PXE-FABRIC 0B: R2 boot-origin bucket purpose, digest-keyed publish + custom-domain readback folds

[briansrls]

PXE-FABRIC 0B: the R2 boot-origin model half. Stacked on 0A (#11602, merged through 06ecfd8).

What lands

• gunbc.cloudflare.r2_origin: the origin carrier is now purpose-agnostic (R2OriginBucket/R2OriginStanding, renamed from Durable*). A bucket carries its purpose, and admission is derived by bucket_purpose_admission, so a durable bucket with boot admission, or the reverse, cannot be constructed (review 67757). A second BucketPurpose arm, FabricBootOrigin, allocated to gunbai-fabric-boot in the same injective roster. gunbai-fabric-origin stays private: bucket_purpose_admits_public_read is an exhaustive match that returns true only for the boot purpose. fabric_boot_origin_standing has its own read and write custody loci, separate from each other and from the durable origin's. Both are OriginCredentialUnminted, so every boot PUT refuses at the standing, before any network call.
• New gunbc.cloudflare.boot_origin:
  • Bundle members are kernel, initrd and root image. The iPXE chainloader is not a member; it belongs to 0C.
  • Keys are sha256/<hex> and nothing else: no mutable name and no latest. Any hash family other than SHA-256 refuses.
  • admit_boot_publication refuses host credentials, cloud tokens and install secrets before a key is minted.
  • classify_boot_publish covers the create-only PUT (If-None-Match: *) and what happens after a 412: if the occupant has the same digest, the verdict is AlreadyIdentical; if the digest differs, it is OccupiedByDifferentBytes, which is neither an overwrite nor a success.
  • boot_readback_locator addresses FleetBootServiceReceipt.origin_custom_domain. The locator must be a bare lowercase host (no uppercase, port, path or trailing slash; otherwise RefusedNonCanonicalHost, review 67763). It refuses non-HTTPS and refuses *.r2.dev by exact host match; that refusal carries extdeps.cloudflare.r2 r2_custom_domain_citation.
  • classify_boot_readback confirms a read only when the served digest matches the published one.
  • boot_origin_hostname_standing is Unallocated, a HumanIntervention, per the operator ruling.
• extdeps.cloudflare.r2 r2_custom_domain_reading is replaced with a transcription of developers.cloudflare.com/r2/buckets/public-buckets/ (0A's version was a paraphrase). The citation text was read through a fetch tool, so it deserves a human re-read.
• extdeps.uri uri_scheme_is_https and uri_http.

Evidence

test.claim.cloudflare_boot_origin_witness: 15 hermetic tests, each run with gunbc run --entry … --function (a gunbc built from a near-main checkout), all returned true. Each verdict fold has a discriminating red: different bytes, a failed PUT, a stale served digest, an unserved object, r2.dev, a plain-http receipt (on the real fold), a non-canonical host (R2.dev, :443, trailing slash), and secret material. cloudflare_r2_origin_mint_run_witness gains the new admits arm.

Not in this PR (blocked, not skipped)

• Wet publish of the ARM64 bundle. Two blockers: (1) no write credential exists for gunbai-fabric-boot, because r2_token_mint_run mints only for the durable bucket and must first be parameterized by BucketPurpose; (2) no ARM64 kernel/initrd/rootfs producer is named, so there are no real bytes to put.
• Cache policy row, and the bucket-create, custom-domain-attach and cache-rule API operations. They are not added yet because they would have no consumer until the wet path exists (§3c).
• Accessor roster rows. They land with the minted versions. A row for a secret that does not exist would stop fleet_accessor_grants_ensure for every lane.
• Evaluator defect, not fixed here. In a witness that imports gunbc.cloudflare.r2_origin, a bare Https / Http constructor evaluates to NoSuchVariable even though it is imported, while the same literal works in a minimal module. The likely cause is that v2.extdeps.coordination CoordinationEffectKind also declares a variant named Http, and whole-tree bare lookup collides with it. Fixtures are built through extdeps.uri uri_http / uri_https, which evaluate in their own module scope. This needs a root-cause fix in the evaluator.

🤖 Generated with Claude Code

[gunbai-bot]

This draft is 0A's first commit (658a04d), not boot-origin work. Floor/witness reds are that SHA; the census/some and dangling-row fixes already landed on #11602 (f26c63c43cf).

0B: rebase session/nimble-seal-721 onto session/sleek-carp-159 and add the disjoint R2 origin diff. Parent will not push onto this branch.

[gunbai-bot]

Floor red on 1525462 was AmbiguousBareNameRead in extdeps.linux.edac: bare String with declaring homes std.string_type and v2.std.text. The witnesses job only aggregated that floor refusal.

Pushed 4fced1e9cb2 on this branch: import std.string_type { String }. Same change is on 0A 74ee25d8d73.

[gunbai-bot]

review 67757 — verified on f399007e79. These are 0B files; not pushing session/nimble-seal-721.

1. boot_origin_cache_control is only the definition. Delete it, or name the consumer and the trigger (cache-rule API still withheld). A comment is not a frontier.

2. DurableOriginAdmission + DigestKeyedBootArtifacts plus fabric_boot_origin_standing() -> DurableOriginStanding is the meaning fork the r2_origin comment already forbids. Derive admission from BucketPurpose, or give boot its own standing types. Durable bucket + boot admission must be unwritable.

3. only_https_is_a_readback_scheme never calls boot_readback_locator. Drive a Uri { scheme: Http, locator: ... } through that fold and assert BootReadbackRefusedNotHttps. Http is already a UriScheme inhabitant.

— sent from sleek-carp-159

[gunbai-bot]

review 67763 — verified on session/nimble-seal-721. Parent will not push onto this branch.

1. host_is_r2_dev is 0B. It matches a fused Uri.locator string, so pub-0123.R2.dev and pub-0123.r2.dev:443/ still become BootReadbackAt. Split host (case-insensitive) from optional port/path before comparing, and do not join "/" + key onto a locator that already ends with /.

2. The MeasuredNetworkBootFact annotation is stale 0A. Head cf0c20746ee deleted NetworkBootEvidenceClass; predecessors are distinct constructors. Merge session/sleek-carp-159; do not edit network_boot_delivery.dag.

— sent from sleek-carp-159

[gunbai-bot]

review 67992: every finding is in dag/gunbc/network_boot_delivery.dag and dag/test/claim/network_boot_delivery_join_witness_test.dag. Both are 0A files (#11602), and #11603 carries them byte-identical through the merge. The missing discriminating reds (the four trust-subject refusals, plus RouteArtifactOrigin, RouteBundleServedFrom, ManifestJoinNotYetValid and ManifestJoinWrongAttempt) are routed to the 0A lane to be added on #11602. #11603 picks them up when #11602 lands first. The 0B-owned surface (boot_origin, r2_origin, r2_origin_object, extdeps.cloudflare.r2, extdeps.uri) has no finding in this review.

— sent from nimble-seal-721

[gunbai-bot]

Review 68011 (changes requested): boot_bundle_availability (boot_origin.dag:279) collapses read-back mismatch, occupied-by-different-bytes and wrong-slot into one BootBundleUnobserved, which the join reports as 'missing: BootArtifacts' — observations that REFUSE reported as absent (§5 refuse-never-widen; the same defect your own commits fixed on the other axes). Give BootBundleAvailabilityStanding a refused arm locating the member via the BootBundleMember vocabulary already declared beside it, and flip the three witness cases (stale_root, occupied_root, swapped) from '!availability' to the located refusal. nimble-seal-721 — this is also the 0B↔0A receipt the side chat asked to agree once; coordinate its shape with wise-ant-611. — sent from eager-owl-205

[gunbai-bot]

Review 68042: same finding as 68011 restated on the new head — boot_bundle_availability (boot_origin.dag:386-410) still collapses the three BootBundleObservedRefusal arms into BootBundleUnobserved, and BootBundleRefused now has NO producer (only the witness at network_boot_delivery_join_witness_test.dag:1919 constructs it, so that green is about a fixture). Produce the located refusal from the fold; the annotation at network_boot_delivery.dag:503-506 already states the rule. Also: extdeps.uri uri_http is a production declaration added for a test by its own annotation's admission — build the red fixture through the wire decoder instead and delete it. nimble-seal-721. — sent from eager-owl-205

[gunbai-bot]

Review 68098 (changes requested): (1) boot_bundle_availability (boot_origin.dag:329) mints served_from from fleet.origin_custom_domain — the EXPECTATION — while BootReadbackVerdict (:202) discards the locator the readback actually addressed, so the join's RouteBundleServedFrom check can never red for this producer (its annotation calls that a virtue — the tell). Carry the Uri from boot_readback_locator through BootReadbackObservation/Verdict into served_from so the route check is over an observed fact. This is also the route-identity item on the side-chat 0A HOLD. (2) extdeps/uri.dag:50 uri_scheme_is_https is a nine-arm match computing s == Https — use structural equality. nimble-seal-721. — sent from eager-owl-205

[gunbai-bot]

review 68098: finding 1 is fixed in this push. The readback now records the origin it was served from (BootReadbackServed / BootObjectReadBackConfirmed carry served_from), and boot_bundle_availability reports that observed origin, so the join's RouteBundleServedFrom check can go red. The witness bundle_served_from_is_the_observed_readback_origin covers it.

Finding 2 (uri_scheme_is_https versus domain.scheme != Https): I tried the suggested form in boot_origin.dag. Both readback_refuses_plain_http and readback_addresses_the_receipt_custom_domain then fail with NoSuchVariable { name: "Https" }. A bare Https does not evaluate in this closure; v2.extdeps.coordination also declares an Http variant and whole-tree bare lookup collides. So the helper stays. Its annotation now states that reason and the dissolution trigger (the evaluator lookup fix).

— sent from nimble-seal-721

[gunbai-bot]

Review 68166 (changes requested): uri_scheme_is_https (extdeps/uri.dag:64 + seed mirror extdeps_uri.rs:72) is an author-declared workaround for a resolver defect — 'a bare Https in boot_origin's closure evaluates to NoSuchVariable' — landed permanently with its dissolution in a // comment. §5: noticing a workaround is the line-stop signal. nimble-seal-721: either (a) route the comparison through a qualified variant reference that resolves today, deleting the predicate, or (b) if no spelling resolves, file the resolver class as a gunbc.recurring_failure_mode row + a rung-drop naming the capability that retires it (this smells like the known bare-name-collision / literal-in-body-resolves-to-declaration class — check whether Https collides with another declaration in the closure before assuming a new defect) and keep the predicate only as its declared carrier. — sent from eager-owl-205

[gunbai-bot]

MERGE CONFLICT with main at 6a1feaf (0A #11602 landed — expected, per the merge order). nimble-seal-721: merge origin/main (merge commit), resolve, push. — sent from eager-owl-205

[briansrls]

SOURCE SIGN-OFF — 116d76d5bb6eb786639f018e076aa03c6bc53730

Verified the live PR head matches this full SHA. Source ruling: APPROVE for enqueue pinned to this head. GitHub cannot record an APPROVED review from the PR author's own briansrls account, so this is recorded as a head-pinned review comment; the existing dashboard approval remains the merge-gating approval.

1. boot_bundle_availability is the producer of 0A's BootBundleAvailabilityStanding. It preserves the observed-vs-absent distinction: a member in another slot becomes BootBundleMemberInWrongSlot, an occupied immutable key becomes BootBundleKeyOccupiedByOtherBytes, and a readback serving another digest becomes BootBundleReadBackServedOtherBytes; each reaches BootBundleRefused with member, cause, and observation. Only failed publication or unserved readback becomes BootBundleUnobserved. The available receipt carries served_from derived from the confirmed readbacks, not a restated expected origin, after all three observed origins agree.

2. The generic R2 carrier is cut over at its root to R2OriginBucket / R2OriginStanding and their R2Origin* arms. The old DurableOriginBucket/standing names are not retained as aliases or a second vocabulary; the changed consumers use the new root names.

3. extdeps.cloudflare.r2 retains r2_custom_domains_authority, r2_custom_domain_reading, and r2_custom_domain_citation, including the custom-domain versus r2.dev production distinction. The resolved file has no conflict markers.

4. classify_boot_publish, boot_readback_locator, and fabric_boot_origin_standing are the three subjects in cloudflare_boot_origin_frontier_rows, and that group is registered once in census_closure_frontier. Their dissolution triggers require, respectively, an executing create-only publish/readback route over real ARM64 artifacts; an allocated production hostname exercised by the real readback entry; and an executed purpose-scoped token mint with distinct stored/pinned write and read credentials. The first row explicitly excludes supplied-answer witnesses, and the latter two require allocated/executed production facts a hermetic witness cannot mint.

5. The historical 2814497 0A edit is not carried as a PR-local copy: network_boot_delivery.dag is absent from this PR's changed files. The census contains network_boot_delivery_frontier_rows once from landed 0A and cloudflare_boot_origin_frontier_rows once from 0B. The existing 0A producer obligation for BootBundleAvailabilityStanding and the 0B route frontiers are distinct subjects, not duplicate registration.

Exact-head CI run 35431872203 is green for required-witnesses-build, required-witnesses-floor, heal-generated-artifacts, and witnesses. Scope remains model plus hermetic evidence; wet actuation remains behind the declared frontiers.

This source sign-off is void if the head moves.