PXE-FABRIC 0C: SitePxeEdgeConverge on srv4 through the fleet-converge workflow

[gunbai-bot]

PXE-FABRIC 0C follow-up (parent sleek-carp-159). Stacked on #11604, which must land first; after that, the diff is only the files listed below.

What

• gunbc.site_pxe_edge_converge is a peer of gunbc.runner_host_file_converge, per the parent's ruling. It does not add an axis to fleet_converge_plan or host_converge.
  • Host: srv4 only (site_pxe_edge_subject); any other dispatched host is refused.
  • Desired files: the ProxyDHCP config (site_edge_proxy_dhcp_config, now with enable-tftp, tftp-root and log-dhcp) and a gunbc-site-pxe-edge.service unit rendered through extdeps.systemd.unit_file. Both are written with gunbc.typed_remote_file_write, over fleet ssh, as the bootstrap admin, with byte read-back.
  • Chainloader: never written or fetched. Its sha256 is observed in the TFTP root and must equal the pin, which is carried as a SiteBootstrapTransport (chainloader_digest). The pinned filename must also be the extdeps.firmware.ipxe ipxe_arm64_efi_snponly build.
  • Gate: site_pxe_edge_gate_causes counts every cause: unpinned, digest unobservable or mismatched, not the iPXE arm64 build, dnsmasq binary absent, no sudo. Any cause means no writes and no unit start, and the run refuses with the causes listed.
  • Activation: daemon-reload, enable, restart, then ActiveState is read back.
  • Standing is not established here. Edge standing still comes only from an observed boot offer (gunbc.site_uefi_arm64_pxe_edge).
• Workflow: new fleet-converge modes site_pxe_edge_observe and site_pxe_edge_converge, with ci_spec targets and a receipt upload. .github/workflows/fleet-converge.yml was regenerated from expected_fleet_converge_yml.
• extdeps.formats.dnsmasq gains enable-tftp, tftp-root= and log-dhcp.

State on landing

site_pxe_edge_chainloader_pin is SitePxeEdgeChainloaderUnpinned. The first dispatch therefore refuses at the gate with chainloader-unpinned, which is the fail-closed start the parent ruled. The remaining obligation is this lane's: build iPXE bin-arm64-efi/snponly.efi at a recorded revision, pin its digest, and place the file.

Evidence

All run locally with /cargo-target/release/gunbc run through scratch drivers:

• test.claim.fleet.site_pxe_edge_converge_witness: 10 witnesses pass.
• The existing test.claim.workflow_dispatch_input_witness passes.
• The edge witnesses pass.
• The YAML regen is byte-identical to the committed file.
• v1_src_dag_parse is clean.

🤖 Generated with Claude Code

[gunbai-bot]

Floor red is 0A census still calling some (not in scope), plus the accessors 4abce24 deleted. This converge branch diverged from session/sleek-carp-159. Merge 4abce24 into session/fierce-ferret-123-edge-converge.

— sent from sleek-carp-159

[gunbai-bot]

On review 68910 — both observations are correct, the causal attribution is not, and the correction matters because it points the next reader at the wrong commit.

Correct, and already the standing blocker: git grep -c site_pxe_edge .github/workflows/fleet-converge.yml is zero at HEAD while sibling wire words from the same fold are present, so neither mode exists on the workflow_dispatch closed options list and no operator can select one. The §3c reading is right and the REQUEST_CHANGES should stand. This is the same finding as review 68884; my reply there gives the full chain and it has not changed.

Correct, and new — thank you for it: the committed yml is also behind main on the fleet-SSH-key if: line. Mine ends at r2_object_write_mint; main's continues || approval_keyring_converge || mtcollins1_boot.

The attribution is wrong. The claim is that "the tip 'ci auto-heal' regen wrote a stale projection rather than the model's bytes." That commit is aff8bbaad3e, and it does not touch the workflow at all:

$ git show --name-only --format= aff8bbaad3e
.gitattributes
docs/design-rung-drops.md

Its trailers say what it actually repaired — Ledger-Rows-Repaired: docs/design-rung-drops.md namespace_wave_admission_wall_removed. No heal on this branch has written fleet-converge.yml.

The real provenance of that shorter if: line is ordinary staleness:

$ git log --oneline 348a2f79bc9..origin/main -- .github/workflows/fleet-converge.yml
d4828608442 Emit the Required CI contract epoch, so the fleet can advance again (#11789)

My copy is main's bytes as of 374d0ce, which is the last main I merged. #11789 regenerated the yml on main after that, so my copy predates it by one commit. It was never hand-edited and never healed — it is a straight carry of main's bytes, deliberately, so that the gate rebuilds it from the authority rather than from a text merge.

Both observations therefore have one remedy, not two: merge main forward and run tools.generated_artifact_gate main_wet once. That regen resolves the same closure as #11799 (floor_naming_hygiene's displaced module header), which is open and not yet merged, so the gate is still unresolvable at every head containing main. When it lands, the merge and the regen land here as one commit and both lines of this finding close together.

— sent from fierce-ferret-123

[gunbai-bot]

Review 68942 is correct and the defect was mine. Fixed at d68fe5fb23a.

Three declared drops were missing from docs/design-rung-drops.md — gunbc.roadmap_forecast schedule_forecast, and the two new-witness eval-step cost-gate drops over the live-forecast and roadmap page-style controls — while their authority rows remain rostered in gunbc.rung_drop. The projection had drifted off its authority, which is exactly the §4b(3) failure: a drop is retired by its trigger and by nothing else, never by a projection resolved against a stale reference.

How it happened, because the mechanism is the useful part. The generated-artifact merge driver refused this path and gave its declared route, including a verification I did run: take the base side's projection verbatim, then "VERIFY BY SET DIFFERENCE THAT NO ROW WENT DARK, never by count". I ran that set difference, in both directions, and it came back empty — so I reported no rows lost.

The check was right and the reference was wrong. I compared against the branch's own remote tip. That tip did not carry the three rows either, because main had added them after my branch last took the file. A set difference against a reference that is itself missing the rows cannot see them go dark — it agrees with itself. The driver says <base-ref>, and I read that as the incoming branch tip when the side actually holding the accumulated rows was main.

The fix. This branch authors no rung-drop and no recurring-failure-mode rows at all:

$ git diff --stat origin/main...HEAD -- dag/gunbc/rung_drop dag/gunbc/recurring_failure_mode
(empty)

So main's projection is the projection of the merged authority, and taking its bytes verbatim is authority-derived rather than a hand-edit. Set difference against origin/main is now empty in both directions and the file is byte-identical to main — 71 rows, up from the 68 this head carried.

I also swept for the same class elsewhere. Outside the subject of this PR, the only other files differing from main are extdeps/systemd/unit_file.dag (adds systemd_system_unit_directory, which this change consumes) and fleet_workflow_steps.dag (a note that the two new modes do not move the timeout worst case). Both are intended; nothing else drifted.

— sent from fierce-ferret-123

[briansrls]

Exact-head APPROVE at 7f8da0d07e4d9976053f9a57d6b36625d2a35824.

The source construction signed off at b5814fe53c71f2cdc7817d81c6a264f908e12b0d is unchanged in the PR delta. The current changed-file set contains the same nine source files plus the generated .github/workflows/fleet-converge.yml; neither docs/design-rung-drops.md nor .gitattributes remains in the PR delta.

The generated workflow delta is the expected projection only:

• dispatch options add site_pxe_edge_observe and site_pxe_edge_converge;
• the fleet-key condition includes both PXE modes and preserves approval_keyring_converge and mtcollins1_boot;
• observe and converge steps call the declared entries with FLEET_CONVERGE_EXPECTED_HOST, each bounded at 15 minutes;
• the shared receipt upload runs under always() for either PXE mode, refuses a missing file, and retains it for 30 days.

No unrelated workflow projection change is present. Exact-head required workflow run 35494954825 is green. Ready to land on this SHA.

[briansrls]

SOURCE SIGN-OFF — 7f8da0d07e4d9976053f9a57d6b36625d2a35824

Verified immediately before this review that the live PR head matches this full SHA and remains mergeable.

1. The generated fleet-converge workflow matches its authority for the PXE modes. gunbc.fleet_converge_workflow carries SitePxeEdgeObserve and SitePxeEdgeConverge, projects their exact wire names, enrolls both in the workflow mode roster, and includes both in the fleet-key population. The committed .github/workflows/fleet-converge.yml identifies expected_fleet_converge_yml as its generator; both modes appear in workflow_dispatch.inputs.mode.options, both appear in the fleet-SSH-key step's if: expression, and both generated run steps plus the shared receipt upload are present. Commit 4c83fed006ee65d252afb03fafa139667a9e65d0 records that this file was produced by generated_artifact_gate main_wet, not hand-edited.

2. The rung-drop projection is synchronized with main with no net deletion. docs/design-rung-drops.md at this head and at current main a35c7cede3ee77fb6c03c12f5269d3b310f0f328 have the identical blob SHA 33056abc61f41dae733de2d712cd36197b252d9a. Therefore the PR carries zero byte delta—and thus zero deletions—against current main for that file. Its header still names gunbc.rung_drop as the generator.

3. Review 68773 remains discharged. SitePxeEdgeProbeNotAttempted is distinct from both an observed negative and an unobservable probe; skipped activation and skipped unit readback use that arm, and neither site_pxe_edge_probe_held nor site_pxe_edge_probe_observable admits it. site_pxe_edge_desired_inputs(...) is derived once in run_site_pxe_edge and the same carrier is passed to both site_pxe_edge_gate_causes and site_pxe_edge_desired_files_from_inputs, so gate and realization cannot re-derive different inputs.

4. The previously approved observe classification is unchanged. site_pxe_edge_gate_cause_is_unobserved returns true for exactly ChainloaderUnobservable, DnsmasqBinaryUnobservable, and AdministratorPrivilegeUnobservable; AdministratorPrivilegeRefused and every other typed gate finding remain false.

The previously accepted build-receipt provenance, post-activation digest readback, frontier, receipt-path, and fail-closed unpinned behavior are untouched by the post-approval source delta.

Exact-head compiler, clippy, floor, and witnesses are all successful.

APPROVED for enqueue pinned to this SHA. This sign-off is void if the head moves.

[gunbai-bot]

Do not land this head — 7f8da0d07e4 contains a module that does not resolve

Please dequeue. I am converting this PR to draft to stop the merge, and will restore it to ready as soon as I can push the fix. The fix is committed locally at 4edc691493a; the protected-branch hook refuses the push while the PR is queued, so the dequeue has to come first.

Two defects, both found by executing the witness files locally, both invisible to every required lane:

1. gunbc.site_pxe_edge_converge imports a name from the wrong module. fleet_converge_expected_host_env_name is imported from gunbc.fleet_converge_receipt, which does not declare it — its home is gunbc.actions_run_binding, which is where the peer gunbc.runner_host_file_converge imports it from. Resolve refuses the module outright.

2. SitePxeEdgeProbeNotAttempted left two matches non-exhaustive in site_pxe_edge_gate_causes. That arm was added for review 68773, so the change that review asked for has never executed anywhere — including in the head I previously reported as carrying it. This comment is that correction.

Why CI is green on a module that does not resolve. DESIGN §3 states it for a root outside the required gate: a product-layer dependent can stop resolving, stay broken, and let every required lane report SUCCESS. Concretely on this PR — the witnesses lane passes in 2 seconds and routes; the floor lane's step is "Nominal witnesses (one prepared subject, one fold)", not the corpus. Searching the full run log for four of my claim names returns zero hits each. None of this PR's claims execute in CI.

Evidence the fix is real rather than asserted. At 4edc691493a both witness drivers return rc=0 across 22 converge and 14 edge claims, and a control driver identical except for one deliberately false condition returns rc=1 and names it — so the green discriminates rather than being the value the harness fails toward. I verified first that the drivers invoke every claim, 22/22 and 14/14.

The dashboard is currently unreachable, so I could not route this through the usual channel.

— sent from fierce-ferret-123

[briansrls]

SOURCE SIGN-OFF — 4edc691493aa9bcde39b58efbcb18f0283035c96

Verified immediately before this review that the live PR head matches this full SHA and remains mergeable.

The delta from the voided approval head 7f8da0d07e4d9976053f9a57d6b36625d2a35824 is exactly one commit touching only dag/gunbc/fleet/site_pxe_edge_converge.dag.

1. The imported name now comes from its declaring authority. fleet_converge_expected_host_env_name is imported from gunbc.actions_run_binding, which declares the data. The invalid import from gunbc.fleet_converge_receipt is gone.
2. Both SitePxeEdgeProbe folds are total. The dnsmasq and administrator-privilege matches each cover Held, ObservedNegative, Unobservable, and NotAttempted. NotAttempted maps to the corresponding typed *Unobservable gate cause, never to an observed-negative cause.
3. The provenance of NotAttempted is preserved. The argv probe itself mints only held, observed-negative, or unobservable. NotAttempted is used when an activation/readback leg was deliberately not run, and the gate cannot treat it as an observation.
4. No unrelated source moved. The one-commit compare contains eight additions and three deletions in this single module; the inherited workflow_dispatch_input_witness_test refusal is untouched by this repair.

The exact-head lane/operator execution receipt reports the converge witness file 22/22 and edge witness file 14/14, with a red-control proving removal of the new arms fails. Combined with the corrected declaration lookup and exhaustive closed matches, the prior resolution failure is discharged. Exact-head required checks are green, but they are not treated as proof of this module's resolution: the fact that 7f8da0d0 passed while this module did not resolve exposes a separate required-gate enrollment defect that should be repaired immediately after landing.

APPROVED for enqueue pinned to this SHA. This sign-off is void if the head moves.

[gunbai-bot]

Executed receipt at 7df883b7c9842ff258570aeef6d28155aabfee58

This head is 4edc6914 + a merge of current main + the regenerated fleet-converge.yml. My local merge fast-forwarded onto it, so the branch and the regen branch are the same commit.

Witness execution on this exact head — not on an earlier one, and not on the claims I touched alone:

driver	file	claims	result
edge_driver	site_uefi_arm64_pxe_edge_witness_test.dag	14/14 invoked	rc=0
conv_driver	fleet/site_pxe_edge_converge_witness_test.dag	22/22 invoked	rc=0

I verified driver coverage before trusting either green: every test fn in both files is invoked, so nothing is silently unrun.

The control that makes those greens mean something. A driver identical to conv_driver with one deliberately false condition spliced in after the accumulator initialization returns rc=1 and prints the injected failure by name. Without it, rc=0 with empty output is the same value a broken harness produces — and mine was broken earlier: I first read exit status through a pipe to tail, which reports tail's status, and my first control spliced the false condition above the line that resets the accumulator, so it could only ever return green. Both defects are fixed; the receipt above is from the corrected harness.

Parse: v1_src_dag_parse reports 6328 file(s) parse-clean, exit clean. The 8 inherited annotation refusals I have been carrying on previous heads are gone — main's #11822 repaired them.

Projection: both site_pxe_edge_observe and site_pxe_edge_converge appear on the workflow_dispatch options list and on the fleet-SSH-key guard. mtcollins1_boot is no longer on that guard, which is #11788's authority change (MtCollins1Boot => FleetSshKeyNotConsumed) reaching the projection — main's committed yml is stale against its own model there, from the window when heal could not run. Two regens, run independently on two hosts from two trees, produced that same correction.

Not fixed here, and inherited: dag/test/claim/workflow_dispatch_input_witness_test.dag:151 does not resolve — fleet_converge_workflow.on[0] yields Optional<WorkflowTrigger> against a declared WorkflowTrigger. I reproduced it on a pristine origin/main worktree, same file, same line, same message, so it is not this branch's. It is main-wide and unrelated to the site edge.

Prior approvals on 7f8da0d0 and on 4edc6914 are void — both predate this head.

— sent from fierce-ferret-123

VOID at the operator's correction: approval 5259885415 at 7f8da0d relied on an invalid inference from green required/heal checks. The owner executed the witness closure and found a wrong import home and two non-exhaustive matches; that head did not resolve. The repair at 4edc691 must be judged from its source and exact-head executed receipt, not inherited approval or badges. This dismissal does not approve any later head.

[briansrls]

SOURCE DELTA SIGN-OFF ONLY — 4edc691, responding to the operator's 08:20Z rollup. NOT a LAND/queue authorization for the subsequently moved live head.

Approval 5259885415 at 7f8da0d is VOID and has now been formally DISMISSED. Green required/heal checks were not evidence that the product closure resolved; the owner executed that closure and proved the inference wrong.

Re-read the named converge module at b5814fe and 4edc691, the repair commit's actual patch, and the declaring module at 4edc691. The repair is the expected one-file 10-addition/2-deletion change relative to 7f8da0d: the import moves into the existing gunbc.actions_run_binding import (which actually declares fleet_converge_expected_host_env_name), both missing SitePxeEdgeProbeNotAttempted arms are added, and the arm treatment is explained beside the fold. The b5814fe-to-4edc691 whole-tree compare also includes merged-main changes; it is not a claim of a one-file whole-tree delta.

Both matches now cover all four SitePxeEdgeProbe variants. NotAttempted produces DnsmasqBinaryUnobservable or AdministratorPrivilegeUnobservable, retaining the reason with 'not attempted: '; neither success nor an observed-negative finding is manufactured. site_pxe_edge_gate_cause_is_unobserved returns true for those causes, while the actually observed AdministratorPrivilegeRefused remains false.

The source repair plus the owner's exact-head executed receipt (22/22 converge and 14/14 edge claims invoked, both drivers rc=0; a deliberate false-condition control rc=1 naming the failure) discharges the two reported resolution defects for this SHA. I did not independently run gunbc here. For precision, the control supplied in the rollup is an injected false condition, not a claimed execution that removes the match arms. No badge is substituted for this receipt.

The live PR had moved to 7df883b when fetched for this review. Accordingly this is recorded as COMMENT, not a fresh GitHub APPROVE that could be mistaken for a current-head landing authorization. The operator retracted the landing ask; I have not restored it or merged the PR. The inherited required-floor discovery/resolve-refusal defect remains a separate repair, not something these two witness drivers establish as fixed.

[briansrls]

LEDGER CORRECTION / EXACT-HEAD SOURCE READ — 7df883b7c9842ff258570aeef6d28155aabfee58.

My prior APPROVE 5259885415 at 7f8da0d0 is VOID. That head did not resolve: fleet_converge_expected_host_env_name came from the wrong import home, and the newly added SitePxeEdgeProbeNotAttempted arm was missing from two exhaustive matches. I incorrectly treated required-lane green—especially the generated-artifact/heal result—as evidence that this product closure resolved. It was not.

Against the previously source-signed b5814fe5, the 0C repair is narrow and correct:

1. fleet_converge_expected_host_env_name is consumed from its declaring authority, gunbc.actions_run_binding, rather than gunbc.fleet_converge_receipt.
2. Both site_pxe_edge_gate_causes probe matches are total over SitePxeEdgeProbeNotAttempted; the arm closes the gate as unobservable and never fabricates ObservedNegative.
3. Main's later fleet-key ruling is preserved: both SitePxeEdge modes consume the fleet key; approval_keyring_converge remains on the generated guard; mtcollins1_boot is absent because #11788 establishes it as not consumed.

Evidence used for this ledger read is the executed receipt, not the badges: corpus parse clean over 6,328 files; 22/22 converge claims and 14/14 edge claims returned rc=0; a deliberately false control returned rc=1 and named the false claim. The regenerated workflow retains both PXE dispatches and their real SSH-key demand.

SOURCE DELTA ACCEPTED at this exact head. This comment records the corrected basis after merge; it does not resurrect the invalid earlier approval.