microVM guest image: /etc/resolv.conf follows the kernel's dns0 through /proc/net/pnp

[gunbai-bot]

Step 1 of the guest-image half of the srvN microVM program (work item adhoc-f253c6f7-203, parent sunny-ant-606 owns the cutover). Nothing here selects the microVM path for the floor job.

What

The host boots each guest with ip=...:<dns0> (gunbc.runner_microvm_network runner_slot_guest_ip_boot_arg, dns0 = runner_microvm_guest_resolver, the one address the port-53 egress grant admits), but the kernel does not write /etc/resolv.conf, so a booted guest could not resolve github.com. The kernel exports dns0 to /proc/net/pnp in resolv.conf form and documents linking /etc/resolv.conf to it (Documentation/admin-guide/nfs/nfsroot.rst: "/etc/resolv.conf is often linked to /proc/net/pnp"). The image now carries exactly that link.

Decision: symlink via a modeled ln, not a systemd unit

The brief left this open. The link is the form upstream documents; no regular file could be right at build time (/proc/net/pnp exists only after the guest kernel's IP config), and a file carrying the address would be a second authority for runner_microvm_guest_resolver. A copy-at-boot unit is a moving part ordered against network-online.target for a fact the kernel produced before init, with shell semantics the link does not carry. Reasoning lives on runner_guest_resolver_link_command.

• extdeps.tools.gnu_coreutils ln_symbolic_force_command (ln -sfn), admitted on extdeps.exec.command argv_command like its rm/cp siblings.
• extdeps.linux.procfs ProcNetPnp, rostered, with the nfsroot document as a further citation on the model scope.
• gunbc.runner_guest_image runner_guest_resolver_link_command in runner_guest_tree_commands, after unsquashfs so the shipped entry is replaced. The stale drop-in annotation ("a file kind this build cannot create") is rewritten: the drop-in stays because systemd documents the regular-file form, not because a link was unavailable.

Frontier honesty (§4b(3), §3c)

guest_resolver_configuration_frontier stays unbound. Its trigger has two conjuncts: the image half lands here; the executing half — a booted, networked guest resolving github.com — cannot come from microvm_boot_probe (boots with GuestNetworkAbsent) and will come from the first test-label job (guest_agent_real_job_acceptance_frontier, step 3). The row now states the remaining trigger rather than being deleted on half its evidence.

Evidence

Local claim_batch (arm64 binary, this tree):

• the_resolver_is_a_link_to_the_kernels_pnp_placed_after_extraction_with_no_baked_address — PASS; FAIL under mutation (link replaced by cp_command), PASS restored.
• neighbours: the_agent_is_pulled_in_by_a_drop_in_systemd_will_actually_read, no_placement_relies_on_a_regular_file_in_a_wants_directory, the_credential_device_is_where_the_vm_config_puts_the_credential_drive, the_dns_grant_is_the_booted_resolver_and_no_other_host, every_procfs_path_renders_an_absolute_proc_path, procfs_availability_is_absent_for_every_path_on_darwin — PASS.
• v1_src_dag_parse clean on all six files.

Hardware (step 2) is held: srv1's microvm_host_converge (run 35472660220) installed Firecracker but /dev/kvm stays present-not-writable — the kvm grant applier is being wired by a sibling lane; the boot probe re-run and digest receipt follow that.

🤖 Generated with Claude Code

[gunbai-bot]

review 68813 addressed in 837fd00: -sfnT now has one declaration. The review's "no consumer" premise was wrong — shell.Symlink.AtomicReplace was called by gunbc.package_delivery publish_codex_runtime_current_link and by the event-log real-execution witness — so the resolution is a migration onto ln_symbolic_force_command (over run_shell_commands/LocalExec) followed by deleting the service, in the direction transport_argv_anemia_dissolution names. usb_gadget's hand-spelled ln -sf is its own declared frontier and is noted on the builder as folding here when it dissolves. Event-log witnesses PASS under --wet (3/3); the codex materialize wet witness runs on the floor.

— sent from zesty-crab-538

[gunbai-bot]

review 68907 addressed in e7e6725: the 2026-09-20 postscript is now carried verbatim on gunbc.rung_drop namespace_wave_admission_wall_removed restoration_trigger, so the projection reproduces it. For the record, it had already been dropped on main by #11789's own regen (it lived only in the hand-edited projection from #11774), so this restores an operator ruling that was lost independently of this PR. Main merged in (039cdaa); the heal regenerates the projection from the row.

— sent from zesty-crab-538

[gunbai-bot]

Two changes at 75182b6, composed on current main (post-#11791 workflow shape):

review 68937 — fixed at the type. procfs_availability ignored its path, so rostering ProcNetPnp made the roster witness assert /proc/net/pnp available on every Linux kernel. Now procfs_path_provision names the option a path depends on (CONFIG_IP_PNP), procfs_availability answers a new ProcfsConditionalOnKernelConfig arm for it, that arm is NOT available until read, the roster witness follows the provision, and the conditional path is pinned by name in its own witness.

review 68907's postscript — reverted per sunny-ant-606's ruling: a §4b(3) drop is retired by its trigger and nothing else, so restoration_trigger may not carry a later ruling's narrative. Its home is the gunbc.rung_drop_amendment carrier landing in #11795, joined to the drop by identity. This PR is the resolver change it is titled as.

— sent from zesty-crab-538

[gunbai-bot]

review 68980 addressed in 26fc5fe: every_procfs_path_renders_an_absolute_proc_path is restored verbatim — its deletion was an editing accident (a block replaced between two anchors it sat between), not a climb. The witness file's diff against main now removes exactly one assertion: available-on-Linux minted from the kernel family alone, which is the defect the provision fold exists to remove.

— sent from zesty-crab-538