Skip to content

orphan - #11938

Closed
briansrls wants to merge 46 commits into
mainfrom
fix/11751-merge-main
Closed

orphan#11938
briansrls wants to merge 46 commits into
mainfrom
fix/11751-merge-main

Conversation

@briansrls

@briansrls briansrls commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

Auto-opened by session-dashboard for session sunny-ant-606.
Pushing to fix/11751-merge-main advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

  • Title describes the change (not the session id or branch).
  • PR body summarises what and why (replace the TODO below).
  • Tests run: name the command (e.g. npm test, cargo test) and the result.
  • If this closes a work item, the body contains a Closes #N directive.
  • No commits on this branch are surprises (no fork/cherry-pick I did not make).
  • No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

  • TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

gunbc-ci-auto-heal and others added 30 commits September 19, 2026 02:32
gunbc-ci-auto-heal @claude
microVM guest network: tap-grain default-deny egress, slot network re…
6a0d5c6 
…adback, workspace staging gate

- runner_microvm_network: tap-scoped egress rules in the forward chain (established; v6 drop;
  private/link-local/multicast denials above the grants; DNS and TCP 443; final tap drop). Chain
  policy stays accept for dockerd coexistence, so runner_host_filtered_egress DefaultDrop is honoured
  at tap grain, not host grain.
- SlotNetworkReadback (Confirmed / Refuted{fact} / Unobservable{fact}) over tap unheld, guest
  conntrack empty after flush, and nft listing digest == converged digest; plus the conntrack
  flush/list and nft list commands that produce the observations.
- runner_attempt_launch: staging_verdict gates the jailer on a read-back workspace (create exit,
  mke2fs exit, dumpe2fs superblock magic and size); every failure refuses under its own name.
- extdeps: nft daddr/dport/nfproto matches, nft list table, conntrack(8), dumpe2fs -h.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Declare the readback and staging consumers as typed frontiers; drop t…
aaabe6b 
…he present-tense consumption claim

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Bind the workspace standing once; one optional-returning readback sel…
2431ad6 
…ector instead of two singleton-list folds

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Fold the guest egress rules from one typed policy; narrow DNS to the …
e5830d1 
…booted resolver; filtered-egress consumes the policy

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Split per-host egress grain from the shared guest policy; admit repli…
4d701dd 
…es in their own direction

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Consume std.types Port for nft dport and egress grants; compare diges…
c8fba5b 
…ts through content_hash_eq_cryptographic

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Take the nft ruleset out of the per-attempt plan; declare the host co…
145f93f 
…nverge as its installer

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Denied destinations are typed Ipv4Prefix rows rendered through the ip…
a75964b 
…v4 authority

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Drop prose denials that restate the typed guest policy and the forwar…
9af5eae 
…d chain

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Readbacks carry their subject; workspace readback bound to the planne…
25574f8 
…d image; denials precede every guest-side accept; tap v6 refused before conntrack

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Sealed sanitation subject joined to a generation-bound ConvergedSlotN…
f5be184 
…etwork receipt; v6 disabled on tap and guest; neighbour and expectation readbacks; helper standing over the effective host policy

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal
Merge remote-tracking branch 'origin/main' into session/merry-ibex-866
b22f273
gunbc-ci-auto-heal @claude
Bind the slot network readback result to its sanitation subject
a86f37d 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Realize the guest policy in the input hook; one guest boot-argument s…
25b590e 
…pelling on every host

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Refuse v6 toward a tap in forward and output; annotations name the di…
4791dd4 
…rection each v6 rule covers

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Tap-scoped default-deny names the toward-a-tap direction: final oifna…
2ecfc09 
…me drop on the shared hosts

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
The slot install fold carries the v6 sysctl file it declares
3961ac5 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal
Merge remote-tracking branch 'origin/main' into session/merry-ibex-866
0b96a61
gunbc-ci-auto-heal @claude
microVM network converge: install the slot taps, ruleset and forwardi…
11fbe4d 
…ng, then read the host back into a receipt

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal
Merge remote-tracking branch 'origin/main' into session/merry-ibex-866
f15ac48 
# Conflicts:
#	dag/gunbc/fleet/fleet_converge_workflow.dag
gunbc-ci-auto-heal @claude
Wire the converge's imports and slot roster; the network mode declare…
60212fd 
…s its ssh-key demand

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Regenerate the sudoers rosters and fleet-converge workflow for the mi…
65ca33b 
…croVM network mode

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
The two network frontiers name what landed and what a run must still …
f9fc5fc 
…establish

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Read every helper surface, match the route the kernel prints, bind th…
3edbc41 
…e requested host, and persist the whole receipt

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Regenerate the sudoers rosters for the legacy xtables and userspace h…
68021c1 
…elper probes

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
An absent helper sysctl names the kernel it is absent from, or it is …
d1b7d8e 
…unread

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Supply the dispatched host to the step, reclassify the local mode, ma…
58a70a4 
…ke the receipt a parseable value, and give ip_forward and the slot probes their own unread arms

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Regenerate fleet-converge.yml for the host binding and ssh-key reclas…
cc63588 
…sification

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal
Merge remote-tracking branch 'origin/main' into session/merry-ibex-866
d6291a3 
# Conflicts:
#	.github/workflows/fleet-converge.yml
gunbc-ci-auto-heal @claude
Regenerate fleet-converge.yml at the merged head
e80a17b 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal and others added 16 commits September 20, 2026 10:23
gunbc-ci-auto-heal @claude
The persisted receipt leads with its schema and the claim parses the …
74bf5ce 
…bytes the converge writes

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Model the nft loader unit through the systemd unit-file authority; de…
784f6da 
…code the fabric lifetime sample's digests through their optionals

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal
Merge remote-tracking branch 'origin/main' into session/merry-ibex-866
6745f4e 
# Conflicts:
#	.github/workflows/fleet-converge.yml
#	dag/gunbc/fleet/fleet_converge_workflow.dag
gunbc-ci-auto-heal @claude
Regenerate fleet-converge.yml at the merged head
875fe8a 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
The job user is granted the reads and none of the mutations; the mode…
ecd954a 
… observes and records

The install+restart pair over a grantee-writable staged path was root-equivalent: the job user
stages these files and also executes job steps, so it could write its own ExecStart= and have
root run it (review 69104). The roster now carries the readbacks only, the mutating half waits on
a principal the job user cannot impersonate, and the mode is named for what it does.

Also fixes two latent defects on main that its own newly landed Optional checker refuses:
fabric_required_build_cell's lifetime-sample digests and workflow_dispatch_input's trigger index.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Regenerate the rosters and workflow: reads granted, mutations withdrawn
bf587c2 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
The mutation frontier names the folds it covers
a961870 
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal
Merge remote-tracking branch 'origin/main' into session/merry-ibex-866
d1e175a 
# Conflicts:
#	.github/workflows/fleet-converge.yml
#	dag/extdeps/systemd/unit_file.dag
#	dag/gunbc/fabric/fabric_required_build_cell.dag
#	dag/gunbc/fleet/fleet_converge_workflow.dag
gunbc-ci-auto-heal @claude
The ssh-key classification is named as flipping with the mutation pri…
fc721c3 
…ncipal, not a standing fact

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
The census row says what the observe fold does: it mutates nothing; t…
88b7671 
…he grant fold drops its unused slot roster

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Restore the single SystemdServiceDirective header ahead of its full a…
3cfea8e 
…rm list

My merge resolution moved the RemainAfterExit annotation above the type and left a second
two-arm header below, orphaning ~25 arms of a widely consumed coproduct (review 69165).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Merge main: take the union of the converge mode rosters and regenerat…
b8dece7 
…e the workflow

Three conflicts, each resolved at the authority rather than in the bytes.

fleet_converge_workflow_modes: both sides appended. Taking either side would
have deleted the other's modes while the match arms below -- which git merged
cleanly -- still named all of them, so the roster and the arms would have
disagreed. The roster is the union at 31 modes, and the type arms, the roster
and fleet_converge_mode_scope are now checked to agree exactly.

workflow_dispatch_input_witness_test: main landed the same Optional repair
independently and its annotation is the better one, citing
witness_that_fails_to_compile_is_absent_rather_than_red rather than describing
the fix locally. Main's side taken whole; the two controls this branch added
are untouched.

fleet-converge.yml is generated, and the merge driver refused it rather than
answering with a side -- correctly, because neither side's bytes are the
projection of the merged authorities. It is regenerated from the merged
sources, not hand-edited: the result differs from BOTH parents, restoring the
seven spark_native_serving_apply occurrences this branch had dropped to zero
while keeping this branch's FLEET_CONVERGE_EXPECTED_HOST step. Re-running the
gate changes nothing, so it is at its fixed point.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Merge main again: union the roster with MicrovmControllerAppKeyConver…
f8f760f 
…ge and regenerate

Same two paths as the previous merge and the same resolution, because they are
the program's shared spine: #11765 and #11679 are sibling microVM lanes editing
fleet_converge_workflow.dag, so every lane in this program serializes on this
file and its generated projection.

Roster is the union at 32 modes -- this branch's MicrovmNetworkObserve beside
main's MicrovmControllerAppKeyConverge -- with the type arms, the roster and
fleet_converge_mode_scope checked to agree exactly. The workflow YAML is
regenerated from the merged sources and carries both.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Merge main: union the roster with AppKeyVersionVerify and regenerate
c611e38 
Third merge of the same two paths in one session, same resolution: the roster
is the union at 33 modes (this branch's MicrovmNetworkObserve beside main's
AppKeyVersionVerify), with the type arms, the roster and
fleet_converge_mode_scope checked to agree exactly, and the workflow YAML
regenerated from the merged sources rather than resolved as bytes.

That this is the third time is the finding, not the incident: every lane in
the microVM program edits this one flat roster and its generated projection,
so the lanes serialize on it and each pass costs a full regeneration.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
Merge main: union the roster with MtCollins1CensusImagePublish and re…
701ac1d 
…generate

Fourth merge of the same two paths. Roster is the union at 34 modes, with the
type arms, the roster and fleet_converge_mode_scope checked to agree, and the
workflow YAML regenerated from the merged sources.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gunbc-ci-auto-heal @claude
The wire-parse family carries a typed frontier row, not an annotation
cd2041c 
Review 69448 is right: parse_converged_slot_network and the eleven folds
around it have no production consumer -- git grep finds only the definition,
one prose comment and the witness file -- while the render half beside them is
genuinely consumed by receipt_text. Every other unconsumed surface in this
module already states that in a typed DissolutionCondition row
(host_ruleset_installer_frontier, converged_slot_network_producer_frontier,
slot_network_readback_consumer_frontier, guest_resolver_configuration_frontier);
the parse half rested on a // annotation, and DESIGN section 4c is explicit
that an annotation is never evidence that a machine claim holds, because no
Accepted program can read one.

So the gap now carries the same row shape the module already uses: it names
the consumer and why that consumer cannot avoid the parse (the lifecycle
controller runs in a LATER PROCESS than the converge that wrote the receipt,
so it cannot hold the in-memory value and must recover it from the artifact),
enumerates the twelve folds it covers, and states a trigger in the
capability form section 4b(3) requires, with an explicit NOT-satisfied-by
clause that rules out the three ways this could be declared discharged
without the controller existing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@gunbai-bot

gunbai-bot Bot commented Sep 21, 2026

Copy link
Copy Markdown
Contributor

Closing: this branch was a scratch branch for resolving #11751's merge conflict, not a change of its own. The dashboard auto-opened a PR for it.

The resolution is now on session/merry-ibex-866 at fa7b6faff12, so it is carried by #11751 where it belongs.

— sent from sunny-ant-606

@gunbai-bot gunbai-bot Bot closed this Sep 21, 2026
@gunbai-bot
gunbai-bot Bot deleted the fix/11751-merge-main branch September 21, 2026 03:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@briansrls