From 7658ab7ee27f767173da8f47f8f1f8f1b0c36e38 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 02:56:51 +0000
Subject: [PATCH 01/22] microVM JIT mint on the host and attempt-owned jail
 staging

Close jit_mint_http_realization_frontier and jail_jit_device_staging_frontier.

- extdeps.auth.jws: RFC 7515 compact JWS signing input + RS256 (RFC 7518 3.3).
- extdeps.tools.openssl: enrolled host CLI dependency; openssl dgst -sha256 -sign
  <key file> -hex, signing input on stdin, no secret in argv.
- extdeps.github: POST app/installations/{id}/access_tokens and org
  generate-jitconfig as REST operations on the #10923 performer.
- gunbc.github_effect_perform: the effect home; perform_organization_jit_mint
  signs the App JWT on the host with the controller-custodied key, mints the
  installation token and the JIT config, and returns a typed performance
  (commit-ambiguous generate is its own arm).
- gunbc.runner_attempt_launch: admits a credential only from a delivered,
  attempt-bound, floor-to-ceiling mint; the jit device and the jailer are one
  plan arm, so no admitted credential means no device and no VMM. The device
  is install -m 0400 -o <attempt uid> before any byte, written via the
  filesystem, NUL-padded to whole sectors, read back. Registration id and
  runner name are recorded on the launch.
- Drop the out-of-jail jit.img path fork (runner_microvm_attempt /
  runner_jit_mint / runner_jit_perform): the device location has one owner.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/extdeps/auth/jws.dag                      |  70 +++
 dag/extdeps/exec/command.dag                  |   5 +
 dag/extdeps/github/actions_jit_runner.dag     |  55 ++-
 dag/extdeps/github/app.dag                    |  38 ++
 dag/extdeps/github/org_admin_auth.dag         |  11 +
 dag/extdeps/package_managers/apt.dag          |   1 +
 dag/extdeps/tools/gnu_coreutils.dag           |  21 +-
 dag/extdeps/tools/openssl.dag                 | 112 +++++
 dag/extdeps/tools/stat.dag                    |  14 +
 dag/gunbc/github_effect_perform.dag           | 175 ++++++++
 dag/gunbc/host/host_cli_dependency.dag        |   7 +
 dag/gunbc/runner/runner_attempt_launch.dag    | 323 ++++++++-----
 .../runner/runner_bound_attempt_receipt.dag   |   7 +-
 dag/gunbc/runner/runner_jit_mint.dag          |   7 +-
 dag/gunbc/runner/runner_jit_perform.dag       |  86 ++--
 dag/gunbc/runner/runner_microvm_attempt.dag   |   6 -
 .../github_app_registry_witness_test.dag      |  39 +-
 .../github_effect_perform_witness_test.dag    | 116 +++++
 .../runner_attempt_launch_witness_test.dag    | 424 +++++++++++-------
 .../runner_microvm_attempt_witness_test.dag   |   2 +-
 docs/plans/ci-per-job-microvm-migration.md    |   7 +-
 21 files changed, 1159 insertions(+), 367 deletions(-)
 create mode 100644 dag/extdeps/auth/jws.dag
 create mode 100644 dag/extdeps/tools/openssl.dag
 create mode 100644 dag/gunbc/github_effect_perform.dag
 create mode 100644 dag/test/claim/github_effect_perform_witness_test.dag

diff --git a/dag/extdeps/auth/jws.dag b/dag/extdeps/auth/jws.dag
new file mode 100644
index 00000000000..ba0ad2643f1
--- /dev/null
+++ b/dag/extdeps/auth/jws.dag
@@ -0,0 +1,70 @@
+module extdeps.auth.jws
+
+import std.types { String, NonEmptyStr, Int, List }
+import std.integer { UInt8 }
+import std.bytes { bytes_octets, utf8_encode_bytes }
+import std.encoding { base64_encode, UrlSafe }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import extdeps.uri { Uri, Https }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri { scheme: Https, locator: "datatracker.ietf.org/doc/html/rfc7515" }
+}
+
+data jwa_rs256_citation: ExternalAuthority = ExternalAuthority {
+  uri: Uri { scheme: Https, locator: "datatracker.ietf.org/doc/html/rfc7518#section-3.3" }
+}
+
+// THIS MODULE IS THE SHAPE OF A COMPACT JWS AND NOTHING ELSE. It produces the JWS Signing Input
+// (RFC 7515 section 5.1 step 5: BASE64URL(UTF8(protected header)) '.' BASE64URL(payload)) and joins
+// a signature the CALLER obtained onto it (section 7.1). It does not sign: the signature is a
+// private-key operation, and which realization performs it -- a host CLI, an HSM, a library -- is a
+// transport bound to this shape, never a fact about JWS (DESIGN §3). extdeps.auth.jwt describes
+// claims and does not verify them; this module is the other direction and does not verify either.
+//
+// ONE ALGORITHM, RS256, because one is what this fleet signs with. RFC 7518 registers many;
+// modeling ones no realization produces would be vocabulary with no consumer (DESIGN §3c). When a
+// second signer lands, this row becomes an algorithm coproduct and the functions take it.
+data jws_rs256_alg: NonEmptyStr = "RS256"
+
+// BASE64URL IS RFC 7515 section 2's: the URL-safe alphabet of RFC 4648 section 5 WITH ALL TRAILING
+// '=' OMITTED. std.encoding pads, so the padding is cut here rather than a second encoder written.
+fn jws_base64url_octets(octets: List<UInt8>) -> String {
+  join(split(s: base64_encode(octets: octets, variant: UrlSafe), delimiter: "="), "")
+}
+
+fn jws_base64url_text(s: String) -> String {
+  jws_base64url_octets(octets: bytes_octets(b: utf8_encode_bytes(s: s)))
+}
+
+fn jws_rs256_protected_header_json() -> String {
+  join(["\{\"alg\":\"", jws_rs256_alg as String, "\",\"typ\":\"JWT\"}"], "")
+}
+
+fn jws_rs256_signing_input(payload_json: String) -> NonEmptyStr {
+  join([
+    jws_base64url_text(s: jws_rs256_protected_header_json()),
+    ".",
+    jws_base64url_text(s: payload_json),
+  ], "") as NonEmptyStr
+}
+
+// THE SIGNATURE IS OCTETS, NOT TEXT. A realization that hands back a printable rendering (hex,
+// standard base64) decodes it to octets first; this join then encodes exactly once. Accepting a
+// pre-encoded String here would let a standard-alphabet signature through looking valid.
+fn jws_compact_serialization(signing_input: NonEmptyStr, signature: List<UInt8>) -> NonEmptyStr {
+  join([signing_input as String, ".", jws_base64url_octets(octets: signature)], "") as NonEmptyStr
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.auth.jws",
+      decl_name: "jws_rs256_signing_input",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps.auth.jws.extdeps_external_authority_anchor,
+  further_citations: [extdeps.auth.jws.jwa_rs256_citation]
+}
diff --git a/dag/extdeps/exec/command.dag b/dag/extdeps/exec/command.dag
index eac4dd24b28..1bfd96ed44f 100644
--- a/dag/extdeps/exec/command.dag
+++ b/dag/extdeps/exec/command.dag
@@ -155,6 +155,11 @@ fn argv_command(program: NonEmptyStr, arguments: List<String>) -> ArgvCommand
     decl_ref(module_path: "extdeps.sudo.elevation", decl_name: "sudo_preserve_environment_command"),
     decl_ref(module_path: "extdeps.tools.stat", decl_name: "stat_file_type_command"),
     decl_ref(module_path: "extdeps.tools.stat", decl_name: "stat_inode_command"),
+    decl_ref(module_path: "extdeps.tools.stat", decl_name: "stat_owner_uid_command"),
+    decl_ref(module_path: "extdeps.tools.stat", decl_name: "stat_mode_command"),
+    decl_ref(module_path: "extdeps.tools.stat", decl_name: "stat_size_bytes_command"),
+    decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "install_empty_file_command"),
+    decl_ref(module_path: "extdeps.tools.gnu_coreutils", decl_name: "truncate_to_size_command"),
     decl_ref(module_path: "extdeps.tools.mkdir", decl_name: "mkdir_parents_command_at"),
     decl_ref(module_path: "extdeps.tools.mkdir", decl_name: "mkdir_exact_command_at"),
     decl_ref(module_path: "gunbc.claim_executor_cli", decl_name: "claim_executor_command"),
diff --git a/dag/extdeps/github/actions_jit_runner.dag b/dag/extdeps/github/actions_jit_runner.dag
index b62df115f5b..089247f4154 100644
--- a/dag/extdeps/github/actions_jit_runner.dag
+++ b/dag/extdeps/github/actions_jit_runner.dag
@@ -1,6 +1,8 @@
 module extdeps.github.actions_jit_runner
 
-import std.types { String, NonEmptyStr, Bool, Int, List, HttpStatus }
+import std.types { String, NonEmptyStr, Bool, Int, List, HttpStatus, Secret }
+import extdeps.github.github { default_api_base }
+import extdeps.transports.rest { RestOutcome }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
 
@@ -123,3 +125,54 @@ fn jit_config_mint_outcome(status: HttpStatus, encoded: String, runner_id: Int,
     }
   }
 }
+
+// THE MINT IS ONE OPERATION ON GitHub's REST SURFACE, bound to the shape above. The Bearer is an
+// INSTALLATION access token (extdeps.github.app github.AppInstallationAccessTokens), taken as a
+// Secret input and never an argv word. The body is JitRunnerConfigRequest's wire: labels arrive as
+// the JSON array the endpoint documents, projected by jit_runner_label_wire. 201 decodes the runner
+// identity and the opaque blob; every other status is RestStatusRefused and is mapped through
+// jit_config_mint_outcome, the one authority for what a non-201 means.
+type JitConfigCreatedRunner {
+  id: Int
+}
+
+type JitConfigCreatedBody {
+  runner: JitConfigCreatedRunner
+  encoded_jit_config: String
+}
+
+service github.ActionsJitRunners {
+  config {
+    endpoint: default_api_base
+    auth: Bearer
+    auth_input: installation_token
+  }
+
+  operation GenerateOrganizationJitConfig {
+    input {
+      installation_token: Secret
+      org: NonEmptyStr
+      name: NonEmptyStr
+      runner_group_id: Int
+      labels: List<String>
+      work_folder: NonEmptyStr
+    }
+    output {
+      result: JitConfigCreatedBody
+      outcome: RestOutcome
+    }
+    transport rest {
+      method: POST,
+      path: "/orgs/\{org\}/actions/runners/generate-jitconfig",
+      body: {
+        name: name,
+        runner_group_id: runner_group_id,
+        labels: labels,
+        work_folder: work_folder
+      }
+    }
+    response {
+      201 => JitConfigCreatedBody
+    }
+  }
+}
diff --git a/dag/extdeps/github/app.dag b/dag/extdeps/github/app.dag
index 4af97cc51e6..25bd427a2ca 100644
--- a/dag/extdeps/github/app.dag
+++ b/dag/extdeps/github/app.dag
@@ -1260,3 +1260,41 @@ data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
     extdeps.github.app.webhook_events_citation
   ]
 }
+
+// POST /app/installations/{installation_id}/access_tokens, cited by
+// extdeps.github.org_admin_auth installation_token_citation. It authenticates AS THE APP -- the
+// Bearer is an RS256 App JWT (extdeps.auth.jws), never an installation or user token -- and answers
+// 201 with a token valid for one hour. The token is decoded straight into a Secret so it has no
+// String life in this process. A mutation: a transport refusal is commit-ambiguous, and the caller
+// classifies it through extdeps.transports.rest classify_rest_outcome as RestMutationExchange.
+service github.AppInstallationAccessTokens {
+  config {
+    endpoint: default_api_base
+    auth: Bearer
+    auth_input: app_jwt
+  }
+
+  operation Create {
+    input {
+      app_jwt: Secret
+      installation_id: Int
+    }
+    output {
+      token: Secret from "token"
+      outcome: RestOutcome
+    }
+    transport rest {
+      method: POST,
+      path: "/app/installations/\{installation_id\}/access_tokens",
+      body: { }
+    }
+    response {
+      201 => GitHubInstallationAccessTokenBody
+    }
+  }
+}
+
+type GitHubInstallationAccessTokenBody {
+  token: String
+  expires_at: String
+}
diff --git a/dag/extdeps/github/org_admin_auth.dag b/dag/extdeps/github/org_admin_auth.dag
index ec0ee5a484c..736a804df36 100644
--- a/dag/extdeps/github/org_admin_auth.dag
+++ b/dag/extdeps/github/org_admin_auth.dag
@@ -38,6 +38,17 @@ data github_app_jwt_backdate_seconds: Int = 60
 
 data github_app_jwt_lifetime_seconds: Int = 540
 
+// THE APP JWT'S CLAIMS, as installation_token_citation states them: iss is the App id, iat is
+// backdated for clock skew, exp is within ten minutes of issue. One authority for the claim set, so
+// a signer anywhere in the tree cannot pick its own bounds.
+fn github_app_jwt_claims_json(app_id: Int, now_epoch_secs: Int) -> String {
+  join([
+    "\{\"iat\":", to_string(now_epoch_secs - github_app_jwt_backdate_seconds),
+    ",\"exp\":", to_string(now_epoch_secs + github_app_jwt_lifetime_seconds),
+    ",\"iss\":\"", to_string(app_id), "\"}",
+  ], "")
+}
+
 data oauth_flow_citation: ExternalAuthority = ExternalAuthority {
   uri: Uri { scheme: Https, locator: "docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps" }
 }
diff --git a/dag/extdeps/package_managers/apt.dag b/dag/extdeps/package_managers/apt.dag
index 0a448810142..26a61ac55f7 100644
--- a/dag/extdeps/package_managers/apt.dag
+++ b/dag/extdeps/package_managers/apt.dag
@@ -38,6 +38,7 @@ data package_curl: NonEmptyStr = "curl"
 data package_nbdkit: NonEmptyStr = "nbdkit"
 data package_socat: NonEmptyStr = "socat"
 data package_sshpass: NonEmptyStr = "sshpass"
+data package_openssl: NonEmptyStr = "openssl"
 data package_mosquitto_clients: NonEmptyStr = "mosquitto-clients"
 data package_websocat: NonEmptyStr = "websocat"
 data package_xorriso: NonEmptyStr = "xorriso"
diff --git a/dag/extdeps/tools/gnu_coreutils.dag b/dag/extdeps/tools/gnu_coreutils.dag
index e4ea10f36f1..ba05b65580b 100644
--- a/dag/extdeps/tools/gnu_coreutils.dag
+++ b/dag/extdeps/tools/gnu_coreutils.dag
@@ -1,7 +1,7 @@
 module extdeps.tools.gnu_coreutils
 
 import std.types { NonEmptyStr, FilePath, String, List, Int }
-import std.measure { Second, second_count }
+import std.measure { Second, second_count, ByteSize, byte_size_count }
 import extdeps.version { VersionConstraint }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
@@ -42,6 +42,8 @@ data true_program: NonEmptyStr = "true"
 data whoami_program: NonEmptyStr = "whoami"
 data readlink_program: NonEmptyStr = "readlink"
 data ls_program: NonEmptyStr = "ls"
+data install_program: NonEmptyStr = "install"
+data truncate_program: NonEmptyStr = "truncate"
 
 // -1 ALONE, AND THE NAME CARRIES IT FOR THE SAME REASON rm_force_command's DOES. `-1` forces ONE
 // ENTRY PER LINE, which is what makes the output splittable by the caller: ls(1) columnates when
@@ -62,6 +64,23 @@ fn cp_command(source: String, destination: String) -> ArgvCommand {
   argv_command(program: cp_program, arguments: [source, destination])
 }
 
+// install(1) COPYING /dev/null CREATES AN EMPTY FILE WITH ITS FINAL OWNER AND MODE IN ONE STEP.
+// The point is the ORDER it makes possible: a file that will later hold a secret exists with its
+// restrictive mode before a single secret byte is written, so there is no window in which the bytes
+// sit under the default umask. Mode is an octal spelling because that is what -m documents.
+fn install_empty_file_command(path: String, octal_mode: NonEmptyStr, uid: Int, gid: Int) -> ArgvCommand {
+  argv_command(
+    program: install_program,
+    arguments: ["-m", octal_mode as String, "-o", to_string(uid), "-g", to_string(gid), "/dev/null", path],
+  )
+}
+
+// truncate(1) -s N EXTENDS a shorter file with NUL bytes (and would CUT a longer one -- the caller
+// owns ensuring N is not below the content it keeps). Used to pad a payload to a block boundary.
+fn truncate_to_size_command(path: String, size: ByteSize) -> ArgvCommand {
+  argv_command(program: truncate_program, arguments: ["-s", to_string(byte_size_count(b: size)), path])
+}
+
 // -f ALONE, NEVER -rf, AND THAT IS THE POINT OF THE NAME. -f makes a missing file a success, which
 // is what an unlink-if-present means; it does NOT recurse, so a path that turns out to be a
 // directory refuses instead of destroying its contents. The recursive form is a different operation
diff --git a/dag/extdeps/tools/openssl.dag b/dag/extdeps/tools/openssl.dag
new file mode 100644
index 00000000000..7bc65eebd52
--- /dev/null
+++ b/dag/extdeps/tools/openssl.dag
@@ -0,0 +1,112 @@
+module extdeps.tools.openssl
+
+import std.types { String, NonEmptyStr, Int, Bool, List }
+import std.integer { UInt8 }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import extdeps.uri { Uri, Https }
+import extdeps.tools { CliTool, SourceApt }
+import extdeps.apt { package_openssl }
+import extdeps.numeric.base16 { base16_decode_lower }
+import v2.std.optional { Absent, Present }
+import std.algebra { trim }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri { scheme: Https, locator: "docs.openssl.org/3.0/man1/openssl-dgst/" }
+}
+
+data openssl_binary_name: NonEmptyStr = "openssl"
+
+// ENROLLED THE WAY extdeps.tools.sshpass IS: the binary this module execs and the binary
+// gunbc.host_cli_dependency probes for are one declaration, so a probe cannot pass while the exec
+// fails. min_version is none: `dgst -sign -hex` is present in every OpenSSL this fleet runs (1.1 and
+// 3.x), and a floor nothing measured would be an invented constraint.
+data openssl_cli_tool: CliTool = CliTool {
+  name: openssl_binary_name,
+  min_version: none,
+  installable_via: [SourceApt { package: package_openssl }],
+}
+
+// `openssl dgst -sha256 -sign KEY -hex` IS RSASSA-PKCS1-v1_5 OVER SHA-256 -- RS256 as RFC 7518
+// section 3.3 defines it -- and it is exactly what the fleet's live mint executes today.
+//
+// WHY THE ARGV CARRIES A PATH AND NEVER A SECRET. The private key is read by openssl from a file
+// the argv names; the data to sign arrives on stdin; the signature leaves on stdout. Nothing another
+// process can read from /proc/<pid>/cmdline is secret -- the class gunbc.credential_argv_exposure
+// measures. -hex rather than -binary because a transport stdout is text, and an octet stream
+// through a String is a lossy decode the caller could not detect; hex round-trips exactly.
+service openssl.Dgst {
+  operation SignSha256Hex {
+    input { key_file: NonEmptyStr, signing_input: NonEmptyStr }
+    output {
+      exit_code: Int from "exit_code"
+      stdout: String from "stdout"
+      stderr: String from "stderr"
+    }
+    readonly
+    transport shell {
+      argv: [openssl_binary_name, "dgst", "-sha256", "-sign", "{key_file}", "-hex"]
+      stdin: signing_input
+    }
+    exit {
+      0 => Unit
+      nonzero => Unit
+    }
+  }
+}
+
+// THE -hex RENDERING IS `<label>= <lowercase hex>`, whose label differs by version ("(stdin)= " in
+// 1.1, "RSA-SHA2-256(stdin)= " in 3.x). The digits after the LAST "= " are the signature in both;
+// anything else -- no separator, empty digits, a non-hex character -- is a refusal, never a guess.
+type OpensslSignature
+  = OpensslSigned { octets: List<UInt8> }
+  | OpensslSignRefused { exit_code: Int, detail: String }
+
+fn openssl_last_separator_end(s: String, i: Int) -> Int {
+  if i < 1 {
+    0
+  } else if char_at(s, i - 1) == "=" && char_at(s, i) == " " {
+    i + 1
+  } else {
+    openssl_last_separator_end(s: s, i: i - 1)
+  }
+}
+
+fn openssl_hex_signature_digits(stdout: String) -> String {
+  let line = trim(s: stdout)
+  let start = openssl_last_separator_end(s: line, i: string_length(line) - 1)
+  if start == 0 { "" } else { substring(s: line, start: start, end: string_length(line)) }
+}
+
+fn openssl_signature_of(exit_code: Int, stdout: String, stderr: String) -> OpensslSignature {
+  if exit_code != 0 {
+    OpensslSignRefused { exit_code: exit_code, detail: trim(s: stderr) }
+  } else {
+    let digits = openssl_hex_signature_digits(stdout: stdout)
+    if digits == "" {
+      OpensslSignRefused { exit_code: exit_code, detail: "openssl dgst -hex printed no '= <hex>' signature" }
+    } else {
+      match base16_decode_lower(hex: digits) {
+        Absent => OpensslSignRefused { exit_code: exit_code, detail: "openssl dgst -hex signature is not lowercase hex" }
+        Present { value: octets } => OpensslSigned { octets: octets }
+      }
+    }
+  }
+}
+
+fn openssl_sign_sha256(key_file: NonEmptyStr, signing_input: NonEmptyStr) -> OpensslSignature {
+  let run = openssl.Dgst.SignSha256Hex(key_file: key_file, signing_input: signing_input)
+  openssl_signature_of(exit_code: run.exit_code, stdout: run.stdout, stderr: run.stderr)
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.tools.openssl",
+      decl_name: "openssl_cli_tool",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps.tools.openssl.extdeps_external_authority_anchor,
+  further_citations: []
+}
diff --git a/dag/extdeps/tools/stat.dag b/dag/extdeps/tools/stat.dag
index 1592e671f2f..cdf51379394 100644
--- a/dag/extdeps/tools/stat.dag
+++ b/dag/extdeps/tools/stat.dag
@@ -81,6 +81,20 @@ fn stat_inode_command(path: String) -> ArgvCommand {
   argv_command(program: stat_binary_path, arguments: ["-c", "%i", "--", path])
 }
 
+// %u AND %a AND %s AS COMMANDS, for a caller that reads back a file it just staged: numeric owner,
+// octal mode, size in bytes. One token each, for the reason the argv pair above states.
+fn stat_owner_uid_command(path: String) -> ArgvCommand {
+  argv_command(program: stat_binary_path, arguments: ["-c", "%u", "--", path])
+}
+
+fn stat_mode_command(path: String) -> ArgvCommand {
+  argv_command(program: stat_binary_path, arguments: ["-c", "%a", "--", path])
+}
+
+fn stat_size_bytes_command(path: String) -> ArgvCommand {
+  argv_command(program: stat_binary_path, arguments: ["-c", "%s", "--", path])
+}
+
 // THE TYPED OBSERVATION, BESIDE THE ARGV BUILDER THAT ALREADY SPELLS IT. `stat_file_type_command`
 // above builds the same words for a caller that needs an ArgvCommand; this operation is the
 // declared, transport-bound form a `.dag` caller can invoke directly. The corpus already carries
diff --git a/dag/gunbc/github_effect_perform.dag b/dag/gunbc/github_effect_perform.dag
new file mode 100644
index 00000000000..5d1c4f097e4
--- /dev/null
+++ b/dag/gunbc/github_effect_perform.dag
@@ -0,0 +1,175 @@
+module gunbc.github_effect_perform
+
+import std.types { String, NonEmptyStr, Int, List, Secret }
+import std.resources { Network }
+import std.dissolution { DissolutionCondition, unbound_dissolution }
+import extdeps.clock { clock_unix_millis_read, ClockUnixMillisObserved, ClockUnixMillisRefused }
+import extdeps.auth.jws { jws_rs256_signing_input, jws_compact_serialization }
+import extdeps.tools.openssl { openssl_sign_sha256, OpensslSigned, OpensslSignRefused }
+import extdeps.github.org_admin_auth { github_app_jwt_claims_json }
+import extdeps.github.actions_jit_runner {
+  JitConfigCreatedBody, jit_config_mint_outcome, jit_config_created_status, jit_runner_label_wire,
+}
+import extdeps.transports.rest {
+  RestOutcome, RestMutationExchange, classify_rest_outcome, RestExchangePerformance,
+  RestExchangeSucceeded, RestExchangeStatusRefused,
+}
+import extdeps.github.app
+import extdeps.github.actions_jit_runner
+import gunbc.host_cli_dependency {
+  HostCliDependencyAbsence, first_absent_host_cli_dependency, jit_mint_host_cli_requirements,
+}
+import gunbc.runner.runner_jit_perform {
+  JitMintDispatch, JitMintDispatchAuthorized, JitMintDispatchRefused,
+  JitCredentialDelivery, JitCredentialNotDispatched, receive_jit_mint,
+}
+import v2.std.optional { Absent, Present }
+
+// THE HOME OF A PERFORMED GitHubEffect. extdeps.github.effect is the effect SHAPE; the services in
+// extdeps.github.* are REST realizations bound to it (gunbc#10923); this module is the workflow
+// layer that PERFORMS one -- it sequences the realizations, holds the credentials between them, and
+// hands back a typed performance. Policy about WHICH effect to perform stays with its caller (DESIGN
+// §3: interface, realization and policy are three facts). Its first effect is the organization JIT
+// mint, whose dispatch gunbc.runner.runner_jit_perform already decides; a second effect lands here
+// as a second perform function, not as a second module.
+//
+// THE MINT IS THE TWO-STEP APP PATH gunbc.runner.runner_jit_admission names, all on the HOST:
+//   1. sign an App JWT (extdeps.auth.jws over extdeps.github.org_admin_auth's claims) with the App
+//      key, realized by openssl reading a key FILE the controller alone can read;
+//   2. POST /app/installations/{id}/access_tokens with that JWT for an installation token;
+//   3. POST /orgs/{org}/actions/runners/generate-jitconfig with that token.
+// The JWT and the token are Secrets that live only inside this call. Neither is returned, written,
+// or rendered into an argv, and the key never leaves the file openssl reads -- so nothing this
+// function produces is a path from a guest to the App key.
+
+// §3c, STATED SO A GREEN WITNESS IS NOT READ AS A WORKING MINT. perform_organization_jit_mint is
+// the realization gunbc.runner.runner_jit_perform's old transport frontier asked for, and it is
+// consumed by NO production route in this change: the caller is the per-attempt lifecycle controller
+// (gunbc.runner_microvm VmmUnderLifecycleController), which is another lane's to land, and the floor
+// job does not select the microVM path. Its witnesses supply RestOutcomes and establish the
+// decision, never that GitHub has minted through it. The same holds for
+// gunbc.runner_attempt_launch stage_jit_device. The trigger is the CAPABILITY, not an import.
+data jit_mint_lifecycle_controller_consumer_frontier: DissolutionCondition = unbound_dissolution(description: "NAMED CONSUMER: the per-attempt lifecycle controller (gunbc.runner_microvm VmmUnderLifecycleController) calling gunbc.github_effect_perform perform_organization_jit_mint and gunbc.runner_attempt_launch stage_jit_device on a host. TRIGGER: one attempt on srv1 mints through it with the controller-custodied App key, stages exactly one device, and a runner registers under the attempt's unit name, with a receipt. SUFFICIENT FOR deleting this row. NOT satisfied by a witness over supplied RestOutcomes, nor by an import of these functions." as NonEmptyStr)
+
+// THE KEY THE MINT SIGNS WITH IS ONE MODELED PATH, NOT A CALLER PARAMETER. It is deliberately NOT
+// gunbc.runner_unit_file runner_host_app_pem_path: that file is owned by the runner user, which is
+// the principal whose processes run jobs today. The lifecycle controller's copy is root-owned and
+// readable by the controller alone, outside every jail root (gunbc.runner_microvm_attempt roots all
+// attempt storage under the fabric cell's attempt root, and /etc is not under it). Its delivery and
+// ownership readback are a converge entry, not this module; until that entry lands the path names a
+// file no converge has produced, and perform refuses at the signer (openssl cannot open it) rather
+// than falling back to the runner-owned key.
+data lifecycle_controller_app_key_path: NonEmptyStr = "/etc/gunbc/microvm-controller/app.pem"
+
+type JitMintStep
+  = InstallationAccessTokenStep
+  | GenerateJitConfigStep
+
+// EVERY NON-DELIVERY IS ITS OWN ARM. In particular a generate-jitconfig whose response never
+// arrived is RestExchangeCommitAmbiguous, NOT a refusal: GitHub may have created the registration.
+// It is carried with its step so an operator can reconcile the orphan by the runner name, which is
+// the attempt's unit name (gunbc.runner_jit_mint jit_runner_name_for).
+type JitMintPerformance
+  = JitMintReceived { delivery: JitCredentialDelivery }
+  | JitMintSignerToolAbsent { absence: HostCliDependencyAbsence }
+  | JitMintClockUnread { detail: String }
+  | JitMintAppJwtUnsigned { detail: String }
+  | JitMintStepNotSucceeded { step: JitMintStep, performance: RestExchangePerformance }
+
+fn app_jwt_for(dispatch_app_id: Int, key_file: NonEmptyStr, now_epoch_secs: Int) -> JitMintAppJwt {
+  let signing_input = jws_rs256_signing_input(
+    payload_json: github_app_jwt_claims_json(app_id: dispatch_app_id, now_epoch_secs: now_epoch_secs),
+  )
+  match openssl_sign_sha256(key_file: key_file, signing_input: signing_input) {
+    OpensslSignRefused { exit_code: _, detail: d } => AppJwtUnsigned { detail: d }
+    OpensslSigned { octets: sig } =>
+      AppJwtSigned { jwt: jws_compact_serialization(signing_input: signing_input, signature: sig) as Secret }
+  }
+}
+
+type JitMintAppJwt
+  = AppJwtSigned { jwt: Secret }
+  | AppJwtUnsigned { detail: String }
+
+// THE GENERATE STEP'S ANSWER, DECIDED WITHOUT I/O so the decision is witnessable on supplied
+// RestOutcomes (DESIGN §3: a witness discriminates at one interface). A 2xx decodes through the
+// same jit_config_mint_outcome every status goes through, so an empty blob under 201 is still
+// refused there; a non-2xx the remote DECIDED is a JitConfigMintOutcome refusal; an answer that
+// never arrived is commit-ambiguous and is NOT reported as a refusal.
+fn jit_mint_performance_of_generate(
+  dispatch: JitMintDispatch,
+  outcome: RestOutcome,
+  created: JitConfigCreatedBody,
+) -> JitMintPerformance {
+  match classify_rest_outcome(standing: RestMutationExchange { rest: outcome }) {
+    RestExchangeSucceeded =>
+      JitMintReceived {
+        delivery: receive_jit_mint(
+          dispatch: dispatch,
+          outcome: jit_config_mint_outcome(
+            status: jit_config_created_status,
+            encoded: created.encoded_jit_config,
+            runner_id: created.runner.id,
+            error_body: "",
+          ),
+        ),
+      }
+    RestExchangeStatusRefused { status: s, body: b } =>
+      JitMintReceived {
+        delivery: receive_jit_mint(
+          dispatch: dispatch,
+          outcome: jit_config_mint_outcome(status: s, encoded: "", runner_id: 0, error_body: b),
+        ),
+      }
+    other => JitMintStepNotSucceeded { step: GenerateJitConfigStep, performance: other }
+  }
+}
+
+fn perform_organization_jit_mint(dispatch: JitMintDispatch) -> JitMintPerformance uses net: Network {
+  match dispatch {
+    JitMintDispatchRefused { refusal: r } =>
+      JitMintReceived { delivery: JitCredentialNotDispatched { refusal: r } }
+    JitMintDispatchAuthorized {
+      attempt: _,
+      app: app,
+      installation: installation,
+      organization: organization,
+      request: request,
+    } =>
+      match first_absent_host_cli_dependency(tools: jit_mint_host_cli_requirements) {
+        Present { value: absence } => JitMintSignerToolAbsent { absence: absence }
+        Absent =>
+          match clock_unix_millis_read() {
+            ClockUnixMillisRefused { detail: d } => JitMintClockUnread { detail: d }
+            ClockUnixMillisObserved { millis: ms } =>
+              match app_jwt_for(dispatch_app_id: app.app_id.value, key_file: lifecycle_controller_app_key_path, now_epoch_secs: ms / 1000) {
+                AppJwtUnsigned { detail: d } => JitMintAppJwtUnsigned { detail: d }
+                AppJwtSigned { jwt: jwt } => {
+                  let token = github.AppInstallationAccessTokens.Create(
+                    app_jwt: jwt,
+                    installation_id: installation.value,
+                  )
+                  match classify_rest_outcome(standing: RestMutationExchange { rest: token.outcome }) {
+                    RestExchangeSucceeded => {
+                      let minted = github.ActionsJitRunners.GenerateOrganizationJitConfig(
+                        installation_token: token.token,
+                        org: organization.login,
+                        name: request.name.value,
+                        runner_group_id: request.runner_group_id.value,
+                        labels: map(request.labels, l => jit_runner_label_wire(l: l)),
+                        work_folder: request.work_folder.value,
+                      )
+                      jit_mint_performance_of_generate(
+                        dispatch: dispatch,
+                        outcome: minted.outcome,
+                        created: minted.result,
+                      )
+                    }
+                    other => JitMintStepNotSucceeded { step: InstallationAccessTokenStep, performance: other }
+                  }
+                }
+              }
+          }
+      }
+  }
+}
diff --git a/dag/gunbc/host/host_cli_dependency.dag b/dag/gunbc/host/host_cli_dependency.dag
index 3494567fba7..3cb49ef807d 100644
--- a/dag/gunbc/host/host_cli_dependency.dag
+++ b/dag/gunbc/host/host_cli_dependency.dag
@@ -3,6 +3,7 @@ module gunbc.host_cli_dependency
 import extdeps.tools { CliTool, install_hint }
 import extdeps.tools.npm { npm_cli_tool }
 import extdeps.tools.sshpass { sshpass_cli_tool }
+import extdeps.tools.openssl { openssl_cli_tool }
 import extdeps.shell
 import std.types { String, NonEmptyStr }
 import v2.std.optional { Optional, Present, Absent, optional_absent, optional_present }
@@ -80,6 +81,12 @@ data codex_wet_materialization_host_cli_requirements: List<CliTool> = [npm_cli_t
 // side belongs to.
 data password_session_host_cli_requirements: List<CliTool> = [sshpass_cli_tool]
 
+// THIRD ENROLLMENT ANSWER: the host that MINTS a JIT runner credential. gunbc.github_effect_perform
+// signs the App JWT with openssl (extdeps.tools.openssl), and refuses from this roster before the
+// key is touched when the binary is absent. A separate roster for the same reason the two above are
+// separate: the population is "hosts whose lifecycle controller mints", not every runner.
+data jit_mint_host_cli_requirements: List<CliTool> = [openssl_cli_tool]
+
 // The absence is its own type, not a variant used in type position. Before this split,
 // first_absent_codex_wet_materialization_host_cli_dependency named HostCliDependencyAbsent as its
 // element type; the type system has no such thing, so the column widened to the parent coproduct
diff --git a/dag/gunbc/runner/runner_attempt_launch.dag b/dag/gunbc/runner/runner_attempt_launch.dag
index 6d41be2e0f5..7c5f3a866df 100644
--- a/dag/gunbc/runner/runner_attempt_launch.dag
+++ b/dag/gunbc/runner/runner_attempt_launch.dag
@@ -1,12 +1,16 @@
 module gunbc.runner_attempt_launch
 
 import std.types { String, NonEmptyStr, Bool, Int, List, FilePath }
+import v2.std.optional { Absent, Present }
+import std.algebra { trim }
 import std.disposition { Disposition, SingleAuthority }
 import std.dissolution { DissolutionCondition, unbound_dissolution }
-import std.measure { Second, second, ByteSize, byte_size, measure_le, Mebibyte, mebibyte }
-import extdeps.exec.command { ArgvCommand }
+import std.measure { Second, second, ByteSize, byte_size, byte_size_count, Mebibyte, mebibyte }
+import extdeps.exec.command { ArgvCommand, LocalExec }
 import extdeps.tools.e2fsprogs { Ext2, mke2fs_format_command }
-import extdeps.tools.gnu_coreutils { timeout_command, cp_command }
+import extdeps.tools.gnu_coreutils {
+  timeout_command, cp_command, install_empty_file_command, truncate_to_size_command,
+}
 import extdeps.tools.mkdir { mkdir_parents_command }
 import extdeps.tools.busybox { busybox_dd_sparse_image_command }
 import extdeps.virtualization.firecracker {
@@ -27,10 +31,12 @@ import product.fabric.grant_issue {
 import gunbc.guarantee_rung {
   GuaranteeRung, Mitigatable, MechanicallyPreventable, guarantee_rung_index,
 }
-import gunbc.runner.runner_jit_admission {
-  SignatureAxis, ExpiryAxis, jit_admission_axis_standing,
-  AxisRequired, HostEnvelopeNonemptyAndFresh,
+import extdeps.github.actions_jit_runner { EncodedJitConfig, JitRunnerName }
+import gunbc.github_effect_perform { JitMintPerformance, JitMintReceived }
+import gunbc.runner.runner_jit_perform {
+  JitCredentialDelivery, JitCredentialBoundToAttempt,
 }
+import gunbc.runner_jit_mint { jit_runner_name_for }
 import gunbc.runner_microvm {
   runner_microvm_vm_config,
   attach_workspace_drive,
@@ -50,6 +56,10 @@ import gunbc.runner_microvm_network {
   runner_microvm_nft_ruleset_text,
 }
 import extdeps.systemd.systemd_run { SystemdRunProperty }
+import extdeps.shell.exec { ProcessOutcome, ProcessOutputPresent, ProcessOutputAbsent, ProcessRefused }
+import extdeps.tools.stat { stat_owner_uid_command, stat_mode_command, stat_size_bytes_command }
+import std.resources { Network, Filesystem }
+import gunbc.command_runner { run_shell_command_capture }
 
 data runner_attempt_launch_disposition: Disposition = SingleAuthority
 
@@ -64,25 +74,6 @@ data host_boot_cutover_frontier: DissolutionCondition = unbound_dissolution(
   description: "NAMED CONSUMER: the host-image build whose per-attempt driver is gunbc.runner_attempt_launch plan_attempt_launch executed at host boot on tmpfs. TRIGGER: that capability holds — Y execs at host boot and the host image is built from Y — so the recovered initramfs/init path has zero production consumers. SUFFICIENT FOR deleting docs/recovered/mtcollins-host-image-source and this row in one motion. NOT satisfied by this planner compiling, by a gunbc binary in a checkout, or by Y sitting beside X." as NonEmptyStr,
 )
 
-// DECLARED FRONTIER (DESIGN 3c). Step 6's mint is a GitHub HTTP effect. Do not take a dependency
-// on unmerged gunbc#10923. NAMED CONSUMER: plan_attempt_launch's envelope arm. TRIGGER: #10923
-// merges gunbc.github_effect_perform (classify_github_http_outcome / github_effect_http_path for
-// GenerateOrganizationJitConfig) and this planner obtains encoded_jit_config through that
-// realization. SUFFICIENT FOR deleting this row. NOT satisfied by wget, a host HTTP server, or a
-// second performer in this module.
-data jit_mint_http_realization_frontier: DissolutionCondition = unbound_dissolution(
-  description: "NAMED CONSUMER: gunbc.runner_attempt_launch plan_attempt_launch envelope arm. TRIGGER: gunbc#10923 merges gunbc.github_effect_perform so generate-jitconfig is a classified GitHubEffect HTTP realization; this planner then takes the minted blob from that effect rather than a presented EnvelopeStanding. SUFFICIENT FOR deleting this row. NOT satisfied by wget, a second HTTP stack here, or an unmerged #10923." as NonEmptyStr,
-)
-
-// DECLARED FRONTIER. After mint, the blob must be written into the jail as /jit.bin (X's
-// padded block device). NAMED CONSUMER: plan_authorized_steps. TRIGGER: the #10923 mint
-// supplies encoded_jit_config and this planner emits the host write into
-// firecracker_jailer_chroot_root. SUFFICIENT FOR deleting this row. NOT satisfied by
-// creating an empty jit.bin beside the workspace.
-data jail_jit_device_staging_frontier: DissolutionCondition = unbound_dissolution(
-  description: "NAMED CONSUMER: gunbc.runner_attempt_launch plan_authorized_steps. TRIGGER: gunbc#10923 mint supplies encoded_jit_config and this planner writes that blob at firecracker_jailer_chroot_root/.../jit.bin so the in-jail path /jit.bin names a file the VMM can open. SUFFICIENT FOR deleting this row. NOT satisfied by an empty placeholder beside work.img." as NonEmptyStr,
-)
-
 // SHADOW MEANS SHADOW. No fleet-converge entry, no dual dispatch, no "use Y when available".
 // Production does not import plan_attempt_launch; a Bool in this module cannot decide that.
 
@@ -141,34 +132,123 @@ type AttemptGround
   = GroundClear
   | GroundOccupied
 
-// X's run_attempt admission order after a fetch: absent, malformed, signature, unit, boot,
-// nonce, attempt, payload digest, floor, ceiling. Presented here because mint is still the
-// #10923 frontier; the planner must still refuse every arm so the later cut does not erase a
-// correctness distinction. Host-once refusals (no boot secret, stage2 missing files) are PID 1
-// and are outside this per-attempt planner.
-type EnvelopeStanding
-  = EnvelopeAdmitted { bytes: ByteSize }
-  | EnvelopeAbsent
-  | EnvelopeMalformed
-  | EnvelopeSignatureRejected
-  | EnvelopeBoundToDifferentUnit
-  | EnvelopeBoundToDifferentBoot
-  | EnvelopeNonceMismatch
-  | EnvelopeBoundToDifferentAttempt
-  | EnvelopePayloadDigestMismatch
-  | EnvelopePayloadBelowFloor { bytes: ByteSize }
-  | EnvelopePayloadAboveCeiling { bytes: ByteSize }
-  | EnvelopeAdmissionAxisNotRequired
+// THE JIT CREDENTIAL IS ADMITTED FROM THE MINT'S OWN PERFORMANCE, NOT FROM A PRESENTED STANDING.
+//
+// This replaces X's EnvelopeStanding, which a CALLER assembled: a host fetched a blob, checked it,
+// and told the planner "admitted, N bytes". The receipted fail-open was exactly that shape --
+// jitconfig-bytes=0 and a launch anyway -- because the only thing between the fetch and the jailer
+// was a value anyone could write. Here the planner takes gunbc.github_effect_perform's
+// JitMintPerformance and admits a credential only from its delivered arm, bound to THIS attempt.
+//
+// "SIGNATURE-BOUND" is the App path, not a field. A JitMintReceived delivery is produced by
+// perform_organization_jit_mint only after an RS256 App JWT signed with the host's key was accepted
+// by GitHub for an installation token, and GitHub minted the blob against that token; the blob is
+// opaque (gunbc.runner.runner_jit_admission) and there is no signature in it for a host to check.
+// What is NOT structural, stated so it is not over-read: a caller can still construct a
+// JitMintReceived beside the performer -- witnesses do -- so this is mitigatable on the planner
+// path and its next rung is a sealed performance carrier. Host-envelope axes that had no subject
+// once the fetch was gone (unit, boot, nonce, payload digest) dissolve into the attempt binding,
+// as gunbc.runner.runner_jit_admission already rules for unit and boot.
+type JitDeviceRefusal
+  = JitMintNotReceived { performance: JitMintPerformance }
+  | JitCredentialNotDelivered { delivery: JitCredentialDelivery }
+  | JitCredentialBoundToDifferentAttempt { bound_to: MicroVmAttempt }
+  | JitCredentialBelowFloor { bytes: Int }
+  | JitCredentialAboveCeiling { bytes: Int }
+
+// THE ONLY CARRIER A DEVICE CAN BE STAGED FROM, and admit_jit_credential is its only constructor.
+// The registration id travels with the credential rather than beside it: it is GitHub's identity
+// for the runner this blob registers, and it is recorded on the launch so every later event about
+// this attempt can name the registration a leak or orphan would be reconciled against.
+type AdmittedJitCredential sole_constructor {
+  credential: EncodedJitConfig
+  runner_name: JitRunnerName
+  registration_id: Int
+}
+
+type JitCredentialAdmission
+  = JitCredentialAdmitted { admitted: AdmittedJitCredential }
+  | JitCredentialRefused { refusal: JitDeviceRefusal }
+
+fn jit_credential_bytes(credential: EncodedJitConfig) -> Int {
+  string_length(credential.encoded as String)
+}
+
+fn admit_jit_credential(attempt: MicroVmAttempt, mint: JitMintPerformance) -> JitCredentialAdmission {
+  match mint {
+    JitMintReceived { delivery: delivery } =>
+      match delivery {
+        JitCredentialBoundToAttempt { attempt: bound, credential: c, runner_id: id } =>
+          if bound != attempt {
+            JitCredentialRefused { refusal: JitCredentialBoundToDifferentAttempt { bound_to: bound } }
+          } else if jit_credential_bytes(credential: c) < byte_size_count(b: jit_config_byte_floor) {
+            JitCredentialRefused { refusal: JitCredentialBelowFloor { bytes: jit_credential_bytes(credential: c) } }
+          } else if jit_credential_bytes(credential: c) > byte_size_count(b: jit_config_byte_ceiling) {
+            JitCredentialRefused { refusal: JitCredentialAboveCeiling { bytes: jit_credential_bytes(credential: c) } }
+          } else {
+            JitCredentialAdmitted {
+              admitted: AdmittedJitCredential {
+                credential: c,
+                runner_name: jit_runner_name_for(attempt: attempt),
+                registration_id: id,
+              },
+            }
+          }
+        other => JitCredentialRefused { refusal: JitCredentialNotDelivered { delivery: other } }
+      }
+    other => JitCredentialRefused { refusal: JitMintNotReceived { performance: other } }
+  }
+}
+
+// THE DEVICE, AS THREE HOST STEPS WHOSE ORDER IS THE SECURITY PROPERTY. (1) install(1) creates an
+// EMPTY file already owned by the attempt's unprivileged uid and mode 0400, inside the attempt's
+// jail; (2) the credential bytes are written into it -- through the filesystem, never an argv; (3)
+// truncate(1) pads it with NULs to jit_config_byte_ceiling, a whole number of 512-byte sectors,
+// because a virtio-blk device exposes only whole sectors and the guest strips the NULs (the
+// contract the recovered guest init already reads). There is never a moment where secret bytes
+// exist under a looser mode, and the file is inside the chroot of exactly one attempt: the guest
+// sees it as a read-only drive (gunbc.runner_microvm JitConfigOnReadOnlyDrive) and never sees the
+// host path, the App key, the JWT or the installation token, none of which this carrier holds.
+type JitDeviceStaging {
+  host_path: String
+  create: ArgvCommand
+  credential: EncodedJitConfig
+  pad: ArgvCommand
+}
+
+data jit_device_octal_mode: NonEmptyStr = "0400"
+
+fn jit_device_staging(jail_root: String, admitted: AdmittedJitCredential) -> JitDeviceStaging {
+  let host_path = join([jail_root, jail_jit_path as String], "")
+  JitDeviceStaging {
+    host_path: host_path,
+    create: install_empty_file_command(
+      path: host_path,
+      octal_mode: jit_device_octal_mode,
+      uid: attempt_unprivileged_uid,
+      gid: attempt_unprivileged_gid,
+    ),
+    credential: admitted.credential,
+    pad: truncate_to_size_command(path: host_path, size: jit_config_byte_ceiling),
+  }
+}
 
 // PID1 refusals (no boot secret, stage2 missing files) have no constructor on AttemptLaunchPlan.
 // That is the census: they are outside this per-attempt planner by construction, not by a Bool.
+//
+// THE LAW THIS SHAPE CARRIES: jit_device and jailer are fields of ONE arm, and that arm is
+// reachable only through admit_jit_credential's admitted arm. So no admitted, non-empty,
+// attempt-bound credential means no device AND no VMM process -- the two cannot come apart.
 
 type AttemptLaunchPlan
   = LaunchRefusedUnauthorized { authorization: GrantAuthorization }
-  | LaunchRefusedEnvelope { standing: EnvelopeStanding }
+  | LaunchRefusedJitCredential { refusal: JitDeviceRefusal }
   | LaunchRefusedPriorResources
   | LaunchAuthorized {
       authorization: GrantAuthorization
+      jit_runner_name: JitRunnerName
+      jit_registration_id: Int
+      jit_device: JitDeviceStaging
       tap_device: NonEmptyStr
       guest_ip_boot_arg: String
       nft_ruleset: String
@@ -185,66 +265,6 @@ type AttemptLaunchPlan
       jailer: ArgvCommand
     }
 
-fn envelope_floor_is_required() -> Bool {
-  match jit_admission_axis_standing(axis: SignatureAxis) {
-    AxisRequired { checker: HostEnvelopeNonemptyAndFresh } =>
-      match jit_admission_axis_standing(axis: ExpiryAxis) {
-        AxisRequired { checker: HostEnvelopeNonemptyAndFresh } => true
-        _ => false
-      }
-    _ => false
-  }
-}
-
-fn credential_bytes_admit(bytes: ByteSize) -> Bool {
-  envelope_floor_is_required()
-    && measure_le(a: jit_config_byte_floor, b: bytes)
-    && measure_le(a: bytes, b: jit_config_byte_ceiling)
-}
-
-fn envelope_admits_launch(standing: EnvelopeStanding) -> Bool {
-  match standing {
-    EnvelopeAdmitted { bytes: n } => credential_bytes_admit(bytes: n)
-    EnvelopeAbsent => false
-    EnvelopeMalformed => false
-    EnvelopeSignatureRejected => false
-    EnvelopeBoundToDifferentUnit => false
-    EnvelopeBoundToDifferentBoot => false
-    EnvelopeNonceMismatch => false
-    EnvelopeBoundToDifferentAttempt => false
-    EnvelopePayloadDigestMismatch => false
-    EnvelopePayloadBelowFloor { bytes: _ } => false
-    EnvelopePayloadAboveCeiling { bytes: _ } => false
-    EnvelopeAdmissionAxisNotRequired => false
-  }
-}
-
-fn refuse_or_normalize_envelope(standing: EnvelopeStanding) -> EnvelopeStanding {
-  match standing {
-    EnvelopeAdmitted { bytes: n } =>
-      if !envelope_floor_is_required() {
-        EnvelopeAdmissionAxisNotRequired
-      } else if !measure_le(a: jit_config_byte_floor, b: n) {
-        EnvelopePayloadBelowFloor { bytes: n }
-      } else if !measure_le(a: n, b: jit_config_byte_ceiling) {
-        EnvelopePayloadAboveCeiling { bytes: n }
-      } else {
-        standing
-      }
-    EnvelopeAbsent => standing
-    EnvelopeMalformed => standing
-    EnvelopeSignatureRejected => standing
-    EnvelopeBoundToDifferentUnit => standing
-    EnvelopeBoundToDifferentBoot => standing
-    EnvelopeNonceMismatch => standing
-    EnvelopeBoundToDifferentAttempt => standing
-    EnvelopePayloadDigestMismatch => standing
-    EnvelopePayloadBelowFloor { bytes: _ } => standing
-    EnvelopePayloadAboveCeiling { bytes: _ } => standing
-    EnvelopeAdmissionAxisNotRequired => standing
-  }
-}
-
 fn with_guest_ip_boot_arg(config: FirecrackerVmConfig, ip_arg: String) -> FirecrackerVmConfig {
   FirecrackerVmConfig {
     boot_source: FirecrackerBootSource {
@@ -286,7 +306,7 @@ fn plan_attempt_launch(
   demand: FabricIdentity<NonEmptyStr, DemandKey>,
   offer: FabricIdentity<NonEmptyStr, OfferKey>,
   attempt: MicroVmAttempt,
-  envelope: EnvelopeStanding,
+  mint: JitMintPerformance,
   ground: AttemptGround,
   jailer_binary: String,
   firecracker_binary: String,
@@ -306,7 +326,7 @@ fn plan_attempt_launch(
     GrantAuthorizes => plan_after_authorization(
       authorization: authorization,
       attempt: attempt,
-      envelope: envelope,
+      mint: mint,
       ground: ground,
       jailer_binary: jailer_binary,
       firecracker_binary: firecracker_binary,
@@ -324,7 +344,7 @@ fn plan_attempt_launch(
 fn plan_after_authorization(
   authorization: GrantAuthorization,
   attempt: MicroVmAttempt,
-  envelope: EnvelopeStanding,
+  mint: JitMintPerformance,
   ground: AttemptGround,
   jailer_binary: String,
   firecracker_binary: String,
@@ -335,18 +355,18 @@ fn plan_after_authorization(
   match ground {
     GroundOccupied => LaunchRefusedPriorResources
     GroundClear =>
-      if envelope_admits_launch(standing: envelope) {
-        plan_authorized_steps(
+      match admit_jit_credential(attempt: attempt, mint: mint) {
+        JitCredentialRefused { refusal: r } => LaunchRefusedJitCredential { refusal: r }
+        JitCredentialAdmitted { admitted: admitted } => plan_authorized_steps(
           authorization: authorization,
           attempt: attempt,
+          admitted: admitted,
           jailer_binary: jailer_binary,
           firecracker_binary: firecracker_binary,
           kernel_source: kernel_source,
           rootfs_source: rootfs_source,
           guest_size: guest_size,
         )
-      } else {
-        LaunchRefusedEnvelope { standing: refuse_or_normalize_envelope(standing: envelope) }
       }
   }
 }
@@ -354,6 +374,7 @@ fn plan_after_authorization(
 fn plan_authorized_steps(
   authorization: GrantAuthorization,
   attempt: MicroVmAttempt,
+  admitted: AdmittedJitCredential,
   jailer_binary: String,
   firecracker_binary: String,
   kernel_source: String,
@@ -377,6 +398,9 @@ fn plan_authorized_steps(
   )
   LaunchAuthorized {
     authorization: authorization,
+    jit_runner_name: admitted.runner_name,
+    jit_registration_id: admitted.registration_id,
+    jit_device: jit_device_staging(jail_root: jail_root, admitted: admitted),
     tap_device: net.tap_device,
     guest_ip_boot_arg: runner_slot_guest_ip_boot_arg(net: net),
     nft_ruleset: runner_microvm_nft_ruleset_text(),
@@ -434,6 +458,9 @@ fn planned_jailer_launches(plan: AttemptLaunchPlan) -> Int {
   match plan {
     LaunchAuthorized {
       authorization: _,
+      jit_runner_name: _,
+      jit_registration_id: _,
+      jit_device: _,
       tap_device: _,
       guest_ip_boot_arg: _,
       nft_ruleset: _,
@@ -450,11 +477,83 @@ fn planned_jailer_launches(plan: AttemptLaunchPlan) -> Int {
       jailer: _,
     } => 1
     LaunchRefusedUnauthorized { authorization: _ } => 0
-    LaunchRefusedEnvelope { standing: _ } => 0
+    LaunchRefusedJitCredential { refusal: _ } => 0
     LaunchRefusedPriorResources => 0
   }
 }
 
+// THE POSITIVE-CONTROL COUNT beside planned_jailer_launches: an authorized plan stages exactly one
+// device, and every refusal stages none. Because both counts read the same arm they are equal by
+// construction -- a device without a launch, or a launch without a device, has no value to be.
+fn planned_jit_devices(plan: AttemptLaunchPlan) -> Int {
+  planned_jailer_launches(plan: plan)
+}
+
+// STAGING, PERFORMED -- and READ BACK FROM THE HOST rather than believed from the steps' exits.
+// Each step's refusal is its own arm naming the step, so a failed install is not reported as a
+// failed write. The readback checks the three facts the device's safety rests on: owned by the
+// attempt's uid (the jailer drops to it, so root-owned would be unreadable and anything looser would
+// be readable by others), mode 0400, and size exactly the padded ceiling (so the guest sees whole
+// sectors). A device that fails readback is a refusal: the caller must not launch over it.
+type JitDeviceStagingStep
+  = JitDeviceCreateStep
+  | JitDeviceWriteStep
+  | JitDevicePadStep
+  | JitDeviceReadbackStep
+
+type JitDeviceStagingOutcome
+  = JitDeviceStaged { host_path: String }
+  | JitDeviceStagingRefused { step: JitDeviceStagingStep, detail: String }
+
+fn process_outcome_token(outcome: ProcessOutcome) -> String {
+  match outcome {
+    ProcessOutputPresent { text: t } => trim(s: t)
+    ProcessOutputAbsent => ""
+    ProcessRefused { exit_code: _, stderr: _ } => ""
+  }
+}
+
+fn jit_device_readback(uid: String, mode: String, size: String) -> JitDeviceStagingOutcome? {
+  if uid != to_string(attempt_unprivileged_uid) {
+    Present { value: JitDeviceStagingRefused { step: JitDeviceReadbackStep, detail: join(["owner uid is ", uid], "") } }
+  } else if mode != "400" {
+    Present { value: JitDeviceStagingRefused { step: JitDeviceReadbackStep, detail: join(["mode is ", mode], "") } }
+  } else if size != to_string(byte_size_count(b: jit_config_byte_ceiling)) {
+    Present { value: JitDeviceStagingRefused { step: JitDeviceReadbackStep, detail: join(["size is ", size], "") } }
+  } else {
+    none
+  }
+}
+
+fn stage_jit_device(device: JitDeviceStaging) -> JitDeviceStagingOutcome
+  uses net: Network, fs: Filesystem
+{
+  match run_shell_command_capture(command: device.create, transport: LocalExec) {
+    ProcessRefused { exit_code: _, stderr: e } =>
+      JitDeviceStagingRefused { step: JitDeviceCreateStep, detail: trim(s: e) }
+    _ => {
+      let wrote = Filesystem.Write(path: device.host_path, content: device.credential.encoded as String)
+      if wrote.success == false {
+        JitDeviceStagingRefused { step: JitDeviceWriteStep, detail: device.host_path }
+      } else {
+        match run_shell_command_capture(command: device.pad, transport: LocalExec) {
+          ProcessRefused { exit_code: _, stderr: e } =>
+            JitDeviceStagingRefused { step: JitDevicePadStep, detail: trim(s: e) }
+          _ =>
+            match jit_device_readback(
+              uid: process_outcome_token(outcome: run_shell_command_capture(command: stat_owner_uid_command(path: device.host_path), transport: LocalExec)),
+              mode: process_outcome_token(outcome: run_shell_command_capture(command: stat_mode_command(path: device.host_path), transport: LocalExec)),
+              size: process_outcome_token(outcome: run_shell_command_capture(command: stat_size_bytes_command(path: device.host_path), transport: LocalExec)),
+            ) {
+              Present { value: refused } => refused
+              Absent => JitDeviceStaged { host_path: device.host_path }
+            }
+        }
+      }
+    }
+  }
+}
+
 type WorkNotEstablished {
   vmm_exit: Int
 }
diff --git a/dag/gunbc/runner/runner_bound_attempt_receipt.dag b/dag/gunbc/runner/runner_bound_attempt_receipt.dag
index cff6bd29fbd..0c3b7dac1a0 100644
--- a/dag/gunbc/runner/runner_bound_attempt_receipt.dag
+++ b/dag/gunbc/runner/runner_bound_attempt_receipt.dag
@@ -2,9 +2,8 @@ module gunbc.runner.runner_bound_attempt_receipt
 
 import std.types { Bool, Int, List, NonEmptyStr, String }
 import std.dissolution { dissolution_description }
-import gunbc.runner.runner_jit_perform {
-  jit_mint_effect_transport_frontier, host_side_jit_fetch_deletion_frontier,
-}
+import gunbc.runner.runner_jit_perform { host_side_jit_fetch_deletion_frontier }
+import gunbc.github_effect_perform { jit_mint_lifecycle_controller_consumer_frontier }
 import gunbc.runner.runner_jit_admission {
   ExpiryAxis, JitAdmissionAxis,
   axis_mint_observability, MintExpiresAtCoverage, MintUnobservableDeclaredBoundary,
@@ -163,7 +162,7 @@ data still_open: List<NonEmptyStr> = concat(
   concat(
     still_open_from_live_census(census: duplicate_jitconfig_name_409_coverage),
     [
-      dissolution_description(condition: jit_mint_effect_transport_frontier) as NonEmptyStr,
+      dissolution_description(condition: jit_mint_lifecycle_controller_consumer_frontier) as NonEmptyStr,
       dissolution_description(condition: host_side_jit_fetch_deletion_frontier) as NonEmptyStr,
       dissolution_description(condition: host_image_placeability_wet_probe_frontier) as NonEmptyStr,
       placeability_standing_open_item(outcome: host_image_placeability_standing),
diff --git a/dag/gunbc/runner/runner_jit_mint.dag b/dag/gunbc/runner/runner_jit_mint.dag
index ae6ccb5b5d0..88d5b2b15ff 100644
--- a/dag/gunbc/runner/runner_jit_mint.dag
+++ b/dag/gunbc/runner/runner_jit_mint.dag
@@ -30,15 +30,14 @@ data runner_jit_mint_disposition: Disposition = SingleAuthority
 // owns neither.
 //
 // Planning them together rather than at the call site is what makes the ordering unwritable: a
-// caller cannot mint first and check ownership after, because the only value that names a drive
-// destination is produced by the arm that already proved both.
+// caller cannot mint first and check ownership after, because the only value that names the attempt
+// a credential belongs to is produced by the arm that already proved both.
 
 type JitMintPlan
   = JitMintAuthorized {
       attempt: MicroVmAttempt
       endpoint_path: String
       request: JitRunnerConfigRequest
-      drive_destination: String
     }
   | JitMintRefusedCellNotOwned { cause: String }
   | JitMintRefusedCredential {
@@ -86,7 +85,6 @@ fn plan_jit_mint(
     VmBoundToOwnedCell {
       attempt: attempt,
       rootfs_path: _,
-      jit_drive_path: drive,
       vm_config_path: _,
       unit_name: _,
       slice_property: _,
@@ -105,7 +103,6 @@ fn plan_jit_mint(
               runner_group_id: runner_group_id,
               labels: labels,
             ),
-            drive_destination: drive,
           }
         } else {
           JitMintRefusedAttemptUnbound {
diff --git a/dag/gunbc/runner/runner_jit_perform.dag b/dag/gunbc/runner/runner_jit_perform.dag
index 8a71e526ae8..53af5d6e31a 100644
--- a/dag/gunbc/runner/runner_jit_perform.dag
+++ b/dag/gunbc/runner/runner_jit_perform.dag
@@ -4,13 +4,13 @@ import std.types { String, NonEmptyStr, Bool, Int, List }
 import std.disposition { Disposition, SingleAuthority }
 import std.dissolution { DissolutionCondition, unbound_dissolution }
 import extdeps.github.app { GitHubAppInstallationId }
+import gunbc.auth.github_apps { DeclaredGitHubApp }
 import extdeps.github.effect { GitHubOrganizationRef }
 import extdeps.github.actions_jit_runner {
   JitRunnerConfigRequest, JitRunnerGroupId, JitRunnerLabel, EncodedJitConfig,
   JitConfigMintOutcome, JitConfigMinted, JitConfigMintRefused, JitConfigMintNotFound,
   JitConfigMintConflict, JitConfigMintValidationFailed,
 }
-import extdeps.github.org_admin_auth { github_app_installation_access_token_url }
 import gunbc.auth.github_apps { GitHubAppControlPlaneState }
 import gunbc.auth.github_credential {
   GitHubCredentialAuthority, ActionsJobCredential, ManagedAppInstallationCredential,
@@ -27,16 +27,17 @@ data runner_jit_perform_disposition: Disposition = SingleAuthority
 
 // THIS MODULE IS THE NAMED CONSUMER OF gunbc.runner_jit_mint.plan_jit_mint, and landing it is what
 // deleted that module's consumer frontier. It performs no I/O and claims none: the two folds below
-// sit on either side of a transport this repository does not yet have, and the frontier at the foot
-// of this module says so rather than letting a green witness read as a working mint.
+// sit on either side of the transport, which gunbc.github_effect_perform performs.
 //
 // THE DIRECTION IS PUSH, AND THAT IS THE WHOLE POINT OF SPLITTING THE FOLD IN TWO.
 //
 // The gap this addresses (gunbc#10733) is that a host fetches its JIT config from an endpoint on
 // the segment, so whichever host reaches it first takes the registration. The repair is not a better
 // endpoint: it is that no endpoint exists to ask. A credential is minted control-plane-side, against
-// a cell whose ownership was already proven, and its only destination is the drive path the proving
-// arm itself named.
+// a cell whose ownership was already proven, and it is bound to the attempt the proving arm itself
+// named. WHERE that attempt's device lives is one fact with one owner --
+// gunbc.runner_attempt_launch, which derives it inside the jail it launches; this module carried a
+// second, out-of-jail path once and the VMM could never have opened it.
 //
 // So the ordering has to be unwritable rather than documented. dispatch_jit_mint is the only way to
 // obtain a JitMintDispatchAuthorized, and it produces one only from JitMintAuthorized -- which
@@ -49,8 +50,9 @@ data runner_jit_perform_disposition: Disposition = SingleAuthority
 // caller would have had to call GitHub before the fold ran, which is mint-first-check-after with
 // the check moved after the spend -- the ordering gunbc.runner_jit_mint exists to make unwritable.
 //
-// THE INSTALLATION TOKEN IS NAMED, NEVER CARRIED. The dispatch holds the URL that mints the
-// installation access token and does not hold the token; nothing in this module has a field a
+// THE INSTALLATION TOKEN IS NAMED, NEVER CARRIED. The dispatch holds the App and installation
+// identity the token is minted FOR (gunbc.github_effect_perform mints it, uses it, and drops it
+// inside one call) and does not hold the token; nothing in this module has a field a
 // bearer secret could occupy. gunbc.credential_argv_exposure measures what this fleet already paid
 // for rendering a credential into a place other processes can read, and a token field here would be
 // that class re-opened one layer up from the argv it warns about.
@@ -91,17 +93,23 @@ type JitDispatchRefusal
 type JitMintDispatch
   = JitMintDispatchAuthorized {
       attempt: MicroVmAttempt
-      installation_token_url: String
-      endpoint_path: String
+      app: DeclaredGitHubApp
+      installation: GitHubAppInstallationId
+      organization: GitHubOrganizationRef
       request: JitRunnerConfigRequest
-      drive_destination: String
     }
   | JitMintDispatchRefused { refusal: JitDispatchRefusal }
 
-fn authority_installation(authority: GitHubCredentialAuthority) -> GitHubAppInstallationId? {
+type AuthorityInstallation {
+  app: DeclaredGitHubApp
+  installation: GitHubAppInstallationId
+}
+
+fn authority_installation(authority: GitHubCredentialAuthority) -> AuthorityInstallation? {
   match authority {
     ActionsJobCredential { grant: _ } => none
-    ManagedAppInstallationCredential { app: _, installation: i, profile: _ } => Present { value: i }
+    ManagedAppInstallationCredential { app: a, installation: i, profile: _ } =>
+      Present { value: AuthorityInstallation { app: a, installation: i } }
   }
 }
 
@@ -133,9 +141,8 @@ fn dispatch_jit_mint(
       }
     JitMintAuthorized {
       attempt: attempt,
-      endpoint_path: path,
+      endpoint_path: _,
       request: request,
-      drive_destination: destination,
     } =>
       match authority_installation(authority: authority) {
         Absent =>
@@ -144,25 +151,23 @@ fn dispatch_jit_mint(
               cause: "the authorized credential names no App installation, so no installation access token can be minted and the two-step generate-jitconfig path cannot be taken",
             },
           }
-        Present { value: installation } =>
+        Present { value: held } =>
           JitMintDispatchAuthorized {
             attempt: attempt,
-            installation_token_url: github_app_installation_access_token_url(
-              installation_id: installation.value,
-            ),
-            endpoint_path: path,
+            app: held.app,
+            installation: held.installation,
+            organization: organization,
             request: request,
-            drive_destination: destination,
           }
       }
   }
 }
 
-// THE DELIVERY IS WHERE THE CREDENTIAL AND ITS DESTINATION BECOME INSEPARABLE.
+// THE DELIVERY IS WHERE THE CREDENTIAL AND ITS ATTEMPT BECOME INSEPARABLE.
 //
-// An EncodedJitConfig is obtainable from this module only alongside the drive path the ownership
-// proof produced, so there is no value here that hands a caller a credential it may send anywhere
-// it likes. That is the structural form of "there is no endpoint a host may ask": the credential is
+// An EncodedJitConfig is obtainable from this module only alongside the attempt the ownership proof
+// produced, so there is no value here that hands a caller a credential it may send anywhere it
+// likes: gunbc.runner_attempt_launch refuses a delivery bound to any other attempt. That is the structural form of "there is no endpoint a host may ask": the credential is
 // not addressable independently of the attempt it belongs to.
 //
 // THE NOT-CREATED ARM CARRIES GitHub's OWN OUTCOME VALUE UNCHANGED. Re-coining upstream's four
@@ -174,9 +179,8 @@ fn dispatch_jit_mint(
 // its arms, which does not exist today. Duplicating the vocabulary to reach rung four would trade a
 // state no fold writes for a fork that drifts.
 type JitCredentialDelivery
-  = JitCredentialBoundToDrive {
+  = JitCredentialBoundToAttempt {
       attempt: MicroVmAttempt
-      drive_destination: String
       credential: EncodedJitConfig
       runner_id: Int
     }
@@ -191,16 +195,15 @@ fn receive_jit_mint(
     JitMintDispatchRefused { refusal: r } => JitCredentialNotDispatched { refusal: r }
     JitMintDispatchAuthorized {
       attempt: attempt,
-      installation_token_url: _,
-      endpoint_path: _,
+      app: _,
+      installation: _,
+      organization: _,
       request: _,
-      drive_destination: destination,
     } =>
       match outcome {
         JitConfigMinted { config: config, runner_id: runner_id } =>
-          JitCredentialBoundToDrive {
+          JitCredentialBoundToAttempt {
             attempt: attempt,
-            drive_destination: destination,
             credential: config,
             runner_id: runner_id,
           }
@@ -222,9 +225,8 @@ fn receive_jit_mint(
 
 fn jit_credential_delivered(delivery: JitCredentialDelivery) -> Bool {
   match delivery {
-    JitCredentialBoundToDrive {
+    JitCredentialBoundToAttempt {
       attempt: _,
-      drive_destination: _,
       credential: _,
       runner_id: _,
     } => true
@@ -233,24 +235,6 @@ fn jit_credential_delivered(delivery: JitCredentialDelivery) -> Bool {
   }
 }
 
-// §3c: THESE FOLDS ARE NOT EXECUTED BY PRODUCTION, AND SAYING SO IS THE POINT OF THIS ROW.
-//
-// What stands between them is a transport: nothing in gunbc performs a GitHubEffect. A census of
-// the corpus finds GitHubEffect in exactly two places -- gunbc.auth.github_credential, which
-// decides authorization, and gunbc.runner_jit_mint, which plans -- and no realization anywhere
-// posts either step of this path. So the witnesses enrolled for this module are FIXTURE-ONLY and
-// establish the fold's discrimination, never that a credential has ever been minted this way.
-//
-// The trigger names the CAPABILITY rather than an artifact, because a trigger naming less than the
-// capability is satisfied while the capability stays dead (DESIGN §4b(3)). What is required is a
-// realization that PERFORMS a GitHubEffect and returns its typed outcome, sufficient for
-// receive_jit_mint to be reached with a JitConfigMintOutcome that GitHub produced. A curl argv is
-// not that capability and would not discharge this row: the installation token would ride in an
-// argv, which is the exposure gunbc.credential_argv_exposure already measures, so the effect
-// realization this names is blocked behind the declared input TYPE on v2.std.operation_argv
-// ShellTransportOperationRow that extdeps.github.actions_jit_runner names for the same reason.
-data jit_mint_effect_transport_frontier: DissolutionCondition = unbound_dissolution(description: "NAMED CONSUMER: a realization that performs a GitHubEffect and returns JitConfigMintOutcome, reaching receive_jit_mint with an outcome GitHub produced. TRIGGER: that realization exists and this module's delivery is executed through it. SUFFICIENT FOR deleting this row. NOT satisfied by a witness, nor by an argv-rendered token, which re-opens gunbc.credential_argv_exposure." as NonEmptyStr)
-
 // §3c: THE HOST-SIDE FETCH IS STILL STANDING AND THIS CHANGE DID NOT DELETE IT.
 //
 // An inverted push with the pull still reachable is TWO authorities for one credential, and the
diff --git a/dag/gunbc/runner/runner_microvm_attempt.dag b/dag/gunbc/runner/runner_microvm_attempt.dag
index 86ef678b3ff..685ccef3d95 100644
--- a/dag/gunbc/runner/runner_microvm_attempt.dag
+++ b/dag/gunbc/runner/runner_microvm_attempt.dag
@@ -121,10 +121,6 @@ fn runner_microvm_attempt_rootfs_path(attempt: MicroVmAttempt) -> String {
   join([runner_microvm_attempt_dir(attempt: attempt), "/rootfs.ext4"], "")
 }
 
-fn runner_microvm_attempt_jit_drive_path(attempt: MicroVmAttempt) -> String {
-  join([runner_microvm_attempt_dir(attempt: attempt), "/jit.img"], "")
-}
-
 fn runner_microvm_attempt_vm_config_path(attempt: MicroVmAttempt) -> String {
   join([runner_microvm_attempt_dir(attempt: attempt), "/vm-config.json"], "")
 }
@@ -166,7 +162,6 @@ type MicroVmCellBinding
   = VmBoundToOwnedCell {
       attempt: MicroVmAttempt
       rootfs_path: String
-      jit_drive_path: String
       vm_config_path: String
       unit_name: NonEmptyStr
       slice_property: SystemdRunProperty
@@ -227,7 +222,6 @@ fn bind_owned_attempt(attempt: MicroVmAttempt, owned: Bool) -> MicroVmCellBindin
     VmBoundToOwnedCell {
       attempt: attempt,
       rootfs_path: runner_microvm_attempt_rootfs_path(attempt: attempt),
-      jit_drive_path: runner_microvm_attempt_jit_drive_path(attempt: attempt),
       vm_config_path: runner_microvm_attempt_vm_config_path(attempt: attempt),
       unit_name: runner_microvm_attempt_unit_name(attempt: attempt),
       slice_property: runner_microvm_attempt_slice_property(attempt: attempt),
diff --git a/dag/test/claim/github_app_registry_witness_test.dag b/dag/test/claim/github_app_registry_witness_test.dag
index fd962955956..6f8f786bfb5 100644
--- a/dag/test/claim/github_app_registry_witness_test.dag
+++ b/dag/test/claim/github_app_registry_witness_test.dag
@@ -13,7 +13,6 @@ import gunbc.runner_microvm_attempt {
   MicroVmCellBinding, VmUnboundCellNotOwned,
   MicroVmAttemptResult, MicroVmAttemptAccepted, MicroVmAttemptRefused,
   microvm_attempt, bind_owned_attempt, runner_microvm_attempt_unit_name,
-  runner_microvm_attempt_jit_drive_path,
 }
 import extdeps.github.actions_jit_runner {
   JitRunnerGroupId, JitRunnerLabel, JitConfigMintOutcome, jit_config_mint_outcome,
@@ -30,7 +29,7 @@ import gunbc.runner.runner_jit_perform {
   JitMintDispatch, JitMintDispatchAuthorized, JitMintDispatchRefused,
   JitDispatchRefusal, DispatchRefusedCellNotOwned, DispatchRefusedCredential,
   DispatchRefusedAttemptUnbound,
-  JitCredentialDelivery, JitCredentialBoundToDrive, JitCredentialNotDispatched,
+  JitCredentialDelivery, JitCredentialBoundToAttempt, JitCredentialNotDispatched,
   JitCredentialMintNotCreated,
   dispatch_jit_mint, receive_jit_mint, jit_credential_delivered,
 }
@@ -996,19 +995,17 @@ test fn witness_jit_mint_refuses_a_credential_missing_the_runner_permission() ->
 }
 
 // POSITIVE CONTROL. Without it both refusals above are satisfied by a planner that refuses
-// unconditionally. It also pins the two facts the mint's caller consumes: the drive destination is
-// the ATTEMPT's own path, and the runner name is the unit name rather than a second identifier.
+// unconditionally. It also pins the fact the mint's caller consumes: the runner name is the unit
+// name rather than a second identifier.
 test fn witness_jit_mint_authorizes_an_owned_cell_with_the_runner_permission() -> Bool {
   match planned(owned: true, perms: runner_grant) {
     JitMintAuthorized {
       attempt: a,
       endpoint_path: path,
       request: req,
-      drive_destination: dest,
     } =>
       path == "/orgs/gunb-ai/actions/runners/generate-jitconfig"
         && (req.name.value as String) == (runner_microvm_attempt_unit_name(attempt: a) as String)
-        && string_contains(s: dest, pattern: "/jit.img")
     _ => false
   }
 }
@@ -1113,22 +1110,22 @@ test fn witness_jit_dispatch_refuses_when_the_attempt_binding_is_deferred() -> B
 }
 
 // POSITIVE CONTROL. Without it the three reds above are satisfied by a dispatcher that refuses
-// unconditionally. It also pins the two-step shape: the installation token URL is derived from the
-// credential's own installation id rather than spelled, and the second step is the org-derived
-// generate-jitconfig path, so a dispatch cannot address another organization's runners.
+// unconditionally. It also pins the two-step shape: the App and installation the token is minted
+// for are the credential's own (not spelled at a call site), and the organization is the one the
+// plan authorized, so a dispatch cannot address another organization's runners.
 test fn witness_jit_dispatch_authorizes_and_names_both_steps_of_the_app_path() -> Bool {
   match dispatched(owned: true, perms: runner_grant) {
     JitMintDispatchAuthorized {
       attempt: a,
-      installation_token_url: token_url,
-      endpoint_path: path,
+      app: app,
+      installation: installation,
+      organization: org,
       request: req,
-      drive_destination: dest,
     } =>
-      token_url == "https://api.github.com/app/installations/999/access_tokens"
-        && path == "/orgs/gunb-ai/actions/runners/generate-jitconfig"
+      installation.value == 999
+        && app == gunbai_bot_declared
+        && (org.login as String) == "gunb-ai"
         && (req.name.value as String) == (runner_microvm_attempt_unit_name(attempt: a) as String)
-        && string_contains(s: dest, pattern: "/jit.img")
     _ => false
   }
 }
@@ -1167,23 +1164,25 @@ test fn witness_an_authorized_dispatch_delivers_nothing_when_the_mint_was_not_cr
 }
 
 // DELIVERY POSITIVE CONTROL, and it pins the property the push direction rests on: the credential
-// is reachable ONLY beside the attempt's own drive destination. There is no value in this module's
+// is reachable ONLY bound to the attempt the dispatch proved. There is no value in this module's
 // vocabulary that hands a caller a credential it may address anywhere else, which is the structural
 // form of "there is no endpoint a host may ask".
-test fn witness_a_minted_credential_is_bound_to_the_attempts_own_drive_destination() -> Bool {
+test fn witness_a_minted_credential_is_bound_to_the_dispatched_attempt() -> Bool {
   let delivery = receive_jit_mint(
     dispatch: dispatched(owned: true, perms: runner_grant),
     outcome: minted_outcome,
   )
   jit_credential_delivered(delivery: delivery)
     && match delivery {
-      JitCredentialBoundToDrive {
+      JitCredentialBoundToAttempt {
         attempt: a,
-        drive_destination: dest,
         credential: c,
         runner_id: id,
       } =>
-        dest == runner_microvm_attempt_jit_drive_path(attempt: a)
+        match dispatched(owned: true, perms: runner_grant) {
+          JitMintDispatchAuthorized { attempt: d, app: _, installation: _, organization: _, request: _ } => a == d
+          _ => false
+        }
           && (c.encoded as String) == "ZmFrZS1qaXQtY29uZmln"
           && id == 4242
       _ => false
diff --git a/dag/test/claim/github_effect_perform_witness_test.dag b/dag/test/claim/github_effect_perform_witness_test.dag
new file mode 100644
index 00000000000..baa838a9702
--- /dev/null
+++ b/dag/test/claim/github_effect_perform_witness_test.dag
@@ -0,0 +1,116 @@
+module test.claim.github_effect_perform_witness
+
+import std.types { String, Bool, Int, List, NonEmptyStr }
+import std.integer { UInt8 }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import extdeps.auth.jws { jws_rs256_signing_input, jws_compact_serialization }
+import extdeps.github.org_admin_auth { github_app_jwt_claims_json }
+import extdeps.tools.openssl { openssl_signature_of, OpensslSigned, OpensslSignRefused }
+import extdeps.github.actions_jit_runner { JitConfigCreatedBody, JitConfigCreatedRunner }
+import extdeps.transports.rest {
+  RestOk, RestStatusRefused, RestTransportRefused, RestExchangeCommitAmbiguous,
+}
+import gunbc.runner.runner_jit_perform {
+  JitCredentialBoundToAttempt, JitCredentialMintNotCreated, JitCredentialNotDispatched,
+}
+import gunbc.github_effect_perform {
+  jit_mint_performance_of_generate, perform_organization_jit_mint,
+  JitMintReceived, JitMintStepNotSucceeded, GenerateJitConfigStep,
+}
+import test.claim.github_app_registry { dispatched, runner_grant }
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// RFC 7515 appendix A's header differs from ours only in alg; this golden is base64url of
+// {"alg":"RS256","typ":"JWT"} computed outside this tree (`base64 | tr '+/' '-_' | tr -d =`), so a
+// padded, standard-alphabet or re-ordered header goes red.
+data rs256_jwt_header_b64url: String = "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9"
+
+test fn witness_jws_signing_input_leads_with_the_rs256_header_unpadded() -> Bool {
+  let input = jws_rs256_signing_input(payload_json: "x") as String
+  starts_with(s: input, prefix: concat(rs256_jwt_header_b64url, "."))
+}
+
+// 0xFB 0xFF is "+/8=" in the standard alphabet and "-_8" in base64url: one input that goes red for
+// the wrong alphabet AND for kept padding, which are the two ways a signature segment is mis-encoded.
+test fn witness_jws_signature_segment_is_base64url_without_padding() -> Bool {
+  let compact = jws_compact_serialization(signing_input: "h.p", signature: [251, 255]) as String
+  compact == "h.p.-_8"
+}
+
+test fn witness_app_jwt_claims_backdate_iat_bound_exp_and_name_the_app() -> Bool {
+  github_app_jwt_claims_json(app_id: 2653532, now_epoch_secs: 1000)
+    == "\{\"iat\":940,\"exp\":1540,\"iss\":\"2653532\"}"
+}
+
+// BOTH OpenSSL RENDERINGS decode to the same octets; a refusal from the process, a missing
+// separator and a non-hex digit each refuse rather than yielding a guessed signature.
+test fn witness_openssl_hex_signature_decodes_both_renderings_and_refuses_the_rest() -> Bool {
+  let v3 = match openssl_signature_of(exit_code: 0, stdout: "RSA-SHA2-256(stdin)= 0aff\n", stderr: "") {
+    OpensslSigned { octets: o } => o == [10, 255]
+    OpensslSignRefused { exit_code: _, detail: _ } => false
+  }
+  let v1 = match openssl_signature_of(exit_code: 0, stdout: "(stdin)= 0aff", stderr: "") {
+    OpensslSigned { octets: o } => o == [10, 255]
+    OpensslSignRefused { exit_code: _, detail: _ } => false
+  }
+  let failed = match openssl_signature_of(exit_code: 1, stdout: "", stderr: "Could not open file") {
+    OpensslSignRefused { exit_code: 1, detail: _ } => true
+    _ => false
+  }
+  let unseparated = match openssl_signature_of(exit_code: 0, stdout: "0aff", stderr: "") {
+    OpensslSignRefused { exit_code: _, detail: _ } => true
+    OpensslSigned { octets: _ } => false
+  }
+  let not_hex = match openssl_signature_of(exit_code: 0, stdout: "(stdin)= zz", stderr: "") {
+    OpensslSignRefused { exit_code: _, detail: _ } => true
+    OpensslSigned { octets: _ } => false
+  }
+  v3 && v1 && failed && unseparated && not_hex
+}
+
+data created_body: JitConfigCreatedBody = JitConfigCreatedBody {
+  runner: JitConfigCreatedRunner { id: 4242 },
+  encoded_jit_config: "ZmFrZS1qaXQtY29uZmln",
+}
+
+// THE GENERATE STEP'S THREE ANSWERS, supplied rather than fetched (DESIGN §3: this witness is about
+// the decision, and the dispatch fixture is test.claim.github_app_registry's, not re-derived here).
+// A 201 delivers bound to the dispatched attempt with the registration id; a 409 GitHub decided is
+// a not-created refusal; a POST that never answered is commit-ambiguous and is NOT a refusal,
+// because GitHub may have created the registration.
+test fn witness_generate_step_delivers_refuses_or_reports_ambiguity_by_what_github_answered() -> Bool {
+  let d = dispatched(owned: true, perms: runner_grant)
+  let delivered = match jit_mint_performance_of_generate(dispatch: d, outcome: RestOk, created: created_body) {
+    JitMintReceived { delivery: JitCredentialBoundToAttempt { attempt: _, credential: c, runner_id: id } } =>
+      (c.encoded as String) == "ZmFrZS1qaXQtY29uZmln" && id == 4242
+    _ => false
+  }
+  let conflicted = match jit_mint_performance_of_generate(
+    dispatch: d,
+    outcome: RestStatusRefused { status: 409, body: "Already exists" },
+    created: created_body,
+  ) {
+    JitMintReceived { delivery: JitCredentialMintNotCreated { outcome: _ } } => true
+    _ => false
+  }
+  let ambiguous = match jit_mint_performance_of_generate(
+    dispatch: d,
+    outcome: RestTransportRefused { cause: "connection reset" },
+    created: created_body,
+  ) {
+    JitMintStepNotSucceeded { step: GenerateJitConfigStep, performance: RestExchangeCommitAmbiguous { detail: _ } } => true
+    _ => false
+  }
+  delivered && conflicted && ambiguous
+}
+
+// A REFUSED DISPATCH PERFORMS NOTHING: no key is read and no request is sent, and the refusal the
+// plan reached is what comes back. This executes the real perform function, which reaches no
+// effect on this arm.
+test fn witness_a_refused_dispatch_performs_no_mint() -> Bool {
+  match perform_organization_jit_mint(dispatch: dispatched(owned: false, perms: runner_grant)) {
+    JitMintReceived { delivery: JitCredentialNotDispatched { refusal: _ } } => true
+    _ => false
+  }
+}
diff --git a/dag/test/claim/runner/runner_attempt_launch_witness_test.dag b/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
index c548c9b3f7d..45a9d44c8dd 100644
--- a/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
+++ b/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
@@ -1,14 +1,14 @@
 module test.claim.runner_attempt_launch_witness
 
 import std.types { String, Bool, Int, List, NonEmptyStr }
+import v2.std.optional { Absent, Present }
 import std.nat { Nat }
-import std.measure { byte_size, byte_size_count }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import extdeps.exec.command { argv_words }
 import extdeps.tools.mkdir { mkdir_binary_path }
 import gunbc.runner_microvm { gunbc_runner_microvm_declared_size }
 import extdeps.virtualization.firecracker {
-  firecracker_requires_kvm_device,
+  firecracker_requires_kvm_device, FirecrackerDrive,
 }
 import test.claim.fabric_grant_issuance_witness {
   issue, subject_work, first_attempt, funded_account, exhausted_account,
@@ -30,19 +30,30 @@ import std.dissolution { UnboundDissolution, BoundDissolution }
 import gunbc.guarantee_rung { Mitigatable, MechanicallyPreventable, OutsideTheLadder, StructurallyGuaranteed, StructurallyImpossible }
 import gunbc.runner_attempt_launch {
   AttemptLaunchPlan, LaunchAuthorized, LaunchRefusedUnauthorized,
-  LaunchRefusedEnvelope, LaunchRefusedPriorResources,
+  LaunchRefusedJitCredential, LaunchRefusedPriorResources,
   AttemptGround, GroundClear, GroundOccupied,
-  EnvelopeStanding, EnvelopeAdmitted, EnvelopeAbsent, EnvelopeMalformed,
-  EnvelopeSignatureRejected, EnvelopeBoundToDifferentUnit, EnvelopeBoundToDifferentBoot,
-  EnvelopeNonceMismatch, EnvelopeBoundToDifferentAttempt, EnvelopePayloadDigestMismatch,
-  EnvelopePayloadBelowFloor, EnvelopePayloadAboveCeiling, EnvelopeAdmissionAxisNotRequired,
-  plan_attempt_launch, planned_jailer_launches,
+  JitDeviceRefusal, JitMintNotReceived, JitCredentialNotDelivered,
+  JitCredentialBoundToDifferentAttempt, JitCredentialBelowFloor, JitCredentialAboveCeiling,
+  jit_device_readback, JitDeviceStagingRefused, JitDeviceReadbackStep,
+  plan_attempt_launch, planned_jailer_launches, planned_jit_devices,
   attempt_jail_chroot_root, workspace_drive_path_on_host,
   work_standing_from_vmm_exit, WorkNotEstablished,
   reported_attempt_launch_rung,
-  host_boot_cutover_frontier, jit_mint_http_realization_frontier, jail_jit_device_staging_frontier,
-  jail_workspace_path,
+  host_boot_cutover_frontier,
+  jail_workspace_path, jail_jit_path,
 }
+import extdeps.github.actions_jit_runner {
+  EncodedJitConfig, JitConfigMinted, jit_config_mint_outcome,
+}
+import extdeps.transports.rest { RestExchangeCommitAmbiguous }
+import gunbc.runner.runner_jit_perform {
+  JitCredentialBoundToAttempt, JitCredentialMintNotCreated,
+}
+import gunbc.github_effect_perform {
+  JitMintPerformance, JitMintReceived, JitMintAppJwtUnsigned, JitMintStepNotSucceeded,
+  GenerateJitConfigStep,
+}
+import gunbc.runner_microvm_attempt { runner_microvm_attempt_unit_name }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
@@ -83,11 +94,46 @@ fn accepted_attempt(i: Nat, id: String) -> List<MicroVmAttempt> {
   }
 }
 
+// THE CREDENTIAL FIXTURE IS BUILT THROUGH jit_config_mint_outcome, the one authority that turns a
+// 201 body into an EncodedJitConfig, so the witnesses below are fed the same carrier a real mint
+// produces rather than a second constructor of it. Lengths are made by doubling so the floor
+// (512) and ceiling (65536) are straddled without spelling kilobytes of literal.
+fn doubled(s: String, k: Int) -> String {
+  if k <= 0 { s } else { doubled(s: concat(s, s), k: k - 1) }
+}
+
+data registration_fixture_id: Int = 4242
+
+fn minted_credential(encoded: String) -> List<EncodedJitConfig> {
+  match jit_config_mint_outcome(status: 201, encoded: encoded, runner_id: registration_fixture_id, error_body: "") {
+    JitConfigMinted { config: c, runner_id: _ } => [c]
+    _ => []
+  }
+}
+
+// 20 characters: GitHub never mints this short, and it is the fail-open receipt's shape --
+// something that is not a whole credential, handed on as if it were.
+data short_blob: String = "ZmFrZS1qaXQtY29uZmln"
+
+fn received_for(attempt: MicroVmAttempt, encoded: String) -> JitMintPerformance {
+  match minted_credential(encoded: encoded) {
+    Cons { head: c, tail: _ } =>
+      JitMintReceived {
+        delivery: JitCredentialBoundToAttempt { attempt: attempt, credential: c, runner_id: registration_fixture_id },
+      }
+    Empty {} => JitMintAppJwtUnsigned { detail: "fixture: credential fixture did not mint" }
+  }
+}
+
+fn live_grant(attempt: MicroVmAttempt) -> JitMintPerformance {
+  received_for(attempt: attempt, encoded: doubled(s: "A", k: 10))
+}
+
 fn plan_for(
   pair: IssuedPair,
   account: MoneyAccount,
   attempt: MicroVmAttempt,
-  envelope: EnvelopeStanding,
+  mint: JitMintPerformance,
   ground: AttemptGround,
 ) -> AttemptLaunchPlan {
   plan_attempt_launch(
@@ -98,7 +144,7 @@ fn plan_for(
     demand: pair.grant.context.demand,
     offer: pair.grant.object.offer,
     attempt: attempt,
-    envelope: envelope,
+    mint: mint,
     ground: ground,
     jailer_binary: "/bin/jailer",
     firecracker_binary: "/bin/firecracker",
@@ -108,65 +154,73 @@ fn plan_for(
   )
 }
 
-fn admitted(n: Nat) -> EnvelopeStanding {
-  EnvelopeAdmitted { bytes: byte_size(count: n) }
+fn refusal_of(plan: AttemptLaunchPlan) -> List<JitDeviceRefusal> {
+  match plan {
+    LaunchRefusedJitCredential { refusal: r } => [r]
+    _ => []
+  }
 }
 
-fn launches_for(
-  pair: IssuedPair,
-  account: MoneyAccount,
-  attempt: MicroVmAttempt,
-  envelope: EnvelopeStanding,
-  ground: AttemptGround,
-) -> Int {
-  planned_jailer_launches(plan: plan_for(
-    pair: pair, account: account, attempt: attempt, envelope: envelope, ground: ground,
-  ))
+// NEITHER A DEVICE NOR A VMM: the law's two halves, read off one plan so they cannot disagree.
+fn no_device_no_vmm(plan: AttemptLaunchPlan) -> Bool {
+  planned_jailer_launches(plan: plan) == 0 && planned_jit_devices(plan: plan) == 0
 }
 
-test fn a_zero_byte_credential_does_not_start_the_vmm() -> Bool {
+// THE RECEIPTED FAIL-OPEN, AS A RED. X staged whatever bytes it had and launched. A credential below
+// the floor must yield no device and no VMM, and the refusal must say it was the floor.
+test fn a_below_floor_credential_stages_no_device_and_starts_no_vmm() -> Bool {
   match issued_pairs() {
     Cons { head: pair, tail: _ } =>
       match accepted_attempt(i: 1, id: "cred0") {
+        Cons { head: a, tail: _ } => {
+          let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: received_for(attempt: a, encoded: short_blob), ground: GroundClear)
+          no_device_no_vmm(plan: plan)
+            && match refusal_of(plan: plan) {
+              Cons { head: JitCredentialBelowFloor { bytes: n }, tail: _ } => n == 20
+              _ => false
+            }
+        }
+        Empty {} => false
+      }
+    Empty {} => false
+  }
+}
+
+test fn an_above_ceiling_credential_stages_no_device_and_starts_no_vmm() -> Bool {
+  match issued_pairs() {
+    Cons { head: pair, tail: _ } =>
+      match accepted_attempt(i: 1, id: "credbig") {
+        Cons { head: a, tail: _ } => {
+          let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: received_for(attempt: a, encoded: doubled(s: "A", k: 17)), ground: GroundClear)
+          no_device_no_vmm(plan: plan)
+            && match refusal_of(plan: plan) {
+              Cons { head: JitCredentialAboveCeiling { bytes: _ }, tail: _ } => true
+              _ => false
+            }
+        }
+        Empty {} => false
+      }
+    Empty {} => false
+  }
+}
+
+// A CREDENTIAL IS THE ATTEMPT'S OR IT IS NOBODY'S. A live credential bound to a sibling attempt on
+// the same slot must not become this attempt's device -- that is the segment race inside one host.
+test fn a_credential_bound_to_another_attempt_stages_no_device() -> Bool {
+  match issued_pairs() {
+    Cons { head: pair, tail: _ } =>
+      match accepted_attempt(i: 6, id: "mine") {
         Cons { head: a, tail: _ } =>
-          match plan_for(pair: pair, account: pair.account, attempt: a, envelope: admitted(n: 0), ground: GroundClear) {
-            LaunchRefusedEnvelope { standing: s } =>
-              match s {
-                EnvelopePayloadBelowFloor { bytes: n } =>
-                  byte_size_count(b: n) == 0 && launches_for(
-                    pair: pair, account: pair.account, attempt: a, envelope: admitted(n: 0), ground: GroundClear,
-                  ) == 0
-                EnvelopeAdmitted { bytes: _ } => false
-                EnvelopeAbsent => false
-                EnvelopeMalformed => false
-                EnvelopeSignatureRejected => false
-                EnvelopeBoundToDifferentUnit => false
-                EnvelopeBoundToDifferentBoot => false
-                EnvelopeNonceMismatch => false
-                EnvelopeBoundToDifferentAttempt => false
-                EnvelopePayloadDigestMismatch => false
-                EnvelopePayloadAboveCeiling { bytes: _ } => false
-                EnvelopeAdmissionAxisNotRequired => false
-              }
-            LaunchRefusedUnauthorized { authorization: _ } => false
-            LaunchRefusedPriorResources => false
-            LaunchAuthorized {
-              authorization: _,
-              tap_device: _,
-              guest_ip_boot_arg: _,
-              nft_ruleset: _,
-              slice: _,
-              jail_root: _,
-              stage_jail_root: _,
-              stage_kernel: _,
-              stage_rootfs: _,
-              workspace_path: _,
-              workspace_create: _,
-              workspace_format: _,
-              kvm_device: _,
-              vm_config: _,
-              jailer: _,
-            } => false
+          match accepted_attempt(i: 6, id: "theirs") {
+            Cons { head: b, tail: _ } => {
+              let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: b), ground: GroundClear)
+              no_device_no_vmm(plan: plan)
+                && match refusal_of(plan: plan) {
+                  Cons { head: JitCredentialBoundToDifferentAttempt { bound_to: other }, tail: _ } => other == b
+                  _ => false
+                }
+            }
+            Empty {} => false
           }
         Empty {} => false
       }
@@ -174,18 +228,55 @@ test fn a_zero_byte_credential_does_not_start_the_vmm() -> Bool {
   }
 }
 
+// EVERY NON-DELIVERY ARM OF THE MINT -- an unsigned App JWT, a commit-ambiguous generate step, and a
+// GitHub refusal that created nothing -- yields no device and no VMM, and each is carried as ITS
+// OWN refusal rather than collapsed into one "no credential".
+test fn a_mint_that_delivered_nothing_stages_no_device_and_starts_no_vmm() -> Bool {
+  match issued_pairs() {
+    Cons { head: pair, tail: _ } =>
+      match accepted_attempt(i: 5, id: "nomint") {
+        Cons { head: a, tail: _ } => {
+          let unsigned = plan_for(pair: pair, account: pair.account, attempt: a,
+            mint: JitMintAppJwtUnsigned { detail: "fixture: openssl refused the key" }, ground: GroundClear)
+          let ambiguous = plan_for(pair: pair, account: pair.account, attempt: a,
+            mint: JitMintStepNotSucceeded {
+              step: GenerateJitConfigStep,
+              performance: RestExchangeCommitAmbiguous { detail: "fixture: no response to the generate POST" },
+            }, ground: GroundClear)
+          let refused = plan_for(pair: pair, account: pair.account, attempt: a,
+            mint: JitMintReceived {
+              delivery: JitCredentialMintNotCreated {
+                outcome: jit_config_mint_outcome(status: 409, encoded: "", runner_id: 0, error_body: "fixture: name taken"),
+              },
+            }, ground: GroundClear)
+          no_device_no_vmm(plan: unsigned) && no_device_no_vmm(plan: ambiguous) && no_device_no_vmm(plan: refused)
+            && match refusal_of(plan: unsigned) {
+              Cons { head: JitMintNotReceived { performance: _ }, tail: _ } => true
+              _ => false
+            }
+            && match refusal_of(plan: ambiguous) {
+              Cons { head: JitMintNotReceived { performance: _ }, tail: _ } => true
+              _ => false
+            }
+            && match refusal_of(plan: refused) {
+              Cons { head: JitCredentialNotDelivered { delivery: _ }, tail: _ } => true
+              _ => false
+            }
+        }
+        Empty {} => false
+      }
+    Empty {} => false
+  }
+}
+
 test fn an_unauthorized_grant_yields_zero_jailer_launches() -> Bool {
   match issued_pairs() {
     Cons { head: pair, tail: _ } =>
       match accepted_attempt(i: 2, id: "unauth") {
         Cons { head: a, tail: _ } =>
-          match plan_for(
-            pair: pair, account: exhausted_account, attempt: a, envelope: admitted(n: 4096), ground: GroundClear,
-          ) {
+          match plan_for(pair: pair, account: exhausted_account, attempt: a, mint: live_grant(attempt: a), ground: GroundClear) {
             LaunchRefusedUnauthorized { authorization: _ } =>
-              launches_for(
-                pair: pair, account: exhausted_account, attempt: a, envelope: admitted(n: 4096), ground: GroundClear,
-              ) == 0
+              no_device_no_vmm(plan: plan_for(pair: pair, account: exhausted_account, attempt: a, mint: live_grant(attempt: a), ground: GroundClear))
             _ => false
           }
         Empty {} => false
@@ -199,12 +290,9 @@ test fn prior_resources_refuse_rather_than_reuse() -> Bool {
     Cons { head: pair, tail: _ } =>
       match accepted_attempt(i: 3, id: "prior") {
         Cons { head: a, tail: _ } =>
-          match plan_for(
-            pair: pair, account: pair.account, attempt: a, envelope: admitted(n: 4096), ground: GroundOccupied,
-          ) {
-            LaunchRefusedPriorResources => launches_for(
-              pair: pair, account: pair.account, attempt: a, envelope: admitted(n: 4096), ground: GroundOccupied,
-            ) == 0
+          match plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: a), ground: GroundOccupied) {
+            LaunchRefusedPriorResources =>
+              no_device_no_vmm(plan: plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: a), ground: GroundOccupied))
             _ => false
           }
         Empty {} => false
@@ -213,69 +301,113 @@ test fn prior_resources_refuse_rather_than_reuse() -> Bool {
   }
 }
 
-test fn an_authorized_plan_carries_network_slice_workspace_and_jailer_command() -> Bool {
+fn jit_drive_is_read_only_at(cfg_drives: List<FirecrackerDrive>, path: String) -> Bool {
+  fold(cfg_drives, init: false, f: (acc, d) =>
+    acc || ((d.path_on_host as String) == path && d.is_read_only))
+}
+
+// THE POSITIVE CONTROL. Without it every red above is satisfied by a planner that refuses
+// unconditionally. A live grant yields EXACTLY ONE staged device and one launch; the device is the
+// attempt's jail /jit.bin, created 0400 and owned by the uid the jailer drops to BEFORE any byte is
+// written, padded to whole sectors, carrying the minted credential unchanged; the VM sees it only
+// as a read-only drive; and the registration id and runner name are recorded on the launch.
+test fn a_live_grant_stages_exactly_one_device_and_records_the_registration() -> Bool {
   match issued_pairs() {
     Cons { head: pair, tail: _ } =>
       match accepted_attempt(i: 4, id: "ok1") {
-        Cons { head: a, tail: _ } =>
-          match plan_for(
-            pair: pair, account: pair.account, attempt: a, envelope: admitted(n: 4096), ground: GroundClear,
-          ) {
-            LaunchAuthorized {
-              authorization: _,
-              tap_device: tap,
-              guest_ip_boot_arg: ip,
-              nft_ruleset: nft,
-              slice: _,
-              jail_root: jail_root,
-              stage_jail_root: stage_root,
-              stage_kernel: stage_k,
-              stage_rootfs: stage_r,
-              workspace_path: ws,
-              workspace_create: create,
-              workspace_format: fmt,
-              kvm_device: kvm,
-              vm_config: cfg,
-              jailer: jailer,
-            } => {
-              let words = join(argv_words(command: jailer), " ")
-              let create_words = join(argv_words(command: create), " ")
-              (tap as String) == (runner_slot_tap_device_name(slot: a.slot) as String)
-                && nft == runner_microvm_nft_ruleset_text()
-                && jail_root == attempt_jail_chroot_root(attempt: a, firecracker_binary: "/bin/firecracker")
-                && (stage_root.program as String) == (mkdir_binary_path as String)
-                && (stage_k.program as String) == "cp"
-                && (stage_r.program as String) == "cp"
-                && string_contains(s: ws, pattern: runner_microvm_attempt_jail_base(attempt: a))
-                && string_contains(s: ws, pattern: jail_workspace_path as String)
-                && string_contains(s: create_words, pattern: concat("of=", ws))
-                && workspace_drive_path_on_host(config: cfg) == (jail_workspace_path as String)
-                && (kvm as String) == (firecracker_requires_kvm_device as String)
-                && string_contains(s: ip, pattern: "ip=")
-                && string_contains(s: words, pattern: "--exec-file")
-                && string_contains(s: words, pattern: "--no-api")
-                && string_contains(s: words, pattern: "--chroot-base-dir")
-                && string_contains(s: words, pattern: "--cgroup-version")
-                && string_contains(s: words, pattern: "/bin/jailer")
-                && (fmt.program as String) == "mke2fs"
-                && (create.program as String) == "/bin/busybox"
-                && string_contains(s: join(argv_words(command: create), " "), pattern: "count=0")
-                && string_contains(s: join(argv_words(command: create), " "), pattern: "seek=4096")
-                && count(cfg.drives) == 3
-                && planned_jailer_launches(plan: plan_for(
-                  pair: pair, account: pair.account, attempt: a, envelope: admitted(n: 4096), ground: GroundClear,
-                )) == 1
+        Cons { head: a, tail: _ } => {
+          let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: a), ground: GroundClear)
+          planned_jit_devices(plan: plan) == 1 && planned_jailer_launches(plan: plan) == 1
+            && match plan {
+              LaunchAuthorized {
+                authorization: _,
+                jit_runner_name: name,
+                jit_registration_id: reg,
+                jit_device: device,
+                tap_device: tap,
+                guest_ip_boot_arg: ip,
+                nft_ruleset: nft,
+                slice: _,
+                jail_root: jail_root,
+                stage_jail_root: stage_root,
+                stage_kernel: stage_k,
+                stage_rootfs: stage_r,
+                workspace_path: ws,
+                workspace_create: create,
+                workspace_format: fmt,
+                kvm_device: kvm,
+                vm_config: cfg,
+                jailer: jailer,
+              } => {
+                let words = join(argv_words(command: jailer), " ")
+                let create_words = join(argv_words(command: create), " ")
+                let device_create = join(argv_words(command: device.create), " ")
+                let device_pad = join(argv_words(command: device.pad), " ")
+                reg == registration_fixture_id
+                  && (name.value as String) == (runner_microvm_attempt_unit_name(attempt: a) as String)
+                  && device.host_path == concat(jail_root, jail_jit_path as String)
+                  && (device.create.program as String) == "install"
+                  && string_contains(s: device_create, pattern: "-m 0400 -o 1000 -g 1000 /dev/null")
+                  && string_contains(s: device_create, pattern: device.host_path)
+                  && (device.pad.program as String) == "truncate"
+                  && string_contains(s: device_pad, pattern: "-s 65536")
+                  && (device.credential.encoded as String) == doubled(s: "A", k: 10)
+                  && jit_drive_is_read_only_at(cfg_drives: cfg.drives, path: jail_jit_path as String)
+                  && (tap as String) == (runner_slot_tap_device_name(slot: a.slot) as String)
+                  && nft == runner_microvm_nft_ruleset_text()
+                  && jail_root == attempt_jail_chroot_root(attempt: a, firecracker_binary: "/bin/firecracker")
+                  && (stage_root.program as String) == (mkdir_binary_path as String)
+                  && (stage_k.program as String) == "cp"
+                  && (stage_r.program as String) == "cp"
+                  && string_contains(s: ws, pattern: runner_microvm_attempt_jail_base(attempt: a))
+                  && string_contains(s: ws, pattern: jail_workspace_path as String)
+                  && string_contains(s: create_words, pattern: concat("of=", ws))
+                  && workspace_drive_path_on_host(config: cfg) == (jail_workspace_path as String)
+                  && (kvm as String) == (firecracker_requires_kvm_device as String)
+                  && string_contains(s: ip, pattern: "ip=")
+                  && string_contains(s: words, pattern: "--exec-file")
+                  && string_contains(s: words, pattern: "--no-api")
+                  && string_contains(s: words, pattern: "--chroot-base-dir")
+                  && string_contains(s: words, pattern: "--cgroup-version")
+                  && string_contains(s: words, pattern: "/bin/jailer")
+                  && (fmt.program as String) == "mke2fs"
+                  && (create.program as String) == "/bin/busybox"
+                  && string_contains(s: create_words, pattern: "count=0")
+                  && string_contains(s: create_words, pattern: "seek=4096")
+                  && count(cfg.drives) == 3
+              }
+              _ => false
             }
-            LaunchRefusedUnauthorized { authorization: _ } => false
-            LaunchRefusedEnvelope { standing: _ } => false
-            LaunchRefusedPriorResources => false
-          }
+        }
         Empty {} => false
       }
     Empty {} => false
   }
 }
 
+// THE READBACK DECIDES ON WHAT THE HOST REPORTS. Each of the three facts refuses on its own -- a
+// root-owned device (unreadable to the dropped uid), a group-readable one, a short one -- and the
+// exact triple the staging should produce is the only one that admits.
+test fn staging_readback_refuses_each_wrong_fact_and_admits_the_right_one() -> Bool {
+  let refused_owner = match jit_device_readback(uid: "0", mode: "400", size: "65536") {
+    Present { value: JitDeviceStagingRefused { step: JitDeviceReadbackStep, detail: _ } } => true
+    _ => false
+  }
+  let refused_mode = match jit_device_readback(uid: "1000", mode: "440", size: "65536") {
+    Present { value: JitDeviceStagingRefused { step: JitDeviceReadbackStep, detail: _ } } => true
+    _ => false
+  }
+  let refused_size = match jit_device_readback(uid: "1000", mode: "400", size: "1024") {
+    Present { value: JitDeviceStagingRefused { step: JitDeviceReadbackStep, detail: _ } } => true
+    _ => false
+  }
+  let admitted = match jit_device_readback(uid: "1000", mode: "400", size: "65536") {
+    Absent => true
+    Present { value: _ } => false
+  }
+  refused_owner && refused_mode && refused_size && admitted
+}
+
 test fn a_clean_vmm_exit_is_not_evidence_that_work_ran() -> Bool {
   match work_standing_from_vmm_exit(exit_code: 0) {
     WorkNotEstablished { vmm_exit: z } =>
@@ -295,41 +427,9 @@ test fn reported_rung_is_the_minimum_across_paths_and_is_mitigatable() -> Bool {
   }
 }
 
-test fn the_cutover_and_mint_frontiers_are_unbound() -> Bool {
+test fn the_cutover_frontier_is_unbound() -> Bool {
   match host_boot_cutover_frontier {
-    UnboundDissolution { description: _ } =>
-      match jit_mint_http_realization_frontier {
-        UnboundDissolution { description: _ } =>
-          match jail_jit_device_staging_frontier {
-            UnboundDissolution { description: _ } => true
-            BoundDissolution { trigger: _ } => false
-          }
-        BoundDissolution { trigger: _ } => false
-      }
+    UnboundDissolution { description: _ } => true
     BoundDissolution { trigger: _ } => false
   }
 }
-
-test fn every_x_envelope_refusal_arm_yields_zero_jailer_launches() -> Bool {
-  match issued_pairs() {
-    Cons { head: pair, tail: _ } =>
-      match accepted_attempt(i: 5, id: "envx") {
-        Cons { head: a, tail: _ } =>
-          launches_for(pair: pair, account: pair.account, attempt: a, envelope: EnvelopeAbsent, ground: GroundClear) == 0
-            && launches_for(pair: pair, account: pair.account, attempt: a, envelope: EnvelopeMalformed, ground: GroundClear) == 0
-            && launches_for(pair: pair, account: pair.account, attempt: a, envelope: EnvelopeSignatureRejected, ground: GroundClear) == 0
-            && launches_for(pair: pair, account: pair.account, attempt: a, envelope: EnvelopeBoundToDifferentUnit, ground: GroundClear) == 0
-            && launches_for(pair: pair, account: pair.account, attempt: a, envelope: EnvelopeBoundToDifferentBoot, ground: GroundClear) == 0
-            && launches_for(pair: pair, account: pair.account, attempt: a, envelope: EnvelopeNonceMismatch, ground: GroundClear) == 0
-            && launches_for(pair: pair, account: pair.account, attempt: a, envelope: EnvelopeBoundToDifferentAttempt, ground: GroundClear) == 0
-            && launches_for(pair: pair, account: pair.account, attempt: a, envelope: EnvelopePayloadDigestMismatch, ground: GroundClear) == 0
-            && launches_for(pair: pair, account: pair.account, attempt: a, envelope: EnvelopePayloadBelowFloor { bytes: byte_size(count: 100) }, ground: GroundClear) == 0
-            && launches_for(pair: pair, account: pair.account, attempt: a, envelope: EnvelopePayloadAboveCeiling { bytes: byte_size(count: 70000) }, ground: GroundClear) == 0
-            && launches_for(pair: pair, account: pair.account, attempt: a, envelope: EnvelopeAdmissionAxisNotRequired, ground: GroundClear) == 0
-            && launches_for(pair: pair, account: pair.account, attempt: a, envelope: admitted(n: 70000), ground: GroundClear) == 0
-        Empty {} => false
-      }
-    Empty {} => false
-  }
-}
-
diff --git a/dag/test/claim/runner/runner_microvm_attempt_witness_test.dag b/dag/test/claim/runner/runner_microvm_attempt_witness_test.dag
index be196531393..74afa5872a3 100644
--- a/dag/test/claim/runner/runner_microvm_attempt_witness_test.dag
+++ b/dag/test/claim/runner/runner_microvm_attempt_witness_test.dag
@@ -87,7 +87,7 @@ test fn the_vmm_is_placed_in_the_cells_own_slice() -> Bool {
   match attempt(i: 3, id: "s1") {
     MicroVmAttemptAccepted { attempt: at } =>
       match bind_owned_attempt(attempt: at, owned: true) {
-        VmBoundToOwnedCell { attempt: a, rootfs_path: _, jit_drive_path: _, vm_config_path: _, unit_name: _, slice_property: sp } =>
+        VmBoundToOwnedCell { attempt: a, rootfs_path: _, vm_config_path: _, unit_name: _, slice_property: sp } =>
           (sp.value as String) == fabric_cell_slice_name(slot: a.slot)
         _ => false
       }
diff --git a/docs/plans/ci-per-job-microvm-migration.md b/docs/plans/ci-per-job-microvm-migration.md
index f6cbad7f85e..e90754e32c4 100644
--- a/docs/plans/ci-per-job-microvm-migration.md
+++ b/docs/plans/ci-per-job-microvm-migration.md
@@ -74,7 +74,7 @@ Not yet represented; CI need vs customer need:
 
 | Missing constructor | CI-on-microVMs | Customer-job |
 |---|---|---|
-| Live signature verification and fetch (mint is `jit_mint_http_realization_frontier`) | **Required before any production CI job on this path.** The receipted fail-open was `jitconfig-bytes=0` then launch anyway. gunbc#10923 is **merged**, but the named module `gunbc.github_effect_perform` still does not resolve in this tree; `gunbc.runner.runner_jit_perform` still performs no I/O. The frontier's trigger sentence is therefore **not satisfied by the merge alone**. | Same. |
+| Host-side JIT mint and jail staging | **Required before any production CI job on this path.** The receipted fail-open was `jitconfig-bytes=0` then launch anyway. `gunbc.github_effect_perform` `perform_organization_jit_mint` now performs the App path on the host (RS256 App JWT via openssl, installation token, generate-jitconfig), and `gunbc.runner_attempt_launch` admits only a delivered, attempt-bound, floor-to-ceiling credential: no admitted credential means no jit device and no VMM, in one plan arm. What stays open is execution by the lifecycle controller: `gunbc.github_effect_perform` `jit_mint_lifecycle_controller_consumer_frontier`. | Same. |
 | nft install/readback | **Required.** The guest must reach `github.com` (JIT register, checkout, API). A plan that cannot install or read back NAT is a guest that cannot run Actions. | Same. |
 | mkfs failure | **Required.** Checkout and toolchain isolation live on the workspace image. | Same. |
 | Live bidirectional cgroup placement census | **Defer for first CI dogfood.** Isolation is structurally the guest+jailer; a live census is evidence quality, not the class that made private exit 126. | Required before selling tenancy (`tenant-boundary-minimum`). |
@@ -151,7 +151,7 @@ Named lower-bound dispatch (not a guest): `ctrl-build --remote -- bash -lc '…
 
 - **Shared toolchain / cargo caches across jobs on one host.** Isolation makes the deleter class unwritable. Lost *local* reuse is accepted under the working assumption: 815–1053 s still clears 3341 s and the ~61-minute cancel class. External sccache is an optimization blocked on `GuestEgressNotEstablished`, not cover for the cut.
 - **`ci_isolate_toolchain_script` / start-end filesystem probe.** Retired when microVMs make the eviction class impossible — that question belongs to **still-bear-335**, not to the process-count PR.
-- **Persistent runner registration.** Replaced by JIT per attempt. Covered only when mint HTTP + jail staging frontiers bind (`jit_mint_http_realization_frontier`, `jail_jit_device_staging_frontier`).
+- **Persistent runner registration.** Replaced by JIT per attempt. Covered only when the lifecycle controller executes the mint and staging (`jit_mint_lifecycle_controller_consumer_frontier`).
 - **Slot RAM carve / `CARGO_BUILD_JOBS` from `ci_runner_target_memory_regime`.** A guest size is a different envelope (`gunbc.runner_microvm` size decision). The flip must project through `selected_ci_runner_target`, not a literal in YAML.
 - **Canary-only capacity.** Covered by refusing to cut public until capacity is named, or by a declared §4b drop of dual-lane parallelism with a restoration trigger = a second canary host or serialized lanes that still meet the floor.
 
@@ -181,8 +181,7 @@ Three lanes, three questions. An earlier revision of this plan routed the filesy
 |---|---|
 | `host_boot_cutover_frontier` | Unbound |
 | `host_image_placeability_wet_probe_frontier` | Unbound; BMC HTTPS 200; standing still access-refused |
-| `jit_mint_http_realization_frontier` | Unbound; #10923 merged; named performer module still absent |
-| `jail_jit_device_staging_frontier` | Unbound |
+| `jit_mint_lifecycle_controller_consumer_frontier` | Unbound; mint and staging are modeled and realized, no production caller yet |
 | `toolchain_filesystem_probe_dissolution_condition` | Unbound. Proposed home of the two-conjunct bind is gunbc#10985. The 2026-09-11 specimen (run 34562801087, 34-slot overlapping registration window) **identifies** the deleter and does **not** bind this row. |
 | `dogfood-started` | Not started (public CI still on srv slots) |
 | This plan's cutover | **Not taken** — operator decision |

From 84c6a567bf1ea5a26ec81f9f9e67b0e7d98080c3 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 03:09:48 +0000
Subject: [PATCH 02/22] MicroVM controller App-key custody converge: root:root
 0400, readback receipt

Adds gunbc.microvm_controller_app_key_converge, enrolled as fleet-converge mode
microvm_controller_app_key_converge (one runner host per dispatch). It reads
gunbai_ci_app_pem_secret through the typed fetch_secret_ref_credential over the
run's WIF token, ensures the key directory is root:root with no group/other bits,
writes the key through converge_typed_remote_file under sudo at mode 0400 (new
RemoteFileModeOwnerRead arm), removes the far-side staging sibling and reads its
absence back, then reads back owner, mode, directory, ancestors and bytes
(far-side cmp against the SM version). The receipt never carries the bytes.

The runner-owned /etc/actions-runner/app.pem is untouched and recorded as the
custody this narrows. Nothing selects the microVM path for the floor job.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/gunbc/ci/ci_spec.dag                      |  16 +
 dag/gunbc/fleet/fleet_converge_workflow.dag   |  51 +-
 dag/gunbc/host_convergence_census.dag         |  10 +
 .../microvm_controller_app_key_converge.dag   | 739 ++++++++++++++++++
 dag/gunbc/typed_remote_file_write.dag         |   5 +
 ...ntroller_app_key_converge_witness_test.dag | 190 +++++
 6 files changed, 1010 insertions(+), 1 deletion(-)
 create mode 100644 dag/gunbc/runner/microvm_controller_app_key_converge.dag
 create mode 100644 dag/test/claim/runner/microvm_controller_app_key_converge_witness_test.dag

diff --git a/dag/gunbc/ci/ci_spec.dag b/dag/gunbc/ci/ci_spec.dag
index 525b0ebbecb..224b3a12d15 100644
--- a/dag/gunbc/ci/ci_spec.dag
+++ b/dag/gunbc/ci/ci_spec.dag
@@ -823,6 +823,11 @@ data gunbc_ci_runner_password_session_tool_converge_target: GunbcRunStepTarget =
   function: "runner_password_session_tool_converge_ci_wet",
 }
 
+data gunbc_ci_microvm_controller_app_key_converge_target: GunbcRunStepTarget = GunbcRunStepTarget {
+  entry: "dag/gunbc/runner/microvm_controller_app_key_converge.dag",
+  function: "microvm_controller_app_key_converge_ci_wet",
+}
+
 // THE OBSERVER SIDE OF ONE RESET ATTEMPT. It takes no arguments: the dispatch names the OBSERVER, the
 // step hands that label over by environment, and the subject is derived from the label through the
 // modeled assignment. There is no input of any kind through which a caller could name a subject,
@@ -1004,6 +1009,7 @@ fn gunbc_run_step_targets() -> List<GunbcRunStepTarget> {
     gunbc_ci_runner_host_file_observe_target,
     gunbc_ci_runner_host_file_converge_target,
     gunbc_ci_runner_password_session_tool_converge_target,
+    gunbc_ci_microvm_controller_app_key_converge_target,
     gunbc_ci_runner_microvm_boot_probe_target,
     gunbc_ci_host_reset_return_target,
     gunbc_ci_host_reset_dispatch_admission_target,
@@ -1831,6 +1837,16 @@ fn gunbc_ci_runner_password_session_tool_converge_invoke() -> String {
   )
 }
 
+fn gunbc_ci_microvm_controller_app_key_converge_invoke() -> String {
+  gunbc_run_step_script(
+    source_roots: witness_layer_roots,
+    entry: gunbc_ci_microvm_controller_app_key_converge_target.entry,
+    function: gunbc_ci_microvm_controller_app_key_converge_target.function,
+    claim_run: false,
+    receipt_rel: "target/microvm-controller-app-key-converge-receipt.txt"
+  )
+}
+
 fn gunbc_ci_host_reset_return_invoke() -> String {
   gunbc_run_step_script(
     source_roots: witness_layer_roots,
diff --git a/dag/gunbc/fleet/fleet_converge_workflow.dag b/dag/gunbc/fleet/fleet_converge_workflow.dag
index 8236a50a234..77858a7a02f 100644
--- a/dag/gunbc/fleet/fleet_converge_workflow.dag
+++ b/dag/gunbc/fleet/fleet_converge_workflow.dag
@@ -181,6 +181,7 @@ type FleetConvergeWorkflowMode
   | RunnerHostFileObserve
   | RunnerHostFileConverge
   | RunnerPasswordSessionToolConverge
+  | MicrovmControllerAppKeyConverge
   | R2MintPreflight
   | R2ObjectWriteMint
 
@@ -206,6 +207,7 @@ fn fleet_converge_workflow_mode_wire(mode: FleetConvergeWorkflowMode) -> String
     RunnerHostFileObserve => "runner_host_file_observe"
     RunnerHostFileConverge => "runner_host_file_converge"
     RunnerPasswordSessionToolConverge => "runner_password_session_tool_converge"
+    MicrovmControllerAppKeyConverge => "microvm_controller_app_key_converge"
     R2MintPreflight => "r2_mint_preflight"
     R2ObjectWriteMint => "r2_object_write_mint"
   }
@@ -232,7 +234,7 @@ fn fleet_converge_spark_target_description() -> String {
   ], "")
 }
 
-data fleet_converge_workflow_modes: List<FleetConvergeWorkflowMode> = [FullHostPlan, LaunchEnvironmentPlan, AllocationStorePlan, FleetApply, OrgActionsObserve, AppControlPlaneObserve, MicrovmHostConverge, GuestImageObserve, GuestImageConverge, MicrovmBootProbe, SparkGrants, SparkBootstrap, SparkServingApply, SparkRuntimeImageProbe, DashboardDeploy, RlmLaunchDeploymentReceipt, HostResetReturn, RunnerHostFileObserve, RunnerHostFileConverge, RunnerPasswordSessionToolConverge, R2MintPreflight, R2ObjectWriteMint]
+data fleet_converge_workflow_modes: List<FleetConvergeWorkflowMode> = [FullHostPlan, LaunchEnvironmentPlan, AllocationStorePlan, FleetApply, OrgActionsObserve, AppControlPlaneObserve, MicrovmHostConverge, GuestImageObserve, GuestImageConverge, MicrovmBootProbe, SparkGrants, SparkBootstrap, SparkServingApply, SparkRuntimeImageProbe, DashboardDeploy, RlmLaunchDeploymentReceipt, HostResetReturn, RunnerHostFileObserve, RunnerHostFileConverge, RunnerPasswordSessionToolConverge, MicrovmControllerAppKeyConverge, R2MintPreflight, R2ObjectWriteMint]
 
 // WHICH SCOPE A MODE SELECTS, WHERE IT SELECTS ONE AT ALL.
 //
@@ -276,6 +278,7 @@ fn fleet_converge_mode_scope(mode: FleetConvergeWorkflowMode) -> FleetConvergeSc
     RunnerHostFileObserve => none
     RunnerHostFileConverge => none
     RunnerPasswordSessionToolConverge => none
+    MicrovmControllerAppKeyConverge => none
     R2MintPreflight => none
     R2ObjectWriteMint => none
   }
@@ -990,6 +993,50 @@ fn fleet_converge_runner_password_session_tool_converge_step() -> Step {
   )
 }
 
+// THE CONTROLLER APP KEY MODE (gunbc.microvm_controller_app_key_converge). A step in the host-pinned
+// job like the password-session mode, but NOT through fleet_converge_runner_host_file_step: it reads
+// the key from Secret Manager in-process, so it carries the run's workload-identity token beside the
+// host binding. Dispatching it delivers custody only; nothing selects the microVM path for the floor
+// job.
+data fleet_converge_microvm_controller_app_key_converge_step_if: String = fleet_converge_mode_step_if(mode: MicrovmControllerAppKeyConverge)
+
+fn fleet_converge_microvm_controller_app_key_converge_step() -> Step {
+  RunStep {
+    name: Present { value: "MicroVM controller App key: deliver root:root 0400 from Secret Manager, read owner, mode, bytes and staging back" },
+    id: Present { value: "microvm_controller_app_key_converge" },
+    run: gunbc_ci_microvm_controller_app_key_converge_invoke(),
+    shell: none,
+    env: Present {
+      value: [
+        kv(key: fleet_converge_expected_host_env_name, value: yaml_string(s: "${{ github.event.inputs.host }}")),
+        kv(key: "WIF_ACCESS_TOKEN", value: yaml_string(s: "${{ steps.wif_auth.outputs.access_token }}")),
+      ]
+    },
+    working_directory: none,
+    if_condition: Present { value: fleet_converge_microvm_controller_app_key_converge_step_if },
+    continue_on_error: none,
+    timeout_minutes: Present { value: gunbc_ci_runner_host_file_step_timeout_minutes }
+  }
+}
+
+fn fleet_converge_microvm_controller_app_key_receipt_upload_step() -> Step {
+  UsesStep {
+    name: Present { value: "Upload microVM controller App key custody receipt" },
+    id: Present { value: "microvm_controller_app_key_receipt_upload" },
+    uses: upload_artifact_action,
+    with: Present { value: [
+      kv(key: "name", value: yaml_string(s: "microvm-controller-app-key-converge-receipt")),
+      kv(key: "path", value: yaml_string(s: "target/microvm-controller-app-key-converge-receipt.txt")),
+      kv(key: "if-no-files-found", value: yaml_string(s: "error")),
+      kv(key: "retention-days", value: yaml_int(n: 30)),
+    ] },
+    env: none,
+    if_condition: Present { value: concat("always() && (", concat(fleet_converge_microvm_controller_app_key_converge_step_if, ")")) },
+    continue_on_error: none,
+    timeout_minutes: Present { value: gunbc_ci_artifact_transfer_step_timeout_minutes }
+  }
+}
+
 fn fleet_converge_runner_host_file_receipt_upload_step() -> Step {
   UsesStep {
     name: Present { value: "Upload runner host file converge receipt" },
@@ -1550,6 +1597,8 @@ fn fleet_converge_job() -> Job {
         fleet_converge_runner_host_file_converge_step(),
         fleet_converge_runner_password_session_tool_converge_step(),
         fleet_converge_runner_password_session_tool_receipt_upload_step(),
+        fleet_converge_microvm_controller_app_key_converge_step(),
+        fleet_converge_microvm_controller_app_key_receipt_upload_step(),
         fleet_converge_runner_host_file_receipt_upload_step(),
         ci_fleet_key_agent_cleanup_step(),
       ]
diff --git a/dag/gunbc/host_convergence_census.dag b/dag/gunbc/host_convergence_census.dag
index d097d8e1d92..5623112473c 100644
--- a/dag/gunbc/host_convergence_census.dag
+++ b/dag/gunbc/host_convergence_census.dag
@@ -60,6 +60,7 @@ type HostConvergenceSubject
   | SparkRuntimeImage
   | RunnerHostFiles
   | RunnerPasswordSessionTools
+  | MicrovmControllerAppKey
   | MicrovmHost
   | GuestImage
   | Srv3InstallMedia
@@ -683,6 +684,15 @@ data host_convergence_census_rows: List<HostConvergenceCensusRow> = [
     disposition: BindToAuthority { target: fleet_plan() },
     first_consumer: cite(module_path: "gunbc.runner_password_session_tool_converge", decl_name: "runner_password_session_tool_converge_ci_wet"),
   ),
+  census_row(
+    identity: cite(module_path: "gunbc.microvm_controller_app_key_converge", decl_name: "microvm_controller_app_key_converge_ci_wet"),
+    subject: MicrovmControllerAppKey,
+    phases: protocol_phases(false, true, true, true, true, true, false),
+    current_authority: cite(module_path: "gunbc.microvm_controller_app_key_converge", decl_name: "microvm_controller_app_key_converge_ci_wet"),
+    persistent_host_effect: ReachesPersistentHostMutation,
+    disposition: BindToAuthority { target: fleet_plan() },
+    first_consumer: cite(module_path: "gunbc.fleet_converge_workflow", decl_name: "fleet_converge_workflow_modes"),
+  ),
   census_row(
     identity: cite(module_path: "gunbc.runner_microvm_host_ready", decl_name: "runner_microvm_host_converge_wet"),
     subject: MicrovmHost,
diff --git a/dag/gunbc/runner/microvm_controller_app_key_converge.dag b/dag/gunbc/runner/microvm_controller_app_key_converge.dag
new file mode 100644
index 00000000000..ec31264af5f
--- /dev/null
+++ b/dag/gunbc/runner/microvm_controller_app_key_converge.dag
@@ -0,0 +1,739 @@
+module gunbc.microvm_controller_app_key_converge
+
+import std.types { String, NonEmptyStr, List, Bool, Int, FilePath, Secret }
+import std.algebra { trim }
+import std.resources { Network }
+import std.process { ProcessExit, ExitSuccess, exit_failure }
+import extdeps.filesystem.filesystem_io { Filesystem }
+import extdeps.cloud.gcp.secret_ref { secret_ref_version_resource }
+import extdeps.cloud.gcp.secret_manager { SmResolvedVersionIdentity }
+import product.placement_supply { HostIdentity }
+import gunbc.clock_read { clock_now_probed_at, probed_at_word }
+import gunbc.actions_run_binding { actions_variable_read, ActionsVariablePresent, ActionsVariableAbsent }
+import gunbc.fleet_converge_receipt { fleet_converge_expected_host_env_name }
+import gunbc.fleet_ssh_locus { prepare_fleet_ssh_agent_context, FleetSshContextReady, FleetSshContextRefused }
+import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext }
+import gunbc.file_access { FileTreeScope, path_within_file_tree_scope }
+import gunbc.auth.github_apps { gunbai_ci_app_pem_secret }
+import gunbc.auth.access_token_source { WorkloadIdentityToken }
+import gunbc.auth.secret_ref_credential {
+  fetch_secret_ref_credential,
+  SecretCredentialReady,
+  SecretCredentialAccessUpsertRequired,
+  SecretCredentialWireDecodeRefused,
+  SecretCredentialFetchRefused,
+  SecretCredentialResolvedVersionMismatch,
+}
+import gunbc.github_effect_perform { lifecycle_controller_app_key_path }
+import gunbc.fabric_cell_converge { fabric_cell_base_dir }
+import gunbc.typed_remote_file_write {
+  RemoteFileModeOwnerRead,
+  RemoteFileViaNonInteractiveSudo,
+  TypedRemoteFileWrite,
+  TypedRemoteFileWriteAdmitted,
+  TypedRemoteFileWriteAdmissionRefused,
+  TypedRemoteFileConverged,
+  TypedRemoteFileConvergenceRefused,
+  TypedRemoteFileStepRan,
+  TypedRemoteFileStepArgvRefused,
+  TypedRemoteFileStepLegRefused,
+  typed_remote_file_write_seal,
+  typed_remote_file_staging_path,
+  typed_remote_file_compare_argv,
+  typed_remote_file_step,
+  classify_typed_remote_file_comparison,
+  remote_file_privileged_argv,
+  converge_typed_remote_file,
+}
+import gunbc.runner_host_file_converge {
+  RunnerHostFileSubject,
+  RunnerHostFileSubjectAdmitted,
+  RunnerHostFileSubjectRefused,
+  runner_host_file_subject,
+  RunnerHostFileStanding,
+  HostFileIdentical,
+  HostFileDiffers,
+  HostFileAbsent,
+  HostFileUnobservable,
+  classify_host_file_presence,
+  runner_host_file_standing_of_report,
+  RunnerHostPathMetadata,
+  PathsRootOnly,
+  PathsNotRootOnly,
+  PathsUnobservable,
+  PathsNotApplicable,
+  runner_host_path_ancestors,
+  runner_host_root_only_find_argv,
+  classify_root_only_paths,
+  runner_host_path_metadata_wire,
+}
+
+// THE MICROVM LIFECYCLE CONTROLLER'S COPY OF THE gunbai-ci APP KEY, DELIVERED AND READ BACK.
+//
+// gunbc.github_effect_perform perform_organization_jit_mint signs its App JWT with the file at
+// lifecycle_controller_app_key_path and refuses at the signer when that file is absent; this module
+// is the converge entry that note names. It moves the key from Secret Manager (gunbc.auth.github_apps
+// gunbai_ci_app_pem_secret) to that path on ONE runner host per dispatch, as root:root 0400 in a
+// root:root directory with no group or other bits at all, and it answers with a readback receipt that
+// names the owner, the mode, the Secret Manager version the content was compared against, and the
+// absence of the staging sibling -- never the bytes.
+//
+// THE CUSTODY THIS NARROWS. The shared-slot path still reads gunbc.runner_unit_file
+// runner_host_app_pem_path (/etc/actions-runner/app.pem), which is owned by the RUNNER USER -- the
+// principal whose processes run CI jobs. So today every job on a shared slot runs as an account that
+// can read the key that mints registrations for the whole org. That file is deliberately NOT touched
+// here: the shared-slot path is X in a replacement migration (DESIGN §3), still load-bearing, and
+// changing its owner would break it before Y is selected. What this module establishes is the Y-side
+// custody: a copy readable by root alone, outside every jail and attempt root, so that when the floor
+// job moves to the microVM path the runner-owned copy has no remaining reader and can be deleted with
+// X. Nothing in this change selects the microVM path.
+//
+// WHY ROOT-ONLY IS ENOUGH TO SAY "NOT READABLE BY THE RUNNER USER OR ATTEMPT UID 1000". Both are
+// non-root principals. A regular file owned root:root with mode 0400, inside a directory owned
+// root:root with no group/other bits, cannot be opened by any non-root uid: the directory denies the
+// traversal and the file denies the read, independently. Both facts are READ BACK below rather than
+// inferred from the commands that set them. The placement admission additionally refuses a key path
+// inside the fabric-cell tree (gunbc.fabric_cell_converge fabric_cell_base_dir), which roots every
+// attempt directory and therefore every jail (gunbc.runner_microvm_attempt runner_microvm_attempt_dir),
+// so a future edit to the path cannot move the key into a guest-visible tree without refusing here.
+//
+// THE FETCH IS TYPED, NOT A PRELUDE. gunbc.ci_spec gunbc_ci_app_jwt_prelude fetches the same secret
+// with curl and python in shell, because a GitHub Actions step has to produce a header file before any
+// .dag process runs. This entry is a .dag process, so it reads through
+// gunbc.auth.secret_ref_credential fetch_secret_ref_credential over the run's workload-identity token,
+// which refuses a response about a different version than the one requested. The plaintext therefore
+// never touches the near-side disk; it exists in this process and on the far side's stdin.
+//
+// DIGEST, STATED AS WHAT IS ACTUALLY CHECKED. The brief asked for a digest match against the Secret
+// Manager version. .dag has no SHA-256 over a String (gunbc.typed_remote_file_write states the same
+// limit), so a near-side digest of the intended bytes cannot be computed. The comparison made instead
+// is STRONGER and is the one converge_typed_remote_file already owns: `cmp -s -` far-side with the
+// fetched version's exact bytes on stdin. Byte equality implies digest equality; the converse would
+// admit a collision. The receipt names the resolved version identity the bytes came from.
+//
+// PLAINTEXT STAGING. The only staging is the far-side sibling <path>.gunbc-staging that
+// converge_typed_remote_file writes, modes and renames. It lives inside the root-only directory,
+// which is verified BEFORE the stage leg runs, so even the moment between `dd` and `chmod 400` is not
+// observable by a non-root uid. It is removed after every run whether or not a write was attempted,
+// and its absence is READ BACK; a failed removal or a surviving sibling refuses the run (the
+// cleanup-is-part-of-the-mint rule of gunbc.secret_provision_actuator).
+
+// ── Placement (pure) ─────────────────────────────────────────────────────────────────────────────
+
+data controller_app_key_scope_root: FileTreeScope = FileTreeScope { root_path: "/etc" as NonEmptyStr }
+
+data controller_app_key_forbidden_tree: FileTreeScope = FileTreeScope { root_path: fabric_cell_base_dir as NonEmptyStr }
+
+type ControllerAppKeyPlacement
+  = ControllerAppKeyPlaced { key_path: NonEmptyStr, key_dir: NonEmptyStr, upper_ancestors: List<String> }
+  | ControllerAppKeyPlacementRefused { cause: NonEmptyStr }
+
+fn last_or_empty(xs: List<String>) -> String {
+  fold(xs, init: "", f: fn(_, x) { x })
+}
+
+// The directory and its ancestors are derived from the one path authority, never re-spelled.
+fn controller_app_key_placement(key_path: NonEmptyStr) -> ControllerAppKeyPlacement {
+  let ancestors = runner_host_path_ancestors(path: key_path as String)
+  let dir = last_or_empty(xs: ancestors)
+  if path_within_file_tree_scope(scope: controller_app_key_forbidden_tree, path: key_path) {
+    ControllerAppKeyPlacementRefused {
+      cause: join(["controller app key path ", key_path as String, " is inside the fabric-cell tree ", fabric_cell_base_dir, ", which roots every attempt and jail"], "") as NonEmptyStr,
+    }
+  } else if !path_within_file_tree_scope(scope: controller_app_key_scope_root, path: key_path) {
+    ControllerAppKeyPlacementRefused {
+      cause: join(["controller app key path ", key_path as String, " is outside /etc"], "") as NonEmptyStr,
+    }
+  } else if dir == "" || dir == (controller_app_key_scope_root.root_path as String) {
+    ControllerAppKeyPlacementRefused {
+      cause: join(["controller app key path ", key_path as String, " has no dedicated directory below /etc to hold root-only"], "") as NonEmptyStr,
+    }
+  } else {
+    ControllerAppKeyPlaced {
+      key_path: key_path,
+      key_dir: dir as NonEmptyStr,
+      upper_ancestors: filter(ancestors, a => a != dir),
+    }
+  }
+}
+
+// ── Readback vocabulary (pure) ───────────────────────────────────────────────────────────────────
+
+// THREE FAR-SIDE QUESTIONS, ONE PER CLAUSE, so a refusal says WHICH clause failed. A single find with
+// every clause conjoined answers only "not printed", which cannot tell a wrong owner from a
+// group-readable mode, and those have different causes. `%` is outside the portable-word allowlist
+// (gunbc.fleet_known_hosts_anchor portable_remote_word_char_allowed), so a stat format string cannot
+// cross the SSH edge; find predicates can, and each prints the path exactly when its clause holds.
+type KeyPathFindReading {
+  root_owned: Bool
+  group_or_other_bits: Bool
+  exactly_owner_read: Bool
+}
+
+type KeyFileMetadata
+  = KeyFileRootOwnerRead
+  | KeyFileWrongOwner
+  | KeyFileGroupOrOtherAccess
+  | KeyFileModeNotOwnerReadOnly
+  | KeyFileAbsent
+  | KeyFileMetadataUnobservable { reason: String }
+
+type KeyDirMetadata
+  = KeyDirRootOnly
+  | KeyDirWrongOwner
+  | KeyDirGroupOrOtherAccess
+  | KeyDirAbsent
+  | KeyDirMetadataUnobservable { reason: String }
+
+// The order is owner first: a runner-owned file is the most dangerous state regardless of its mode,
+// and reporting it as a mode defect would send the reader to chmod a file they do not own.
+fn classify_key_file_metadata(reading: KeyPathFindReading) -> KeyFileMetadata {
+  if !reading.root_owned {
+    KeyFileWrongOwner
+  } else if reading.group_or_other_bits {
+    KeyFileGroupOrOtherAccess
+  } else if !reading.exactly_owner_read {
+    KeyFileModeNotOwnerReadOnly
+  } else {
+    KeyFileRootOwnerRead
+  }
+}
+
+fn classify_key_dir_metadata(reading: KeyPathFindReading) -> KeyDirMetadata {
+  if !reading.root_owned {
+    KeyDirWrongOwner
+  } else if reading.group_or_other_bits {
+    KeyDirGroupOrOtherAccess
+  } else {
+    KeyDirRootOnly
+  }
+}
+
+fn key_file_metadata_wire(m: KeyFileMetadata) -> String {
+  match m {
+    KeyFileRootOwnerRead => "owner=root:root mode=0400"
+    KeyFileWrongOwner => "WRONG-OWNER (not root:root)"
+    KeyFileGroupOrOtherAccess => "GROUP-OR-OTHER-ACCESS (mode has bits in 077)"
+    KeyFileModeNotOwnerReadOnly => "MODE-NOT-0400"
+    KeyFileAbsent => "ABSENT"
+    KeyFileMetadataUnobservable { reason: r } => concat("UNOBSERVABLE ", r)
+  }
+}
+
+fn key_dir_metadata_wire(m: KeyDirMetadata) -> String {
+  match m {
+    KeyDirRootOnly => "owner=root:root no-group-other-bits"
+    KeyDirWrongOwner => "WRONG-OWNER (not root:root)"
+    KeyDirGroupOrOtherAccess => "GROUP-OR-OTHER-ACCESS (mode has bits in 077)"
+    KeyDirAbsent => "ABSENT"
+    KeyDirMetadataUnobservable { reason: r } => concat("UNOBSERVABLE ", r)
+  }
+}
+
+// The staging sibling's presence: `test -e` answers 0 (present) or 1 (absent); anything else means the
+// test did not run, which is neither answer.
+type StagingResidue
+  = StagingAbsent
+  | StagingResiduePresent { path: String }
+  | StagingUnobservable { reason: String }
+
+fn classify_staging_residue(path: String, exit_code: Int, stderr: String) -> StagingResidue {
+  if exit_code == 1 {
+    StagingAbsent
+  } else if exit_code == 0 {
+    StagingResiduePresent { path: path }
+  } else {
+    StagingUnobservable { reason: join(["staging presence test exit=", to_string(exit_code), " ", trim(s: stderr)], "") }
+  }
+}
+
+fn staging_residue_wire(s: StagingResidue) -> String {
+  match s {
+    StagingAbsent => "absent"
+    StagingResiduePresent { path: p } => concat("RESIDUE ", p)
+    StagingUnobservable { reason: r } => concat("UNOBSERVABLE ", r)
+  }
+}
+
+fn content_standing_wire(s: RunnerHostFileStanding) -> String {
+  match s {
+    HostFileIdentical => "identical-to-sm-version"
+    HostFileDiffers => "DIFFERS-FROM-SM-VERSION"
+    HostFileAbsent => "ABSENT"
+    HostFileUnobservable { reason: r } => concat("UNOBSERVABLE ", r)
+  }
+}
+
+// THE READBACK AND ITS VERDICT. Held requires every component, observed after the last mutation. The
+// verdict carries the causes so the receipt and the exit agree on why.
+type ControllerAppKeyReadback {
+  file: KeyFileMetadata
+  dir: KeyDirMetadata
+  upper_ancestors: RunnerHostPathMetadata
+  content: RunnerHostFileStanding
+  staging: StagingResidue
+}
+
+type ControllerAppKeyCustody
+  = ControllerAppKeyHeld
+  | ControllerAppKeyNotHeld { causes: List<String> }
+
+fn controller_app_key_custody(readback: ControllerAppKeyReadback) -> ControllerAppKeyCustody {
+  let causes = concat(concat(concat(concat(
+    match readback.file {
+      KeyFileRootOwnerRead => []
+      _ => [concat("file ", key_file_metadata_wire(m: readback.file))]
+    },
+    match readback.dir {
+      KeyDirRootOnly => []
+      _ => [concat("dir ", key_dir_metadata_wire(m: readback.dir))]
+    }),
+    match readback.upper_ancestors {
+      PathsRootOnly => []
+      _ => [concat("ancestors ", runner_host_path_metadata_wire(m: readback.upper_ancestors))]
+    }),
+    match readback.content {
+      HostFileIdentical => []
+      _ => [concat("content ", content_standing_wire(s: readback.content))]
+    }),
+    match readback.staging {
+      StagingAbsent => []
+      _ => [concat("staging ", staging_residue_wire(s: readback.staging))]
+    })
+  if length(causes) == 0 { ControllerAppKeyHeld } else { ControllerAppKeyNotHeld { causes: causes } }
+}
+
+// ── The decision before any write (pure) ─────────────────────────────────────────────────────────
+
+type ControllerAppKeyAction
+  = AppKeyLeaveInPlace
+  | AppKeyWrite
+  | AppKeyActionRefused { reason: String }
+
+// The directory and the ancestors are decided first because a write cannot repair them and writing
+// into an unsafe directory would publish the key where a non-root uid can reach it. An unsafe FILE is
+// repaired by the write: the staged sibling is created by root, moded 0400, and renamed over it.
+fn controller_app_key_action(
+  dir: KeyDirMetadata,
+  upper_ancestors: RunnerHostPathMetadata,
+  content: RunnerHostFileStanding,
+  file: KeyFileMetadata,
+) -> ControllerAppKeyAction {
+  match upper_ancestors {
+    PathsRootOnly =>
+      match dir {
+        KeyDirRootOnly =>
+          match content {
+            HostFileUnobservable { reason: r } => AppKeyActionRefused { reason: concat("content unobservable: ", r) }
+            HostFileAbsent => AppKeyWrite
+            HostFileDiffers => AppKeyWrite
+            HostFileIdentical =>
+              match file {
+                KeyFileRootOwnerRead => AppKeyLeaveInPlace
+                KeyFileMetadataUnobservable { reason: r } => AppKeyActionRefused { reason: concat("file metadata unobservable: ", r) }
+                _ => AppKeyWrite
+              }
+          }
+        _ => AppKeyActionRefused { reason: concat("key directory is not root-only: ", key_dir_metadata_wire(m: dir)) }
+      }
+    _ => AppKeyActionRefused { reason: concat("an ancestor directory is not root-only: ", runner_host_path_metadata_wire(m: upper_ancestors)) }
+  }
+}
+
+fn controller_app_key_action_wire(a: ControllerAppKeyAction) -> String {
+  match a {
+    AppKeyLeaveInPlace => "left-in-place"
+    AppKeyWrite => "written"
+    AppKeyActionRefused { reason: r } => concat("REFUSED ", r)
+  }
+}
+
+// ── Remote legs (argv pure, execution effectful) ─────────────────────────────────────────────────
+
+fn key_path_find_argv(path: String, kind: String, clause: List<String>) -> List<String> {
+  concat(["find", path, "-maxdepth", "0", "-type", kind], clause)
+}
+
+data key_path_root_owned_clause: List<String> = ["-user", "root", "-group", "root"]
+data key_path_group_or_other_clause: List<String> = ["-perm", "/077"]
+data key_path_exactly_owner_read_clause: List<String> = ["-perm", "0400"]
+
+fn key_dir_ensure_argv(dir: String) -> List<String> {
+  ["install", "-d", "-o", "root", "-g", "root", "-m", "0700", dir]
+}
+
+fn staging_remove_argv(staging: String) -> List<String> {
+  ["rm", "-f", "--", staging]
+}
+
+fn elevated(argv: List<String>) -> List<String> {
+  remote_file_privileged_argv(privilege: RemoteFileViaNonInteractiveSudo, argv: argv)
+}
+
+type ElevatedLeg
+  = ElevatedLegRan { exit_code: Int, stdout: String, stderr: String }
+  | ElevatedLegRefused { reason: String }
+
+// Every leg is elevated: the directory is root-only, so an unprivileged find or test inside it would
+// report the permission boundary as an answer.
+fn run_elevated_leg(
+  subject: RunnerHostFileSubject,
+  context: FleetSshExecutionContext,
+  argv: List<String>,
+  stdin_payload: String,
+) -> ElevatedLeg
+  uses net: Network
+{
+  match typed_remote_file_step(target: subject.target, context: context, raws: elevated(argv: argv), stdin_payload: stdin_payload) {
+    TypedRemoteFileStepArgvRefused => ElevatedLegRefused { reason: "argv refused as non-portable under the far-side shell re-parse allowlist" }
+    TypedRemoteFileStepLegRefused { cause: why } => ElevatedLegRefused { reason: why as String }
+    TypedRemoteFileStepRan { result: r } => ElevatedLegRan { exit_code: r.exit_code, stdout: r.stdout, stderr: r.stderr }
+  }
+}
+
+type FindAnswer
+  = FindPrinted
+  | FindSilent
+  | FindUnobservable { reason: String }
+
+fn classify_find_answer(path: String, exit_code: Int, stdout: String, stderr: String) -> FindAnswer {
+  if exit_code != 0 {
+    FindUnobservable { reason: join(["find exit=", to_string(exit_code), " ", trim(s: stderr)], "") }
+  } else if any(split(s: stdout, delimiter: "\n"), l => trim(s: l) == path) {
+    FindPrinted
+  } else {
+    FindSilent
+  }
+}
+
+fn find_answer(
+  subject: RunnerHostFileSubject,
+  context: FleetSshExecutionContext,
+  path: String,
+  kind: String,
+  clause: List<String>,
+) -> FindAnswer
+  uses net: Network
+{
+  match run_elevated_leg(subject: subject, context: context, argv: key_path_find_argv(path: path, kind: kind, clause: clause), stdin_payload: "") {
+    ElevatedLegRefused { reason: r } => FindUnobservable { reason: r }
+    ElevatedLegRan { exit_code: c, stdout: o, stderr: e } => classify_find_answer(path: path, exit_code: c, stdout: o, stderr: e)
+  }
+}
+
+fn find_printed(a: FindAnswer) -> Bool {
+  match a {
+    FindPrinted => true
+    FindSilent => false
+    FindUnobservable { reason: _ } => false
+  }
+}
+
+type KeyPathObservation
+  = KeyPathObserved { reading: KeyPathFindReading }
+  | KeyPathMissing
+  | KeyPathUnobservable { reason: String }
+
+fn observe_key_path(
+  subject: RunnerHostFileSubject,
+  context: FleetSshExecutionContext,
+  path: String,
+  kind: String,
+) -> KeyPathObservation
+  uses net: Network
+{
+  match find_answer(subject: subject, context: context, path: path, kind: kind, clause: []) {
+    FindUnobservable { reason: r } =>
+      match run_elevated_leg(subject: subject, context: context, argv: ["test", "-e", path], stdin_payload: "") {
+        ElevatedLegRan { exit_code: c, stdout: _, stderr: _ } =>
+          if c == 1 { KeyPathMissing } else { KeyPathUnobservable { reason: r } }
+        ElevatedLegRefused { reason: _ } => KeyPathUnobservable { reason: r }
+      }
+    FindSilent => KeyPathUnobservable { reason: concat(concat("exists but is not of type ", kind), ", or find printed nothing") }
+    FindPrinted => {
+      let owned = find_answer(subject: subject, context: context, path: path, kind: kind, clause: key_path_root_owned_clause)
+      let open = find_answer(subject: subject, context: context, path: path, kind: kind, clause: key_path_group_or_other_clause)
+      let exact = find_answer(subject: subject, context: context, path: path, kind: kind, clause: key_path_exactly_owner_read_clause)
+      match owned {
+        FindUnobservable { reason: r } => KeyPathUnobservable { reason: r }
+        _ => match open {
+          FindUnobservable { reason: r } => KeyPathUnobservable { reason: r }
+          _ => match exact {
+            FindUnobservable { reason: r } => KeyPathUnobservable { reason: r }
+            _ => KeyPathObserved {
+              reading: KeyPathFindReading {
+                root_owned: find_printed(a: owned),
+                group_or_other_bits: find_printed(a: open),
+                exactly_owner_read: find_printed(a: exact),
+              },
+            }
+          }
+        }
+      }
+    }
+  }
+}
+
+fn observe_key_file(subject: RunnerHostFileSubject, context: FleetSshExecutionContext, path: String) -> KeyFileMetadata
+  uses net: Network
+{
+  match observe_key_path(subject: subject, context: context, path: path, kind: "f") {
+    KeyPathMissing => KeyFileAbsent
+    KeyPathUnobservable { reason: r } => KeyFileMetadataUnobservable { reason: r }
+    KeyPathObserved { reading: rd } => classify_key_file_metadata(reading: rd)
+  }
+}
+
+fn observe_key_dir(subject: RunnerHostFileSubject, context: FleetSshExecutionContext, path: String) -> KeyDirMetadata
+  uses net: Network
+{
+  match observe_key_path(subject: subject, context: context, path: path, kind: "d") {
+    KeyPathMissing => KeyDirAbsent
+    KeyPathUnobservable { reason: r } => KeyDirMetadataUnobservable { reason: r }
+    KeyPathObserved { reading: rd } => classify_key_dir_metadata(reading: rd)
+  }
+}
+
+fn observe_upper_ancestors(subject: RunnerHostFileSubject, context: FleetSshExecutionContext, paths: List<String>) -> RunnerHostPathMetadata
+  uses net: Network
+{
+  match run_elevated_leg(subject: subject, context: context, argv: runner_host_root_only_find_argv(paths: paths, kind: "d"), stdin_payload: "") {
+    ElevatedLegRefused { reason: r } => PathsUnobservable { reason: r }
+    ElevatedLegRan { exit_code: c, stdout: o, stderr: e } => classify_root_only_paths(requested: paths, exit_code: c, stdout: o, stderr: e)
+  }
+}
+
+// The same far-side `cmp -s -` judgment converge_typed_remote_file mints from, run elevated with the
+// fetched version's bytes on stdin, so observation and apply cannot disagree about "identical".
+fn observe_key_content(subject: RunnerHostFileSubject, context: FleetSshExecutionContext, write: TypedRemoteFileWrite) -> RunnerHostFileStanding
+  uses net: Network
+{
+  match run_elevated_leg(subject: subject, context: context, argv: ["test", "-e", write.path as String], stdin_payload: "") {
+    ElevatedLegRefused { reason: r } => HostFileUnobservable { reason: r }
+    ElevatedLegRan { exit_code: pc, stdout: _, stderr: pe } =>
+      match classify_host_file_presence(exit_code: pc, stderr: pe) {
+        Present { value: settled } => settled
+        Absent =>
+          match run_elevated_leg(subject: subject, context: context, argv: typed_remote_file_compare_argv(write: write), stdin_payload: write.content) {
+            ElevatedLegRefused { reason: r } => HostFileUnobservable { reason: r }
+            ElevatedLegRan { exit_code: cc, stdout: _, stderr: ce } =>
+              runner_host_file_standing_of_report(
+                report: classify_typed_remote_file_comparison(write: write, compare_exit_code: cc, compare_stderr: ce),
+              )
+          }
+      }
+  }
+}
+
+// REMOVE, THEN READ THE ABSENCE BACK. `rm -f` exits 0 on an absent path, so its exit alone cannot
+// distinguish "removed" from "never there" -- which is fine -- nor "there and still there", which is
+// not; the presence test is what answers that.
+fn clear_staging(subject: RunnerHostFileSubject, context: FleetSshExecutionContext, staging: String) -> StagingResidue
+  uses net: Network
+{
+  match run_elevated_leg(subject: subject, context: context, argv: staging_remove_argv(staging: staging), stdin_payload: "") {
+    ElevatedLegRefused { reason: r } => StagingUnobservable { reason: concat("staging removal not run: ", r) }
+    ElevatedLegRan { exit_code: rc, stdout: _, stderr: re } =>
+      if rc != 0 {
+        StagingUnobservable { reason: join(["staging removal exit=", to_string(rc), " ", trim(s: re)], "") }
+      } else {
+        match run_elevated_leg(subject: subject, context: context, argv: ["test", "-e", staging], stdin_payload: "") {
+          ElevatedLegRefused { reason: r } => StagingUnobservable { reason: r }
+          ElevatedLegRan { exit_code: c, stdout: _, stderr: e } => classify_staging_residue(path: staging, exit_code: c, stderr: e)
+        }
+      }
+  }
+}
+
+// ── The converge for one host ────────────────────────────────────────────────────────────────────
+
+type ControllerAppKeyRun {
+  host: HostIdentity
+  key_path: NonEmptyStr
+  sm_version: SmResolvedVersionIdentity
+  action: ControllerAppKeyAction
+  write_refusal: String?
+  readback: ControllerAppKeyReadback
+}
+
+fn ensure_key_dir(subject: RunnerHostFileSubject, context: FleetSshExecutionContext, dir: String) -> KeyDirMetadata
+  uses net: Network
+{
+  match observe_key_dir(subject: subject, context: context, path: dir) {
+    KeyDirRootOnly => KeyDirRootOnly
+    KeyDirMetadataUnobservable { reason: r } => KeyDirMetadataUnobservable { reason: r }
+    _ =>
+      match run_elevated_leg(subject: subject, context: context, argv: key_dir_ensure_argv(dir: dir), stdin_payload: "") {
+        ElevatedLegRefused { reason: r } => KeyDirMetadataUnobservable { reason: concat("directory ensure not run: ", r) }
+        ElevatedLegRan { exit_code: c, stdout: _, stderr: e } =>
+          if c != 0 {
+            KeyDirMetadataUnobservable { reason: join(["directory ensure exit=", to_string(c), " ", trim(s: e)], "") }
+          } else {
+            observe_key_dir(subject: subject, context: context, path: dir)
+          }
+      }
+  }
+}
+
+fn converge_controller_app_key(
+  subject: RunnerHostFileSubject,
+  context: FleetSshExecutionContext,
+  placed_path: NonEmptyStr,
+  key_dir: NonEmptyStr,
+  upper_ancestors: List<String>,
+  write: TypedRemoteFileWrite,
+  sm_version: SmResolvedVersionIdentity,
+) -> ControllerAppKeyRun
+  uses net: Network
+{
+  let staging = typed_remote_file_staging_path(write: write)
+  let dir_before = ensure_key_dir(subject: subject, context: context, dir: key_dir as String)
+  let ancestors_before = observe_upper_ancestors(subject: subject, context: context, paths: upper_ancestors)
+  let content_before = observe_key_content(subject: subject, context: context, write: write)
+  let file_before = observe_key_file(subject: subject, context: context, path: placed_path as String)
+  let action = controller_app_key_action(dir: dir_before, upper_ancestors: ancestors_before, content: content_before, file: file_before)
+  let write_refusal = match action {
+    AppKeyWrite =>
+      match converge_typed_remote_file(
+        target: subject.target,
+        context: context,
+        admission: TypedRemoteFileWriteAdmitted { write: write },
+        mode: RemoteFileModeOwnerRead,
+        privilege: RemoteFileViaNonInteractiveSudo,
+      ) {
+        TypedRemoteFileConverged { converged: _ } => none
+        TypedRemoteFileConvergenceRefused { step: st, reason: why } => Present { value: join(["step=", st, " ", why], "") }
+      }
+    _ => none
+  }
+  let staging_after = clear_staging(subject: subject, context: context, staging: staging)
+  ControllerAppKeyRun {
+    host: subject.host,
+    key_path: placed_path,
+    sm_version: sm_version,
+    action: action,
+    write_refusal: write_refusal,
+    readback: ControllerAppKeyReadback {
+      file: observe_key_file(subject: subject, context: context, path: placed_path as String),
+      dir: observe_key_dir(subject: subject, context: context, path: key_dir as String),
+      upper_ancestors: observe_upper_ancestors(subject: subject, context: context, paths: upper_ancestors),
+      content: observe_key_content(subject: subject, context: context, write: write),
+      staging: staging_after,
+    },
+  }
+}
+
+fn controller_app_key_run_settled(run: ControllerAppKeyRun) -> Bool {
+  let refused_before = match run.action {
+    AppKeyActionRefused { reason: _ } => true
+    AppKeyLeaveInPlace => false
+    AppKeyWrite => false
+  }
+  let write_failed = match run.write_refusal {
+    Present { value: _ } => true
+    Absent => false
+  }
+  let held = match controller_app_key_custody(readback: run.readback) {
+    ControllerAppKeyHeld => true
+    ControllerAppKeyNotHeld { causes: _ } => false
+  }
+  !refused_before && !write_failed && held
+}
+
+// NEVER THE BYTES. Every field below is metadata or a judgment; the content is named only by the
+// Secret Manager version it was compared against.
+fn controller_app_key_receipt(run: ControllerAppKeyRun) -> String {
+  join([
+    "ControllerAppKeyCustodyReceipt host=", run.host as String,
+    " path=", run.key_path as String,
+    " sm_version=", run.sm_version as String,
+    "\n  action=", controller_app_key_action_wire(a: run.action),
+    match run.write_refusal {
+      Present { value: w } => concat(" write=REFUSED ", w)
+      Absent => ""
+    },
+    "\n  file=", key_file_metadata_wire(m: run.readback.file),
+    "\n  dir=", key_dir_metadata_wire(m: run.readback.dir),
+    "\n  ancestors=", runner_host_path_metadata_wire(m: run.readback.upper_ancestors),
+    "\n  content=", content_standing_wire(s: run.readback.content),
+    "\n  staging=", staging_residue_wire(s: run.readback.staging),
+    "\n  custody=", match controller_app_key_custody(readback: run.readback) {
+      ControllerAppKeyHeld => "HELD"
+      ControllerAppKeyNotHeld { causes: cs } => concat("NOT-HELD ", join(cs, "; "))
+    },
+    "\n",
+  ], "")
+}
+
+// ── CI entry ─────────────────────────────────────────────────────────────────────────────────────
+
+data microvm_controller_app_key_converge_attempt_raw: String = "microvm-controller-app-key-converge-ci"
+
+data microvm_controller_app_key_converge_receipt_path: String = "target/microvm-controller-app-key-converge-receipt.txt"
+
+fn write_receipt_then_exit(body: String, ok: Bool) -> ProcessExit {
+  let w = Filesystem.Write(path: microvm_controller_app_key_converge_receipt_path, content: body)
+  if w.success == false {
+    exit_failure(reason: join(["microvm_controller_app_key_converge: receipt write failed: ", w.error, "\n", body], ""))
+  } else if ok {
+    ExitSuccess
+  } else {
+    exit_failure(reason: body)
+  }
+}
+
+// ONE HOST PER RUN, NAMED BY THE DISPATCH, exactly as gunbc.runner_password_session_tool_converge:
+// the fleet-converge job is pinned to a runner on the named host, and the subject (the administrator
+// target, refusing a host with no runner deploy row or whose administrator is the job user) is
+// gunbc.runner_host_file_converge runner_host_file_subject rather than a second resolution. The
+// receipt is written on the failing path too.
+fn microvm_controller_app_key_converge_ci_wet() -> ProcessExit
+  uses net: Network
+{
+  let stamp = concat("probed_at=", probed_at_word(reading: clock_now_probed_at()) as String)
+  match actions_variable_read(name: fleet_converge_expected_host_env_name) {
+    ActionsVariableAbsent { variable: v, detail: d } =>
+      write_receipt_then_exit(body: join(["microvm_controller_app_key_converge: ", v, " ", d, "; one host per run, named by the dispatch\n"], ""), ok: false)
+    ActionsVariablePresent { value: raw_host } =>
+      match runner_host_file_subject(host: raw_host as HostIdentity) {
+        RunnerHostFileSubjectRefused { cause: c } => write_receipt_then_exit(body: concat(c, "\n"), ok: false)
+        RunnerHostFileSubjectAdmitted { subject: subject } =>
+          match controller_app_key_placement(key_path: lifecycle_controller_app_key_path) {
+            ControllerAppKeyPlacementRefused { cause: c } => write_receipt_then_exit(body: concat(c as String, "\n"), ok: false)
+            ControllerAppKeyPlaced { key_path: kp, key_dir: kd, upper_ancestors: ua } =>
+              match fetch_secret_ref_credential(secret_ref: gunbai_ci_app_pem_secret, token_source: WorkloadIdentityToken) {
+                SecretCredentialAccessUpsertRequired { plan: _ } =>
+                  write_receipt_then_exit(body: join(["microvm_controller_app_key_converge: ", secret_ref_version_resource(ref: gunbai_ci_app_pem_secret), " needs an interactive access ensure, which a CI run cannot perform\n"], ""), ok: false)
+                SecretCredentialFetchRefused { reason: r } =>
+                  write_receipt_then_exit(body: join(["microvm_controller_app_key_converge: token for ", secret_ref_version_resource(ref: gunbai_ci_app_pem_secret), " refused: ", r as String, "\n"], ""), ok: false)
+                SecretCredentialWireDecodeRefused { identity_cause: _, payload_cause: _ } =>
+                  write_receipt_then_exit(body: join(["microvm_controller_app_key_converge: the AccessVersion response for ", secret_ref_version_resource(ref: gunbai_ci_app_pem_secret), " did not decode\n"], ""), ok: false)
+                SecretCredentialResolvedVersionMismatch { requested: rq, resolved: rs } =>
+                  write_receipt_then_exit(body: join(["microvm_controller_app_key_converge: requested ", rq, " but Secret Manager answered about ", rs, "\n"], ""), ok: false)
+                SecretCredentialReady { credential: key, resolved_version: version } =>
+                  match typed_remote_file_write_seal(
+                    path: kp as FilePath,
+                    content: key as String,
+                    allowed_scope: FileTreeScope { root_path: kd },
+                  ) {
+                    TypedRemoteFileWriteAdmissionRefused { cause: c } => write_receipt_then_exit(body: concat(c as String, "\n"), ok: false)
+                    TypedRemoteFileWriteAdmitted { write: w } =>
+                      match prepare_fleet_ssh_agent_context(attempt_raw: microvm_controller_app_key_converge_attempt_raw) {
+                        FleetSshContextRefused { cause: c } => write_receipt_then_exit(body: concat(c, "\n"), ok: false)
+                        FleetSshContextReady { context: context, receipt: context_receipt } => {
+                          let run = converge_controller_app_key(
+                            subject: subject, context: context, placed_path: kp, key_dir: kd,
+                            upper_ancestors: ua, write: w, sm_version: version,
+                          )
+                          write_receipt_then_exit(
+                            body: join([stamp, "\n", context_receipt, controller_app_key_receipt(run: run)], ""),
+                            ok: controller_app_key_run_settled(run: run),
+                          )
+                        }
+                      }
+                  }
+              }
+          }
+      }
+  }
+}
diff --git a/dag/gunbc/typed_remote_file_write.dag b/dag/gunbc/typed_remote_file_write.dag
index 249bb39b1b8..3fb11377443 100644
--- a/dag/gunbc/typed_remote_file_write.dag
+++ b/dag/gunbc/typed_remote_file_write.dag
@@ -92,14 +92,19 @@ type TypedRemoteFileWriteOutcome
 // deliberately moved FAR-SIDE into `cmp -s -`, so what a witness exercises is the classification of
 // cmp's exit vocabulary plus the whole route over a hermetic fixture, not a near-side byte compare.
 // For a unit file the transfer is a few hundred bytes.
+// OWNER-READ-ONLY IS ITS OWN ARM, not a caller-supplied octal: a signing key read by root alone
+// (gunbc.microvm_controller_app_key_converge) has no reason to be writable even by its owner, and an
+// open octal parameter would let any consumer spell a group- or world-readable key.
 type RemoteFileMode
   = RemoteFileModeOwnerReadWrite
   | RemoteFileModeOwnerReadWriteWorldRead
+  | RemoteFileModeOwnerRead
 
 fn remote_file_mode_octal(mode: RemoteFileMode) -> String {
   match mode {
     RemoteFileModeOwnerReadWrite => "600"
     RemoteFileModeOwnerReadWriteWorldRead => "644"
+    RemoteFileModeOwnerRead => "400"
   }
 }
 
diff --git a/dag/test/claim/runner/microvm_controller_app_key_converge_witness_test.dag b/dag/test/claim/runner/microvm_controller_app_key_converge_witness_test.dag
new file mode 100644
index 00000000000..cf8a3447670
--- /dev/null
+++ b/dag/test/claim/runner/microvm_controller_app_key_converge_witness_test.dag
@@ -0,0 +1,190 @@
+module test.claim.microvm_controller_app_key_converge_witness
+
+import std.logic { Bool }
+import std.types { String, NonEmptyStr, List, Int }
+import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
+import gunbc.github_effect_perform { lifecycle_controller_app_key_path }
+import gunbc.runner_host_file_converge {
+  HostFileIdentical,
+  HostFileDiffers,
+  PathsRootOnly,
+  PathsNotRootOnly,
+}
+import gunbc.microvm_controller_app_key_converge {
+  ControllerAppKeyPlaced,
+  ControllerAppKeyPlacementRefused,
+  controller_app_key_placement,
+  KeyPathFindReading,
+  KeyFileRootOwnerRead,
+  KeyFileWrongOwner,
+  KeyFileGroupOrOtherAccess,
+  KeyFileModeNotOwnerReadOnly,
+  KeyFileAbsent,
+  KeyDirRootOnly,
+  KeyDirGroupOrOtherAccess,
+  classify_key_file_metadata,
+  classify_key_dir_metadata,
+  StagingAbsent,
+  StagingResiduePresent,
+  StagingUnobservable,
+  classify_staging_residue,
+  ControllerAppKeyReadback,
+  ControllerAppKeyHeld,
+  ControllerAppKeyNotHeld,
+  controller_app_key_custody,
+  AppKeyLeaveInPlace,
+  AppKeyWrite,
+  AppKeyActionRefused,
+  controller_app_key_action,
+  key_path_find_argv,
+  key_path_exactly_owner_read_clause,
+}
+
+data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
+
+// THE SUBJECT OF EVERY CLAIM HERE IS ONE PURE INTERFACE, with its inputs SUPPLIED (DESIGN §3, a
+// witness discriminates at one interface): the far-side find answers and the cmp/test exits are
+// constructed rather than produced by a host. The execution route (fleet SSH, sudo, Secret Manager)
+// has no hermetic seam that returns distinct answers per leg, so its inhabitance is the dispatched
+// fleet-converge mode's receipt, not a claim in this file.
+
+data held_file: KeyPathFindReading = KeyPathFindReading { root_owned: true, group_or_other_bits: false, exactly_owner_read: true }
+
+data held_dir: KeyPathFindReading = KeyPathFindReading { root_owned: true, group_or_other_bits: false, exactly_owner_read: false }
+
+fn readback_with(file: KeyPathFindReading, staging_exit: Int, content_identical: Bool) -> ControllerAppKeyReadback {
+  ControllerAppKeyReadback {
+    file: classify_key_file_metadata(reading: file),
+    dir: classify_key_dir_metadata(reading: held_dir),
+    upper_ancestors: PathsRootOnly,
+    content: if content_identical { HostFileIdentical } else { HostFileDiffers },
+    staging: classify_staging_residue(path: "/etc/gunbc/microvm-controller/app.pem.gunbc-staging", exit_code: staging_exit, stderr: ""),
+  }
+}
+
+fn is_held(r: ControllerAppKeyReadback) -> Bool {
+  match controller_app_key_custody(readback: r) {
+    ControllerAppKeyHeld => true
+    ControllerAppKeyNotHeld { causes: _ } => false
+  }
+}
+
+// ── positive control ────────────────────────────────────────────────────────────────────────────
+
+test fn a_root_owned_0400_identical_key_with_no_staging_is_held() -> Bool {
+  is_held(r: readback_with(file: held_file, staging_exit: 1, content_identical: true))
+}
+
+// ── discriminating reds, each changing ONE input from the control and asserting the REASON ──────
+
+test fn a_runner_owned_key_is_not_held_and_is_named_wrong_owner() -> Bool {
+  let r = readback_with(file: KeyPathFindReading { root_owned: false, group_or_other_bits: false, exactly_owner_read: true }, staging_exit: 1, content_identical: true)
+  !is_held(r: r) && match r.file {
+    KeyFileWrongOwner => true
+    _ => false
+  }
+}
+
+test fn a_group_readable_key_is_not_held_and_is_named_group_or_other_access() -> Bool {
+  let r = readback_with(file: KeyPathFindReading { root_owned: true, group_or_other_bits: true, exactly_owner_read: false }, staging_exit: 1, content_identical: true)
+  !is_held(r: r) && match r.file {
+    KeyFileGroupOrOtherAccess => true
+    _ => false
+  }
+}
+
+test fn an_owner_writable_key_is_not_held_and_is_named_mode_not_0400() -> Bool {
+  let r = readback_with(file: KeyPathFindReading { root_owned: true, group_or_other_bits: false, exactly_owner_read: false }, staging_exit: 1, content_identical: true)
+  !is_held(r: r) && match r.file {
+    KeyFileModeNotOwnerReadOnly => true
+    _ => false
+  }
+}
+
+test fn a_key_whose_bytes_differ_from_the_sm_version_is_not_held() -> Bool {
+  !is_held(r: readback_with(file: held_file, staging_exit: 1, content_identical: false))
+}
+
+test fn a_surviving_staging_sibling_is_not_held_and_is_named_residue() -> Bool {
+  let r = readback_with(file: held_file, staging_exit: 0, content_identical: true)
+  !is_held(r: r) && match r.staging {
+    StagingResiduePresent { path: _ } => true
+    _ => false
+  }
+}
+
+test fn an_unrunnable_staging_test_is_unobservable_not_absent() -> Bool {
+  let r = readback_with(file: held_file, staging_exit: 2, content_identical: true)
+  !is_held(r: r) && match r.staging {
+    StagingUnobservable { reason: _ } => true
+    _ => false
+  }
+}
+
+test fn a_group_traversable_directory_is_not_held() -> Bool {
+  let r = ControllerAppKeyReadback {
+    file: classify_key_file_metadata(reading: held_file),
+    dir: classify_key_dir_metadata(reading: KeyPathFindReading { root_owned: true, group_or_other_bits: true, exactly_owner_read: false }),
+    upper_ancestors: PathsRootOnly,
+    content: HostFileIdentical,
+    staging: StagingAbsent,
+  }
+  !is_held(r: r) && match r.dir {
+    KeyDirGroupOrOtherAccess => true
+    _ => false
+  }
+}
+
+// ── the decision before a write ─────────────────────────────────────────────────────────────────
+
+test fn an_identical_key_with_wrong_owner_is_rewritten_not_left() -> Bool {
+  match controller_app_key_action(dir: KeyDirRootOnly, upper_ancestors: PathsRootOnly, content: HostFileIdentical, file: KeyFileWrongOwner) {
+    AppKeyWrite => true
+    _ => false
+  }
+}
+
+test fn a_held_key_is_left_in_place() -> Bool {
+  match controller_app_key_action(dir: KeyDirRootOnly, upper_ancestors: PathsRootOnly, content: HostFileIdentical, file: KeyFileRootOwnerRead) {
+    AppKeyLeaveInPlace => true
+    _ => false
+  }
+}
+
+test fn an_unsafe_directory_refuses_before_any_write() -> Bool {
+  match controller_app_key_action(dir: KeyDirGroupOrOtherAccess, upper_ancestors: PathsRootOnly, content: HostFileDiffers, file: KeyFileAbsent) {
+    AppKeyActionRefused { reason: _ } => true
+    _ => false
+  }
+}
+
+test fn a_writable_ancestor_refuses_before_any_write() -> Bool {
+  match controller_app_key_action(dir: KeyDirRootOnly, upper_ancestors: PathsNotRootOnly { paths: ["/etc/gunbc"], detail: "" }, content: HostFileDiffers, file: KeyFileAbsent) {
+    AppKeyActionRefused { reason: _ } => true
+    _ => false
+  }
+}
+
+// ── placement ───────────────────────────────────────────────────────────────────────────────────
+
+// THE REAL PATH, not a fixture: this reddens if lifecycle_controller_app_key_path moves somewhere
+// with no dedicated root-only directory or into the fabric-cell tree.
+test fn the_modeled_key_path_places_in_its_own_directory_under_etc() -> Bool {
+  match controller_app_key_placement(key_path: lifecycle_controller_app_key_path) {
+    ControllerAppKeyPlaced { key_path: _, key_dir: d, upper_ancestors: ua } =>
+      (d as String) == "/etc/gunbc/microvm-controller" && ua == ["/etc", "/etc/gunbc"]
+    ControllerAppKeyPlacementRefused { cause: _ } => false
+  }
+}
+
+test fn a_key_path_under_the_attempt_tree_is_refused() -> Bool {
+  match controller_app_key_placement(key_path: "/opt/fabric-cells/slot-1/attempts/a1/app.pem" as NonEmptyStr) {
+    ControllerAppKeyPlacementRefused { cause: c } => string_contains(s: c as String, pattern: "fabric-cell tree")
+    ControllerAppKeyPlaced { key_path: _, key_dir: _, upper_ancestors: _ } => false
+  }
+}
+
+test fn the_mode_leg_asks_for_exactly_0400() -> Bool {
+  key_path_find_argv(path: "/p", kind: "f", clause: key_path_exactly_owner_read_clause)
+    == ["find", "/p", "-maxdepth", "0", "-type", "f", "-perm", "0400"]
+}

From 3341ce97cbad1e1e3dc86210222e678f65d20f54 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 03:37:22 +0000
Subject: [PATCH 03/22] Address review 68117: ByteSize carrier, one JWT
 claim/header authority, HostMintAdmission checker

- Credential size refusals carry ByteSize and compare through measure_le again.
- ci_spec's two App-JWT preludes take the RS256 header from extdeps.auth.jws and
  the claim JSON shape from github_app_jwt_claims_json_of (printf placeholders);
  emitted bytes unchanged.
- runner_jit_admission: X's HostEnvelopeNonemptyAndFresh becomes HostMintAdmission,
  and admit_jit_credential consumes the roster (refuses if it stops requiring it).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/extdeps/github/org_admin_auth.dag         | 22 +++++++----
 dag/gunbc/ci/ci_spec.dag                      | 10 +++--
 dag/gunbc/runner/runner_attempt_launch.dag    | 37 +++++++++++++++----
 dag/gunbc/runner/runner_jit_admission.dag     | 15 ++++++--
 .../runner/runner_two_attempt_receipt.dag     | 10 ++---
 .../runner_attempt_launch_witness_test.dag    |  3 +-
 .../runner_jit_admission_witness_test.dag     |  8 ++--
 7 files changed, 73 insertions(+), 32 deletions(-)

diff --git a/dag/extdeps/github/org_admin_auth.dag b/dag/extdeps/github/org_admin_auth.dag
index 736a804df36..4ee8c2be47f 100644
--- a/dag/extdeps/github/org_admin_auth.dag
+++ b/dag/extdeps/github/org_admin_auth.dag
@@ -39,14 +39,22 @@ data github_app_jwt_backdate_seconds: Int = 60
 data github_app_jwt_lifetime_seconds: Int = 540
 
 // THE APP JWT'S CLAIMS, as installation_token_citation states them: iss is the App id, iat is
-// backdated for clock skew, exp is within ten minutes of issue. One authority for the claim set, so
-// a signer anywhere in the tree cannot pick its own bounds.
+// backdated for clock skew, exp is within ten minutes of issue. ONE authority for the claim SHAPE:
+// github_app_jwt_claims_json_of spells the JSON once over rendered values, and both producers go
+// through it -- gunbc.github_effect_perform with the numbers themselves, and gunbc.ci_spec's shell
+// preludes with printf placeholders their runtime `date +%s` fills (those preludes compute the
+// clock in the step that signs, so they cannot take a number from here; the shape and both bounds
+// they still can).
+fn github_app_jwt_claims_json_of(iat: String, exp: String, iss: String) -> String {
+  join(["\{\"iat\":", iat, ",\"exp\":", exp, ",\"iss\":\"", iss, "\"}"], "")
+}
+
 fn github_app_jwt_claims_json(app_id: Int, now_epoch_secs: Int) -> String {
-  join([
-    "\{\"iat\":", to_string(now_epoch_secs - github_app_jwt_backdate_seconds),
-    ",\"exp\":", to_string(now_epoch_secs + github_app_jwt_lifetime_seconds),
-    ",\"iss\":\"", to_string(app_id), "\"}",
-  ], "")
+  github_app_jwt_claims_json_of(
+    iat: to_string(now_epoch_secs - github_app_jwt_backdate_seconds),
+    exp: to_string(now_epoch_secs + github_app_jwt_lifetime_seconds),
+    iss: to_string(app_id),
+  )
 }
 
 data oauth_flow_citation: ExternalAuthority = ExternalAuthority {
diff --git a/dag/gunbc/ci/ci_spec.dag b/dag/gunbc/ci/ci_spec.dag
index 525b0ebbecb..63012673ef5 100644
--- a/dag/gunbc/ci/ci_spec.dag
+++ b/dag/gunbc/ci/ci_spec.dag
@@ -7,7 +7,9 @@ import gunbc.ledger_row_coherence { heal_repair_declaration_artifact_path }
 import extdeps.cloud.gcp.secret_ref { secret_ref_access_url, secret_ref_version_resource }
 import gunbc.auth.github_apps { gunbai_ci_declared, gunbai_ci_app_pem_secret, gunbai_ci_declared_installation_id }
 import gunbc.auth.org_admin_credential { org_admin_app_key_unreadable_message, org_admin_installation_token_refused_message }
+import extdeps.auth.jws { jws_rs256_protected_header_json }
 import extdeps.github.org_admin_auth {
+  github_app_jwt_claims_json_of,
   github_app_installation_access_token_url,
   github_app_jwt_backdate_seconds,
   github_app_jwt_lifetime_seconds,
@@ -1562,11 +1564,11 @@ fn gunbc_ci_org_admin_app_token_prelude() -> List<PipelineStep> {
     Do { run: ci_retry_body_run(command: "chmod 600 \"$KEY_FILE\"") },
     Do { run: ci_retry_body_run(command: "NOW=$(date +%s)") },
     Do { run: ci_retry_body_run(command: "b64url() { base64 -w0 | tr '+/' '-_' | tr -d '='; }") },
-    Do { run: ci_retry_body_run(command: "JWT_HEADER=$(printf '%s' '\{\"alg\":\"RS256\",\"typ\":\"JWT\"}' | b64url)") },
+    Do { run: ci_retry_body_run(command: join(["JWT_HEADER=$(printf '%s' '", jws_rs256_protected_header_json(), "' | b64url)"], "")) },
     Do {
       run: ci_retry_body_run(
         command: join([
-          "JWT_PAYLOAD=$(printf '\{\"iat\":%d,\"exp\":%d,\"iss\":\"%s\"}' \"$((NOW-",
+          "JWT_PAYLOAD=$(printf '", github_app_jwt_claims_json_of(iat: "%d", exp: "%d", iss: "%s"), "' \"$((NOW-",
           to_string(github_app_jwt_backdate_seconds),
           "))\" \"$((NOW+",
           to_string(github_app_jwt_lifetime_seconds),
@@ -1698,11 +1700,11 @@ fn gunbc_ci_app_jwt_prelude() -> List<PipelineStep> {
     Do { run: ci_retry_body_run(command: "chmod 600 \"$APP_KEY_FILE\"") },
     Do { run: ci_retry_body_run(command: "APP_NOW=$(date +%s)") },
     Do { run: ci_retry_body_run(command: "app_b64url() { base64 -w0 | tr '+/' '-_' | tr -d '='; }") },
-    Do { run: ci_retry_body_run(command: "APP_JWT_HEADER=$(printf '%s' '\{\"alg\":\"RS256\",\"typ\":\"JWT\"}' | app_b64url)") },
+    Do { run: ci_retry_body_run(command: join(["APP_JWT_HEADER=$(printf '%s' '", jws_rs256_protected_header_json(), "' | app_b64url)"], "")) },
     Do {
       run: ci_retry_body_run(
         command: join([
-          "APP_JWT_PAYLOAD=$(printf '\{\"iat\":%d,\"exp\":%d,\"iss\":\"%s\"}' \"$((APP_NOW-",
+          "APP_JWT_PAYLOAD=$(printf '", github_app_jwt_claims_json_of(iat: "%d", exp: "%d", iss: "%s"), "' \"$((APP_NOW-",
           to_string(github_app_jwt_backdate_seconds),
           "))\" \"$((APP_NOW+",
           to_string(github_app_jwt_lifetime_seconds),
diff --git a/dag/gunbc/runner/runner_attempt_launch.dag b/dag/gunbc/runner/runner_attempt_launch.dag
index 7c5f3a866df..5675e10c6cd 100644
--- a/dag/gunbc/runner/runner_attempt_launch.dag
+++ b/dag/gunbc/runner/runner_attempt_launch.dag
@@ -5,7 +5,7 @@ import v2.std.optional { Absent, Present }
 import std.algebra { trim }
 import std.disposition { Disposition, SingleAuthority }
 import std.dissolution { DissolutionCondition, unbound_dissolution }
-import std.measure { Second, second, ByteSize, byte_size, byte_size_count, Mebibyte, mebibyte }
+import std.measure { Second, second, ByteSize, byte_size, byte_size_count, measure_le, Mebibyte, mebibyte }
 import extdeps.exec.command { ArgvCommand, LocalExec }
 import extdeps.tools.e2fsprogs { Ext2, mke2fs_format_command }
 import extdeps.tools.gnu_coreutils {
@@ -37,6 +37,9 @@ import gunbc.runner.runner_jit_perform {
   JitCredentialDelivery, JitCredentialBoundToAttempt,
 }
 import gunbc.runner_jit_mint { jit_runner_name_for }
+import gunbc.runner.runner_jit_admission {
+  SignatureAxis, ExpiryAxis, jit_admission_axis_standing, AxisRequired, HostMintAdmission,
+}
 import gunbc.runner_microvm {
   runner_microvm_vm_config,
   attach_workspace_drive,
@@ -153,8 +156,9 @@ type JitDeviceRefusal
   = JitMintNotReceived { performance: JitMintPerformance }
   | JitCredentialNotDelivered { delivery: JitCredentialDelivery }
   | JitCredentialBoundToDifferentAttempt { bound_to: MicroVmAttempt }
-  | JitCredentialBelowFloor { bytes: Int }
-  | JitCredentialAboveCeiling { bytes: Int }
+  | JitCredentialBelowFloor { bytes: ByteSize }
+  | JitCredentialAboveCeiling { bytes: ByteSize }
+  | JitMintAdmissionAxisNotRequired
 
 // THE ONLY CARRIER A DEVICE CAN BE STAGED FROM, and admit_jit_credential is its only constructor.
 // The registration id travels with the credential rather than beside it: it is GitHub's identity
@@ -170,8 +174,23 @@ type JitCredentialAdmission
   = JitCredentialAdmitted { admitted: AdmittedJitCredential }
   | JitCredentialRefused { refusal: JitDeviceRefusal }
 
-fn jit_credential_bytes(credential: EncodedJitConfig) -> Int {
-  string_length(credential.encoded as String)
+fn jit_credential_bytes(credential: EncodedJitConfig) -> ByteSize {
+  byte_size(count: string_length(credential.encoded as String))
+}
+
+// THE ROSTER IS CONSUMED, NOT RESTATED. gunbc.runner.runner_jit_admission declares signature and
+// expiry required with the HostMintAdmission checker, and admit_jit_credential IS that checker; so
+// it refuses if the roster stops saying so, rather than enforcing a wall the roster no longer
+// declares (or the roster declaring one nothing enforces).
+fn host_mint_admission_is_required() -> Bool {
+  match jit_admission_axis_standing(axis: SignatureAxis) {
+    AxisRequired { checker: HostMintAdmission } =>
+      match jit_admission_axis_standing(axis: ExpiryAxis) {
+        AxisRequired { checker: HostMintAdmission } => true
+        _ => false
+      }
+    _ => false
+  }
 }
 
 fn admit_jit_credential(attempt: MicroVmAttempt, mint: JitMintPerformance) -> JitCredentialAdmission {
@@ -179,11 +198,13 @@ fn admit_jit_credential(attempt: MicroVmAttempt, mint: JitMintPerformance) -> Ji
     JitMintReceived { delivery: delivery } =>
       match delivery {
         JitCredentialBoundToAttempt { attempt: bound, credential: c, runner_id: id } =>
-          if bound != attempt {
+          if !host_mint_admission_is_required() {
+            JitCredentialRefused { refusal: JitMintAdmissionAxisNotRequired }
+          } else if bound != attempt {
             JitCredentialRefused { refusal: JitCredentialBoundToDifferentAttempt { bound_to: bound } }
-          } else if jit_credential_bytes(credential: c) < byte_size_count(b: jit_config_byte_floor) {
+          } else if !measure_le(a: jit_config_byte_floor, b: jit_credential_bytes(credential: c)) {
             JitCredentialRefused { refusal: JitCredentialBelowFloor { bytes: jit_credential_bytes(credential: c) } }
-          } else if jit_credential_bytes(credential: c) > byte_size_count(b: jit_config_byte_ceiling) {
+          } else if !measure_le(a: jit_credential_bytes(credential: c), b: jit_config_byte_ceiling) {
             JitCredentialRefused { refusal: JitCredentialAboveCeiling { bytes: jit_credential_bytes(credential: c) } }
           } else {
             JitCredentialAdmitted {
diff --git a/dag/gunbc/runner/runner_jit_admission.dag b/dag/gunbc/runner/runner_jit_admission.dag
index 9715ec523e7..c4724dbd2b8 100644
--- a/dag/gunbc/runner/runner_jit_admission.dag
+++ b/dag/gunbc/runner/runner_jit_admission.dag
@@ -29,8 +29,17 @@ type JitAdmissionAxis
   | BootBindingAxis
   | AttemptBindingAxis
 
+// HostMintAdmission REPLACES X's HostEnvelopeNonemptyAndFresh, and the rename is the point (§3: a
+// materially different check needs a different name). X's checker read a blob a host FETCHED and
+// asked whether it was nonempty and fresh. There is no fetch now: the credential is minted on the
+// host by gunbc.github_effect_perform under an RS256 App JWT signed with the controller's key, and
+// gunbc.runner_attempt_launch admit_jit_credential admits it only from that performance's delivered
+// arm, bound to the attempt, within the byte floor and ceiling. SIGNATURE is therefore the App path
+// (GitHub minted it for our authenticated App; the blob is opaque and carries none for a host to
+// check); EXPIRY is freshness by construction -- minted in the attempt that stages it, immediately
+// before staging, and generate-jitconfig reports no expiry to check against.
 type JitAdmissionChecker
-  = HostEnvelopeNonemptyAndFresh
+  = HostMintAdmission
   | GitHubMintRequestName
 
 type JitAdmissionAxisStanding
@@ -40,8 +49,8 @@ type JitAdmissionAxisStanding
 
 fn jit_admission_axis_standing(axis: JitAdmissionAxis) -> JitAdmissionAxisStanding {
   match axis {
-    SignatureAxis => AxisRequired { checker: HostEnvelopeNonemptyAndFresh }
-    ExpiryAxis => AxisRequired { checker: HostEnvelopeNonemptyAndFresh }
+    SignatureAxis => AxisRequired { checker: HostMintAdmission }
+    ExpiryAxis => AxisRequired { checker: HostMintAdmission }
     ReplayAxis => AxisDeferred { trigger: "host cannot detect a second consumer of a minted encoded_jit_config; a generate-jitconfig 409 on a duplicate name is a different question" as NonEmptyStr }
     UnitBindingAxis => AxisDissolvedInto { into: AttemptBindingAxis }
     BootBindingAxis => AxisDissolvedInto { into: AttemptBindingAxis }
diff --git a/dag/gunbc/runner/runner_two_attempt_receipt.dag b/dag/gunbc/runner/runner_two_attempt_receipt.dag
index f743f636c40..48883fafd1b 100644
--- a/dag/gunbc/runner/runner_two_attempt_receipt.dag
+++ b/dag/gunbc/runner/runner_two_attempt_receipt.dag
@@ -4,7 +4,7 @@ import std.types { Bool, Int, List, NonEmptyStr, String }
 import gunbc.runner.runner_jit_admission {
   JitAdmissionAxis, SignatureAxis, ExpiryAxis, ReplayAxis, UnitBindingAxis, BootBindingAxis,
   AttemptBindingAxis, jit_admission_axis_standing, AxisRequired, AxisDeferred, AxisDissolvedInto,
-  HostEnvelopeNonemptyAndFresh, GitHubMintRequestName,
+  HostMintAdmission, GitHubMintRequestName,
 }
 
 // TWO GITHUB ACTIONS JOBS RAN IN TWO SEPARATE MICROVMS ON ONE BOOT OF THE PHYSICAL MACHINE.
@@ -134,10 +134,10 @@ data artifact_staging: NonEmptyStr = "guest kernel and rootfs are copied off the
 // Axis membership is gunbc.runner.runner_jit_admission, not a second roster on this receipt.
 fn still_open_from_axis_standing(axis: JitAdmissionAxis) -> List<NonEmptyStr> {
   match jit_admission_axis_standing(axis: axis) {
-    AxisRequired { checker: HostEnvelopeNonemptyAndFresh } => match axis {
-      SignatureAxis => ["signature still required on the host envelope"]
-      ExpiryAxis => ["expiry still required on the host envelope"]
-      _ => ["host envelope nonempty-and-fresh still required"]
+    AxisRequired { checker: HostMintAdmission } => match axis {
+      SignatureAxis => ["signature: admitted only from the host App-JWT mint (gunbc.runner_attempt_launch admit_jit_credential); not yet executed by the lifecycle controller"]
+      ExpiryAxis => ["expiry: fresh by construction from a per-attempt host mint; not yet executed by the lifecycle controller"]
+      _ => ["host mint admission not yet executed by the lifecycle controller"]
     }
     AxisRequired { checker: GitHubMintRequestName } =>
       ["attempt binding still required on the mint name"]
diff --git a/dag/test/claim/runner/runner_attempt_launch_witness_test.dag b/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
index 45a9d44c8dd..69f3462d73c 100644
--- a/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
+++ b/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
@@ -2,6 +2,7 @@ module test.claim.runner_attempt_launch_witness
 
 import std.types { String, Bool, Int, List, NonEmptyStr }
 import v2.std.optional { Absent, Present }
+import std.measure { byte_size_count }
 import std.nat { Nat }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import extdeps.exec.command { argv_words }
@@ -176,7 +177,7 @@ test fn a_below_floor_credential_stages_no_device_and_starts_no_vmm() -> Bool {
           let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: received_for(attempt: a, encoded: short_blob), ground: GroundClear)
           no_device_no_vmm(plan: plan)
             && match refusal_of(plan: plan) {
-              Cons { head: JitCredentialBelowFloor { bytes: n }, tail: _ } => n == 20
+              Cons { head: JitCredentialBelowFloor { bytes: n }, tail: _ } => byte_size_count(b: n) == 20
               _ => false
             }
         }
diff --git a/dag/test/claim/runner_jit_admission_witness_test.dag b/dag/test/claim/runner_jit_admission_witness_test.dag
index ec74aca7ddd..b8da10b3027 100644
--- a/dag/test/claim/runner_jit_admission_witness_test.dag
+++ b/dag/test/claim/runner_jit_admission_witness_test.dag
@@ -7,17 +7,17 @@ import gunbc.auth.github_apps { gunbai_ci_declared }
 import gunbc.runner.runner_jit_admission {
   SignatureAxis, ExpiryAxis, ReplayAxis, UnitBindingAxis, BootBindingAxis, AttemptBindingAxis,
   AxisRequired, AxisDeferred, AxisDissolvedInto,
-  HostEnvelopeNonemptyAndFresh, GitHubMintRequestName,
+  HostMintAdmission, GitHubMintRequestName,
   jit_admission_axis_standing, attempt_binding_admits_mint_name,
 }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
 
-test fn signature_and_expiry_are_required_host_envelope_checks() -> Bool {
+test fn signature_and_expiry_are_required_host_mint_admission_checks() -> Bool {
   match jit_admission_axis_standing(axis: SignatureAxis) {
-    AxisRequired { checker: HostEnvelopeNonemptyAndFresh } =>
+    AxisRequired { checker: HostMintAdmission } =>
       match jit_admission_axis_standing(axis: ExpiryAxis) {
-        AxisRequired { checker: HostEnvelopeNonemptyAndFresh } => true
+        AxisRequired { checker: HostMintAdmission } => true
         _ => false
       }
     _ => false

From bf07613c06ebdcc96f4037e27a2d4593bffc03d2 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 04:19:24 +0000
Subject: [PATCH 04/22] Regenerate fleet-converge.yml for the
 microvm_controller_app_key_converge mode

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/fleet-converge.yml | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/fleet-converge.yml b/.github/workflows/fleet-converge.yml
index bb830799529..c365d59516d 100644
--- a/.github/workflows/fleet-converge.yml
+++ b/.github/workflows/fleet-converge.yml
@@ -13,7 +13,7 @@ on:
       mode:
         description: plan shows membership hunks; apply executes a prior plan artifact; org_actions_observe validates the org credential and refuses on runner-group drift; app_control_plane_observe reads the gunbai-ci App registration and webhook config with a short-lived App JWT and refuses on hook-config drift; microvm_host_converge installs the cited Firecracker release on the selected host and refuses the kvm grant by name; guest_image_observe reports the micro-VM base artifacts and their measured digests on the selected host and builds nothing; guest_image_converge builds the runner guest image there; microvm_boot_probe boots that image and reads its serial console; spark_grants and spark_bootstrap prepare the selected Spark; spark_serving_apply applies the promoted fabric groups' vLLM units over the password session, workers before heads; spark_runtime_image_probe pulls the pinned runtime image on the selected Spark and reads its capabilities from inside its own digest, changing nothing; host_reset_return drives a rostered reset subject through its controller and measures the return FROM A PEER, and takes reset_observer rather than host because the observer must not be the subject; runner_host_file_observe reads the runner teardown drop-in, the needrestart deferral and the loaded teardown on the selected host as its administrator and writes nothing; runner_host_file_converge writes whichever of those two files differs, reloads systemd only if the drop-in changed, and refuses unless the manager then reports the declared teardown
         required: true
-        options: [plan, launch_environment_plan, allocation_store_plan, apply, org_actions_observe, app_control_plane_observe, microvm_host_converge, guest_image_observe, guest_image_converge, microvm_boot_probe, spark_grants, spark_bootstrap, spark_serving_apply, spark_runtime_image_probe, dashboard_deploy, rlm_launch_deployment_receipt, host_reset_return, runner_host_file_observe, runner_host_file_converge, runner_password_session_tool_converge, r2_mint_preflight, r2_object_write_mint]
+        options: [plan, launch_environment_plan, allocation_store_plan, apply, org_actions_observe, app_control_plane_observe, microvm_host_converge, guest_image_observe, guest_image_converge, microvm_boot_probe, spark_grants, spark_bootstrap, spark_serving_apply, spark_runtime_image_probe, dashboard_deploy, rlm_launch_deployment_receipt, host_reset_return, runner_host_file_observe, runner_host_file_converge, runner_password_session_tool_converge, microvm_controller_app_key_converge, r2_mint_preflight, r2_object_write_mint]
         type: choice
       target:
         description: "Spark target host for the spark_* modes, naming the administrator credential the run materializes (any rostered Spark: srv5, srv6, srv7, srv8, srv9, srv10, srv11, srv12); apply reads the subject off the plan artifact"
@@ -651,6 +651,27 @@ jobs:
           retention-days: 30
         if: always() && (github.event.inputs.mode == 'runner_password_session_tool_converge')
         timeout-minutes: 10
+      - name: "MicroVM controller App key: deliver root:root 0400 from Secret Manager, read owner, mode, bytes and staging back"
+        id: microvm_controller_app_key_converge
+        run: |
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/runner/microvm_controller_app_key_converge.dag --function microvm_controller_app_key_converge_ci_wet
+          cat "$ROOT/target/microvm-controller-app-key-converge-receipt.txt"
+        env:
+          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
+          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
+        if: github.event.inputs.mode == 'microvm_controller_app_key_converge'
+        timeout-minutes: 15
+      - name: Upload microVM controller App key custody receipt
+        id: microvm_controller_app_key_receipt_upload
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        with:
+          name: microvm-controller-app-key-converge-receipt
+          path: target/microvm-controller-app-key-converge-receipt.txt
+          if-no-files-found: error
+          retention-days: 30
+        if: always() && (github.event.inputs.mode == 'microvm_controller_app_key_converge')
+        timeout-minutes: 10
       - name: Upload runner host file converge receipt
         id: runner_host_file_receipt_upload
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f

From 0e26b37010f417c15b7eb97c8ae1042034fa8198 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 04:23:36 +0000
Subject: [PATCH 05/22] Address review 68156: EpochSecs for the JWT clock,
 delete planned_jit_devices alias

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/extdeps/clock/clock.dag                           |  7 +++++++
 dag/extdeps/github/org_admin_auth.dag                 |  4 ++--
 dag/gunbc/github_effect_perform.dag                   | 10 ++++++----
 dag/gunbc/runner/runner_attempt_launch.dag            |  7 -------
 .../runner/runner_attempt_launch_witness_test.dag     | 11 +++++++----
 5 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/dag/extdeps/clock/clock.dag b/dag/extdeps/clock/clock.dag
index 6e85d512063..d84e83c0ec9 100644
--- a/dag/extdeps/clock/clock.dag
+++ b/dag/extdeps/clock/clock.dag
@@ -88,6 +88,13 @@ type ClockUnixMillisRead
   | ClockUnixMillisRefused { detail: String }
 
 // The OPERATION's output stays String and the TYPED read is a function over it, which is the shape every other numeric host read in this tree already has (extdeps.tools.wc, extdeps.systemd.systemd, extdeps.filesystem.linux all take a stdout String and route it through parse_int). The alternative — declaring the operation's output as EpochMs and letting the transport coerce — would put a decode inside the transport layer where it has no way to REFUSE: a stdout that is not a number would have to become some Int anyway, and the only available answers are a fabricated zero or a crash. Here an unparseable clock reading is ClockUnixMillisRefused carrying what was actually read, and a caller must answer that arm. The negative check is not redundant with parse_int: parse_int admits a leading minus, EpochMs is `Int where range(min: 0)`, and a clock that reported a pre-epoch instant is a broken clock rather than a very old one.
+// THE ONE MILLIS-TO-SECONDS CONVERSION, beside the read that produces millis. Truncation toward the
+// epoch is POSIX seconds' own rounding (date +%s truncates), and both carriers are non-negative, so
+// a reading that satisfied EpochMs yields one that satisfies EpochSecs.
+fn epoch_secs_of_millis(millis: EpochMs) -> EpochSecs {
+  millis / 1000
+}
+
 fn clock_unix_millis_read() -> ClockUnixMillisRead {
   let result = Clock.UnixMillis()
   match parse_int(s: trim(result.unix_millis)) {
diff --git a/dag/extdeps/github/org_admin_auth.dag b/dag/extdeps/github/org_admin_auth.dag
index 4ee8c2be47f..830ffb8599c 100644
--- a/dag/extdeps/github/org_admin_auth.dag
+++ b/dag/extdeps/github/org_admin_auth.dag
@@ -1,6 +1,6 @@
 module extdeps.github.org_admin_auth
 
-import std.types { NonEmptyStr, Timestamp, String, Int }
+import std.types { NonEmptyStr, Timestamp, String, Int, EpochSecs }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
 import extdeps.uri { Uri, Https }
@@ -49,7 +49,7 @@ fn github_app_jwt_claims_json_of(iat: String, exp: String, iss: String) -> Strin
   join(["\{\"iat\":", iat, ",\"exp\":", exp, ",\"iss\":\"", iss, "\"}"], "")
 }
 
-fn github_app_jwt_claims_json(app_id: Int, now_epoch_secs: Int) -> String {
+fn github_app_jwt_claims_json(app_id: Int, now_epoch_secs: EpochSecs) -> String {
   github_app_jwt_claims_json_of(
     iat: to_string(now_epoch_secs - github_app_jwt_backdate_seconds),
     exp: to_string(now_epoch_secs + github_app_jwt_lifetime_seconds),
diff --git a/dag/gunbc/github_effect_perform.dag b/dag/gunbc/github_effect_perform.dag
index 5d1c4f097e4..fa6b534e822 100644
--- a/dag/gunbc/github_effect_perform.dag
+++ b/dag/gunbc/github_effect_perform.dag
@@ -1,9 +1,11 @@
 module gunbc.github_effect_perform
 
-import std.types { String, NonEmptyStr, Int, List, Secret }
+import std.types { String, NonEmptyStr, Int, List, Secret, EpochSecs }
 import std.resources { Network }
 import std.dissolution { DissolutionCondition, unbound_dissolution }
-import extdeps.clock { clock_unix_millis_read, ClockUnixMillisObserved, ClockUnixMillisRefused }
+import extdeps.clock {
+  clock_unix_millis_read, ClockUnixMillisObserved, ClockUnixMillisRefused, epoch_secs_of_millis,
+}
 import extdeps.auth.jws { jws_rs256_signing_input, jws_compact_serialization }
 import extdeps.tools.openssl { openssl_sign_sha256, OpensslSigned, OpensslSignRefused }
 import extdeps.github.org_admin_auth { github_app_jwt_claims_json }
@@ -76,7 +78,7 @@ type JitMintPerformance
   | JitMintAppJwtUnsigned { detail: String }
   | JitMintStepNotSucceeded { step: JitMintStep, performance: RestExchangePerformance }
 
-fn app_jwt_for(dispatch_app_id: Int, key_file: NonEmptyStr, now_epoch_secs: Int) -> JitMintAppJwt {
+fn app_jwt_for(dispatch_app_id: Int, key_file: NonEmptyStr, now_epoch_secs: EpochSecs) -> JitMintAppJwt {
   let signing_input = jws_rs256_signing_input(
     payload_json: github_app_jwt_claims_json(app_id: dispatch_app_id, now_epoch_secs: now_epoch_secs),
   )
@@ -142,7 +144,7 @@ fn perform_organization_jit_mint(dispatch: JitMintDispatch) -> JitMintPerformanc
           match clock_unix_millis_read() {
             ClockUnixMillisRefused { detail: d } => JitMintClockUnread { detail: d }
             ClockUnixMillisObserved { millis: ms } =>
-              match app_jwt_for(dispatch_app_id: app.app_id.value, key_file: lifecycle_controller_app_key_path, now_epoch_secs: ms / 1000) {
+              match app_jwt_for(dispatch_app_id: app.app_id.value, key_file: lifecycle_controller_app_key_path, now_epoch_secs: epoch_secs_of_millis(millis: ms)) {
                 AppJwtUnsigned { detail: d } => JitMintAppJwtUnsigned { detail: d }
                 AppJwtSigned { jwt: jwt } => {
                   let token = github.AppInstallationAccessTokens.Create(
diff --git a/dag/gunbc/runner/runner_attempt_launch.dag b/dag/gunbc/runner/runner_attempt_launch.dag
index 5675e10c6cd..b4730a6306e 100644
--- a/dag/gunbc/runner/runner_attempt_launch.dag
+++ b/dag/gunbc/runner/runner_attempt_launch.dag
@@ -503,13 +503,6 @@ fn planned_jailer_launches(plan: AttemptLaunchPlan) -> Int {
   }
 }
 
-// THE POSITIVE-CONTROL COUNT beside planned_jailer_launches: an authorized plan stages exactly one
-// device, and every refusal stages none. Because both counts read the same arm they are equal by
-// construction -- a device without a launch, or a launch without a device, has no value to be.
-fn planned_jit_devices(plan: AttemptLaunchPlan) -> Int {
-  planned_jailer_launches(plan: plan)
-}
-
 // STAGING, PERFORMED -- and READ BACK FROM THE HOST rather than believed from the steps' exits.
 // Each step's refusal is its own arm naming the step, so a failed install is not reported as a
 // failed write. The readback checks the three facts the device's safety rests on: owned by the
diff --git a/dag/test/claim/runner/runner_attempt_launch_witness_test.dag b/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
index 69f3462d73c..67f1212dcef 100644
--- a/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
+++ b/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
@@ -36,7 +36,7 @@ import gunbc.runner_attempt_launch {
   JitDeviceRefusal, JitMintNotReceived, JitCredentialNotDelivered,
   JitCredentialBoundToDifferentAttempt, JitCredentialBelowFloor, JitCredentialAboveCeiling,
   jit_device_readback, JitDeviceStagingRefused, JitDeviceReadbackStep,
-  plan_attempt_launch, planned_jailer_launches, planned_jit_devices,
+  plan_attempt_launch, planned_jailer_launches,
   attempt_jail_chroot_root, workspace_drive_path_on_host,
   work_standing_from_vmm_exit, WorkNotEstablished,
   reported_attempt_launch_rung,
@@ -162,9 +162,12 @@ fn refusal_of(plan: AttemptLaunchPlan) -> List<JitDeviceRefusal> {
   }
 }
 
-// NEITHER A DEVICE NOR A VMM: the law's two halves, read off one plan so they cannot disagree.
+// NEITHER A DEVICE NOR A VMM. The device and the jailer are fields of the one LaunchAuthorized arm,
+// so the law is carried by the plan's shape: zero launches IS zero devices. This helper counts
+// launches and says nothing more; a second count read off the same arm would be green by
+// construction (DESIGN §4b).
 fn no_device_no_vmm(plan: AttemptLaunchPlan) -> Bool {
-  planned_jailer_launches(plan: plan) == 0 && planned_jit_devices(plan: plan) == 0
+  planned_jailer_launches(plan: plan) == 0
 }
 
 // THE RECEIPTED FAIL-OPEN, AS A RED. X staged whatever bytes it had and launched. A credential below
@@ -318,7 +321,7 @@ test fn a_live_grant_stages_exactly_one_device_and_records_the_registration() ->
       match accepted_attempt(i: 4, id: "ok1") {
         Cons { head: a, tail: _ } => {
           let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: a), ground: GroundClear)
-          planned_jit_devices(plan: plan) == 1 && planned_jailer_launches(plan: plan) == 1
+          planned_jailer_launches(plan: plan) == 1
             && match plan {
               LaunchAuthorized {
                 authorization: _,

From eb3a189f9e884cff0fca8986aeaef78e4073fa0d Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 04:53:23 +0000
Subject: [PATCH 06/22] Placement reads runner_host_file_scope instead of
 re-minting the /etc scope

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../runner/microvm_controller_app_key_converge.dag    | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/dag/gunbc/runner/microvm_controller_app_key_converge.dag b/dag/gunbc/runner/microvm_controller_app_key_converge.dag
index ec31264af5f..e62cc1f648e 100644
--- a/dag/gunbc/runner/microvm_controller_app_key_converge.dag
+++ b/dag/gunbc/runner/microvm_controller_app_key_converge.dag
@@ -63,6 +63,7 @@ import gunbc.runner_host_file_converge {
   PathsUnobservable,
   PathsNotApplicable,
   runner_host_path_ancestors,
+  runner_host_file_scope,
   runner_host_root_only_find_argv,
   classify_root_only_paths,
   runner_host_path_metadata_wire,
@@ -120,8 +121,6 @@ import gunbc.runner_host_file_converge {
 
 // ── Placement (pure) ─────────────────────────────────────────────────────────────────────────────
 
-data controller_app_key_scope_root: FileTreeScope = FileTreeScope { root_path: "/etc" as NonEmptyStr }
-
 data controller_app_key_forbidden_tree: FileTreeScope = FileTreeScope { root_path: fabric_cell_base_dir as NonEmptyStr }
 
 type ControllerAppKeyPlacement
@@ -140,13 +139,13 @@ fn controller_app_key_placement(key_path: NonEmptyStr) -> ControllerAppKeyPlacem
     ControllerAppKeyPlacementRefused {
       cause: join(["controller app key path ", key_path as String, " is inside the fabric-cell tree ", fabric_cell_base_dir, ", which roots every attempt and jail"], "") as NonEmptyStr,
     }
-  } else if !path_within_file_tree_scope(scope: controller_app_key_scope_root, path: key_path) {
+  } else if !path_within_file_tree_scope(scope: runner_host_file_scope, path: key_path) {
     ControllerAppKeyPlacementRefused {
-      cause: join(["controller app key path ", key_path as String, " is outside /etc"], "") as NonEmptyStr,
+      cause: join(["controller app key path ", key_path as String, " is outside ", runner_host_file_scope.root_path as String], "") as NonEmptyStr,
     }
-  } else if dir == "" || dir == (controller_app_key_scope_root.root_path as String) {
+  } else if dir == "" || dir == (runner_host_file_scope.root_path as String) {
     ControllerAppKeyPlacementRefused {
-      cause: join(["controller app key path ", key_path as String, " has no dedicated directory below /etc to hold root-only"], "") as NonEmptyStr,
+      cause: join(["controller app key path ", key_path as String, " has no dedicated directory below ", runner_host_file_scope.root_path as String, " to hold root-only"], "") as NonEmptyStr,
     }
   } else {
     ControllerAppKeyPlaced {

From afcc7018c3054bfd47f2853d2fc5457d63d68b2d Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 06:44:59 +0000
Subject: [PATCH 07/22] extdeps.tools.openssl: import Unit from std.types
 (floor AmbiguousBareNameRead)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/extdeps/tools/openssl.dag | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dag/extdeps/tools/openssl.dag b/dag/extdeps/tools/openssl.dag
index 7bc65eebd52..0f30eb5fd5b 100644
--- a/dag/extdeps/tools/openssl.dag
+++ b/dag/extdeps/tools/openssl.dag
@@ -1,6 +1,6 @@
 module extdeps.tools.openssl
 
-import std.types { String, NonEmptyStr, Int, Bool, List }
+import std.types { String, NonEmptyStr, Int, Bool, List, Unit }
 import std.integer { UInt8 }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }

From be8da1606ff42e4aff49dde4d85b35bd9c028c02 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 07:23:20 +0000
Subject: [PATCH 08/22] runner_attempt_launch: derive the jit device's install
 mode and readback mode from one row (review 68264)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/gunbc/runner/runner_attempt_launch.dag | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/dag/gunbc/runner/runner_attempt_launch.dag b/dag/gunbc/runner/runner_attempt_launch.dag
index b4730a6306e..c3f2671f4f4 100644
--- a/dag/gunbc/runner/runner_attempt_launch.dag
+++ b/dag/gunbc/runner/runner_attempt_launch.dag
@@ -237,7 +237,13 @@ type JitDeviceStaging {
   pad: ArgvCommand
 }
 
-data jit_device_octal_mode: NonEmptyStr = "0400"
+// ONE ROW FOR THE DEVICE'S MODE, in the digits stat(1) %a prints. install(1) -m takes the same
+// digits with a leading 0; both spellings derive from this row, so they cannot drift.
+data jit_device_mode_digits: NonEmptyStr = "400"
+
+fn jit_device_install_mode() -> NonEmptyStr {
+  concat("0", jit_device_mode_digits as String) as NonEmptyStr
+}
 
 fn jit_device_staging(jail_root: String, admitted: AdmittedJitCredential) -> JitDeviceStaging {
   let host_path = join([jail_root, jail_jit_path as String], "")
@@ -245,7 +251,7 @@ fn jit_device_staging(jail_root: String, admitted: AdmittedJitCredential) -> Jit
     host_path: host_path,
     create: install_empty_file_command(
       path: host_path,
-      octal_mode: jit_device_octal_mode,
+      octal_mode: jit_device_install_mode(),
       uid: attempt_unprivileged_uid,
       gid: attempt_unprivileged_gid,
     ),
@@ -530,7 +536,7 @@ fn process_outcome_token(outcome: ProcessOutcome) -> String {
 fn jit_device_readback(uid: String, mode: String, size: String) -> JitDeviceStagingOutcome? {
   if uid != to_string(attempt_unprivileged_uid) {
     Present { value: JitDeviceStagingRefused { step: JitDeviceReadbackStep, detail: join(["owner uid is ", uid], "") } }
-  } else if mode != "400" {
+  } else if mode != (jit_device_mode_digits as String) {
     Present { value: JitDeviceStagingRefused { step: JitDeviceReadbackStep, detail: join(["mode is ", mode], "") } }
   } else if size != to_string(byte_size_count(b: jit_config_byte_ceiling)) {
     Present { value: JitDeviceStagingRefused { step: JitDeviceReadbackStep, detail: join(["size is ", size], "") } }

From 4830553bc9fc2539a0818a38d439287988e30291 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 08:03:08 +0000
Subject: [PATCH 09/22] App JWT carried as extdeps.auth.jwt
 JwtCompactSerialization, not a bare Secret (review 68283)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/extdeps/auth/jws.dag            | 8 ++++++--
 dag/gunbc/github_effect_perform.dag | 9 ++++++---
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/dag/extdeps/auth/jws.dag b/dag/extdeps/auth/jws.dag
index ba0ad2643f1..a764f3a9e8b 100644
--- a/dag/extdeps/auth/jws.dag
+++ b/dag/extdeps/auth/jws.dag
@@ -7,6 +7,7 @@ import std.encoding { base64_encode, UrlSafe }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
 import extdeps.uri { Uri, Https }
+import extdeps.auth.jwt { JwtCompactSerialization }
 
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri { scheme: Https, locator: "datatracker.ietf.org/doc/html/rfc7515" }
@@ -53,8 +54,11 @@ fn jws_rs256_signing_input(payload_json: String) -> NonEmptyStr {
 // THE SIGNATURE IS OCTETS, NOT TEXT. A realization that hands back a printable rendering (hex,
 // standard base64) decodes it to octets first; this join then encodes exactly once. Accepting a
 // pre-encoded String here would let a standard-alphabet signature through looking valid.
-fn jws_compact_serialization(signing_input: NonEmptyStr, signature: List<UInt8>) -> NonEmptyStr {
-  join([signing_input as String, ".", jws_base64url_octets(octets: signature)], "") as NonEmptyStr
+// THE RESULT IS extdeps.auth.jwt JwtCompactSerialization, not a bare string: the only protected
+// header this module produces is typ JWT, so every value it emits IS a JWT, and the brand keeps it
+// from being confused with an opaque bearer (an installation token is not decodable).
+fn jws_compact_serialization(signing_input: NonEmptyStr, signature: List<UInt8>) -> JwtCompactSerialization {
+  join([signing_input as String, ".", jws_base64url_octets(octets: signature)], "") as JwtCompactSerialization
 }
 
 data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
diff --git a/dag/gunbc/github_effect_perform.dag b/dag/gunbc/github_effect_perform.dag
index fa6b534e822..9a91013320f 100644
--- a/dag/gunbc/github_effect_perform.dag
+++ b/dag/gunbc/github_effect_perform.dag
@@ -7,6 +7,7 @@ import extdeps.clock {
   clock_unix_millis_read, ClockUnixMillisObserved, ClockUnixMillisRefused, epoch_secs_of_millis,
 }
 import extdeps.auth.jws { jws_rs256_signing_input, jws_compact_serialization }
+import extdeps.auth.jwt { JwtCompactSerialization }
 import extdeps.tools.openssl { openssl_sign_sha256, OpensslSigned, OpensslSignRefused }
 import extdeps.github.org_admin_auth { github_app_jwt_claims_json }
 import extdeps.github.actions_jit_runner {
@@ -85,12 +86,12 @@ fn app_jwt_for(dispatch_app_id: Int, key_file: NonEmptyStr, now_epoch_secs: Epoc
   match openssl_sign_sha256(key_file: key_file, signing_input: signing_input) {
     OpensslSignRefused { exit_code: _, detail: d } => AppJwtUnsigned { detail: d }
     OpensslSigned { octets: sig } =>
-      AppJwtSigned { jwt: jws_compact_serialization(signing_input: signing_input, signature: sig) as Secret }
+      AppJwtSigned { jwt: jws_compact_serialization(signing_input: signing_input, signature: sig) }
   }
 }
 
 type JitMintAppJwt
-  = AppJwtSigned { jwt: Secret }
+  = AppJwtSigned { jwt: JwtCompactSerialization }
   | AppJwtUnsigned { detail: String }
 
 // THE GENERATE STEP'S ANSWER, DECIDED WITHOUT I/O so the decision is witnessable on supplied
@@ -147,8 +148,10 @@ fn perform_organization_jit_mint(dispatch: JitMintDispatch) -> JitMintPerformanc
               match app_jwt_for(dispatch_app_id: app.app_id.value, key_file: lifecycle_controller_app_key_path, now_epoch_secs: epoch_secs_of_millis(millis: ms)) {
                 AppJwtUnsigned { detail: d } => JitMintAppJwtUnsigned { detail: d }
                 AppJwtSigned { jwt: jwt } => {
+                  // The JWT stays JwtCompactSerialization up to this one call; the operation's
+                  // Bearer input is a Secret, and this is the single place the brand is shed.
                   let token = github.AppInstallationAccessTokens.Create(
-                    app_jwt: jwt,
+                    app_jwt: jwt as Secret,
                     installation_id: installation.value,
                   )
                   match classify_rest_outcome(standing: RestMutationExchange { rest: token.outcome }) {

From 2fc768aa74f7f20daa91ad5a7910ebadd394b8e6 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 08:30:10 +0000
Subject: [PATCH 10/22] github_effect_perform: hoist the brand-shedding note
 out of the function body (parse: annotation at module-item grain only)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/gunbc/github_effect_perform.dag | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dag/gunbc/github_effect_perform.dag b/dag/gunbc/github_effect_perform.dag
index 9a91013320f..65168ed13f5 100644
--- a/dag/gunbc/github_effect_perform.dag
+++ b/dag/gunbc/github_effect_perform.dag
@@ -128,6 +128,9 @@ fn jit_mint_performance_of_generate(
   }
 }
 
+// THE APP JWT STAYS JwtCompactSerialization until the installation-token call, whose Bearer input
+// is a Secret; that call is the single place the brand is shed, so the JWT and the opaque
+// installation token are not interchangeable anywhere else in this function.
 fn perform_organization_jit_mint(dispatch: JitMintDispatch) -> JitMintPerformance uses net: Network {
   match dispatch {
     JitMintDispatchRefused { refusal: r } =>
@@ -148,8 +151,6 @@ fn perform_organization_jit_mint(dispatch: JitMintDispatch) -> JitMintPerformanc
               match app_jwt_for(dispatch_app_id: app.app_id.value, key_file: lifecycle_controller_app_key_path, now_epoch_secs: epoch_secs_of_millis(millis: ms)) {
                 AppJwtUnsigned { detail: d } => JitMintAppJwtUnsigned { detail: d }
                 AppJwtSigned { jwt: jwt } => {
-                  // The JWT stays JwtCompactSerialization up to this one call; the operation's
-                  // Bearer input is a Secret, and this is the single place the brand is shed.
                   let token = github.AppInstallationAccessTokens.Create(
                     app_jwt: jwt as Secret,
                     installation_id: installation.value,

From e20ac1c799b309ac2600e5b1ade531b0f874f9ee Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 09:09:06 +0000
Subject: [PATCH 11/22] Reconcile the RS256 'cannot sign' rows with the signer
 this PR lands; keep clock notes attached (review 68318)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/extdeps/clock/clock.dag                  | 14 +++++++-------
 dag/extdeps/github/app.dag                   | 15 +++++++++------
 dag/gunbc/github_app_acquisition.dag         | 11 ++++++-----
 dag/gunbc/instruments/github_app_acquire.dag |  4 ++--
 4 files changed, 24 insertions(+), 20 deletions(-)

diff --git a/dag/extdeps/clock/clock.dag b/dag/extdeps/clock/clock.dag
index d84e83c0ec9..893584d70c0 100644
--- a/dag/extdeps/clock/clock.dag
+++ b/dag/extdeps/clock/clock.dag
@@ -88,13 +88,6 @@ type ClockUnixMillisRead
   | ClockUnixMillisRefused { detail: String }
 
 // The OPERATION's output stays String and the TYPED read is a function over it, which is the shape every other numeric host read in this tree already has (extdeps.tools.wc, extdeps.systemd.systemd, extdeps.filesystem.linux all take a stdout String and route it through parse_int). The alternative — declaring the operation's output as EpochMs and letting the transport coerce — would put a decode inside the transport layer where it has no way to REFUSE: a stdout that is not a number would have to become some Int anyway, and the only available answers are a fabricated zero or a crash. Here an unparseable clock reading is ClockUnixMillisRefused carrying what was actually read, and a caller must answer that arm. The negative check is not redundant with parse_int: parse_int admits a leading minus, EpochMs is `Int where range(min: 0)`, and a clock that reported a pre-epoch instant is a broken clock rather than a very old one.
-// THE ONE MILLIS-TO-SECONDS CONVERSION, beside the read that produces millis. Truncation toward the
-// epoch is POSIX seconds' own rounding (date +%s truncates), and both carriers are non-negative, so
-// a reading that satisfied EpochMs yields one that satisfies EpochSecs.
-fn epoch_secs_of_millis(millis: EpochMs) -> EpochSecs {
-  millis / 1000
-}
-
 fn clock_unix_millis_read() -> ClockUnixMillisRead {
   let result = Clock.UnixMillis()
   match parse_int(s: trim(result.unix_millis)) {
@@ -112,6 +105,13 @@ fn clock_unix_millis_read() -> ClockUnixMillisRead {
       }
   }
 }
+
+// THE ONE MILLIS-TO-SECONDS CONVERSION, beside the read that produces millis. Truncation toward the
+// epoch is POSIX seconds' own rounding (date +%s truncates), and both carriers are non-negative, so
+// a reading that satisfied EpochMs yields one that satisfies EpochSecs.
+fn epoch_secs_of_millis(millis: EpochMs) -> EpochSecs {
+  millis / 1000
+}
 // SAME OUTPUT-SHAPE DISCIPLINE AS clock_unix_millis_read: the operation's
 // output stays String, and this typed wrapper parses it with proper refusal.
 // Uses EpochSecs (std.types), the same pattern clock_unix_millis_read uses
diff --git a/dag/extdeps/github/app.dag b/dag/extdeps/github/app.dag
index 25bd427a2ca..f7a1a2ae45c 100644
--- a/dag/extdeps/github/app.dag
+++ b/dag/extdeps/github/app.dag
@@ -1077,8 +1077,10 @@ service github.AppPublicRegistry {
 // THE APP-JWT CREDENTIAL IS READ AT THE TRANSPORT FROM THE ENVIRONMENT, NOT TAKEN AS AN OPERATION
 // INPUT, following the extdeps.google.sheets and github.Checks precedent and for the reason
 // list_app_installations_citation states outright: "You must use a JWT to access this endpoint." That
-// JWT is RS256-signed with the App's private key, and NOTHING IN THIS CORPUS CAN SIGN RS256 - verified,
-// not assumed. So the minting step is external and hourly (org_admin_auth: iat backdated up to 60s,
+// JWT is RS256-signed with the App's private key. The corpus CAN sign one on a host that holds the key
+// FILE -- extdeps.auth.jws over extdeps.tools.openssl, performed by gunbc.github_effect_perform -- but
+// this service's callers (the census and org instruments) run where no key file is custodied, so for
+// them the minting step is still external and hourly (org_admin_auth: iat backdated up to 60s,
 // exp at most 10 minutes), and the boundary this module holds is that no caller can interpolate a token
 // into an argument list: the transport reads GITHUB_APP_JWT or the request goes out unauthenticated and
 // upstream refuses it with a status this operation classifies.
@@ -1197,10 +1199,11 @@ fn installation_from_record(record: GitHubAppInstallationRecord) -> Installation
 // GitHubInstallationTokenRequest above carried the narrowing vocabulary and the verdict fold but had
 // no spelling of the POST body those narrowings become, so the half of the budget path that IS
 // decidable here - what we would ask for, and whether it exceeds the installation - stopped short of
-// the wire. The endpoint is named through org_admin_auth's citation-bearing builder rather than
-// respelled. There is no operation: the request needs an RS256-signed App JWT, and nothing in this
-// corpus can sign one, so declaring an operation would be a route that cannot execute (DESIGN 4b:
-// do not cite a check for a red it cannot produce).
+// the wire. installation_token_request_url names the endpoint through org_admin_auth's
+// citation-bearing builder. The OPERATION is github.AppInstallationAccessTokens below, taking the
+// App JWT as an input; its rest path template is necessarily a transport literal (the template
+// language interpolates the id into the path, it cannot call a builder), and it names the same
+// endpoint -- a divergence of spelling the transport forces, stated rather than hidden.
 fn installation_token_request_url(request: GitHubInstallationTokenRequest) -> String {
   github_app_installation_access_token_url(installation_id: request.installation_id.value)
 }
diff --git a/dag/gunbc/github_app_acquisition.dag b/dag/gunbc/github_app_acquisition.dag
index 4e7a4d84e85..950f21e896a 100644
--- a/dag/gunbc/github_app_acquisition.dag
+++ b/dag/gunbc/github_app_acquisition.dag
@@ -101,11 +101,12 @@ import extdeps.transports.rest {
 // WHY THIS IS THE AUTOMATABLE HALF AND WHERE IT STOPS. The code-for-credentials exchange
 // authenticates with the temporary code alone and needs no JWT, so it runs in-process. Everything
 // downstream of the stored private key - listing installations, minting an installation access token -
-// requires an RS256-signed App JWT, and nothing in this corpus can sign RS256. That is not a gap this
-// module papers over with a plausible-looking arm: extdeps.github.app declares github.AppInstallations
-// with auth_source EnvVar so an external step supplies the JWT at the transport, and the token request
-// is modeled to its wire with no operation, because an operation that cannot execute would be a route
-// cited for a red it cannot produce (DESIGN 4b).
+// requires an RS256-signed App JWT. The corpus signs one only on a host holding the key FILE
+// (extdeps.auth.jws over extdeps.tools.openssl, performed by gunbc.github_effect_perform), and this
+// acquisition flow runs where the stored key is not custodied as such a file, so it does not consume
+// that signer: extdeps.github.app declares github.AppInstallations with auth_source EnvVar so an
+// external step supplies the JWT at the transport. The wiring that would retire that is a key
+// custody for the census App, not a signer.
 
 // THE APP'S SHAPE, DECLARED ONCE. Each permission is here because a specific census read needs it,
 // and the set is what makes an installation worth having: an installation multiplies this fleet's
diff --git a/dag/gunbc/instruments/github_app_acquire.dag b/dag/gunbc/instruments/github_app_acquire.dag
index 0ed19f8d587..0269e5925ac 100644
--- a/dag/gunbc/instruments/github_app_acquire.dag
+++ b/dag/gunbc/instruments/github_app_acquire.dag
@@ -852,9 +852,9 @@ fn installations_read_exit(installations: List<GitHubAppInstallation>) -> Proces
 data census_app_installation_route_frontier_rows: List<FrontierRow> = [
   frontier_row_decl(
     ref: decl_ref(module_path: "gunbc.instruments.github_app_acquire", decl_name: "census_app_installations_receipt"),
-    reason: "the route exists and cannot execute green yet: the census App has not been registered, so it has no installations, and the App JWT this endpoint requires is RS256-signed with a private key this corpus cannot sign with. Measured live today it refuses twice and fabricates nothing -- the transport refuses with AuthDeclaredButUnwired when GITHUB_APP_JWT is absent, and GitHub answers 401 when it holds a value that is not a valid App JWT",
+    reason: "the route exists and cannot execute green yet: the census App has not been registered, so it has no installations, and the App JWT this endpoint requires is RS256-signed with the census App's private key, which is not custodied as a key file where this instrument runs -- the corpus signer (extdeps.auth.jws over extdeps.tools.openssl) needs exactly that file. Measured live today it refuses twice and fabricates nothing -- the transport refuses with AuthDeclaredButUnwired when GITHUB_APP_JWT is absent, and GitHub answers 401 when it holds a value that is not a valid App JWT",
     dissolution: unbound_dissolution(
-      description: "dissolves when this entry point returns ExitSuccess against a live GET /app/installations -- which needs BOTH the census App acquired through census_app_acquire_receipt AND an external step that signs an App JWT from the stored pem and exports it as GITHUB_APP_JWT. The ExitSuccess arm is REACHABLE WITHOUT EDITING THIS FUNCTION: a 200 whose records decode writes the report and returns it, so acquiring the App and exporting a valid JWT is sufficient and nothing else is required. That is stated because it was briefly false -- the successful path returned exit_failure to get its listing printed, which made this trigger dischargeable only by changing the code it describes (review 67504), and DESIGN 4b(3) rules a drop is retired by its trigger and by nothing else. A witness over supplied GitHubAppInstallationRecord values does not fire this; only a live green does"
+      description: "dissolves when this entry point returns ExitSuccess against a live GET /app/installations -- which needs BOTH the census App acquired through census_app_acquire_receipt AND a valid App JWT for it in GITHUB_APP_JWT -- signed either by an external step from the stored pem or by the corpus signer (extdeps.auth.jws over extdeps.tools.openssl) once the census App's key is custodied as a file where this instrument runs. The ExitSuccess arm is REACHABLE WITHOUT EDITING THIS FUNCTION: a 200 whose records decode writes the report and returns it, so acquiring the App and exporting a valid JWT is sufficient and nothing else is required. That is stated because it was briefly false -- the successful path returned exit_failure to get its listing printed, which made this trigger dischargeable only by changing the code it describes (review 67504), and DESIGN 4b(3) rules a drop is retired by its trigger and by nothing else. A witness over supplied GitHubAppInstallationRecord values does not fire this; only a live green does"
     )
   )
 ]

From 9580ef25026efead383405ddc7ab73b6c8f3be40 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 15:23:43 +0000
Subject: [PATCH 12/22] Model the signer over a key reference (extdeps.auth.jws
 JwsSigningKeyRef/JwsSignOutcome); openssl is one handler in
 gunbc.jws_signer_realize (CRYPTO-0/PRIMITIVE-EGRESS-0 shape condition)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/extdeps/auth/jws.dag                     | 14 +++++++++
 dag/extdeps/github/app.dag                   |  2 +-
 dag/gunbc/github_app_acquisition.dag         |  2 +-
 dag/gunbc/github_effect_perform.dag          | 28 ++++++++----------
 dag/gunbc/host/host_cli_dependency.dag       | 10 +++----
 dag/gunbc/instruments/github_app_acquire.dag |  4 +--
 dag/gunbc/jws_signer_realize.dag             | 31 ++++++++++++++++++++
 7 files changed, 66 insertions(+), 25 deletions(-)
 create mode 100644 dag/gunbc/jws_signer_realize.dag

diff --git a/dag/extdeps/auth/jws.dag b/dag/extdeps/auth/jws.dag
index a764f3a9e8b..d3d80f43335 100644
--- a/dag/extdeps/auth/jws.dag
+++ b/dag/extdeps/auth/jws.dag
@@ -54,6 +54,20 @@ fn jws_rs256_signing_input(payload_json: String) -> NonEmptyStr {
 // THE SIGNATURE IS OCTETS, NOT TEXT. A realization that hands back a printable rendering (hex,
 // standard base64) decodes it to octets first; this join then encodes exactly once. Accepting a
 // pre-encoded String here would let a standard-alphabet signature through looking valid.
+// THE SIGNER INTERFACE: sign(signing input, key reference) -> signature octets. Its SUBJECT is the
+// KEY CUSTODY BOUNDARY -- a private key that must not enter the evaluator -- which is what makes a
+// host realization honest here (PRIMITIVE-EGRESS-0 ruling, fierce-seal-607: a signer on an external
+// key is a bound host effect; "RSA realized by a CLI" would be an ambient primitive). So the key is
+// named by REFERENCE and never carried as bytes, and the outcome is octets or a located refusal.
+// Handlers bind to this shape (extdeps.tools.openssl is one); the dispatch that selects a handler is
+// realization and lives peripheral, in gunbc.jws_signer_realize, never here (DESIGN §3).
+type JwsSigningKeyRef
+  = HostKeyFile { path: NonEmptyStr }
+
+type JwsSignOutcome
+  = JwsSigned { signature: List<UInt8> }
+  | JwsSignRefused { detail: String }
+
 // THE RESULT IS extdeps.auth.jwt JwtCompactSerialization, not a bare string: the only protected
 // header this module produces is typ JWT, so every value it emits IS a JWT, and the brand keeps it
 // from being confused with an opaque bearer (an installation token is not decodable).
diff --git a/dag/extdeps/github/app.dag b/dag/extdeps/github/app.dag
index c546a86c27a..07735822f35 100644
--- a/dag/extdeps/github/app.dag
+++ b/dag/extdeps/github/app.dag
@@ -1081,7 +1081,7 @@ service github.AppPublicRegistry {
 // INPUT, following the extdeps.google.sheets and github.Checks precedent and for the reason
 // list_app_installations_citation states outright: "You must use a JWT to access this endpoint." That
 // JWT is RS256-signed with the App's private key. The corpus CAN sign one on a host that holds the key
-// FILE -- extdeps.auth.jws over extdeps.tools.openssl, performed by gunbc.github_effect_perform -- but
+// FILE -- the extdeps.auth.jws signer, realized by gunbc.jws_signer_realize, performed by gunbc.github_effect_perform -- but
 // this service's callers (the census and org instruments) run where no key file is custodied, so for
 // them the minting step is still external and hourly (org_admin_auth: iat backdated up to 60s,
 // exp at most 10 minutes), and the boundary this module holds is that no caller can interpolate a token
diff --git a/dag/gunbc/github_app_acquisition.dag b/dag/gunbc/github_app_acquisition.dag
index 950f21e896a..2d387132e92 100644
--- a/dag/gunbc/github_app_acquisition.dag
+++ b/dag/gunbc/github_app_acquisition.dag
@@ -102,7 +102,7 @@ import extdeps.transports.rest {
 // authenticates with the temporary code alone and needs no JWT, so it runs in-process. Everything
 // downstream of the stored private key - listing installations, minting an installation access token -
 // requires an RS256-signed App JWT. The corpus signs one only on a host holding the key FILE
-// (extdeps.auth.jws over extdeps.tools.openssl, performed by gunbc.github_effect_perform), and this
+// (the extdeps.auth.jws signer, realized by gunbc.jws_signer_realize, performed by gunbc.github_effect_perform), and this
 // acquisition flow runs where the stored key is not custodied as such a file, so it does not consume
 // that signer: extdeps.github.app declares github.AppInstallations with auth_source EnvVar so an
 // external step supplies the JWT at the transport. The wiring that would retire that is a key
diff --git a/dag/gunbc/github_effect_perform.dag b/dag/gunbc/github_effect_perform.dag
index 65168ed13f5..1a29303c2eb 100644
--- a/dag/gunbc/github_effect_perform.dag
+++ b/dag/gunbc/github_effect_perform.dag
@@ -6,9 +6,11 @@ import std.dissolution { DissolutionCondition, unbound_dissolution }
 import extdeps.clock {
   clock_unix_millis_read, ClockUnixMillisObserved, ClockUnixMillisRefused, epoch_secs_of_millis,
 }
-import extdeps.auth.jws { jws_rs256_signing_input, jws_compact_serialization }
+import extdeps.auth.jws {
+  jws_rs256_signing_input, jws_compact_serialization, JwsSigningKeyRef, HostKeyFile, JwsSigned, JwsSignRefused,
+}
+import gunbc.jws_signer_realize { jws_rs256_sign }
 import extdeps.auth.jwt { JwtCompactSerialization }
-import extdeps.tools.openssl { openssl_sign_sha256, OpensslSigned, OpensslSignRefused }
 import extdeps.github.org_admin_auth { github_app_jwt_claims_json }
 import extdeps.github.actions_jit_runner {
   JitConfigCreatedBody, jit_config_mint_outcome, jit_config_created_status, jit_runner_label_wire,
@@ -19,9 +21,6 @@ import extdeps.transports.rest {
 }
 import extdeps.github.app
 import extdeps.github.actions_jit_runner
-import gunbc.host_cli_dependency {
-  HostCliDependencyAbsence, first_absent_host_cli_dependency, jit_mint_host_cli_requirements,
-}
 import gunbc.runner.runner_jit_perform {
   JitMintDispatch, JitMintDispatchAuthorized, JitMintDispatchRefused,
   JitCredentialDelivery, JitCredentialNotDispatched, receive_jit_mint,
@@ -62,7 +61,9 @@ data jit_mint_lifecycle_controller_consumer_frontier: DissolutionCondition = unb
 // ownership readback are a converge entry, not this module; until that entry lands the path names a
 // file no converge has produced, and perform refuses at the signer (openssl cannot open it) rather
 // than falling back to the runner-owned key.
-data lifecycle_controller_app_key_path: NonEmptyStr = "/etc/gunbc/microvm-controller/app.pem"
+data lifecycle_controller_app_key: JwsSigningKeyRef = HostKeyFile {
+  path: "/etc/gunbc/microvm-controller/app.pem",
+}
 
 type JitMintStep
   = InstallationAccessTokenStep
@@ -74,18 +75,17 @@ type JitMintStep
 // the attempt's unit name (gunbc.runner_jit_mint jit_runner_name_for).
 type JitMintPerformance
   = JitMintReceived { delivery: JitCredentialDelivery }
-  | JitMintSignerToolAbsent { absence: HostCliDependencyAbsence }
   | JitMintClockUnread { detail: String }
   | JitMintAppJwtUnsigned { detail: String }
   | JitMintStepNotSucceeded { step: JitMintStep, performance: RestExchangePerformance }
 
-fn app_jwt_for(dispatch_app_id: Int, key_file: NonEmptyStr, now_epoch_secs: EpochSecs) -> JitMintAppJwt {
+fn app_jwt_for(dispatch_app_id: Int, key: JwsSigningKeyRef, now_epoch_secs: EpochSecs) -> JitMintAppJwt {
   let signing_input = jws_rs256_signing_input(
     payload_json: github_app_jwt_claims_json(app_id: dispatch_app_id, now_epoch_secs: now_epoch_secs),
   )
-  match openssl_sign_sha256(key_file: key_file, signing_input: signing_input) {
-    OpensslSignRefused { exit_code: _, detail: d } => AppJwtUnsigned { detail: d }
-    OpensslSigned { octets: sig } =>
+  match jws_rs256_sign(signing_input: signing_input, key: key) {
+    JwsSignRefused { detail: d } => AppJwtUnsigned { detail: d }
+    JwsSigned { signature: sig } =>
       AppJwtSigned { jwt: jws_compact_serialization(signing_input: signing_input, signature: sig) }
   }
 }
@@ -142,13 +142,10 @@ fn perform_organization_jit_mint(dispatch: JitMintDispatch) -> JitMintPerformanc
       organization: organization,
       request: request,
     } =>
-      match first_absent_host_cli_dependency(tools: jit_mint_host_cli_requirements) {
-        Present { value: absence } => JitMintSignerToolAbsent { absence: absence }
-        Absent =>
           match clock_unix_millis_read() {
             ClockUnixMillisRefused { detail: d } => JitMintClockUnread { detail: d }
             ClockUnixMillisObserved { millis: ms } =>
-              match app_jwt_for(dispatch_app_id: app.app_id.value, key_file: lifecycle_controller_app_key_path, now_epoch_secs: epoch_secs_of_millis(millis: ms)) {
+              match app_jwt_for(dispatch_app_id: app.app_id.value, key: lifecycle_controller_app_key, now_epoch_secs: epoch_secs_of_millis(millis: ms)) {
                 AppJwtUnsigned { detail: d } => JitMintAppJwtUnsigned { detail: d }
                 AppJwtSigned { jwt: jwt } => {
                   let token = github.AppInstallationAccessTokens.Create(
@@ -176,6 +173,5 @@ fn perform_organization_jit_mint(dispatch: JitMintDispatch) -> JitMintPerformanc
                 }
               }
           }
-      }
   }
 }
diff --git a/dag/gunbc/host/host_cli_dependency.dag b/dag/gunbc/host/host_cli_dependency.dag
index 3cb49ef807d..b1f5872a745 100644
--- a/dag/gunbc/host/host_cli_dependency.dag
+++ b/dag/gunbc/host/host_cli_dependency.dag
@@ -81,11 +81,11 @@ data codex_wet_materialization_host_cli_requirements: List<CliTool> = [npm_cli_t
 // side belongs to.
 data password_session_host_cli_requirements: List<CliTool> = [sshpass_cli_tool]
 
-// THIRD ENROLLMENT ANSWER: the host that MINTS a JIT runner credential. gunbc.github_effect_perform
-// signs the App JWT with openssl (extdeps.tools.openssl), and refuses from this roster before the
-// key is touched when the binary is absent. A separate roster for the same reason the two above are
-// separate: the population is "hosts whose lifecycle controller mints", not every runner.
-data jit_mint_host_cli_requirements: List<CliTool> = [openssl_cli_tool]
+// THIRD ENROLLMENT ANSWER: a host that SIGNS a JWS with a key it holds as a file.
+// gunbc.jws_signer_realize binds openssl (extdeps.tools.openssl) as that signer's handler and
+// refuses from this roster before the key is touched. It is a separate roster for the same reason
+// the two above are separate: the population is "hosts that sign", not every runner.
+data jws_signer_host_cli_requirements: List<CliTool> = [openssl_cli_tool]
 
 // The absence is its own type, not a variant used in type position. Before this split,
 // first_absent_codex_wet_materialization_host_cli_dependency named HostCliDependencyAbsent as its
diff --git a/dag/gunbc/instruments/github_app_acquire.dag b/dag/gunbc/instruments/github_app_acquire.dag
index 8d4546d24f9..e20653e9d47 100644
--- a/dag/gunbc/instruments/github_app_acquire.dag
+++ b/dag/gunbc/instruments/github_app_acquire.dag
@@ -852,9 +852,9 @@ fn installations_read_exit(installations: List<GitHubAppInstallation>) -> Proces
 data census_app_installation_route_frontier_rows: List<FrontierRow> = [
   frontier_row_decl(
     ref: decl_ref(module_path: "gunbc.instruments.github_app_acquire", decl_name: "census_app_installations_receipt"),
-    reason: "the route exists and cannot execute green yet: the census App has not been registered, so it has no installations, and the App JWT this endpoint requires is RS256-signed with the census App's private key, which is not custodied as a key file where this instrument runs -- the corpus signer (extdeps.auth.jws over extdeps.tools.openssl) needs exactly that file. Measured live today it refuses twice and fabricates nothing -- the transport refuses with AuthDeclaredButUnwired when GITHUB_APP_JWT is absent, and GitHub answers 401 when it holds a value that is not a valid App JWT",
+    reason: "the route exists and cannot execute green yet: the census App has not been registered, so it has no installations, and the App JWT this endpoint requires is RS256-signed with the census App's private key, which is not custodied as a key file where this instrument runs -- the corpus signer (the extdeps.auth.jws signer, realized by gunbc.jws_signer_realize) needs exactly that file. Measured live today it refuses twice and fabricates nothing -- the transport refuses with AuthDeclaredButUnwired when GITHUB_APP_JWT is absent, and GitHub answers 401 when it holds a value that is not a valid App JWT",
     dissolution: unbound_dissolution(
-      description: "dissolves when this entry point returns ExitSuccess against a live GET /app/installations -- which needs BOTH the census App acquired through census_app_acquire_receipt AND a valid App JWT for it in GITHUB_APP_JWT -- signed either by an external step from the stored pem or by the corpus signer (extdeps.auth.jws over extdeps.tools.openssl) once the census App's key is custodied as a file where this instrument runs. The ExitSuccess arm is REACHABLE WITHOUT EDITING THIS FUNCTION: a 200 whose records decode writes the report and returns it, so acquiring the App and exporting a valid JWT is sufficient and nothing else is required. That is stated because it was briefly false -- the successful path returned exit_failure to get its listing printed, which made this trigger dischargeable only by changing the code it describes (review 67504), and DESIGN 4b(3) rules a drop is retired by its trigger and by nothing else. A witness over supplied GitHubAppInstallationRecord values does not fire this; only a live green does"
+      description: "dissolves when this entry point returns ExitSuccess against a live GET /app/installations -- which needs BOTH the census App acquired through census_app_acquire_receipt AND a valid App JWT for it in GITHUB_APP_JWT -- signed either by an external step from the stored pem or by the corpus signer (the extdeps.auth.jws signer, realized by gunbc.jws_signer_realize) once the census App's key is custodied as a file where this instrument runs. The ExitSuccess arm is REACHABLE WITHOUT EDITING THIS FUNCTION: a 200 whose records decode writes the report and returns it, so acquiring the App and exporting a valid JWT is sufficient and nothing else is required. That is stated because it was briefly false -- the successful path returned exit_failure to get its listing printed, which made this trigger dischargeable only by changing the code it describes (review 67504), and DESIGN 4b(3) rules a drop is retired by its trigger and by nothing else. A witness over supplied GitHubAppInstallationRecord values does not fire this; only a live green does"
     )
   )
 ]
diff --git a/dag/gunbc/jws_signer_realize.dag b/dag/gunbc/jws_signer_realize.dag
new file mode 100644
index 00000000000..e39dc3f577e
--- /dev/null
+++ b/dag/gunbc/jws_signer_realize.dag
@@ -0,0 +1,31 @@
+module gunbc.jws_signer_realize
+
+import std.types { String, NonEmptyStr }
+import extdeps.auth.jws { JwsSigningKeyRef, HostKeyFile, JwsSignOutcome, JwsSigned, JwsSignRefused }
+import extdeps.tools.openssl { openssl_sign_sha256, OpensslSigned, OpensslSignRefused }
+import gunbc.host_cli_dependency { first_absent_host_cli_dependency, jws_signer_host_cli_requirements }
+import v2.std.optional { Absent, Present }
+
+// THE HANDLER DISPATCH FOR extdeps.auth.jws's signer interface, kept peripheral because selecting a
+// realization is itself realization (DESIGN §3). A key held as a HOST FILE is signed by openssl,
+// which reads the file itself: the key never enters the evaluator, the signing input goes on stdin
+// and the signature comes back on stdout. openssl is ONE handler: a key held elsewhere (an HSM, a
+// cloud KMS) is a new JwsSigningKeyRef arm with its own handler here, and the interface stays as it is. A
+// modeled RSA inside the evaluator would be a different subject (the key inside) and would not
+// replace this. The handler's enrolled CLI dependency is checked before the key is touched, so a
+// missing binary is refused with its install hint and does not surface as an exec error.
+fn jws_rs256_sign(signing_input: NonEmptyStr, key: JwsSigningKeyRef) -> JwsSignOutcome {
+  match key {
+    HostKeyFile { path: path } =>
+      match first_absent_host_cli_dependency(tools: jws_signer_host_cli_requirements) {
+        Present { value: absence } =>
+          JwsSignRefused { detail: join(["signer tool ", absence.tool as String, " is absent: ", absence.hint], "") }
+        Absent =>
+          match openssl_sign_sha256(key_file: path, signing_input: signing_input) {
+            OpensslSigned { octets: sig } => JwsSigned { signature: sig }
+            OpensslSignRefused { exit_code: code, detail: d } =>
+              JwsSignRefused { detail: join(["openssl dgst exit ", to_string(code), ": ", d], "") }
+          }
+      }
+  }
+}

From 7ec15a3ab087a41e6d1d8b7783c508e36dc763de Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 21:36:39 +0000
Subject: [PATCH 13/22] Read the controller key path through
 lifecycle_controller_app_key's signing-key ref

#11677 wrapped the path in JwsSigningKeyRef HostKeyFile, deleting the bare
lifecycle_controller_app_key_path this module imported, so both the entry and its
witness failed to resolve. signing_key_file_path matches the one arm that names a
file on this host.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../microvm_controller_app_key_converge.dag    | 18 +++++++++++++++---
 ...ontroller_app_key_converge_witness_test.dag |  7 ++++---
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/dag/gunbc/runner/microvm_controller_app_key_converge.dag b/dag/gunbc/runner/microvm_controller_app_key_converge.dag
index e62cc1f648e..08877019c33 100644
--- a/dag/gunbc/runner/microvm_controller_app_key_converge.dag
+++ b/dag/gunbc/runner/microvm_controller_app_key_converge.dag
@@ -24,7 +24,8 @@ import gunbc.auth.secret_ref_credential {
   SecretCredentialFetchRefused,
   SecretCredentialResolvedVersionMismatch,
 }
-import gunbc.github_effect_perform { lifecycle_controller_app_key_path }
+import gunbc.github_effect_perform { lifecycle_controller_app_key }
+import extdeps.auth.jws { JwsSigningKeyRef, HostKeyFile }
 import gunbc.fabric_cell_converge { fabric_cell_base_dir }
 import gunbc.typed_remote_file_write {
   RemoteFileModeOwnerRead,
@@ -72,7 +73,7 @@ import gunbc.runner_host_file_converge {
 // THE MICROVM LIFECYCLE CONTROLLER'S COPY OF THE gunbai-ci APP KEY, DELIVERED AND READ BACK.
 //
 // gunbc.github_effect_perform perform_organization_jit_mint signs its App JWT with the file at
-// lifecycle_controller_app_key_path and refuses at the signer when that file is absent; this module
+// lifecycle_controller_app_key and refuses at the signer when that file is absent; this module
 // is the converge entry that note names. It moves the key from Secret Manager (gunbc.auth.github_apps
 // gunbai_ci_app_pem_secret) to that path on ONE runner host per dispatch, as root:root 0400 in a
 // root:root directory with no group or other bits at all, and it answers with a readback receipt that
@@ -121,6 +122,17 @@ import gunbc.runner_host_file_converge {
 
 // ── Placement (pure) ─────────────────────────────────────────────────────────────────────────────
 
+// THE SUBJECT IS THE SIGNER'S OWN KEY REFERENCE, read through gunbc.github_effect_perform
+// lifecycle_controller_app_key rather than re-spelling its path: the file this delivers is exactly
+// the file perform_organization_jit_mint signs with, and HostKeyFile is the only arm that names one
+// on this host -- a later arm (an agent, a KMS handle) would have no path for a converge to write,
+// so it must refuse here rather than be given a fabricated one.
+fn signing_key_file_path(key: JwsSigningKeyRef) -> NonEmptyStr {
+  match key {
+    HostKeyFile { path: p } => p
+  }
+}
+
 data controller_app_key_forbidden_tree: FileTreeScope = FileTreeScope { root_path: fabric_cell_base_dir as NonEmptyStr }
 
 type ControllerAppKeyPlacement
@@ -697,7 +709,7 @@ fn microvm_controller_app_key_converge_ci_wet() -> ProcessExit
       match runner_host_file_subject(host: raw_host as HostIdentity) {
         RunnerHostFileSubjectRefused { cause: c } => write_receipt_then_exit(body: concat(c, "\n"), ok: false)
         RunnerHostFileSubjectAdmitted { subject: subject } =>
-          match controller_app_key_placement(key_path: lifecycle_controller_app_key_path) {
+          match controller_app_key_placement(key_path: signing_key_file_path(key: lifecycle_controller_app_key)) {
             ControllerAppKeyPlacementRefused { cause: c } => write_receipt_then_exit(body: concat(c as String, "\n"), ok: false)
             ControllerAppKeyPlaced { key_path: kp, key_dir: kd, upper_ancestors: ua } =>
               match fetch_secret_ref_credential(secret_ref: gunbai_ci_app_pem_secret, token_source: WorkloadIdentityToken) {
diff --git a/dag/test/claim/runner/microvm_controller_app_key_converge_witness_test.dag b/dag/test/claim/runner/microvm_controller_app_key_converge_witness_test.dag
index cf8a3447670..de01bc4e46b 100644
--- a/dag/test/claim/runner/microvm_controller_app_key_converge_witness_test.dag
+++ b/dag/test/claim/runner/microvm_controller_app_key_converge_witness_test.dag
@@ -3,7 +3,7 @@ module test.claim.microvm_controller_app_key_converge_witness
 import std.logic { Bool }
 import std.types { String, NonEmptyStr, List, Int }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import gunbc.github_effect_perform { lifecycle_controller_app_key_path }
+import gunbc.github_effect_perform { lifecycle_controller_app_key }
 import gunbc.runner_host_file_converge {
   HostFileIdentical,
   HostFileDiffers,
@@ -14,6 +14,7 @@ import gunbc.microvm_controller_app_key_converge {
   ControllerAppKeyPlaced,
   ControllerAppKeyPlacementRefused,
   controller_app_key_placement,
+  signing_key_file_path,
   KeyPathFindReading,
   KeyFileRootOwnerRead,
   KeyFileWrongOwner,
@@ -167,10 +168,10 @@ test fn a_writable_ancestor_refuses_before_any_write() -> Bool {
 
 // ── placement ───────────────────────────────────────────────────────────────────────────────────
 
-// THE REAL PATH, not a fixture: this reddens if lifecycle_controller_app_key_path moves somewhere
+// THE REAL PATH, not a fixture: this reddens if lifecycle_controller_app_key moves somewhere
 // with no dedicated root-only directory or into the fabric-cell tree.
 test fn the_modeled_key_path_places_in_its_own_directory_under_etc() -> Bool {
-  match controller_app_key_placement(key_path: lifecycle_controller_app_key_path) {
+  match controller_app_key_placement(key_path: signing_key_file_path(key: lifecycle_controller_app_key)) {
     ControllerAppKeyPlaced { key_path: _, key_dir: d, upper_ancestors: ua } =>
       (d as String) == "/etc/gunbc/microvm-controller" && ua == ["/etc", "/etc/gunbc"]
     ControllerAppKeyPlacementRefused { cause: _ } => false

From 8185db2af3c2729101dee84593bd7f9ece3ddf51 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 21:39:30 +0000
Subject: [PATCH 14/22] Refuse a mint whose App is not the one the controller
 key belongs to (review 68653 note)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/gunbc/github_effect_perform.dag | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/dag/gunbc/github_effect_perform.dag b/dag/gunbc/github_effect_perform.dag
index 1a29303c2eb..9836c0a70f6 100644
--- a/dag/gunbc/github_effect_perform.dag
+++ b/dag/gunbc/github_effect_perform.dag
@@ -21,6 +21,7 @@ import extdeps.transports.rest {
 }
 import extdeps.github.app
 import extdeps.github.actions_jit_runner
+import gunbc.auth.github_apps { DeclaredGitHubApp, gunbai_ci_declared }
 import gunbc.runner.runner_jit_perform {
   JitMintDispatch, JitMintDispatchAuthorized, JitMintDispatchRefused,
   JitCredentialDelivery, JitCredentialNotDispatched, receive_jit_mint,
@@ -65,6 +66,11 @@ data lifecycle_controller_app_key: JwsSigningKeyRef = HostKeyFile {
   path: "/etc/gunbc/microvm-controller/app.pem",
 }
 
+// THE KEY IS ONE APP'S. The JWT's iss comes from the dispatch's App and the signature from this key,
+// so they must name the same App; a dispatch for any other App is refused BEFORE signing, as its own
+// arm, rather than reaching GitHub as a JWT signed by the wrong key and coming back a 401.
+data lifecycle_controller_app: DeclaredGitHubApp = gunbai_ci_declared
+
 type JitMintStep
   = InstallationAccessTokenStep
   | GenerateJitConfigStep
@@ -75,6 +81,7 @@ type JitMintStep
 // the attempt's unit name (gunbc.runner_jit_mint jit_runner_name_for).
 type JitMintPerformance
   = JitMintReceived { delivery: JitCredentialDelivery }
+  | JitMintAppKeyNotCustodied { app: DeclaredGitHubApp }
   | JitMintClockUnread { detail: String }
   | JitMintAppJwtUnsigned { detail: String }
   | JitMintStepNotSucceeded { step: JitMintStep, performance: RestExchangePerformance }
@@ -142,6 +149,9 @@ fn perform_organization_jit_mint(dispatch: JitMintDispatch) -> JitMintPerformanc
       organization: organization,
       request: request,
     } =>
+      if app != lifecycle_controller_app {
+        JitMintAppKeyNotCustodied { app: app }
+      } else {
           match clock_unix_millis_read() {
             ClockUnixMillisRefused { detail: d } => JitMintClockUnread { detail: d }
             ClockUnixMillisObserved { millis: ms } =>
@@ -173,5 +183,6 @@ fn perform_organization_jit_mint(dispatch: JitMintDispatch) -> JitMintPerformanc
                 }
               }
           }
+      }
   }
 }

From f875cd1eaaaa2f5e7ab51913a7804dc98c3d83ee Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sat, 19 Sep 2026 22:36:52 +0000
Subject: [PATCH 15/22] Measure the credential in bytes, and delete the
 dangling endpoint_path fork (reviews 68668, 68670)

- jit_credential_bytes uses runner_microvm jit_drive_utf8_size, the same measure
  the readback uses; string_length counted code points and labelled them bytes.
  New claim: 65536 two-byte code points are at the ceiling in characters and over
  it in bytes, and are refused.
- JitMintPlan.endpoint_path was produced and discarded (the POST path is the
  operation's own template), so the field and org_generate_jitconfig_path go; the
  org stays an operation input, which is what keeps a caller off another org.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/extdeps/github/actions_jit_runner.dag     | 10 +++----
 dag/gunbc/runner/runner_attempt_launch.dag    |  7 ++++-
 dag/gunbc/runner/runner_jit_admission.dag     |  2 +-
 dag/gunbc/runner/runner_jit_mint.dag          |  3 ---
 dag/gunbc/runner/runner_jit_perform.dag       |  1 -
 .../claim/actions_jit_runner_witness_test.dag | 11 +-------
 .../github_app_registry_witness_test.dag      |  4 +--
 .../runner_attempt_launch_witness_test.dag    | 26 +++++++++++++++++++
 .../runner_jit_admission_witness_test.dag     |  8 ------
 9 files changed, 40 insertions(+), 32 deletions(-)

diff --git a/dag/extdeps/github/actions_jit_runner.dag b/dag/extdeps/github/actions_jit_runner.dag
index 089247f4154..99caa46e38f 100644
--- a/dag/extdeps/github/actions_jit_runner.dag
+++ b/dag/extdeps/github/actions_jit_runner.dag
@@ -73,11 +73,6 @@ type JitConfigMintOutcome
   | JitConfigMintConflict { reason: String }
   | JitConfigMintValidationFailed { reason: String }
 
-// THE ENDPOINT PATH IS DERIVED FROM THE ORG, never concatenated at a call site, so a caller cannot
-// address a different organization's runners by assembling the path itself.
-fn org_generate_jitconfig_path(org_login: NonEmptyStr) -> String {
-  join(["/orgs/", org_login as String, "/actions/runners/generate-jitconfig"], "")
-}
 
 fn jit_runner_label_wire(l: JitRunnerLabel) -> String {
   l.value as String
@@ -141,6 +136,11 @@ type JitConfigCreatedBody {
   encoded_jit_config: String
 }
 
+// THE ORGANIZATION IS AN OPERATION INPUT AND THE PATH INTERPOLATES IT, so a caller cannot address
+// another organization's runners by assembling a path: there is no path to assemble. A builder
+// function beside this template would be a second spelling of one endpoint that the transport can
+// never call -- the template language interpolates, it does not invoke -- so the citation for this
+// path is extdeps_external_authority_anchor above and this operation is its only consumer.
 service github.ActionsJitRunners {
   config {
     endpoint: default_api_base
diff --git a/dag/gunbc/runner/runner_attempt_launch.dag b/dag/gunbc/runner/runner_attempt_launch.dag
index 9fea6c1b1d4..9ac5d9f3b8a 100644
--- a/dag/gunbc/runner/runner_attempt_launch.dag
+++ b/dag/gunbc/runner/runner_attempt_launch.dag
@@ -175,8 +175,13 @@ type JitCredentialAdmission
   = JitCredentialAdmitted { admitted: AdmittedJitCredential }
   | JitCredentialRefused { refusal: JitDeviceRefusal }
 
+// BYTES, MEASURED AS BYTES. string_length counts CODE POINTS, so building a ByteSize from it labels
+// one quantity as another -- they coincide for the base64 GitHub returns and diverge for anything
+// else, which is exactly the silent wrong answer a floor and ceiling must not admit (review 68668).
+// gunbc.runner_microvm jit_drive_utf8_size is the corpus authority for the UTF-8 size of text, and
+// it is the same measure the staged device is read back against.
 fn jit_credential_bytes(credential: EncodedJitConfig) -> ByteSize {
-  byte_size(count: string_length(credential.encoded as String))
+  jit_drive_utf8_size(text: credential.encoded as String)
 }
 
 // THE ROSTER IS CONSUMED, NOT RESTATED. gunbc.runner.runner_jit_admission declares signature and
diff --git a/dag/gunbc/runner/runner_jit_admission.dag b/dag/gunbc/runner/runner_jit_admission.dag
index c4724dbd2b8..de5ae69f2f6 100644
--- a/dag/gunbc/runner/runner_jit_admission.dag
+++ b/dag/gunbc/runner/runner_jit_admission.dag
@@ -17,7 +17,7 @@ data runner_jit_admission_disposition: Disposition = SingleAuthority
 //      extdeps.github.org_admin_auth.github_app_installation_access_token_url, minted from the
 //      gunbai-ci App key (gunbc.auth.github_apps.gunbai_ci_declared).
 //   2. POST /orgs/{org}/actions/runners/generate-jitconfig with that installation token, path from
-//      extdeps.github.actions_jit_runner.org_generate_jitconfig_path.
+//      the org-interpolated path template of extdeps.github.actions_jit_runner github.ActionsJitRunners.GenerateOrganizationJitConfig.
 // What step 2 accepts as a body is JitRunnerConfigRequest and nothing else.
 // encoded_jit_config is opaque; a host cannot check binding axes by decoding it.
 
diff --git a/dag/gunbc/runner/runner_jit_mint.dag b/dag/gunbc/runner/runner_jit_mint.dag
index 1ec597eeed6..a3f8fcbe840 100644
--- a/dag/gunbc/runner/runner_jit_mint.dag
+++ b/dag/gunbc/runner/runner_jit_mint.dag
@@ -5,7 +5,6 @@ import std.disposition { Disposition, SingleAuthority }
 import extdeps.github.effect { GitHubEffect, GenerateOrganizationJitConfig, GitHubOrganizationRef }
 import extdeps.github.actions_jit_runner {
   JitRunnerConfigRequest, JitRunnerName, JitRunnerGroupId, JitRunnerLabel, JitWorkFolder,
-  org_generate_jitconfig_path,
 }
 import gunbc.runner.runner_jit_admission {
   attempt_binding_admits_mint_name, JitAdmissionAxisStanding,
@@ -39,7 +38,6 @@ data runner_jit_mint_disposition: Disposition = SingleAuthority
 type JitMintPlan
   = JitMintAuthorized {
       attempt: MicroVmAttempt
-      endpoint_path: String
       request: JitRunnerConfigRequest
     }
   | JitMintRefusedCellNotOwned { cause: String }
@@ -109,7 +107,6 @@ fn plan_jit_mint(
             RegistrationLabelsResolved { labels: labels } =>
               JitMintAuthorized {
                 attempt: attempt,
-                endpoint_path: org_generate_jitconfig_path(org_login: organization.login),
                 request: jit_config_request_for(
                   attempt: attempt,
                   runner_group_id: runner_group_id,
diff --git a/dag/gunbc/runner/runner_jit_perform.dag b/dag/gunbc/runner/runner_jit_perform.dag
index 59aee3180d5..4895d9fe91f 100644
--- a/dag/gunbc/runner/runner_jit_perform.dag
+++ b/dag/gunbc/runner/runner_jit_perform.dag
@@ -142,7 +142,6 @@ fn dispatch_jit_mint(
       }
     JitMintAuthorized {
       attempt: attempt,
-      endpoint_path: _,
       request: request,
     } =>
       match authority_installation(authority: authority) {
diff --git a/dag/test/claim/actions_jit_runner_witness_test.dag b/dag/test/claim/actions_jit_runner_witness_test.dag
index dddc87f90f0..500bb1539e9 100644
--- a/dag/test/claim/actions_jit_runner_witness_test.dag
+++ b/dag/test/claim/actions_jit_runner_witness_test.dag
@@ -5,7 +5,7 @@ import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
 import extdeps.github.actions_jit_runner {
   JitConfigMintOutcome, JitConfigMinted, JitConfigMintRefused,
   JitConfigMintNotFound, JitConfigMintConflict, JitConfigMintValidationFailed,
-  jit_config_mint_outcome, org_generate_jitconfig_path,
+  jit_config_mint_outcome,
   jit_config_not_found_status, jit_config_conflict_status, jit_config_validation_failed_status,
 }
 
@@ -82,12 +82,3 @@ test fn a_created_status_with_a_body_mints() -> Bool {
   }
 }
 
-// THE PATH IS DERIVED FROM THE ORG rather than assembled per call site, so a caller cannot address
-// another organization's runners. Two distinct orgs must yield two distinct paths -- a constant
-// would pass a single-org assertion.
-test fn the_jitconfig_path_is_derived_per_organization() -> Bool {
-  org_generate_jitconfig_path(org_login: "gunb-ai" as NonEmptyStr)
-    == "/orgs/gunb-ai/actions/runners/generate-jitconfig"
-    && org_generate_jitconfig_path(org_login: "other-org" as NonEmptyStr)
-       == "/orgs/other-org/actions/runners/generate-jitconfig"
-}
diff --git a/dag/test/claim/github_app_registry_witness_test.dag b/dag/test/claim/github_app_registry_witness_test.dag
index f039d2bb995..8c35dc7691c 100644
--- a/dag/test/claim/github_app_registry_witness_test.dag
+++ b/dag/test/claim/github_app_registry_witness_test.dag
@@ -1068,11 +1068,9 @@ test fn witness_jit_mint_authorizes_an_owned_cell_with_the_runner_permission() -
   match planned(owned: true, perms: runner_grant) {
     JitMintAuthorized {
       attempt: a,
-      endpoint_path: path,
       request: req,
     } =>
-      path == "/orgs/gunb-ai/actions/runners/generate-jitconfig"
-        && (req.name.value as String) == (runner_microvm_attempt_unit_name(attempt: a) as String)
+      (req.name.value as String) == (runner_microvm_attempt_unit_name(attempt: a) as String)
         && runner_label_sets_equal(
              a: map(req.labels, l => l.value as String),
              b: ["self-hosted", "linux", "arm64", "gunbc-heavy", "srv2"],
diff --git a/dag/test/claim/runner/runner_attempt_launch_witness_test.dag b/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
index 317cfa860db..85d07b28036 100644
--- a/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
+++ b/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
@@ -192,6 +192,32 @@ test fn a_below_floor_credential_stages_no_device_and_starts_no_vmm() -> Bool {
   }
 }
 
+// THE WALL MEASURES BYTES, NOT CODE POINTS, AND THIS IS THE CASE WHERE THEY DIVERGE. Sixty-five
+// thousand five hundred thirty-six two-byte code points are 65,536 characters -- exactly the
+// ceiling when counted as characters, and 131,072 bytes, twice it. A wall built on string_length
+// admits this; the byte wall refuses it. GitHub returns base64, where the two coincide, so only a
+// multi-byte case can hold the measure honest.
+test fn a_credential_at_the_ceiling_in_code_points_but_over_it_in_bytes_is_refused() -> Bool {
+  match issued_pairs() {
+    Cons { head: pair, tail: _ } =>
+      match accepted_attempt(i: 7, id: "multibyte") {
+        Cons { head: a, tail: _ } => {
+          let wide = doubled(s: "\u{00e9}", k: 16)
+          let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: received_for(attempt: a, encoded: wide), ground: GroundClear)
+          string_length(wide) == 65536
+            && byte_size_count(b: jit_drive_utf8_size(text: wide)) == 131072
+            && no_device_no_vmm(plan: plan)
+            && match refusal_of(plan: plan) {
+              Cons { head: JitCredentialAboveCeiling { bytes: n }, tail: _ } => byte_size_count(b: n) == 131072
+              _ => false
+            }
+        }
+        Empty {} => false
+      }
+    Empty {} => false
+  }
+}
+
 test fn an_above_ceiling_credential_stages_no_device_and_starts_no_vmm() -> Bool {
   match issued_pairs() {
     Cons { head: pair, tail: _ } =>
diff --git a/dag/test/claim/runner_jit_admission_witness_test.dag b/dag/test/claim/runner_jit_admission_witness_test.dag
index b8da10b3027..2fabc2b0c72 100644
--- a/dag/test/claim/runner_jit_admission_witness_test.dag
+++ b/dag/test/claim/runner_jit_admission_witness_test.dag
@@ -2,7 +2,6 @@ module gunbc.test.claim.runner_jit_admission_witness_test
 
 import std.types { String, Bool, NonEmptyStr }
 import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly }
-import extdeps.github.actions_jit_runner { org_generate_jitconfig_path }
 import gunbc.auth.github_apps { gunbai_ci_declared }
 import gunbc.runner.runner_jit_admission {
   SignatureAxis, ExpiryAxis, ReplayAxis, UnitBindingAxis, BootBindingAxis, AttemptBindingAxis,
@@ -58,10 +57,3 @@ test fn attempt_binding_admits_only_required_mint_name_standing() -> Bool {
   }
 }
 
-test fn the_generate_jitconfig_path_is_derived_from_the_declared_app_owner() -> Bool {
-  org_generate_jitconfig_path(org_login: gunbai_ci_declared.owner_login)
-    == "/orgs/gunb-ai/actions/runners/generate-jitconfig"
-    && org_generate_jitconfig_path(org_login: "other-org" as NonEmptyStr)
-       != org_generate_jitconfig_path(org_login: gunbai_ci_declared.owner_login)
-    && (gunbai_ci_declared.slug as String) == "gunbai-ci"
-}

From e6cef61a9c44096f4a9644414efe95def83dc5f5 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sun, 20 Sep 2026 04:01:00 +0000
Subject: [PATCH 16/22] Staging admits the jailer only from BOTH stagings,
 through a sealed receipt

The workspace gate (#11675) and the jit device (this PR) landed on opposite
sides of a merge, and the join took only the workspace observation: a mint
accepted, LaunchAuthorized built, the credential device failed to stage or never
staged, workspace ready -> jailer admitted. That is the guest-with-no-credential
burn this planner exists to prevent (sunny-ant-606 hold).

- attempt_staging_verdict(plan, jit, workspace) replaces staging_verdict. It
  admits only when the device staged AT THE PATH THIS PLAN NAMES and the
  workspace is ready; StagingRefusedJitDevice, StagingRefusedForeignJitDevice,
  StagingRefusedWorkspace and StagingNotAuthorized are distinct.
- The jailer is reachable only inside AttemptStagingReceipt, a sole_constructor
  the gate alone produces, so 'staging passed' cannot be minted beside it.
- Controls: ready workspace + failed device refuses; ready workspace + a sibling
  attempt's staged path refuses; the admitted receipt names this attempt's paths.
- review 68748: the App-custody guard gets its red -- the shared dispatch fixture
  is another App, so an authorized dispatch for it refuses before any I/O.
- jws.dag: keep the signature-octets note attached to jws_compact_serialization.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/extdeps/auth/jws.dag                      |  7 +-
 dag/gunbc/runner/runner_attempt_launch.dag    | 85 ++++++++++++++----
 .../github_effect_perform_witness_test.dag    | 14 +++
 .../runner_attempt_launch_witness_test.dag    | 90 +++++++++++++++++--
 4 files changed, 167 insertions(+), 29 deletions(-)

diff --git a/dag/extdeps/auth/jws.dag b/dag/extdeps/auth/jws.dag
index d3d80f43335..10a22d3a447 100644
--- a/dag/extdeps/auth/jws.dag
+++ b/dag/extdeps/auth/jws.dag
@@ -51,9 +51,6 @@ fn jws_rs256_signing_input(payload_json: String) -> NonEmptyStr {
   ], "") as NonEmptyStr
 }
 
-// THE SIGNATURE IS OCTETS, NOT TEXT. A realization that hands back a printable rendering (hex,
-// standard base64) decodes it to octets first; this join then encodes exactly once. Accepting a
-// pre-encoded String here would let a standard-alphabet signature through looking valid.
 // THE SIGNER INTERFACE: sign(signing input, key reference) -> signature octets. Its SUBJECT is the
 // KEY CUSTODY BOUNDARY -- a private key that must not enter the evaluator -- which is what makes a
 // host realization honest here (PRIMITIVE-EGRESS-0 ruling, fierce-seal-607: a signer on an external
@@ -68,6 +65,10 @@ type JwsSignOutcome
   = JwsSigned { signature: List<UInt8> }
   | JwsSignRefused { detail: String }
 
+// THE SIGNATURE IS OCTETS, NOT TEXT. A realization that hands back a printable rendering (hex,
+// standard base64) decodes it to octets first; this join then encodes exactly once. Accepting a
+// pre-encoded String here would let a standard-alphabet signature through looking valid.
+//
 // THE RESULT IS extdeps.auth.jwt JwtCompactSerialization, not a bare string: the only protected
 // header this module produces is typ JWT, so every value it emits IS a JWT, and the brand keeps it
 // from being confused with an opaque bearer (an installation token is not decodable).
diff --git a/dag/gunbc/runner/runner_attempt_launch.dag b/dag/gunbc/runner/runner_attempt_launch.dag
index 8f515c7eb49..045d189e8fc 100644
--- a/dag/gunbc/runner/runner_attempt_launch.dag
+++ b/dag/gunbc/runner/runner_attempt_launch.dag
@@ -678,20 +678,53 @@ fn workspace_standing(obs: WorkspaceStagingObservation, planned_path: String) ->
   }
 }
 
+// THE RECEIPT IS SEALED, so the admitted arm cannot be assembled beside the gate. sole_constructor
+// makes attempt_staging_verdict the ONLY producer of an AttemptStagingReceipt, and the jailer
+// command is reachable only inside one -- so a caller cannot mint "staging passed" while holding a
+// failed device, and cannot lift the jailer out of a refusal. The receipt names WHICH device and
+// WHICH workspace were read back, so the capability it releases is bound to the attempt whose
+// premises were established rather than to staging in general.
+//
+// A PROSE OBLIGATION BESIDE A JAILER-ADMITTING VALUE IS NOT A WALL (sunny-ant-606 ruling): the
+// frontier row can say the controller must reach the jailer through this fold, and a controller
+// following it exactly would still have launched on workspace readiness alone while the credential
+// device had failed. The premises are made inseparable here instead.
+type AttemptStagingReceipt sole_constructor {
+  jailer: ArgvCommand
+  jit_device_path: String
+  workspace_path: String
+}
+
 type AttemptStagingVerdict
-  = StagingAdmitsJailer { jailer: ArgvCommand }
+  = StagingAdmitsJailer { receipt: AttemptStagingReceipt }
+  | StagingRefusedJitDevice { outcome: JitDeviceStagingOutcome }
+  | StagingRefusedForeignJitDevice { staged_path: String, planned_path: String }
   | StagingRefusedWorkspace { standing: WorkspaceStanding }
   | StagingNotAuthorized
 
-// THE ONLY ROUTE TO THE JAILER COMMAND AFTER STAGING. A refused plan has no jailer to admit, and a
-// workspace that is anything but WorkspaceReady refuses -- there is no arm that launches anyway.
-fn staging_verdict(plan: AttemptLaunchPlan, obs: WorkspaceStagingObservation) -> AttemptStagingVerdict {
+// THE ONLY ROUTE TO THE JAILER COMMAND AFTER STAGING, AND IT CONSUMES BOTH STAGINGS. A refused plan
+// has no jailer to admit; a workspace that is anything but WorkspaceReady refuses; and the JIT
+// device must have been STAGED FOR THIS ATTEMPT -- the staged path is compared against the path this
+// plan's own jit_device names, so a sibling attempt's device (or a stale one left at another path)
+// refuses rather than being launched over.
+//
+// TAKING ONLY THE WORKSPACE OBSERVATION WAS A FAIL-OPEN, AND IT WAS CREATED BY A MERGE rather than
+// authored: the workspace gate landed on one side and the JIT device on the other, and the join
+// admitted a ready workspace while the credential device had failed to stage or had never been
+// staged at all. A guest reaching the listener with no credential burns its whole deadline looking
+// healthy, which is the class this planner exists to close, so the gate takes both outcomes and
+// there is no arm that launches on one of them.
+fn attempt_staging_verdict(
+  plan: AttemptLaunchPlan,
+  jit: JitDeviceStagingOutcome,
+  workspace: WorkspaceStagingObservation,
+) -> AttemptStagingVerdict {
   match plan {
     LaunchAuthorized {
       authorization: _,
       jit_runner_name: _,
       jit_registration_id: _,
-      jit_device: _,
+      jit_device: device,
       tap_device: _,
       guest_ip_boot_arg: _,
       slice: _,
@@ -705,18 +738,32 @@ fn staging_verdict(plan: AttemptLaunchPlan, obs: WorkspaceStagingObservation) ->
       kvm_device: _,
       vm_config: _,
       jailer: j,
-    } => {
-      let s = workspace_standing(obs: obs, planned_path: planned)
-      match s {
-        WorkspaceReady => StagingAdmitsJailer { jailer: j }
-        WorkspaceCreateFailed { exit: _ } => StagingRefusedWorkspace { standing: s }
-        WorkspaceFormatFailed { exit: _ } => StagingRefusedWorkspace { standing: s }
-        WorkspaceNotExtFilesystem => StagingRefusedWorkspace { standing: s }
-        WorkspaceSizeMismatch { observed: _, expected: _ } => StagingRefusedWorkspace { standing: s }
-        WorkspaceUnreadable { reason: _ } => StagingRefusedWorkspace { standing: s }
-        WorkspaceReadbackOfDifferentImage { read: _, planned: _ } => StagingRefusedWorkspace { standing: s }
+    } =>
+      match jit {
+        JitDeviceStagingRefused { step: _, detail: _ } => StagingRefusedJitDevice { outcome: jit }
+        JitDeviceStaged { host_path: staged } =>
+          if staged != device.host_path {
+            StagingRefusedForeignJitDevice { staged_path: staged, planned_path: device.host_path }
+          } else {
+            let s = workspace_standing(obs: workspace, planned_path: planned)
+            match s {
+              WorkspaceReady =>
+                StagingAdmitsJailer {
+                  receipt: AttemptStagingReceipt {
+                    jailer: j,
+                    jit_device_path: staged,
+                    workspace_path: planned,
+                  },
+                }
+              WorkspaceCreateFailed { exit: _ } => StagingRefusedWorkspace { standing: s }
+              WorkspaceFormatFailed { exit: _ } => StagingRefusedWorkspace { standing: s }
+              WorkspaceNotExtFilesystem => StagingRefusedWorkspace { standing: s }
+              WorkspaceSizeMismatch { observed: _, expected: _ } => StagingRefusedWorkspace { standing: s }
+              WorkspaceUnreadable { reason: _ } => StagingRefusedWorkspace { standing: s }
+              WorkspaceReadbackOfDifferentImage { read: _, planned: _ } => StagingRefusedWorkspace { standing: s }
+            }
+          }
       }
-    }
     LaunchRefusedUnauthorized { authorization: _ } => StagingNotAuthorized
     LaunchRefusedJitCredential { refusal: _ } => StagingNotAuthorized
     LaunchRefusedPriorResources => StagingNotAuthorized
@@ -729,8 +776,8 @@ fn workspace_readback_command(workspace_path: String) -> ArgvCommand {
 
 // DECLARED FRONTIER (DESIGN 3c). NAMED CONSUMER: the lifecycle controller's staging step
 // (gunbc#11670). TRIGGER: that step runs the plan's workspace_create and workspace_format, reads
-// workspace_readback_command, and reaches the jailer only through staging_verdict. SUFFICIENT FOR
-// deleting this row. NOT satisfied by a witness calling staging_verdict.
+// workspace_readback_command, stages the jit device, and reaches the jailer only through
+// attempt_staging_verdict. SUFFICIENT FOR deleting this row. NOT satisfied by a witness calling it.
 data workspace_staging_consumer_frontier: DissolutionCondition = unbound_dissolution(
-  description: "NAMED CONSUMER: the microVM lifecycle controller's staging step (gunbc#11670). TRIGGER: that step executes workspace_create and workspace_format, reads workspace_readback_command, and reaches the jailer only through staging_verdict. SUFFICIENT FOR deleting this row. NOT satisfied by a witness calling staging_verdict." as NonEmptyStr,
+  description: "NAMED CONSUMER: the microVM lifecycle controller's staging step (gunbc#11670). TRIGGER: that step executes workspace_create and workspace_format, executes stage_jit_device and reaches the jailer only through attempt_staging_verdict. SUFFICIENT FOR deleting this row. NOT satisfied by a witness calling it." as NonEmptyStr,
 )
diff --git a/dag/test/claim/github_effect_perform_witness_test.dag b/dag/test/claim/github_effect_perform_witness_test.dag
index baa838a9702..507484ed98c 100644
--- a/dag/test/claim/github_effect_perform_witness_test.dag
+++ b/dag/test/claim/github_effect_perform_witness_test.dag
@@ -16,7 +16,9 @@ import gunbc.runner.runner_jit_perform {
 import gunbc.github_effect_perform {
   jit_mint_performance_of_generate, perform_organization_jit_mint,
   JitMintReceived, JitMintStepNotSucceeded, GenerateJitConfigStep,
+  JitMintAppKeyNotCustodied, lifecycle_controller_app,
 }
+import gunbc.auth.github_apps { gunbai_bot_declared }
 import test.claim.github_app_registry { dispatched, runner_grant }
 
 data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly
@@ -105,6 +107,18 @@ test fn witness_generate_step_delivers_refuses_or_reports_ambiguity_by_what_gith
   delivered && conflicted && ambiguous
 }
 
+// THE KEY IS ONE APP'S, AND THIS IS THE RED FOR IT. The shared dispatch fixture is built on
+// gunbai_bot_declared while the controller's key is gunbai_ci_declared's, so an AUTHORIZED dispatch
+// for the wrong App refuses before any I/O -- no key read, no request. Without this the custody
+// guard would be a wall nothing executes: dropping it while the key still points at the CI App's
+// pem would leave every other witness green (review 68748).
+test fn witness_a_dispatch_for_another_app_is_refused_before_signing() -> Bool {
+  match perform_organization_jit_mint(dispatch: dispatched(owned: true, perms: runner_grant)) {
+    JitMintAppKeyNotCustodied { app: a } => a == gunbai_bot_declared && a != lifecycle_controller_app
+    _ => false
+  }
+}
+
 // A REFUSED DISPATCH PERFORMS NOTHING: no key is read and no request is sent, and the refusal the
 // plan reached is what comes back. This executes the real perform function, which reaches no
 // effect on this arm.
diff --git a/dag/test/claim/runner/runner_attempt_launch_witness_test.dag b/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
index fb0e6eded4a..242dbf4e810 100644
--- a/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
+++ b/dag/test/claim/runner/runner_attempt_launch_witness_test.dag
@@ -44,9 +44,12 @@ import gunbc.runner_attempt_launch {
   jail_workspace_path, jail_jit_path,
   WorkspaceStagingObservation, WorkspaceSuperblockRead, WorkspaceReadbackFailed,
   AttemptStagingVerdict, StagingAdmitsJailer, StagingRefusedWorkspace, StagingNotAuthorized,
+  AttemptStagingReceipt,
   WorkspaceStanding, WorkspaceReady, WorkspaceCreateFailed, WorkspaceFormatFailed,
   WorkspaceNotExtFilesystem, WorkspaceSizeMismatch, WorkspaceUnreadable, WorkspaceReadbackOfDifferentImage,
-  staging_verdict, runner_attempt_workspace_bytes,
+  attempt_staging_verdict, runner_attempt_workspace_bytes,
+  StagingRefusedJitDevice, StagingRefusedForeignJitDevice,
+  JitDeviceStaged, JitDeviceStagingOutcome, JitDeviceStagingRefused, JitDeviceCreateStep,
   workspace_readback_command, workspace_staging_consumer_frontier,
 }
 import extdeps.github.actions_jit_runner {
@@ -484,8 +487,10 @@ fn good_workspace() -> WorkspaceStagingObservation {
 
 fn staging_label(v: AttemptStagingVerdict) -> String {
   match v {
-    StagingAdmitsJailer { jailer: _ } => "admit"
+    StagingAdmitsJailer { receipt: _ } => "admit"
     StagingNotAuthorized => "unauthorized"
+    StagingRefusedJitDevice { outcome: _ } => "jit-device"
+    StagingRefusedForeignJitDevice { staged_path: _, planned_path: _ } => "foreign-jit-device"
     StagingRefusedWorkspace { standing: s } => match s {
       WorkspaceReady => "ready-refused"
       WorkspaceCreateFailed { exit: _ } => "create"
@@ -498,20 +503,91 @@ fn staging_label(v: AttemptStagingVerdict) -> String {
   }
 }
 
-fn staging_for(obs: WorkspaceStagingObservation, ground: AttemptGround) -> String {
+// THE STAGED DEVICE THIS ATTEMPT'S OWN PLAN NAMES, so the workspace cases below vary only the
+// workspace and the gate's other input is the honest one.
+fn staged_device_of(plan: AttemptLaunchPlan) -> JitDeviceStagingOutcome {
+  match plan {
+    LaunchAuthorized {
+      authorization: _, jit_runner_name: _, jit_registration_id: _, jit_device: device,
+      tap_device: _, guest_ip_boot_arg: _, slice: _, jail_root: _, stage_jail_root: _,
+      stage_kernel: _, stage_rootfs: _, workspace_path: _, workspace_create: _,
+      workspace_format: _, kvm_device: _, vm_config: _, jailer: _,
+    } => JitDeviceStaged { host_path: device.host_path }
+    _ => JitDeviceStagingRefused { step: JitDeviceCreateStep, detail: "fixture: plan is not authorized" }
+  }
+}
+
+fn staging_with(jit_of: Bool, obs: WorkspaceStagingObservation, ground: AttemptGround, jit: JitDeviceStagingOutcome) -> String {
   match issued_pairs() {
     Cons { head: pair, tail: _ } =>
       match accepted_attempt(i: 2, id: "ws1") {
-        Cons { head: a, tail: _ } => staging_label(v: staging_verdict(
-          plan: plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: a), ground: ground),
-          obs: obs,
-        ))
+        Cons { head: a, tail: _ } => {
+          let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: a), ground: ground)
+          staging_label(v: attempt_staging_verdict(
+            plan: plan,
+            jit: if jit_of { staged_device_of(plan: plan) } else { jit },
+            workspace: obs,
+          ))
+        }
         Empty {} => "no-attempt"
       }
     Empty {} => "no-grant"
   }
 }
 
+fn staging_for(obs: WorkspaceStagingObservation, ground: AttemptGround) -> String {
+  staging_with(
+    jit_of: true,
+    obs: obs,
+    ground: ground,
+    jit: JitDeviceStagingRefused { step: JitDeviceCreateStep, detail: "unused" },
+  )
+}
+
+// THE GATE CONSUMES BOTH STAGINGS. A ready workspace does not buy a launch when THIS attempt's
+// credential device failed to stage, and it does not buy one when the staged device is some other
+// attempt's path. Both were admitted by the workspace-only gate a merge produced (sunny-ant-606
+// hold on #11677), which is the guest-with-no-credential burn this planner exists to prevent.
+test fn a_ready_workspace_does_not_admit_a_failed_or_foreign_jit_device() -> Bool {
+  staging_with(
+    jit_of: false,
+    obs: good_workspace(),
+    ground: GroundClear,
+    jit: JitDeviceStagingRefused { step: JitDeviceCreateStep, detail: "install exited 1" },
+  ) == "jit-device"
+    && staging_with(
+      jit_of: false,
+      obs: good_workspace(),
+      ground: GroundClear,
+      jit: JitDeviceStaged { host_path: "/srv/jailer/firecracker/other-attempt/root/jit.bin" },
+    ) == "foreign-jit-device"
+    && staging_for(obs: good_workspace(), ground: GroundClear) == "admit"
+    && admitted_receipt_names_this_attempts_paths()
+}
+
+// THE RECEIPT NAMES WHAT WAS READ BACK, not staging in general: the device path is the one this
+// plan's jit_device names and the workspace path is the one it formatted. The jailer is reachable
+// only inside this value, which attempt_staging_verdict alone can construct.
+fn admitted_receipt_names_this_attempts_paths() -> Bool {
+  match issued_pairs() {
+    Cons { head: pair, tail: _ } =>
+      match accepted_attempt(i: 2, id: "ws1") {
+        Cons { head: a, tail: _ } => {
+          let plan = plan_for(pair: pair, account: pair.account, attempt: a, mint: live_grant(attempt: a), ground: GroundClear)
+          match attempt_staging_verdict(plan: plan, jit: staged_device_of(plan: plan), workspace: good_workspace()) {
+            StagingAdmitsJailer { receipt: r } =>
+              r.jit_device_path == concat(attempt_jail_chroot_root(attempt: a, firecracker_binary: "/bin/firecracker"), jail_jit_path as String)
+                && r.workspace_path == planned_ws_path()
+                && string_contains(s: join(argv_words(command: r.jailer), " "), pattern: "--exec-file")
+            _ => false
+          }
+        }
+        Empty {} => false
+      }
+    Empty {} => false
+  }
+}
+
 // THE JAILER IS REACHED ONLY THROUGH A READ-BACK WORKSPACE. The positive control admits; each
 // failure refuses under its own name, and the earliest failure is the one named -- a failed create
 // with a failed format reports the create. The red is any arm that launches onto a workspace the

From 46a9c33639367480aeb48bef9bc275321bc2b083 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sun, 20 Sep 2026 04:22:36 +0000
Subject: [PATCH 17/22] stat.dag: restore the brace my keep-both merge
 resolution cut (floor: unterminated function body)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/extdeps/tools/stat.dag | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dag/extdeps/tools/stat.dag b/dag/extdeps/tools/stat.dag
index 2acff1dc8c9..dd4cb55a688 100644
--- a/dag/extdeps/tools/stat.dag
+++ b/dag/extdeps/tools/stat.dag
@@ -93,6 +93,8 @@ fn stat_mode_command(path: String) -> ArgvCommand {
 
 fn stat_size_bytes_command(path: String) -> ArgvCommand {
   argv_command(program: stat_binary_path, arguments: ["-c", "%s", "--", path])
+}
+
 // %b IS THE NUMBER OF BLOCKS ALLOCATED and %B the size of each in bytes, so their product is the
 // bytes a file actually occupies -- which for a sparse image is the bytes WRITTEN, not the
 // apparent size %s reports. That is the reading a workspace image's usage wants, and it is the

From 7a9a37943f6f224e068bf399f89e6a09356c6ede Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sun, 20 Sep 2026 04:35:34 +0000
Subject: [PATCH 18/22] Take main's generated workflow projections; my copies
 were stale generations carried through merges

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/fleet-converge.yml | 2 +-
 .github/workflows/witnesses.yml      | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/fleet-converge.yml b/.github/workflows/fleet-converge.yml
index a982b0a7dca..3cdf0ff870a 100644
--- a/.github/workflows/fleet-converge.yml
+++ b/.github/workflows/fleet-converge.yml
@@ -227,7 +227,7 @@ jobs:
           echo "fleet-key: agent loaded (identity fleet-automation@gunbc; secret versions/1 pinned; fingerprint verified against modeled authority; key file wiped)"
         env:
           WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-        if: github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'launch_environment_plan' || github.event.inputs.mode == 'allocation_store_plan' || github.event.inputs.mode == 'apply' || github.event.inputs.mode == 'app_control_plane_observe' || github.event.inputs.mode == 'microvm_host_converge' || github.event.inputs.mode == 'guest_image_observe' || github.event.inputs.mode == 'guest_image_converge' || github.event.inputs.mode == 'microvm_boot_probe' || github.event.inputs.mode == 'spark_grants' || github.event.inputs.mode == 'spark_bootstrap' || github.event.inputs.mode == 'spark_serving_apply' || github.event.inputs.mode == 'spark_runtime_image_probe' || github.event.inputs.mode == 'dashboard_deploy' || github.event.inputs.mode == 'rlm_launch_deployment_receipt' || github.event.inputs.mode == 'host_reset_return' || github.event.inputs.mode == 'runner_host_file_observe' || github.event.inputs.mode == 'runner_host_file_converge' || github.event.inputs.mode == 'runner_password_session_tool_converge' || github.event.inputs.mode == 'r2_mint_preflight' || github.event.inputs.mode == 'r2_object_write_mint'
+        if: github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'launch_environment_plan' || github.event.inputs.mode == 'allocation_store_plan' || github.event.inputs.mode == 'apply' || github.event.inputs.mode == 'app_control_plane_observe' || github.event.inputs.mode == 'microvm_host_converge' || github.event.inputs.mode == 'guest_image_observe' || github.event.inputs.mode == 'guest_image_converge' || github.event.inputs.mode == 'microvm_boot_probe' || github.event.inputs.mode == 'spark_grants' || github.event.inputs.mode == 'spark_bootstrap' || github.event.inputs.mode == 'spark_serving_apply' || github.event.inputs.mode == 'spark_runtime_image_probe' || github.event.inputs.mode == 'dashboard_deploy' || github.event.inputs.mode == 'rlm_launch_deployment_receipt' || github.event.inputs.mode == 'host_reset_return' || github.event.inputs.mode == 'runner_host_file_observe' || github.event.inputs.mode == 'runner_host_file_converge' || github.event.inputs.mode == 'runner_password_session_tool_converge' || github.event.inputs.mode == 'r2_mint_preflight' || github.event.inputs.mode == 'r2_object_write_mint' || github.event.inputs.mode == 'approval_keyring_converge' || github.event.inputs.mode == 'mtcollins1_boot'
         timeout-minutes: 5
       - name: Fleet converge plan (membership_reconcile → artifact)
         id: plan
diff --git a/.github/workflows/witnesses.yml b/.github/workflows/witnesses.yml
index 12e5355170c..d421780210c 100644
--- a/.github/workflows/witnesses.yml
+++ b/.github/workflows/witnesses.yml
@@ -19,6 +19,7 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 env:
   CARGO_TERM_COLOR: always
+  GUNBC_REQUIRED_CI_CONTRACT_EPOCH: 2026-09-01.1
 jobs:
   compiler:
     runs-on: ubuntu-24.04-arm

From a6ed2fdddc29c0968a37a2e5eaed43c7652096bf Mon Sep 17 00:00:00 2001
From: "gunbai-bot[bot]" <289086189+gunbai-bot[bot]@users.noreply.github.com>
Date: Sun, 20 Sep 2026 05:23:11 +0000
Subject: [PATCH 19/22] chore: regenerate drifted generated artifacts (ci
 auto-heal)

Ledger-Repair-Judged: docs/design-rung-drops.md
Ledger-Rows-Repaired: docs/design-rung-drops.md namespace_wave_admission_wall_removed
Heal-Candidate-Run: 35490123999
---
 .gitattributes            | 2 +-
 docs/design-rung-drops.md | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/.gitattributes b/.gitattributes
index 3a8eeb7dbd9..dcb611ff7aa 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -75,7 +75,7 @@ src/v1/stage0/src/evaluation_budget_consequence_falsifier_host.rs !merge
 src/v1/stage0/src/generated_artifact_boundary_host.rs !merge
 src/v1/stage0/src/main.rs !merge
 src/v1/stage0/src/memory_governor.rs !merge
-src/v1/stage0/src/namespace_wave_admission.rs !merge
+src/v1/stage0/src/namespace_baseline.rs !merge
 src/v1/stage0/src/partition_crate_boundary_host.rs !merge
 src/v1/stage0/src/phase_profile.rs !merge
 src/v1/stage0/src/pre_push.rs !merge
diff --git a/docs/design-rung-drops.md b/docs/design-rung-drops.md
index 5d127389ac8..a0f7ecc3618 100644
--- a/docs/design-rung-drops.md
+++ b/docs/design-rung-drops.md
@@ -316,7 +316,6 @@ native G0 path records sole_constructor as a type-item property, the way v1 pars
 
 an append to the fabric event log by a principal that is not a fleet writer: RUNG DROP, mechanically preventable -> mitigatable (replacement staged: gunbc.fabric_db_serve fabric_db_serve_handle, reached only through tailscale serve on srv1 (tailnet membership is the only boundary)). Population: gunbc.fabric_db_serve fabric_db_serve_handle, gunbc.fabric_event_log event_log_append, gunbc.fabric_event_log fabric_seat_acquire. Restored when: a modeled roster of fabric writer principals, grounded in an observed reading of the identity each fleet writer presents through tailscale serve on srv1 -- SUFFICIENT FOR fabric_db_serve_handle to refuse a put or advance from any identity outside the roster, including an absent identity, with a discriminating RED over the real handler.
 
-
 ### the required namespace-wave-admission phase: merge-path adjudication of closure, subject-membership and occurrence-binding deltas between merge base and head — declared 2026-09-19
 
-the required namespace-wave-admission phase: merge-path adjudication of closure, subject-membership and occurrence-binding deltas between merge base and head: RUNG DROP, mechanically preventable -> outside the ladder (deleted without replacement). Population: unadjudicated subject-membership deltas between merge base and head: no required run computes or refuses them, unadjudicated occurrence-binding deltas (a spelling already authored on both sides changing which declarations it admits): no required run computes or refuses them, the TargetChanged arm's mis-shaped-wave detection: a wave that both requalifies and repoints a reference to a different declaration is no longer caught anywhere on the merge path, closure deltas, which the wall measured and attributed to their membership generators as blast radius: not computed, the transition-admission roster's stale/consumed bookkeeping and its deletion-follow-up debt record: moot, because no executing consumer reads the roster -- the roster directory dag/gunbc/namespace/transition_admission/ is deleted with the wall, the parse-environment-agreement tripwire on the merge path (a base revision read under its own grammar before adjudication): survives only inside the floor's own planning reconstruction (v1_compiler.cli_run.namespace_baseline), which is not a gate over namespace deltas. Restored when: THE CAPABILITY, BOTH HALVES AND NO SMALLER SET. (1) A debt-collection design for transition admissions that never charges bystanders: a row's consumption and deletion debt is adjudicated on the composition of the change that OWNS the row, and a merge_group run over bystanders cannot refuse on a row it did not touch -- the 2026-09-16 arm removals (gunbc#11481) and this deletion are the two measured costs of getting that billing wrong in either direction. (2) A landing-time enforcement run: the adjudication executes on the composition that actually lands (or on the push to the default branch), so a base-consumed row is observed then and not whenever the roster happens to be touched next. Both halves executing with a discriminating RED each, on the real acceptance path, re-enrol the phase and retire this row; the program interlock's NamespaceWaveAdmissionEnrolled milestone and ACT-0's release gate read this row's standing meanwhile, so the waves cannot be released while it stands. Re-adding the deleted arms verbatim does NOT retire this row: that is the loop the operator priced out. POSTSCRIPT, 2026-09-20: main landed the carrier redesign (gunbc#11704 -- admissions carried in the change's own commit messages, never the tree, so no bystander is ever billed) hours before this deletion; the ruling prices the gate itself, not only its billing, and removes the redesigned wall with the old one. The restoration trigger below stands whole..
+the required namespace-wave-admission phase: merge-path adjudication of closure, subject-membership and occurrence-binding deltas between merge base and head: RUNG DROP, mechanically preventable -> outside the ladder (deleted without replacement). Population: unadjudicated subject-membership deltas between merge base and head: no required run computes or refuses them, unadjudicated occurrence-binding deltas (a spelling already authored on both sides changing which declarations it admits): no required run computes or refuses them, the TargetChanged arm's mis-shaped-wave detection: a wave that both requalifies and repoints a reference to a different declaration is no longer caught anywhere on the merge path, closure deltas, which the wall measured and attributed to their membership generators as blast radius: not computed, the transition-admission roster's stale/consumed bookkeeping and its deletion-follow-up debt record: moot, because no executing consumer reads the roster -- the roster directory dag/gunbc/namespace/transition_admission/ is deleted with the wall, the parse-environment-agreement tripwire on the merge path (a base revision read under its own grammar before adjudication): survives only inside the floor's own planning reconstruction (v1_compiler.cli_run.namespace_baseline), which is not a gate over namespace deltas. Restored when: THE CAPABILITY, BOTH HALVES AND NO SMALLER SET. (1) A debt-collection design for transition admissions that never charges bystanders: a row's consumption and deletion debt is adjudicated on the composition of the change that OWNS the row, and a merge_group run over bystanders cannot refuse on a row it did not touch -- the 2026-09-16 arm removals (gunbc#11481) and this deletion are the two measured costs of getting that billing wrong in either direction. (2) A landing-time enforcement run: the adjudication executes on the composition that actually lands (or on the push to the default branch), so a base-consumed row is observed then and not whenever the roster happens to be touched next. Both halves executing with a discriminating RED each, on the real acceptance path, re-enrol the phase and retire this row; the program interlock's NamespaceWaveAdmissionEnrolled milestone and ACT-0's release gate read this row's standing meanwhile, so the waves cannot be released while it stands. Re-adding the deleted arms verbatim does NOT retire this row: that is the loop the operator priced out..

From 8891230f050e0f172cd5bce1199f8c9d3d878ed2 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sun, 20 Sep 2026 06:04:36 +0000
Subject: [PATCH 20/22] microVM: carry the staged credential device path on
 InFlightAttempt, so #11677's jail-interior device does not leave #11670's
 teardown join importing a deleted symbol

---
 .../runner/runner_microvm_cell_readiness.dag  | 14 +++++++++++
 dag/gunbc/runner/runner_microvm_lifecycle.dag |  6 +++--
 .../runner_microvm_lifecycle_witness_test.dag | 23 +++++++++++++++----
 .../runner/runner_microvm_witness_test.dag    |  2 +-
 4 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/dag/gunbc/runner/runner_microvm_cell_readiness.dag b/dag/gunbc/runner/runner_microvm_cell_readiness.dag
index 5634c7e272c..f64bdcf4fb1 100644
--- a/dag/gunbc/runner/runner_microvm_cell_readiness.dag
+++ b/dag/gunbc/runner/runner_microvm_cell_readiness.dag
@@ -34,10 +34,24 @@ data runner_microvm_cell_readiness_disposition: Disposition = SingleAuthority
 // -- and settle -- the wrong cell's attempt under A's key (side-chat ruling on #11670). The attempt's
 // slot DERIVES its cell, so the key and the attempt are checked against each other where the store is
 // read, and an attempt the key disagrees with makes the store unsound rather than recoverable.
+// THE CREDENTIAL DEVICE'S PATH IS CARRIED, NOT RE-DERIVED, because it stopped being derivable from
+// the attempt. The device used to sit at an attempt-derived path beside the attempt directory;
+// gunbc#11677 moved it INSIDE the jailer's chroot, whose root depends on the firecracker binary's
+// own file name -- a fact the launch PLAN owns and this record cannot recompute. Recomputing it
+// from a convention would make teardown prove some other path absent while the staged device
+// survived, and a convention that drifts is exactly what the in-flight record exists to outlive:
+// the controller that staged the device may be gone, and what recovery needs is the path that WAS
+// staged, not the path today's code would have chosen.
+//
+// IT IS NOT PART OF THE ATTEMPT'S IDENTITY. in_flight_attempt_same compares unit, invocation and
+// registration; two records agreeing on those and disagreeing on the device path are one attempt
+// whose record is incoherent, not two attempts, and folding the path into equality would spell that
+// as a mismatch and send a reader at the wrong fact.
 type InFlightAttempt {
   attempt: MicroVmAttempt
   invocation_id: NonEmptyStr
   jit_registration_id: NonEmptyStr
+  credential_device_path: String
 }
 
 type CellReadinessRecord
diff --git a/dag/gunbc/runner/runner_microvm_lifecycle.dag b/dag/gunbc/runner/runner_microvm_lifecycle.dag
index e3d67aa22ef..48acf09b533 100644
--- a/dag/gunbc/runner/runner_microvm_lifecycle.dag
+++ b/dag/gunbc/runner/runner_microvm_lifecycle.dag
@@ -12,7 +12,7 @@ import gunbc.fabric_cell_converge { fabric_cell_slice_name }
 import gunbc.runner_microvm { RunnerGuestImage }
 import gunbc.runner_microvm_attempt {
   MicroVmAttempt, runner_microvm_attempt_unit_name, runner_microvm_attempt_dir,
-  runner_microvm_attempt_jail_base, runner_microvm_attempt_jit_drive_path,
+  runner_microvm_attempt_jail_base,
 }
 import gunbc.runner_attempt_launch { AttemptGround, GroundClear, GroundOccupied }
 import gunbc.build_cache_instance { runner_slot_identity_equal, runner_slot_instance_name }
@@ -66,6 +66,7 @@ type AttemptIdentity {
   allocation_generation: Int
   invocation_id: NonEmptyStr
   jit_registration_id: NonEmptyStr
+  credential_device_path: String
   guest_image: RunnerGuestImage
 }
 
@@ -100,6 +101,7 @@ fn in_flight_attempt_of_identity(identity: AttemptIdentity) -> InFlightAttempt {
     attempt: identity.attempt,
     invocation_id: identity.invocation_id,
     jit_registration_id: identity.jit_registration_id,
+    credential_device_path: identity.credential_device_path,
   }
 }
 
@@ -334,7 +336,7 @@ fn teardown_subject_pairs(bound: CellBoundAttempt, o: ObservedTeardown) -> List<
     SubjectPair { subject: SubjectCgroupRoot, expected: fabric_cell_slice_name(slot: a.slot), observed: o.cgroup.root as String },
     SubjectPair { subject: SubjectJailRoot, expected: runner_microvm_attempt_jail_base(attempt: a), observed: o.mounts.path },
     SubjectPair { subject: SubjectAttemptDirectory, expected: runner_microvm_attempt_dir(attempt: a), observed: o.attempt_storage.path },
-    SubjectPair { subject: SubjectCredentialDrive, expected: runner_microvm_attempt_jit_drive_path(attempt: a), observed: o.credential_disk.path },
+    SubjectPair { subject: SubjectCredentialDrive, expected: bound.attempt.credential_device_path, observed: o.credential_disk.path },
   ]
 }
 
diff --git a/dag/test/claim/runner/runner_microvm_lifecycle_witness_test.dag b/dag/test/claim/runner/runner_microvm_lifecycle_witness_test.dag
index 39a9d30e8e4..23bde20d3f1 100644
--- a/dag/test/claim/runner/runner_microvm_lifecycle_witness_test.dag
+++ b/dag/test/claim/runner/runner_microvm_lifecycle_witness_test.dag
@@ -7,8 +7,8 @@ import gunbc.fleet_intent_network { operator_host_srv2 }
 import product.fabric.sanitation { CellId, CellReadiness, CellReady, CellQuarantined, cell_is_ready }
 import gunbc.runner_microvm { gunbc_runner_guest_image }
 import gunbc.runner_microvm_attempt {
-  MicroVmAttemptResult, MicroVmAttemptAccepted, microvm_attempt,
-  runner_microvm_attempt_dir, runner_microvm_attempt_jail_base, runner_microvm_attempt_jit_drive_path,
+  MicroVmAttempt, MicroVmAttemptResult, MicroVmAttemptAccepted, microvm_attempt,
+  runner_microvm_attempt_dir, runner_microvm_attempt_jail_base,
   runner_microvm_attempt_unit_name,
 }
 import gunbc.fabric_cell_converge { fabric_cell_slice_name }
@@ -73,6 +73,15 @@ fn identity(generation: Int, invocation: String) -> AttemptIdentity? {
   identity_on(slot: witness_slot, generation: generation, invocation: invocation)
 }
 
+// THE DEVICE PATH IS SUPPLIED, NOT DERIVED, and that is the property under test rather than a
+// shortcut. The staged device now lives inside the jailer's chroot at a path the launch plan owns
+// (gunbc.runner_attempt_launch jit_device_staging), so a witness that recomputed it from the attempt
+// would be asserting a convention this corpus no longer has. Supplying it is also what lets the
+// foreign-subject red below name a DIFFERENT device than the record does.
+fn witness_credential_device_path(attempt: MicroVmAttempt) -> String {
+  join([runner_microvm_attempt_jail_base(attempt: attempt), "/firecracker/w/root/jit.bin"], "")
+}
+
 fn identity_on(slot: RunnerSlotIdentity, generation: Int, invocation: String) -> AttemptIdentity? {
   match microvm_attempt(slot: slot, attempt_id: join(["w-", to_string(generation)], "")) {
     MicroVmAttemptAccepted { attempt: a } =>
@@ -82,6 +91,7 @@ fn identity_on(slot: RunnerSlotIdentity, generation: Int, invocation: String) ->
           allocation_generation: generation,
           invocation_id: invocation as NonEmptyStr,
           jit_registration_id: "reg-1" as NonEmptyStr,
+          credential_device_path: witness_credential_device_path(attempt: a),
           guest_image: gunbc_runner_guest_image,
         },
       }
@@ -192,7 +202,12 @@ fn quiet_network() -> BoundSlotNetworkReadback? {
 }
 
 fn in_flight(id: AttemptIdentity) -> InFlightAttempt {
-  InFlightAttempt { attempt: id.attempt, invocation_id: id.invocation_id, jit_registration_id: id.jit_registration_id }
+  InFlightAttempt {
+    attempt: id.attempt,
+    invocation_id: id.invocation_id,
+    jit_registration_id: id.jit_registration_id,
+    credential_device_path: id.credential_device_path,
+  }
 }
 
 fn bound_of(id: AttemptIdentity) -> CellBoundAttempt? {
@@ -210,7 +225,7 @@ fn observed_for(id: AttemptIdentity, facts: HostFacts) -> ObservedTeardown {
     cgroup: ObservedCgroup { root: fabric_cell_slice_name(slot: id.attempt.slot) as NonEmptyStr, readback: facts.cgroup },
     mounts: ObservedPath { path: runner_microvm_attempt_jail_base(attempt: id.attempt), readback: facts.mounts },
     attempt_storage: ObservedPath { path: runner_microvm_attempt_dir(attempt: id.attempt), readback: facts.attempt_storage },
-    credential_disk: ObservedPath { path: runner_microvm_attempt_jit_drive_path(attempt: id.attempt), readback: facts.credential_disk },
+    credential_disk: ObservedPath { path: id.credential_device_path, readback: facts.credential_disk },
     network: facts.network,
   }
 }
diff --git a/dag/test/claim/runner/runner_microvm_witness_test.dag b/dag/test/claim/runner/runner_microvm_witness_test.dag
index dfdc3c9fc2c..5b0b3016e02 100644
--- a/dag/test/claim/runner/runner_microvm_witness_test.dag
+++ b/dag/test/claim/runner/runner_microvm_witness_test.dag
@@ -1365,7 +1365,7 @@ test fn host_withdrawal_and_recovery_required_are_not_a_cell_refusal() -> Bool {
             records: [CellAttemptInFlight {
               cell: lost_cell,
               generation: 0,
-              attempt: InFlightAttempt { attempt: lost, invocation_id: "inv-lost" as NonEmptyStr, jit_registration_id: "reg-lost" as NonEmptyStr },
+              attempt: InFlightAttempt { attempt: lost, invocation_id: "inv-lost" as NonEmptyStr, jit_registration_id: "reg-lost" as NonEmptyStr, credential_device_path: "/srv/gunbc/cells/lost/jail/firecracker/w/root/jit.bin" },
             }],
           },
           cell: lost_cell,

From 47f50147037147e41685624c2d34acaf8d064810 Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sun, 20 Sep 2026 11:50:30 +0000
Subject: [PATCH 21/22] Import fleet_converge_expected_host_env_name from its
 current home

It moved to gunbc.actions_run_binding; the stale import resolved only under a
compiler built before that move.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 dag/gunbc/runner/microvm_controller_app_key_converge.dag | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/dag/gunbc/runner/microvm_controller_app_key_converge.dag b/dag/gunbc/runner/microvm_controller_app_key_converge.dag
index 08877019c33..a5efdfc1c1a 100644
--- a/dag/gunbc/runner/microvm_controller_app_key_converge.dag
+++ b/dag/gunbc/runner/microvm_controller_app_key_converge.dag
@@ -9,8 +9,7 @@ import extdeps.cloud.gcp.secret_ref { secret_ref_version_resource }
 import extdeps.cloud.gcp.secret_manager { SmResolvedVersionIdentity }
 import product.placement_supply { HostIdentity }
 import gunbc.clock_read { clock_now_probed_at, probed_at_word }
-import gunbc.actions_run_binding { actions_variable_read, ActionsVariablePresent, ActionsVariableAbsent }
-import gunbc.fleet_converge_receipt { fleet_converge_expected_host_env_name }
+import gunbc.actions_run_binding { actions_variable_read, ActionsVariablePresent, ActionsVariableAbsent, fleet_converge_expected_host_env_name }
 import gunbc.fleet_ssh_locus { prepare_fleet_ssh_agent_context, FleetSshContextReady, FleetSshContextRefused }
 import gunbc.fleet_known_hosts_anchor { FleetSshExecutionContext }
 import gunbc.file_access { FileTreeScope, path_within_file_tree_scope }

From 10c83361fdddb0311ccc00672eda8dc11e7d71ab Mon Sep 17 00:00:00 2001
From: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Date: Sun, 20 Sep 2026 17:15:31 +0000
Subject: [PATCH 22/22] Regenerate fleet-converge.yml from its authority
 (review 69279)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The merge resolution 7a9a37943f6 took main's generated workflow
projections wholesale, reverting the child's regen bf07613c06e, so the
projection lost MicrovmControllerAppKeyConverge while the authority
(gunbc.fleet_converge_workflow fleet_converge_workflow_modes) carried
it -- a generated artifact behind its authority (DESIGN §6) and a
dangling consumption route for the census row (§3c).

Regenerated with `gunbc run --entry
dag/gunbc/instruments/generated_artifact_gate.dag --function main_wet`;
the only tracked file the run changed is this projection.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/fleet-converge.yml | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/fleet-converge.yml b/.github/workflows/fleet-converge.yml
index d2a704e6871..23033fc51f8 100644
--- a/.github/workflows/fleet-converge.yml
+++ b/.github/workflows/fleet-converge.yml
@@ -13,7 +13,7 @@ on:
       mode:
         description: plan shows membership hunks; apply executes a prior plan artifact; org_actions_observe validates the org credential and refuses on runner-group drift; org_runner_roster_observe reads the organization's self-hosted runner registrations to exhaustion under the same token and refuses unless the roster is complete; app_control_plane_observe reads the gunbai-ci App registration and webhook config with a short-lived App JWT and refuses on hook-config drift; microvm_host_converge installs the cited Firecracker release on the selected host and refuses the kvm grant by name; guest_image_observe reports the micro-VM base artifacts and their measured digests on the selected host and builds nothing; guest_image_converge builds the runner guest image there; microvm_boot_probe boots that image and reads its serial console; spark_grants and spark_bootstrap prepare the selected Spark; spark_serving_apply applies the promoted fabric groups' pair vLLM units over the password session, workers before heads; spark_native_serving_apply relaunches group B's native four-rank arm as ONE BOUNDED TRANSACTION -- an all-host preflight that mutates nothing and refuses on any unresolved artifact from an earlier run, the incumbent UNIT preserved (plus a diagnostic inspect of the incumbent container -- the container itself cannot outlive its unit, because these run --rm in the foreground under systemd), the head applied BEFORE the workers so every rank joins the head's new rendezvous store, then a readback of the COMPLETE realization through each container's own inspect -- every field the create spec states, the effective --node-rank off that container's argv, and NCCL's typed transport verdict on that incarnation -- plus the head's front door answering with this arm's served model, and then commit or a rollback of the whole arm -- and it is a separate mode because it reloads a 328 GB arm and nobody should reach it by asking for the pair units; spark_runtime_image_probe pulls the pinned runtime image on the selected Spark and reads its capabilities from inside its own digest, changing nothing; host_reset_return drives a rostered reset subject through its controller and measures the return FROM A PEER, and takes reset_observer rather than host because the observer must not be the subject; runner_host_file_observe reads the runner teardown drop-in, the needrestart deferral and the loaded teardown on the selected host as its administrator and writes nothing; runner_host_file_converge writes whichever of those two files differs, reloads systemd only if the drop-in changed, and refuses unless the manager then reports the declared teardown
         required: true
-        options: [plan, launch_environment_plan, allocation_store_plan, apply, org_actions_observe, app_control_plane_observe, microvm_host_converge, guest_image_observe, guest_image_converge, microvm_boot_probe, spark_grants, spark_bootstrap, spark_serving_apply, spark_native_serving_apply, spark_runtime_image_probe, dashboard_deploy, rlm_launch_deployment_receipt, host_reset_return, runner_host_file_observe, runner_host_file_converge, site_pxe_edge_observe, site_pxe_edge_converge, runner_password_session_tool_converge, r2_mint_preflight, r2_object_write_mint, org_runner_roster_observe, approval_keyring_converge, mtcollins1_boot, mtcollins1_fan_observe]
+        options: [plan, launch_environment_plan, allocation_store_plan, apply, org_actions_observe, app_control_plane_observe, microvm_host_converge, guest_image_observe, guest_image_converge, microvm_boot_probe, spark_grants, spark_bootstrap, spark_serving_apply, spark_native_serving_apply, spark_runtime_image_probe, dashboard_deploy, rlm_launch_deployment_receipt, host_reset_return, runner_host_file_observe, runner_host_file_converge, site_pxe_edge_observe, site_pxe_edge_converge, runner_password_session_tool_converge, r2_mint_preflight, r2_object_write_mint, org_runner_roster_observe, approval_keyring_converge, mtcollins1_boot, mtcollins1_fan_observe, microvm_controller_app_key_converge]
         type: choice
       target:
         description: "Spark target host for the spark_* modes, naming the administrator credential the run materializes (any rostered Spark: srv5, srv6, srv7, srv8, srv9, srv10, srv11, srv12); apply reads the subject off the plan artifact"
@@ -227,7 +227,7 @@ jobs:
           echo "fleet-key: agent loaded (identity fleet-automation@gunbc; secret versions/1 pinned; fingerprint verified against modeled authority; key file wiped)"
         env:
           WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
-        if: github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'launch_environment_plan' || github.event.inputs.mode == 'allocation_store_plan' || github.event.inputs.mode == 'apply' || github.event.inputs.mode == 'app_control_plane_observe' || github.event.inputs.mode == 'microvm_host_converge' || github.event.inputs.mode == 'guest_image_observe' || github.event.inputs.mode == 'guest_image_converge' || github.event.inputs.mode == 'microvm_boot_probe' || github.event.inputs.mode == 'spark_grants' || github.event.inputs.mode == 'spark_bootstrap' || github.event.inputs.mode == 'spark_serving_apply' || github.event.inputs.mode == 'spark_native_serving_apply' || github.event.inputs.mode == 'spark_runtime_image_probe' || github.event.inputs.mode == 'dashboard_deploy' || github.event.inputs.mode == 'rlm_launch_deployment_receipt' || github.event.inputs.mode == 'host_reset_return' || github.event.inputs.mode == 'runner_host_file_observe' || github.event.inputs.mode == 'runner_host_file_converge' || github.event.inputs.mode == 'site_pxe_edge_observe' || github.event.inputs.mode == 'site_pxe_edge_converge' || github.event.inputs.mode == 'runner_password_session_tool_converge' || github.event.inputs.mode == 'r2_mint_preflight' || github.event.inputs.mode == 'r2_object_write_mint' || github.event.inputs.mode == 'approval_keyring_converge'
+        if: github.event.inputs.mode == 'plan' || github.event.inputs.mode == 'launch_environment_plan' || github.event.inputs.mode == 'allocation_store_plan' || github.event.inputs.mode == 'apply' || github.event.inputs.mode == 'app_control_plane_observe' || github.event.inputs.mode == 'microvm_host_converge' || github.event.inputs.mode == 'guest_image_observe' || github.event.inputs.mode == 'guest_image_converge' || github.event.inputs.mode == 'microvm_boot_probe' || github.event.inputs.mode == 'spark_grants' || github.event.inputs.mode == 'spark_bootstrap' || github.event.inputs.mode == 'spark_serving_apply' || github.event.inputs.mode == 'spark_native_serving_apply' || github.event.inputs.mode == 'spark_runtime_image_probe' || github.event.inputs.mode == 'dashboard_deploy' || github.event.inputs.mode == 'rlm_launch_deployment_receipt' || github.event.inputs.mode == 'host_reset_return' || github.event.inputs.mode == 'runner_host_file_observe' || github.event.inputs.mode == 'runner_host_file_converge' || github.event.inputs.mode == 'site_pxe_edge_observe' || github.event.inputs.mode == 'site_pxe_edge_converge' || github.event.inputs.mode == 'runner_password_session_tool_converge' || github.event.inputs.mode == 'r2_mint_preflight' || github.event.inputs.mode == 'r2_object_write_mint' || github.event.inputs.mode == 'approval_keyring_converge' || github.event.inputs.mode == 'microvm_controller_app_key_converge'
         timeout-minutes: 5
       - name: Fleet converge plan (membership_reconcile → artifact)
         id: plan
@@ -840,6 +840,27 @@ jobs:
           retention-days: 30
         if: always() && (github.event.inputs.mode == 'runner_password_session_tool_converge')
         timeout-minutes: 10
+      - name: "MicroVM controller App key: deliver root:root 0400 from Secret Manager, read owner, mode, bytes and staging back"
+        id: microvm_controller_app_key_converge
+        run: |
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/runner/microvm_controller_app_key_converge.dag --function microvm_controller_app_key_converge_ci_wet
+          cat "$ROOT/target/microvm-controller-app-key-converge-receipt.txt"
+        env:
+          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
+          WIF_ACCESS_TOKEN: ${{ steps.wif_auth.outputs.access_token }}
+        if: github.event.inputs.mode == 'microvm_controller_app_key_converge'
+        timeout-minutes: 15
+      - name: Upload microVM controller App key custody receipt
+        id: microvm_controller_app_key_receipt_upload
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        with:
+          name: microvm-controller-app-key-converge-receipt
+          path: target/microvm-controller-app-key-converge-receipt.txt
+          if-no-files-found: error
+          retention-days: 30
+        if: always() && (github.event.inputs.mode == 'microvm_controller_app_key_converge')
+        timeout-minutes: 10
       - name: Upload runner host file converge receipt
         id: runner_host_file_receipt_upload
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f