter-5 readback words from the boot-selection axes.
  
  Brian Searls
  and
  cursoragent
  committed
  d8e723e
Commits on Sep 19, 2026
- Merge origin/main into approval-loop-d (0A/0B landed); keep the Unit import edac still consumes; regenerate fleet-converge.yml
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  20862c4
- MegaRAC session release is a present->absent transition: observe GET /api/session before and after CloseSession, accept 404 or 401 as absence only after a succeeding read (boot 20 refused a release…
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  bd804b6
- MegaRAC release re-observation uses a route this firmware serves: GET /api/session answers 404 with a live cookie (boots 20, 21), so the probe is a readonly GET on the remote-media configurations r…
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  f5974a5
- One claim/settle pair for every authorization slot (gunbc.authorization_claim_slot), consumed by the srv3 boot-once-cd step and the Mt. Collins boot step instead of two verbatim copies; state the p…
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  3e535a3
- Merge origin/main into approval-loop-d; ci_spec target roster is the union (drop the retired heal_repo_local_git_config target); regenerate the generated artifacts
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  b2ef96b
- namespace: delete the consumed enrollment_id_for_code admission (#11660's row, satisfied at this branch's merge base); the gate names it as due for deletion on the roster's next touch
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  0daa22a
Commits on Sep 20, 2026
- Merge origin/main into approval-loop-d (0C/0D/#11620 landed); fleet_converge_workflow rosters are the union of both sides; regenerate fleet-converge.yml
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  dda6e77
- scoped_authorization: the claim slot key carries its scope again ('scoped-authorization-' + escalation id) — the earlier repair for the slash-addressability refusal deleted the prefix and moved sco…
  
  gunbc-ci-auto-heal
  and
  claude
  committed
  ce0b794

Commits

Commits on Sep 18, 2026

Commits on Sep 19, 2026

Commits on Sep 20, 2026