Repository navigation
Alias-aware SecretRef version resolution (#11935 blocker) - #11978
Closed
gunbai-bot[bot] wants to merge 9 commits into
Closed
gunbai-bot[bot] wants to merge 9 commits into
gunbai-bot[bot] wants to merge 9 commits into
Conversation
…stody roster gunbc.microvm_controller_app_key_converge becomes gunbc.host_credential_custody_converge: ONE fleet-converge mode whose credential is a dispatch choice over a CLOSED roster of custody rows. The controller key is the first row (its root:root 0400 / 0700 constants are now that row's fields); the approval ntfy publisher token is the second (root:gunbc-ntfy 0640 in a root:gunbc-ntfy 0750 directory, srv1 only). Each row carries SecretRef, path, host scope, file owner/group + mode ARM, and directory owner/group + mode ARM. Both far-side legs (exact mode, forbidden bits) derive from the arm; the owner leg takes -user/-group from the row. Row admission refuses, typed and located, a group-readable file under a directory that denies that group traversal (CustodyGroupCannotTraverse) or belongs to another group (CustodyDirectoryGroupDiffers). The delivery HumanIntervention is deleted; the mint (creating the ntfy user and adding its token to Secret Manager) stays a narrower human row. The token's SecretRef joins the fleet accessor roster. A permission-bits readback does NOT establish that a non-declared principal cannot open the file; this is necessary-but-not-sufficient for gunbc.rung_drop approval_store_single_writer_by_agreement and does not retire it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ng cleanup, ancestors-before-mutation) and #11845 (parent-listing absence) into the custody roster Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…s (review 69483) extdeps.posix.identity gains PosixOwnerNames + posix_owner_names_text and extdeps.tools.chown gains chown_names_argv, so the ':' separator stays spelled in one place. The custody rows' ownership IS that type (CustodyOwnership deleted), and the receipt wire uses the same text fn. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…eview 69483, parent ruling) extdeps.tools.chown chown_argv takes ChownOwner = ChownOwnerIds | ChownOwnerNames, and both render through extdeps.posix.identity posix_owner_pair_text, the one ':' spelling. chown_names_argv is removed; host_effect_realize and the srv3 witness wrap ChownOwnerIds; the custody row and gunbc.auth.approval_keyring_converge keyring_chown_argv use ChownOwnerNames. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Two conflicts, and the second was load-bearing rather than mechanical. .github/workflows/fleet-converge.yml is a generated projection and the driver refused it rather than answering, since both sides changed it since the merge base. Regenerated from the merged authorities instead of merged by hand; the result carries this branch's host_credential_custody_converge mode AND main's new modes (mtcollins1_census_image_publish, r2_bucket_ensure, app_key_version_verify, r2_bucket_admin_mint), with no microvm_controller_app_key surviving. A second gate run wrote nothing. dag/gunbc/runner/microvm_controller_app_key_converge.dag was a modify/delete: this branch deletes it as part of the rename to gunbc.host_credential_custody_converge, while #11946 edited it on main. Taking the delete is right, but the edit could not simply be discarded -- it relocated executor_bootstrap_principal from gunbc.runner_host_grants to gunbc.fleet_bootstrap_principal, and the replacement module still imported it from the old home. Resolving delete-vs-modify without reading main's edit would have produced a branch that merges cleanly and does not resolve. The import is repointed, and a census over the branch confirms no other importer takes executor_bootstrap_principal from runner_host_grants. The prose citation at the privilege law is left alone: it names bootstrap_principal_is_not_the_job_user, which did not move. Measured rather than assumed: compiling the replacement module's closure at this head reports 3 blocking errors, all 'shell' transport emission refusals in extdeps.gunbc, and all present in the same closure family on main. Compiling the deleted module ON main reports its own resolution failure (classify_host_file_presence, deleted by #11845) plus annotation-grain errors -- so main currently carries a module that does not resolve, and this merge removes it rather than inheriting it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
custody_file_exact_perm matched the mode arm and returned its own octal literal, while the same file's WRITE mode already derives its octal from gunbc.typed_remote_file_write remote_file_mode_octal. Two sources for one fact -- the mode a file is written at and the mode it is asserted at -- free to drift apart, in a module whose own header claims both far-side legs derive from the arm. This PR grew that from one arm to two, which is §2's test directly: net concepts must not grow by re-invention. The exact-mode leg now asks the owning authority and prefixes the leading zero find(1) wants. THE WITNESS LITERALS ARE DELIBERATELY LEFT AS LITERALS. The review noted the claim asserts "0400" and "/037" directly. Deriving those from the function under test would collapse the claim to measure() == measure() -- the change detector §5 names -- so they stay an independent oracle. That they are one is measured, not assumed: mutating remote_file_mode_octal's OwnerRead arm from "400" to "440" turns the_mode_legs_ask_for_the_arm_exactly_and_forbid_its_complement from true to false. Unmutated it is true, so the derivation yields the same octals the arm used to spell. Scope checked rather than assumed: the DIRECTORY arm is not a second instance. custody_dir_exact_perm's 0700/0750 have no other home -- directories are not written through typed_remote_file_write -- so it is the sole authority and is left alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
One conflict, the same modify/delete shape as the previous merge: dag/gunbc/runner/microvm_controller_app_key_converge.dag is deleted by this branch's rename and was edited on main by #11941. Main's edit is a pure annotation hoist -- an in-body // block moved to module-item grain -- with no semantic change, so the delete is still the right resolution. But discarding it would have lost the rationale, and the rationale is about a construction this branch KEPT: classify_staging_residue keys on a name that, as a free parameter, a caller could spell freely, and a name that does not match the staging path's basename reads a listing CONTAINING the residue as StagingAbsent -- a false absence that feeds a HELD verdict. Checked rather than assumed: the replacement preserves the construction. Its sole caller derives the key as path_basename of the staging path rather than accepting it. So the annotation is carried onto classify_staging_residue in the new module, at module-item grain, noting where it came from. The rationale outlives the module because the construction it explains does (DESIGN §4c: an annotation may preserve irreducible rationale about why a construction has its shape). The generated projections were regenerated rather than hand-merged and a second gate run wrote nothing. Compiling the replacement's closure reports the same 3 blocking errors as before the merge -- all 'shell' transport emission refusals in extdeps.gunbc, pre-existing on main -- and no annotation-grain diagnostic for the ported block. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Third merge of main into this branch, and the first whose conflicts were not all mechanical. fleet_converge_workflow_modes: both sides edited the roster. This branch replaced MicrovmControllerAppKeyConverge with HostCredentialCustodyConverge; main's #11751 added MicrovmNetworkObserve. Kept both -- main's roster with the rename applied -- rather than taking either side, which would have dropped the other's mode. Checked after regeneration: the emitted workflow carries host_credential_custody_converge and microvm_network_observe and no microvm_controller_app_key. microvm_controller_app_key_converge.dag: modify/delete again, and this time main's edit was #11942, a real repair -- observe_key_content was calling classify_host_file_presence, which #11845 deleted, and the repair rebuilds presence from the sibling's chain so that "I could not look" can no longer walk into the write path. The delete is still correct, and the repair is not lost by taking it: this branch's replacement already reads presence from an elevated parent listing and treats a listing that did not succeed as unobservable rather than absent. Same semantics, reached independently, and verified in the replacement rather than assumed from the port note. Noted rather than fixed, because it is not this PR's subject: after #11942, main's observe_key_parent_presence consumes runner_host_file_converge's repaired chain while this module re-spells the listing branch inline. Both are correct and fail-closed, and both use member_observe's argv and membership read, so the shared primitives are shared -- but they are two spellings of one decision and should converge on the sibling's chain in a follow-up. Measured: compiling the workflow closure reports 11 blocking errors at this head and 11 at origin/main, all in unrelated modules. The resolution introduces none. Generated projections regenerated, not hand-merged; a second gate run wrote nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Fourth merge, same two conflicts as the third: the fleet-converge mode roster and its generated YAML. Main's #11936 added FabricWriterIdentityObserve; this branch replaced MicrovmControllerAppKeyConverge with HostCredentialCustodyConverge. Resolved by taking main's roster with the rename applied, under an assertion that no mode present on either side is dropped -- the resolution refuses rather than silently losing one, since taking either side wholesale is exactly how a mode would disappear here. Emitted workflow carries host_credential_custody_converge and fabric_writer, and no microvm_controller_app_key. Regenerated rather than hand-merged; a second gate run left nothing unstaged. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Auto-opened duplicate: this branch's head was session/proud-fox-175's tip, so the diff was #11935's whole custody change rather than any work of mine. The alias fix is now committed on session/proud-fox-175 (2fdbe44) and carried by #11935 itself, where the blocker lives. Same artifact as #11979/#11980. |
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto-opened by session-dashboard for session
zesty-bee-268.Pushing to
pf175-aliasadvances this PR.Worker attestation
Before flipping this PR to ready for review, confirm each item:
npm test,cargo test) and the result.Closes #Ndirective.Summary
TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.
Test plan