PXE-FABRIC 0A: join NetworkBootDeliveryEstablished from fleet/site/client/boot-control

[gunbai-bot]

Summary

• Extend gunbc.network_boot_delivery so NetworkBootDeliveryEstablished is a join of fleet HTTPS service, site PXE edge, observed UEFI ARM64 client mode, boot-control, and signed-manifest identity — not a second PXE-readiness vocabulary.
• Census-dispose predecessors (srv4 BMC HTTP serve, srv3 authored chain, fabric durable origin ≠ boot origin, measured Mt. Collins DHCP option 60 only) with typed standings; cite iPXE and R2 custom domains in extdeps.
• Hermetic witnesses cover join refusals (missing axis, unknown arch, unreachable origin, wrong target) and that ControlledNetworkBootstrap is not ProductionTrustedBootstrap.

Test plan

• /cargo-target/release/v1_src_dag_parse on every touched .dag file
• CI witness floor on this PR
• Does not touch mtcollins1_boot, approval_*, or srv1 roadmap units

Made with Cursor

[gunbai-bot]

Addressed review 67695 on this head:

• Deleted the copied architecture_is_aarch64; import extdeps.toolchain.types.
• architecture_admitted_on_edge is list membership of the client architecture. A chainloader whose architecture disagrees with the client is SitePxeEdgeArchitectureRefused (witness: Wasm32 loader vs Aarch64 client).
• UEFI ARM64 DHCP class uses dhcp_processor_architecture_code(UefiArm64) rather than a second 11.
• Artifact axis requires the signed manifest's UnitKey and attempt to match the delivery target (witness: other unit does not establish).

— sent from sleek-carp-159

[gunbai-bot]

Review 67714 findings 2 and 3 (on 0A files, also pulled into #11604): addressed on a3bbed8.

• Census accessors and the count/r2.dev witness are gone. Completeness is the named identity join. join_network_boot_delivery refuses when a join observation names a non-client predecessor (frozen_srv4_plan_observation_cannot_establish_delivery).
• Deleted unused ipxe_https_authority / ipxe_chainloading_authority and the unconsumed r2_custom_domain_* rows (they were not in r2_published_location_*).

Finding 1 stays on #11604 (dhcp_processor_architecture_code vs mtcollins1_pxe_arch_code).

[gunbai-bot]

review 67724 on f26c63c — addressed on 4abce24.

• Census no longer imports iPXE for a match whose arms were both true. The iPXE URI-only module is deleted; 0C authors the chainloader shape when the edge lands. ArchitectureChainloader is unchanged.
• ObservedDhcpPxeClient.arch is DhcpProcessorArchitecture; observed_client_is_uefi_arm64 is an exhaustive match on that coproduct.
• Predecessor observation refusal returns JoinObservationNotEstablishing { axis } so a frozen client observation names NetworkBootClientBootMode (frozen_srv4_plan_as_client_observation_names_the_client_axis).
• Wet-acceptance types/predicate/witness removed; the operator ruling is an annotation on join_network_boot_delivery.

[gunbai-bot]

review 67731 — addressed on 39208381827.

• The join is now a single nested walk. There is no missing pre-pass whose *_ok flags restated admission; …Unestablished arms are the real refusals of that walk.
• Deleted gunbc.network_boot_predecessor_census. Establishment evidence carries NetworkBootEvidenceClass on each receipt (MeasuredNetworkBootFact | NonEstablishingNetworkBootPredecessor). An authored plan cannot inhabit the measured arm, so an unrostered DeclarationRef cannot silently establish.
• Join of a predecessor is NetworkBootDeliveryEvidenceRefused { axis, observation }, not Unestablished { missing: [axis] }. pxe_chain_candidate maps that to CandidateNetworkBootEvidenceRefused. Witnesses for the frozen srv4 plan assert the refused arm.

Parse sweep is clean; four_receipts_join_to_established evaluated true.

[gunbai-bot]

review 67738 finding 2 (filed on #11605, lives in 0A): 3572a107146 — artifacts axis establishes only from SignedBootManifestVerified, binds observation time to the ticket window, and refuses an unsigned Identified identity. Finding 1 (diagnostic name in the HMAC preimage) stays on #11605.

[gunbai-bot]

review 67749: SitePxeEdgeArchitectureRefused is no longer collapsed into Unestablished { missing: [NetworkBootServingInfrastructure] }. Join answers NetworkBootDeliveryArchitectureRefused { architecture }; pxe_chain_candidate maps it to CandidateNetworkBootArchitectureRefused. site_architecture_refusal_is_located_on_the_join drives an x86_64 client through join_network_boot_delivery.

[gunbai-bot]

review 67750 (filed on #11605, 0A half): 926e897a6cb — SignedBootManifestVerificationRefused joins as EvidenceRefused on the artifacts axis. Join comment no longer names 0C/0D as the spent mint trigger; production mint is the intake assembler that holds all four receipts plus a verified ticket.

[gunbai-bot]

review 67760 (0A half): observed client-mode / ticket failures are located refusal arms, not missing axes. SignedBootManifestVerificationRefused carries NetworkBootManifestVerificationClass so 0D can keep MAC/replay/expiry distinct.

[gunbai-bot]

review 67756 — already on head 5ef80285102 (same defect as review 67760, filed on #11605).

Measured contradictions are no longer Unestablished { missing }:

• DHCP arch other than UefiArm64 → NetworkBootDeliveryClientModeRefused { arch }
• target mismatch → NetworkBootDeliveryTargetMismatch { axis }
• unsigned identity / digest / window / unit / attempt / non-aarch64 ticket → NetworkBootDeliveryManifestRefused { cause }
• BRD-OTHER-UNIT witness now asserts ManifestJoinWrongTarget, not missing artifacts
• HttpBootArm64 through the join asserts ClientModeRefused

Unestablished.missing remains only for unobserved/absent axes. pxe_chain_candidate maps the new arms to candidate ineligibility causes.

— sent from sleek-carp-159

[gunbai-bot]

review 67755: NetworkBootEvidenceClass is gone. A predecessor cannot inhabit FleetBootServiceEstablished / ClientBootModeObserved / BootControlObserved / SignedBootManifestVerified — those are separate constructors from *Predecessor. Join annotation no longer says 0C must call join_network_boot_delivery; 0C binds NetworkBootJoinInputs.site from the first srv4 boot offer.

[briansrls]

0A is the right authority and must land first, but NetworkBootDeliveryEstablished currently forgets evidence that the new join says is load-bearing.

1. SitePxeEdgeEstablished { receipt: _ } discards the site receipt. The final NetworkBootDeliveryEstablishment.serving_infrastructure carries only fleet.observation, so the established value cannot show which site edge, offer, chainloader, or site reachability completed delivery. This reduces global service + site edge back to one serving observation at the mint.
2. No target↔site join exists. SitePxeEdgeReceipt names a SiteIdentity, but neither the client receipt nor the final target is compared to it. An edge established at site A can therefore be supplied beside a target/client at site B.
3. BootstrapTrustStanding is defined but is not an input to join_network_boot_delivery, and SignedBootManifestVerified does not preserve the trust grade. ControlledNetworkBootstrap, ProductionTrustedBootstrap, and an incorrectly laundered verifier are indistinguishable in the established receipt. The wet result must state which trust boundary it proved.
4. The successful establishment retains only artifact_digest (the root digest) plus the manifest observation ref. The manifest's chainloader/kernel/initrd/root identity is discarded. Retain the verified manifest/bundle identity—or one canonical artifact-set receipt—in the establishment so a later consumer cannot read “artifact established” as only the root digest.

Please make 0A the sole carrier for the composed receipt: target-bound site evidence, fleet service evidence, client/control evidence, verified manifest identity, and bootstrap trust standing. 0B/0C/0D should each inhabit one field rather than carrying alternative copies of the establishment vocabulary.

[gunbai-bot]

Side-chat HOLD (the three lost joins) is resolved at this head (014b358; the structure has been present since a16ed27). Symbols, all in gunbc.network_boot_delivery:

1. Site receipt is kept. NetworkBootDeliveryEstablishment has site: SitePxeEdgeReceipt. The SitePxeEdgeEstablished { receipt: site } arm of join_network_boot_delivery threads that site through join_verified_ticket_after_trust into the established evidence instead of discarding it.
2. Site identity is joined. NetworkBootJoinInputs.expected_site: SiteIdentity. join_network_boot_delivery refuses with NetworkBootDeliverySiteMismatch unless site_identity_eq(a: site.edge.site, b: inputs.expected_site) holds and site_identity_eq(a: client.site, b: inputs.expected_site) holds. site_identity_eq lives beside SiteIdentity in product.placement_supply (review 67927). To be precise: the establishment has no separate expected_site field. Its site receipt is the one proven equal to expected_site. Witness: foreign_site_edge_does_not_join in network_boot_delivery_join_witness_test.
3. Trust is an input. NetworkBootJoinInputs.trust: BootstrapTrustStanding. join_network_boot_delivery matches inputs.trust before join_verified_ticket_after_trust, and NetworkBootDeliveryEstablishment.trust carries it. The unestablished arm refuses with NetworkBootDeliveryTrustUnestablished (witness unestablished_trust_does_not_join).

Also on this head: the join's unexecuted production route is now network_boot_delivery_frontier_rows, registered in gunbc.census_closure_frontier (review 67884). The ObservedDhcpPxeClient annotation now states what the join admits: UefiArm64, code 11, over edge TFTP (review 67925).

— sent from wise-ant-611

[gunbai-bot]

Re: the CHANGES_REQUESTED review at cf0c207. All four points against current head ac525e6, symbols in gunbc.network_boot_delivery:

1. Site receipt kept. NetworkBootDeliveryEstablishment.site: SitePxeEdgeReceipt. SitePxeEdgeEstablished { receipt: site } threads the edge, offer observation and chainloader through to the establishment. serving_infrastructure is gone; fleet is its own fleet: FleetBootServiceReceipt.
2. Site join. BootDeliveryTarget carries no site (gunbc.machine_intake_access: subject + endpoint), so the join takes NetworkBootJoinInputs.expected_site and refuses unless both site.edge.site and the client receipt's site equal it (site_identity_eq). Client and control receipts must be the same target (same_boot_delivery_target). An edge at site A next to a client at site B refuses with NetworkBootDeliverySiteMismatch { axis: SiteEdgeSite | ClientObservationSite, … }. Witnesses: foreign_site_edge_does_not_join, foreign_client_observation_site_names_the_client_axis.
3. Trust is an input and is preserved. NetworkBootJoinInputs.trust: BootstrapTrustStanding, matched before join_verified_ticket_after_trust. NetworkBootDeliveryEstablishment.trust carries the grade. ProductionTrustGrounds makes a production standing with neither ground unconstructible. BootstrapTrustUnestablished refuses (NetworkBootDeliveryTrustUnestablished).
4. Full manifest identity kept. artifact_digest was removed from the establishment. It now carries manifest: SignedBootManifestReceipt { identity: SignedBootManifestIdentity, observation, observed_at }: the chainloader, kernel, initrd and root digests, cmdline, window and key. boot_artifact_delivery reads e.manifest.identity.root_digest.

0A is the sole carrier of the composed receipt. The unexecuted assembler route is the typed network_boot_delivery_frontier_rows, registered in gunbc.census_closure_frontier. The dashboard review on this head (review 67951) approves. CI is pending. Only you can clear this GitHub change request (re-review or dismiss).

— sent from wise-ant-611

[briansrls]

HOLD on ac525e6bfc58c859af4f906d7e3f42a5a0e002f4 as the root the children re-cut onto. The four facts from my prior review are now retained correctly, and CI is green. Three root-level false positives remain; these should be fixed in 0A rather than forcing 0B/0C/0D to fork or reopen the carrier.

1. Production trust is not compatible with the selected boot path. The current positive fixture establishes a UefiPxe { tftp_root } delivery using ProductionTrustedBootstrap { FirmwareHttpsTrusted }. Firmware HTTPS trust does not authenticate a chainloader delivered by PXE/TFTP. For UefiPxe, production trust requires the Secure-Boot-verified chainloader ground (or the combined arm); for UefiHttpBoot, firmware-HTTPS trust is the relevant ground. ControlledNetworkBootstrap may still establish the explicitly retained controlled grade. The trust evidence should also bind its subject: Secure Boot to the chainloader digest/target, controlled-network evidence to this site, and firmware HTTPS to the route it authenticates. Add a RED where UEFI PXE + firmware-HTTPS-only currently establishes.

2. The exact delivery endpoints are still discarded. GlobalHttpsEndpointReachable carries only { observation, observed_at }, so reachability to an unrelated HTTPS service can sit beside fleet.https_boot_endpoint / origin_custom_domain. Separately, dhcp_client_processor_architecture intentionally discards UefiPxe.tftp_root, and SiteBootstrapTransport carries only filename + digest, so a ticket for a foreign TFTP root can join the observed edge. The site receipt needs the exact client-visible TFTP endpoint and exact broker/origin endpoints it reached, and the join must compare them to the fleet receipt and manifest route. Add REDs for reachability-to-other-endpoint and ticket-TFTP-root mismatch.

3. A verified manifest is not evidence that its R2 objects exist. Today a SignedBootManifestVerified naming arbitrary kernel/initrd/root digests can establish NetworkBootBootArtifacts even when 0B has published/read back none of them. There is no field in NetworkBootJoinInputs or NetworkBootDeliveryEstablishment for 0B's content-addressed publication/readback receipt. Add one canonical bundle-availability receipt from 0B and compare its kernel, initrd and root digests to the verified manifest (the chainloader remains the 0C receipt). Add a RED for a verified manifest with no served bundle.

After those changes, the decomposition is clean: 0B inhabits bundle/origin availability, 0C inhabits exact site route + chainloader, 0D inhabits verified manifest identity, and 0A is the sole mint.

[gunbai-bot]

Side-chat ruling on this PR as the PXE stack ROOT: HOLD at ac525e6 (a REQUEST_CHANGES review was filed on that head). The previously lost joins are confirmed fixed. Three false-positive constructions remain before 0B/0C/0D re-cut onto 0A:

1. Trust vs boot mode. bootstrap_trust_standing mints ProductionTrustedBootstrap from FirmwareHttpsTrusted alone and the join accepts it for UefiPxe — firmware-HTTPS trust does not authenticate a chainloader delivered over PXE/TFTP. UefiPxe production trust needs the Secure-Boot-verified-chainloader ground (or the combined ground); HTTPS-only belongs to UefiHttpBoot. Trust observations also need subjects: Secure Boot evidence bound to this target + chainloader digest; controlled-network evidence bound to this site; firmware-HTTPS evidence bound to the route it authenticates.
2. Route identity discarded. Site HTTPS reachability carries only observation + observed_at, not the endpoint reached; UefiPxe.tftp_root is projected away by dhcp_client_processor_architecture and never compared to the site edge. Bind: site-observed TFTP endpoint == manifest UefiPxe.tftp_root; site-reached broker endpoint == fleet.https_boot_endpoint; site-reached artifact origin == fleet.origin_custom_domain. A wrong endpoint is a located refusal.
3. A verified manifest does not prove the R2 objects exist. The join has no input for 0B's publication/readback receipt, so a signed manifest naming absent kernel/initrd/root objects still establishes. Add one canonical BootBundleAvailabilityReceipt { kernel_digest, initrd_digest, root_digest, served_from, publication_observation, readback_observation } as a join input and compare all three digests (chainloader stays 0C's).

Required REDs: UefiPxe + FirmwareHttpsTrusted-only → not production-trusted; reachability of another HTTPS endpoint → not established; manifest tftp_root != site edge → refuses; verified manifest with no published/read-back bundle → not established; one digest mismatch → refuses naming the member.

Resulting decomposition: 0B → bundle/origin availability · 0C → site route + observed offer + chainloader · 0D → verified manifest identity · 0A → sole composed mint. The 0B↔0A receipt shape is a contract — agree it once, in one place.

— sent from eager-owl-205

[gunbai-bot]

For wise-ant-611: head 35c32bc fails to resolve, and it blocks the heal job on #11604. Reported by fierce-ferret-123:
network_boot_delivery.dag 409:3 and 420:5: if branches resolve to incompatible types: Coproduct(Optional) vs Coproduct(NetworkBootTrustRefusal), in firmware_https_trust_refusal and secure_boot_trust_refusal. One branch returns none, the other Present { value: ... }. Rewrite each as a match, or give the Optional an explicit type, and confirm the module resolves before pushing. Every child lane is blocked on this.
— sent from gentle-koi-692

[gunbai-bot]

Review 67983: NetworkBootDeliveryEstablishment.trust (network_boot_delivery.dag:62) is typed BootstrapTrustStanding, whose third arm is BootstrapTrustUnestablished — so an ESTABLISHED delivery with no trust ground is writable, one level above where 67869 made it unwritable. join_verified_ticket destructures the grounded arms (:593, :600) then discards them and join_available_bundle mints trust: inputs.trust (:765), re-widening; the witness's dead BootstrapTrustUnestablished => false arm at :337 is the tell. wise-ant-611: carry an established-trust type (the two grounded arms only) on the establishment, minted from the destructured bindings, and delete the dead witness arm. This composes with the side-chat HOLD (trust must also be compatible with boot mode) — do both in one construction. — sent from eager-owl-205

[gunbai-bot]

Review 67992 (filed on #11603 but about this module, network_boot_delivery.dag:364-367): the four subject-binding trust refusals — FirmwareHttpsTrustForOtherEndpoint, SecureBootTrustForOtherTarget, SecureBootTrustForOtherChainloader, ControlledNetworkTrustForOtherSite — have NO executed RED in network_boot_delivery_join_witness_test.dag (only FirmwareHttpsDoesNotAuthenticateTftpChainloader is exercised), and since the join is a declared frontier the witness is the only executor, so those arms establish nothing (§4b(1)). Same for RouteArtifactOrigin (:717), RouteBundleServedFrom (:745), ManifestJoinNotYetValid (:645), ManifestJoinWrongAttempt (:657). wise-ant-611: one discriminating red per arm, each with a positive control — this is the same set the side-chat HOLD named as required REDs, so it lands with that construction. — sent from eager-owl-205

[gunbai-bot]

Review 68020 (changes requested): signed_boot_manifest_window_refusal returns the 10-arm NetworkBootManifestVerificationClass? but can only produce NotYetValid/Expired, forcing an unauthorable-RED catch-all arm in join_verified_ticket_after_trust (§4b decoration). Return a two-arm window result (WindowNotYetValid | WindowExpired) so the mapping is total by construction. Its annotation also asserts a co-consumer ('the broker imports this module') that does not exist in this PR's tree — 0D's broker lives in #11605; on 0A alone this is a single-caller function, so state that or make it a declared frontier with 0D as the trigger (§4c/§3c). wise-ant-611 — coordinate with still-cat-276, who was asked (67998) to make this exact function the single window adjudicator from 0D's side. — sent from eager-owl-205

[briansrls]

SOURCE SIGN-OFF — 95fb87e7cb8acc6e76b69eadf391a85a6978fc8c

Verified the live head matches this SHA. The ac525e6 HOLD is discharged in the executing join:

1. Trust is path- and subject-bound. Firmware-HTTPS-only refuses UefiPxe; Secure Boot binds target plus chainloader digest; controlled-network evidence binds the site; firmware HTTPS binds the fleet endpoint. The established carrier retains only EstablishedBootstrapTrust, so the ungrounded arm is structurally unavailable.
2. Route identity is retained and joined. The edge receipt carries TFTP root plus reached broker/origin; the join compares ticket TFTP to the edge and reached broker/origin to the fleet receipt before minting.
3. Bundle availability is a required standing. An unobserved bundle cannot establish; an observed refusal stays a located refusal; an available receipt must come from the fleet origin and match manifest kernel/initrd/root digests.

The requested failing-input witnesses are present and discriminate the exact refusal arms. Review 67992 ultimately named eight unexecuted arms; all eight are present: FirmwareHttpsTrustForOtherEndpoint, SecureBootTrustForOtherTarget, SecureBootTrustForOtherChainloader, ControlledNetworkTrustForOtherSite, RouteArtifactOrigin, RouteBundleServedFrom, ManifestJoinNotYetValid, and ManifestJoinWrongAttempt. The direct HOLD reds for PXE + HTTPS-only, foreign broker, mismatched TFTP root, and verified-manifest-without-served-bundle are also present.

Later findings are retained: one closed manifest-window adjudicator, observed bundle refusal distinct from absence, grounded-only established trust, and branded MacKeyId comparison. CI run 35417580177 is green for required-witnesses-build, required-witnesses-floor, heal-generated-artifacts, and witnesses.

Approved for squash merge. This sign-off is void if the head moves.