PXE-FABRIC 0C: SitePxeEdgeConverge on srv4 through the fleet-converge workflow

.github/workflows/fleet-converge.yml

@@ -1,5 +1,3 @@
-# Generated by gunbc.fleet_converge_workflow expected_fleet_converge_yml — do not hand-edit.
-# Authority: gunbc.fleet_converge_workflow fleet_converge_workflow; regen via tools.generated_artifact_gate main_wet.
 name: fleet-converge
 run-name: fleet-converge ${{ inputs.mode }} ${{ inputs.host }} nonce=${{ inputs.transaction_nonce }}
 on:
@@ -13,7 +11,7 @@ on:
       mode:
         description: plan shows membership hunks; apply executes a prior plan artifact; org_actions_observe validates the org credential and refuses on runner-group drift; app_control_plane_observe reads the gunbai-ci App registration and webhook config with a short-lived App JWT and refuses on hook-config drift; microvm_host_converge installs the cited Firecracker release on the selected host and refuses the kvm grant by name; guest_image_observe reports the micro-VM base artifacts and their measured digests on the selected host and builds nothing; guest_image_converge builds the runner guest image there; microvm_boot_probe boots that image and reads its serial console; spark_grants and spark_bootstrap prepare the selected Spark; spark_serving_apply applies the promoted fabric groups' vLLM units over the password session, workers before heads; spark_runtime_image_probe pulls the pinned runtime image on the selected Spark and reads its capabilities from inside its own digest, changing nothing; host_reset_return drives a rostered reset subject through its controller and measures the return FROM A PEER, and takes reset_observer rather than host because the observer must not be the subject; runner_host_file_observe reads the runner teardown drop-in, the needrestart deferral and the loaded teardown on the selected host as its administrator and writes nothing; runner_host_file_converge writes whichever of those two files differs, reloads systemd only if the drop-in changed, and refuses unless the manager then reports the declared teardown
         required: true
-        options: [plan, launch_environment_plan, allocation_store_plan, apply, org_actions_observe, app_control_plane_observe, microvm_host_converge, guest_image_observe, guest_image_converge, microvm_boot_probe, spark_grants, spark_bootstrap, spark_serving_apply, spark_runtime_image_probe, dashboard_deploy, rlm_launch_deployment_receipt, host_reset_return, runner_host_file_observe, runner_host_file_converge, runner_password_session_tool_converge, r2_mint_preflight, r2_object_write_mint]
+        options: [plan, launch_environment_plan, allocation_store_plan, apply, org_actions_observe, app_control_plane_observe, microvm_host_converge, guest_image_observe, guest_image_converge, microvm_boot_probe, spark_grants, spark_bootstrap, spark_serving_apply, spark_runtime_image_probe, dashboard_deploy, rlm_launch_deployment_receipt, host_reset_return, runner_host_file_observe, runner_host_file_converge, site_pxe_edge_observe, site_pxe_edge_converge, runner_password_session_tool_converge, r2_mint_preflight, r2_object_write_mint]
         type: choice
       target:
         description: "Spark target host for the spark_* modes, naming the administrator credential the run materializes (any rostered Spark: srv5, srv6, srv7, srv8, srv9, srv10, srv11, srv12); apply reads the subject off the plan artifact"
@@ -661,6 +659,36 @@ jobs:
           retention-days: 30
         if: always() && (github.event.inputs.mode == 'runner_host_file_observe' || github.event.inputs.mode == 'runner_host_file_converge')
         timeout-minutes: 10
+      - name: "Site PXE edge: observe the chainloader digest, dnsmasq, the edge config and unit (no writes)"
+        id: site_pxe_edge_observe
+        run: |
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/fleet/site_pxe_edge_converge.dag --function site_pxe_edge_observe_ci_wet
+          cat "$ROOT/target/site-pxe-edge-converge-receipt.txt"
+        env:
+          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
+        if: github.event.inputs.mode == 'site_pxe_edge_observe'
+        timeout-minutes: 15
+      - name: "Site PXE edge: if the gate is open, write what differs, restart the unit, read its active state back"
+        id: site_pxe_edge_converge
+        run: |
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/fleet/site_pxe_edge_converge.dag --function site_pxe_edge_converge_ci_wet
+          cat "$ROOT/target/site-pxe-edge-converge-receipt.txt"
+        env:
+          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
+        if: github.event.inputs.mode == 'site_pxe_edge_converge'
+        timeout-minutes: 15
+      - name: Upload site PXE edge converge receipt
+        id: site_pxe_edge_receipt_upload
+        uses: actions/upload-artifact@v4
+        with:
+          name: site-pxe-edge-converge-receipt
+          path: target/site-pxe-edge-converge-receipt.txt
+          if-no-files-found: error
+          retention-days: 30
+        if: always() && (github.event.inputs.mode == 'site_pxe_edge_observe' || github.event.inputs.mode == 'site_pxe_edge_converge')
+        timeout-minutes: 10
       - name: Kill the in-run ssh-agent (key never outlives the job)
         run: |
           if [ -n "${SSH_AGENT_PID:-}" ]; then ssh-agent -k || true; fi

dag/extdeps/cloudflare/r2.dag

@@ -480,7 +480,6 @@ fn r2_published_location_citations() -> List<FactCitation> {
   ]
 }
 
-
 // THE r2_s3_endpoint_url ROW IS RETIRED: gunbc.cloudflare.r2_origin_object reaches it through
 // r2_object_url on the executing put_origin_object and fetch_origin_object entries, which is the
 // consumer the row named. The list is the membership of what remains. r2_tokens_doc_as_of stays:

dag/extdeps/firmware/ipxe.dag

@@ -0,0 +1,36 @@
+module extdeps.firmware.ipxe
+
+import std.types { NonEmptyStr }
+import extdeps.uri { Uri, Https }
+import extdeps.external_authority { ExternalAuthority }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "ipxe.org/docs"
+  }
+}
+
+data ipxe_chainloading_authority: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "ipxe.org/howto/chainloading"
+  }
+}
+
+// iPXE's own build grammar: `make <platform>/<image>` from src/, e.g. bin-arm64-efi/snponly.efi.
+// snponly.efi drives the NIC through the firmware's SNP protocol instead of a native iPXE driver,
+// which is the image the chainloading how-to names for UEFI.
+type IpxeBuildTarget {
+  platform: NonEmptyStr
+  image: NonEmptyStr
+}
+
+data ipxe_arm64_efi_snponly: IpxeBuildTarget = IpxeBuildTarget {
+  platform: "bin-arm64-efi",
+  image: "snponly.efi",
+}
+
+fn ipxe_build_target_path(target: IpxeBuildTarget) -> NonEmptyStr {
+  join([target.platform as String, "/", target.image as String], "") as NonEmptyStr
+}

dag/extdeps/formats/dnsmasq.dag

@@ -23,7 +23,11 @@ type DnsmasqDirective =
   | DnsmasqDhcpRangeProxy { network_address: String }
   | DnsmasqDhcpMatchSet { tag: String, option: String, value: String }
   | DnsmasqDhcpOptionForceTag { tag: String, option: String, value: String }
-  | DnsmasqDhcpBootTag { tag: String, target: String }
+  | DnsmasqDhcpHostSetTag { mac: String, tag: String }
+  | DnsmasqDhcpBootTags { tags: List<String>, target: String }
+  | DnsmasqLogDhcp
+  | DnsmasqEnableTftp
+  | DnsmasqTftpRoot { path: String }
 
 data dnsmasq_protocol: LayoutProtocol = LayoutProtocol { indent_unit: "" }
 
@@ -36,8 +40,13 @@ fn dnsmasq_directive_line(d: DnsmasqDirective) -> String {
       concat(concat(concat("dhcp-match=set:", tag), concat(",", option)), concat(",", value))
     DnsmasqDhcpOptionForceTag { tag: tag, option: option, value: value } =>
       concat(concat(concat("dhcp-option-force=tag:", tag), concat(",", option)), concat(",", value))
-    DnsmasqDhcpBootTag { tag: tag, target: target } =>
-      concat(concat("dhcp-boot=tag:", tag), concat(",", target))
+    DnsmasqDhcpHostSetTag { mac: mac, tag: tag } =>
+      concat(concat("dhcp-host=", mac), concat(",set:", tag))
+    DnsmasqDhcpBootTags { tags: tags, target: target } =>
+      concat(concat("dhcp-boot=", fold(tags, init: "", f: (acc, t) => concat(acc, concat(concat("tag:", t), ",")))), target)
+    DnsmasqLogDhcp => "log-dhcp"
+    DnsmasqEnableTftp => "enable-tftp"
+    DnsmasqTftpRoot { path: path } => concat("tftp-root=", path)
   }
 }
 

dag/extdeps/linux/edac.dag

@@ -7,7 +7,8 @@ import extdeps.uri { Uri, Https }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import std.measure { MemoryControllerCount, memory_controller_count, memory_controller_count_value }
 import v2.std.optional { Absent, Present }
-import std.types { Bool, NonEmptyStr, String }
+import std.string_type { String }
+import std.types { Bool, NonEmptyStr }
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri {
     scheme: Https

dag/gunbc/boot_artifact_delivery.dag

@@ -3,7 +3,8 @@ module gunbc.boot_artifact_delivery
 import std.types { Bool, EpochMs, Int, List, NonEmptyStr, String, Port, list_length }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import std.content_hash { ContentHash }
-import extdeps.uri { Uri }
+import product.placement_supply { SiteIdentity }
+import extdeps.provisioning.dhcp_client_arch { DhcpProcessorArchitecture }
 import extdeps.toolchain.types { Architecture, X86_64, Aarch64, X86, Arm, Armv7, Mips, Mipsel, Mips64, Mips64el, Riscv64, Wasm32 }
 import extdeps.bmc.endpoint { BmcControllerEndpoint }
 import extdeps.bmc.capability {
@@ -102,10 +103,20 @@ import gunbc.install_transport_qualification {
   TransportProbeObservation,
 }
 import gunbc.network_boot_delivery {
+  NetworkBootArchitectureRefusal,
+  NetworkBootDeliveryArchitectureRefused,
+  NetworkBootDeliveryClientModeRefused,
   NetworkBootDeliveryEstablished,
   NetworkBootDeliveryEstablishment,
+  NetworkBootDeliveryEvidenceRefused,
+  NetworkBootDeliveryManifestRefused,
+  NetworkBootDeliverySiteMismatch,
+  NetworkBootDeliverySiteUnestablished,
   NetworkBootDeliveryStanding,
+  NetworkBootDeliveryTargetMismatch,
+  NetworkBootDeliveryTrustUnestablished,
   NetworkBootDeliveryUnestablished,
+  NetworkBootManifestRefusal,
   NetworkBootRequirement,
 }
 
@@ -345,6 +356,14 @@ type BootDeliveryCandidateIneligibility
   | CandidateConfigfsRefused { observed_absent: List<ConfigfsTransportRequirement> }
   | CandidateUefiHttpUnestablished { missing: List<UefiHttpRequirement> }
   | CandidateNetworkBootUnestablished { missing: List<NetworkBootRequirement> }
+  | CandidateNetworkBootEvidenceRefused { axis: NetworkBootRequirement, observation: DeclarationRef }
+  | CandidateNetworkBootArchitectureRefused { cause: NetworkBootArchitectureRefusal }
+  | CandidateNetworkBootClientModeRefused { arch: DhcpProcessorArchitecture }
+  | CandidateNetworkBootTargetMismatch { axis: NetworkBootRequirement }
+  | CandidateNetworkBootManifestRefused { cause: NetworkBootManifestRefusal }
+  | CandidateNetworkBootSiteUnestablished
+  | CandidateNetworkBootSiteMismatch { expected: SiteIdentity, observed: SiteIdentity }
+  | CandidateNetworkBootTrustUnestablished
 
 type BootDeliveryCandidateStanding
   = CandidateEligible
@@ -654,6 +673,22 @@ fn pxe_chain_candidate(ev: BoundBootDeliveryEvidence, request: BootDeliveryReque
         staged_digest_standing(offered: e.artifact_digest, requested: request.artifact.digest)
       }
     NetworkBootDeliveryUnestablished { missing: m } => CandidateIneligible { cause: CandidateNetworkBootUnestablished { missing: m } }
+    NetworkBootDeliveryEvidenceRefused { axis: axis, observation: observation } =>
+      CandidateIneligible { cause: CandidateNetworkBootEvidenceRefused { axis: axis, observation: observation } }
+    NetworkBootDeliveryArchitectureRefused { cause: cause } =>
+      CandidateIneligible { cause: CandidateNetworkBootArchitectureRefused { cause: cause } }
+    NetworkBootDeliveryClientModeRefused { arch: arch } =>
+      CandidateIneligible { cause: CandidateNetworkBootClientModeRefused { arch: arch } }
+    NetworkBootDeliveryTargetMismatch { axis: axis } =>
+      CandidateIneligible { cause: CandidateNetworkBootTargetMismatch { axis: axis } }
+    NetworkBootDeliveryManifestRefused { cause: cause } =>
+      CandidateIneligible { cause: CandidateNetworkBootManifestRefused { cause: cause } }
+    NetworkBootDeliverySiteUnestablished =>
+      CandidateIneligible { cause: CandidateNetworkBootSiteUnestablished }
+    NetworkBootDeliverySiteMismatch { expected: expected, observed: observed } =>
+      CandidateIneligible { cause: CandidateNetworkBootSiteMismatch { expected: expected, observed: observed } }
+    NetworkBootDeliveryTrustUnestablished =>
+      CandidateIneligible { cause: CandidateNetworkBootTrustUnestablished }
   }
 }
 
@@ -799,6 +834,14 @@ fn build_boot_artifact_delivery(
         NetworkBootDeliveryEstablished { evidence: e } =>
           Present { value: BuiltBootArtifactDelivery { candidate: candidate, delivery: PxeChainBoot { evidence: e }, selected: SelectedFromNetworkBootEstablishment { establishment: e } } }
         NetworkBootDeliveryUnestablished { missing: _ } => none
+        NetworkBootDeliveryEvidenceRefused { axis: _, observation: _ } => none
+        NetworkBootDeliveryArchitectureRefused { cause: _ } => none
+        NetworkBootDeliveryClientModeRefused { arch: _ } => none
+        NetworkBootDeliveryTargetMismatch { axis: _ } => none
+        NetworkBootDeliveryManifestRefused { cause: _ } => none
+        NetworkBootDeliverySiteUnestablished => none
+        NetworkBootDeliverySiteMismatch { expected: _, observed: _ } => none
+        NetworkBootDeliveryTrustUnestablished => none
       }
   }
 }

dag/gunbc/ci/ci_spec.dag

@@ -818,6 +818,16 @@ data gunbc_ci_runner_host_file_converge_target: GunbcRunStepTarget = GunbcRunSte
   function: "runner_host_file_converge_ci_wet",
 }
 
+data gunbc_ci_site_pxe_edge_observe_target: GunbcRunStepTarget = GunbcRunStepTarget {
+  entry: "dag/gunbc/fleet/site_pxe_edge_converge.dag",
+  function: "site_pxe_edge_observe_ci_wet",
+}
+
+data gunbc_ci_site_pxe_edge_converge_target: GunbcRunStepTarget = GunbcRunStepTarget {
+  entry: "dag/gunbc/fleet/site_pxe_edge_converge.dag",
+  function: "site_pxe_edge_converge_ci_wet",
+}
+
 data gunbc_ci_runner_password_session_tool_converge_target: GunbcRunStepTarget = GunbcRunStepTarget {
   entry: "dag/gunbc/runner/runner_password_session_tool_converge.dag",
   function: "runner_password_session_tool_converge_ci_wet",
@@ -1003,6 +1013,8 @@ fn gunbc_run_step_targets() -> List<GunbcRunStepTarget> {
     gunbc_ci_runner_microvm_host_converge_target,
     gunbc_ci_runner_host_file_observe_target,
     gunbc_ci_runner_host_file_converge_target,
+    gunbc_ci_site_pxe_edge_observe_target,
+    gunbc_ci_site_pxe_edge_converge_target,
     gunbc_ci_runner_password_session_tool_converge_target,
     gunbc_ci_runner_microvm_boot_probe_target,
     gunbc_ci_host_reset_return_target,
@@ -1821,6 +1833,26 @@ fn gunbc_ci_runner_host_file_converge_invoke() -> String {
   )
 }
 
+fn gunbc_ci_site_pxe_edge_observe_invoke() -> String {
+  gunbc_run_step_script(
+    source_roots: witness_layer_roots,
+    entry: gunbc_ci_site_pxe_edge_observe_target.entry,
+    function: gunbc_ci_site_pxe_edge_observe_target.function,
+    claim_run: false,
+    receipt_rel: "target/site-pxe-edge-converge-receipt.txt"
+  )
+}
+
+fn gunbc_ci_site_pxe_edge_converge_invoke() -> String {
+  gunbc_run_step_script(
+    source_roots: witness_layer_roots,
+    entry: gunbc_ci_site_pxe_edge_converge_target.entry,
+    function: gunbc_ci_site_pxe_edge_converge_target.function,
+    claim_run: false,
+    receipt_rel: "target/site-pxe-edge-converge-receipt.txt"
+  )
+}
+
 fn gunbc_ci_runner_password_session_tool_converge_invoke() -> String {
   gunbc_run_step_script(
     source_roots: witness_layer_roots,