orphan

.github/workflows/fleet-converge.yml

@@ -13,7 +13,7 @@ on:
       mode:
         description: plan shows membership hunks; apply executes a prior plan artifact; org_actions_observe validates the org credential and refuses on runner-group drift; org_runner_roster_observe reads the organization's self-hosted runner registrations to exhaustion under the same token and refuses unless the roster is complete; app_control_plane_observe reads the gunbai-ci App registration and webhook config with a short-lived App JWT and refuses on hook-config drift; app_key_version_verify reads the gunbai-ci App private key at the EXACT Secret Manager version named by app_key_version, mints an installation token with it, and refuses unless GitHub accepts it and the key's rotation deadline has not passed -- no add, disable or destroy; microvm_host_converge installs the cited Firecracker release on the selected host and reads the kvm grant back, refusing by name when the grant has not landed (the grant itself is applied by the full-host apply spine); guest_image_observe reports the micro-VM base artifacts and their measured digests on the selected host and builds nothing; guest_image_converge builds the runner guest image there; microvm_boot_probe boots that image and reads its serial console; spark_grants and spark_bootstrap prepare the selected Spark; spark_serving_apply applies the promoted fabric groups' pair vLLM units over the password session, workers before heads; spark_native_serving_apply relaunches group B's native four-rank arm as ONE BOUNDED TRANSACTION -- an all-host preflight that mutates nothing and refuses on any unresolved artifact from an earlier run, the incumbent UNIT preserved (plus a diagnostic inspect of the incumbent container -- the container itself cannot outlive its unit, because these run --rm in the foreground under systemd), the head applied BEFORE the workers so every rank joins the head's new rendezvous store, then a readback of the COMPLETE realization through each container's own inspect -- every field the create spec states, the effective --node-rank off that container's argv, and NCCL's typed transport verdict on that incarnation -- plus the head's front door answering with this arm's served model, and then commit or a rollback of the whole arm -- and it is a separate mode because it reloads a 328 GB arm and nobody should reach it by asking for the pair units; spark_runtime_image_probe pulls the pinned runtime image on the selected Spark and reads its capabilities from inside its own digest, changing nothing; host_reset_return drives a rostered reset subject through its controller and measures the return FROM A PEER, and takes reset_observer rather than host because the observer must not be the subject; runner_host_file_observe reads the runner teardown drop-in, the needrestart deferral and the loaded teardown on the selected host as its administrator and writes nothing; runner_host_file_converge writes whichever of those two files differs, reloads systemd only if the drop-in changed, and refuses unless the manager then reports the declared teardown
         required: true
-        options: [plan, launch_environment_plan, allocation_store_plan, apply, org_actions_observe, app_control_plane_observe, microvm_host_converge, guest_image_observe, guest_image_converge, microvm_boot_probe, spark_grants, spark_bootstrap, spark_serving_apply, spark_native_serving_apply, spark_runtime_image_probe, dashboard_deploy, approval_broker_dark_install, rlm_launch_deployment_receipt, host_reset_return, runner_host_file_observe, runner_host_file_converge, site_pxe_edge_observe, site_pxe_edge_converge, runner_password_session_tool_converge, r2_mint_preflight, r2_object_write_mint, org_runner_roster_observe, approval_keyring_converge, mtcollins1_boot, mtcollins1_fan_observe, mtcollins1_census_image_publish, microvm_controller_app_key_converge, app_key_version_verify]
+        options: [plan, launch_environment_plan, allocation_store_plan, apply, org_actions_observe, app_control_plane_observe, microvm_host_converge, microvm_network_observe, guest_image_observe, guest_image_converge, microvm_boot_probe, spark_grants, spark_bootstrap, spark_serving_apply, spark_native_serving_apply, spark_runtime_image_probe, dashboard_deploy, approval_broker_dark_install, rlm_launch_deployment_receipt, host_reset_return, runner_host_file_observe, runner_host_file_converge, site_pxe_edge_observe, site_pxe_edge_converge, runner_password_session_tool_converge, r2_mint_preflight, r2_object_write_mint, org_runner_roster_observe, approval_keyring_converge, mtcollins1_boot, mtcollins1_fan_observe, mtcollins1_census_image_publish, microvm_controller_app_key_converge, app_key_version_verify]
         type: choice
       target:
         description: "Spark target host for the spark_* modes, naming the administrator credential the run materializes (any rostered Spark: srv5, srv6, srv7, srv8, srv9, srv10, srv11, srv12); apply reads the subject off the plan artifact"
@@ -731,6 +731,26 @@ jobs:
           retention-days: 30
         if: always() && (github.event.inputs.mode == 'microvm_host_converge')
         timeout-minutes: 10
+      - name: "Runner micro-VM network: read the slot taps, ruleset and forwarding back into a receipt (installs nothing)"
+        id: microvm_network_observe
+        run: |
+          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+          "$ROOT/target/release/gunbc" run --source-root "$ROOT/dag" --source-root "$ROOT/src/v2" --entry dag/gunbc/runner/runner_microvm_network_converge.dag --function runner_microvm_network_observe_wet
+          cat "$ROOT/target/microvm-network-observe.txt"
+        env:
+          FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
+        if: github.event.inputs.mode == 'microvm_network_observe'
+        timeout-minutes: 30
+      - name: Upload runner micro-VM network converge receipt
+        id: microvm_network_observe_receipt_upload
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        with:
+          name: runner-microvm-network-observe-receipt
+          path: target/microvm-network-observe.txt
+          if-no-files-found: error
+          retention-days: 30
+        if: always() && (github.event.inputs.mode == 'microvm_network_observe')
+        timeout-minutes: 10
       - name: "Runner micro-VM: boot the guest image and read the serial console"
         id: microvm_boot_probe
         run: |

dag/extdeps/exec/command.dag

@@ -100,6 +100,9 @@ fn argv_command(program: NonEmptyStr, arguments: List<String>) -> ArgvCommand
     decl_ref(module_path: "extdeps.tools.conntrack", decl_name: "conntrack_list_expectations_command"),
     decl_ref(module_path: "extdeps.iproute2.ip_neigh", decl_name: "ip_neigh_flush_command"),
     decl_ref(module_path: "extdeps.iproute2.ip_neigh", decl_name: "ip_neigh_show_command"),
+    decl_ref(module_path: "extdeps.iproute2.ip_show", decl_name: "ip_addr_show_command"),
+    decl_ref(module_path: "extdeps.iproute2.ip_show", decl_name: "ip_route_show_command"),
+    decl_ref(module_path: "extdeps.tools.uname", decl_name: "uname_release_command"),
     decl_ref(module_path: "extdeps.tools.make", decl_name: "make_command"),
     decl_ref(module_path: "extdeps.package_managers.pip", decl_name: "pip_install_pinned_command"),
     decl_ref(module_path: "extdeps.package_managers.conda_forge", decl_name: "micromamba_create_command"),

dag/extdeps/iproute2/ip_show.dag

@@ -0,0 +1,51 @@
+module extdeps.iproute2.ip_show
+
+import std.types { String, NonEmptyStr, List }
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.uri { Uri, Https }
+import extdeps.exec.command { ArgvCommand, argv_command }
+import extdeps.iproute2.ip_neigh { ip_program }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "man7.org/linux/man-pages/man8/ip-address.8.html"
+  }
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.iproute2.ip_show",
+      decl_name: "ip_show_oneline_flag",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps_external_authority_anchor,
+  further_citations: []
+}
+
+// THE BINARY IS CONSUMED FROM extdeps.iproute2.ip_neigh rather than re-declared: one `ip` on a host,
+// one row naming it.
+//
+// -o PUTS EACH OBJECT ON ONE LINE, which is what makes a reading countable and greppable without a
+// parser: without it `ip addr show` wraps one interface across several lines and a line count stops
+// meaning anything. Reading is unprivileged, unlike the flush in the sibling module.
+data ip_show_oneline_flag: NonEmptyStr = "-o"
+
+data ip_show_ipv4_family_flag: NonEmptyStr = "-4"
+
+fn ip_addr_show_command(device: String) -> ArgvCommand {
+  argv_command(
+    program: ip_program,
+    arguments: [ip_show_oneline_flag as String, ip_show_ipv4_family_flag as String, "addr", "show", "dev", device],
+  )
+}
+
+fn ip_route_show_command(device: String) -> ArgvCommand {
+  argv_command(
+    program: ip_program,
+    arguments: [ip_show_oneline_flag as String, ip_show_ipv4_family_flag as String, "route", "show", "dev", device],
+  )
+}

dag/extdeps/linux/nf_conntrack.dag

@@ -0,0 +1,42 @@
+module extdeps.linux.nf_conntrack
+
+import std.types { String, NonEmptyStr }
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.uri { Uri, Https }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "www.kernel.org/doc/Documentation/networking/nf_conntrack-sysctl.txt"
+  }
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.linux.nf_conntrack",
+      decl_name: "nf_conntrack_helper_proc_path",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps_external_authority_anchor,
+  further_citations: []
+}
+
+// AUTOMATIC HELPER ASSIGNMENT, AS A SYSCTL THAT MAY NOT EXIST. nf_conntrack_helper attached a helper
+// to a flow by port with no rule saying so. Upstream removed it, so on a current kernel the path is
+// ABSENT -- which is a stronger reading than 0, because there is no setting left to turn back on. A
+// reader must therefore distinguish absent from 0 from 1, and never treat absence as unreadable.
+data nf_conntrack_sysctl_dir: NonEmptyStr = "/proc/sys/net/netfilter"
+
+data nf_conntrack_helper_sysctl_name: NonEmptyStr = "nf_conntrack_helper"
+
+// The full path, derived so the directory and the leaf cannot drift apart: a reader establishing the
+// sysctl's PRESENCE lists the directory and looks for the name, while a reader of its VALUE opens
+// the path, and both must name the same file.
+fn nf_conntrack_helper_proc_path_of() -> NonEmptyStr {
+  join([nf_conntrack_sysctl_dir as String, "/", nf_conntrack_helper_sysctl_name as String], "") as NonEmptyStr
+}
+
+data nf_conntrack_helper_proc_path: NonEmptyStr = nf_conntrack_helper_proc_path_of()

dag/extdeps/systemd/systemctl.dag

@@ -124,6 +124,13 @@ data systemctl_start_verb: NonEmptyStr = "start" as NonEmptyStr
 // verb rather than silently restarting, so this cannot degrade into that.
 data systemctl_reload_verb: NonEmptyStr = "reload" as NonEmptyStr
 
+// RESTART IS THE ONLY VERB THAT RE-RUNS A ONESHOT UNIT'S ExecStart. `start` on a RemainAfterExit
+// oneshot that is already active is a no-op, so a converge that installs new file contents and then
+// starts the unit leaves the OLD contents in effect while reporting success -- the fabricated-success
+// arm. A oneshot whose ExecStart is idempotent (nft -f replaces its own table) is safe to restart on
+// every converge, and that is what makes the installed bytes and the live state the same fact.
+data systemctl_restart_verb: NonEmptyStr = "restart" as NonEmptyStr
+
 fn systemctl_enable_argv(unit: NonEmptyStr) -> List<String> {
   ["systemctl", systemctl_enable_verb as String, unit as String]
 }
@@ -138,7 +145,7 @@ fn systemctl_start_argv(unit: NonEmptyStr) -> List<String> {
 }
 
 fn systemctl_restart_argv(unit: NonEmptyStr) -> List<String> {
-  ["systemctl", "restart", unit as String]
+  ["systemctl", systemctl_restart_verb as String, unit as String]
 }
 
 fn systemctl_disable_now_argv(unit: NonEmptyStr) -> List<String> {

dag/extdeps/systemd/unit_file.dag

@@ -270,8 +270,14 @@ fn systemd_readiness_from_active_state(mode: SystemdServiceMode) -> ReadinessFro
   }
 }
 
+// RemainAfterExit= IS WHAT MAKES A ONESHOT'S WORK OUTLIVE ITS PROCESS. systemd.service(5) (v255):
+// a Type=oneshot unit is "active" only while its ExecStart runs unless this is set, and with it the
+// unit stays active after the process exits -- which is how a unit whose job is to INSTALL state
+// (load a ruleset, apply a sysctl) reports that the state is in place rather than that a program is
+// running. The boolean renders as systemd's own yes/no rather than true/false.
 type SystemdServiceDirective
   = ServiceType { mode: SystemdServiceMode }
+  | RemainAfterExit { active: Bool }
   | ExecStartPre { command: NonEmptyStr }
   | ExecStart { command: NonEmptyStr }
   | ExecStartPost { command: NonEmptyStr }
@@ -297,6 +303,7 @@ type SystemdServiceDirective
   | ServiceTasksMax { count: Int }
   | TimeoutStopSec { duration: NonEmptyStr }
 
+
 // THE THREE RESOURCE-DISCIPLINE DIRECTIVES, AND WHY THE MIDDLE ONE IS A COPRODUCT AND NOT A STRING.
 //
 // `Nice=` and `IOSchedulingClass=` are what let a maintenance service share a host with the work
@@ -704,6 +711,7 @@ fn systemd_unit_directive_line(directive: SystemdUnitDirective) -> String {
 fn systemd_service_directive_line(directive: SystemdServiceDirective) -> String {
   match directive {
     ServiceType { mode: v } => join(["Type=", systemd_service_mode_wire(mode: v) as String], "")
+    RemainAfterExit { active: v } => join(["RemainAfterExit=", if v { "yes" } else { "no" }], "")
     ExecStartPre { command: v } => join(["ExecStartPre=", v as String], "")
     ExecStart { command: v } => join(["ExecStart=", v as String], "")
     ExecStartPost { command: v } => join(["ExecStartPost=", v as String], "")

dag/extdeps/tools/uname.dag

@@ -0,0 +1,35 @@
+module extdeps.tools.uname
+
+import std.types { String, NonEmptyStr, List }
+import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
+import std.decl_ref { DeclarationRef, WholeDeclaration }
+import extdeps.uri { Uri, Https }
+import extdeps.exec.command { ArgvCommand, argv_command }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri {
+    scheme: Https
+    locator: "pubs.opengroup.org/onlinepubs/9699919799/utilities/uname.html"
+  }
+}
+
+data extdeps_model_scope: ExternalModelScope = ExternalModelScope {
+  subject: ExternalSubjectRef {
+    declaration: DeclarationRef {
+      module_path: "extdeps.tools.uname",
+      decl_name: "uname_program",
+      field: WholeDeclaration
+    }
+  },
+  first_citation: extdeps_external_authority_anchor,
+  further_citations: []
+}
+
+data uname_program: NonEmptyStr = "uname"
+
+// `-r` PRINTS THE RELEASE, which is the spelling extdeps.linux.kernel LinuxKernelRelease is branded
+// on. It is the reading that says WHICH kernel a standing was established against, so a standing
+// read on one kernel is not silently carried onto another.
+fn uname_release_command() -> ArgvCommand {
+  argv_command(program: uname_program, arguments: ["-r"])
+}

dag/gunbc/ci/ci_spec.dag

@@ -835,6 +835,11 @@ data gunbc_ci_runner_microvm_host_converge_target: GunbcRunStepTarget = GunbcRun
   function: "runner_microvm_host_converge_wet",
 }
 
+data gunbc_ci_runner_microvm_network_observe_target: GunbcRunStepTarget = GunbcRunStepTarget {
+  entry: "dag/gunbc/runner/runner_microvm_network_converge.dag",
+  function: "runner_microvm_network_observe_wet",
+}
+
 data gunbc_ci_runner_host_file_observe_target: GunbcRunStepTarget = GunbcRunStepTarget {
   entry: "dag/gunbc/runner/runner_host_file_converge.dag",
   function: "runner_host_file_observe_ci_wet",
@@ -1111,6 +1116,7 @@ fn gunbc_run_step_targets() -> List<GunbcRunStepTarget> {
     gunbc_ci_runner_guest_image_observe_target,
     gunbc_ci_runner_guest_image_converge_target,
     gunbc_ci_runner_microvm_host_converge_target,
+    gunbc_ci_runner_microvm_network_observe_target,
     gunbc_ci_runner_host_file_observe_target,
     gunbc_ci_runner_host_file_converge_target,
     gunbc_ci_site_pxe_edge_observe_target,
@@ -2239,6 +2245,16 @@ fn gunbc_ci_runner_microvm_host_converge_invoke() -> String {
   )
 }
 
+fn gunbc_ci_runner_microvm_network_observe_invoke() -> String {
+  gunbc_run_step_script(
+    source_roots: witness_layer_roots,
+    entry: gunbc_ci_runner_microvm_network_observe_target.entry,
+    function: gunbc_ci_runner_microvm_network_observe_target.function,
+    claim_run: false,
+    receipt_rel: "target/microvm-network-observe.txt"
+  )
+}
+
 fn gunbc_ci_runner_host_file_observe_invoke() -> String {
   gunbc_run_step_script(
     source_roots: witness_layer_roots,