App Attest step 4: the six device routes on the approval broker as body-authenticated POSTs; wire header rows deleted, vectors regenerated, Swift mirror (stacked on #11989)

[gunbai-bot]

Step 4 of the iOS approval-app plan: the six device routes on gunbc.auth.approval_broker_serve, under decision B (msg_5b415336: every device operation is a POST whose body carries its authentication — gunbc serve hands a route no header but the tailnet login, and the seed's purpose standing refuses growing it for the approval product). Stacked on #11989 → #11981 → #11975 → #11970.

Wire (gunbc.auth.approval_device_wire) — one shape, no headers

• The three X-Approval-* header rows are deleted. ReadAuthentication { enrollment_id, requested_at, assertion_b64 } is the POST body of the three reads; PushUpdateRequest { auth, push } is the push-update body. Strict decoders with located refusals, same idiom as the rest of the wire. The assertion's client data (device_read_client_data, device_push_update_client_data) is unchanged — moving the carrier off the headers changed no signed byte.
• Fixtures: gunbc.auth.approval_device_redemption_fixtures renders read_authentication and push_update_request envelopes and a method_every_device_operation = POST surface row; dag/test/fixture/approval_device_redemption/vectors.json regenerated from the renderer (generated_artifact_gate main_wet_one), never hand-edited.
• Swift mirror: Wire.swift drops ReadHeader, sends readRequest(auth) / pushUpdateRequest(auth, push) bodies over POST for pending/fetch/readback/updatePush; ProtocolVectorTests checks the two new envelopes against the fixture bytes and the method row. (Still the first Swift this project has never executed — operator item.)

Routes (gunbc.auth.approval_device_routes, mounted by approval_broker_serve)

Six folds, each returning {status, JSON body}; the broker owns routing, markers (six new ApprovalBrokerMarker arms) and the process; the redemption/wire/verifier modules own every decision:

• POST /approve/device/enrol — decode → writer gate → verifier config → enrolment_admission over verify_attestation (client data = enrolment_transcript) → commit_enrolment → push registration stored (owner-only, last-write-wins file beside the slot) → EnrolmentGrant.
• POST /approve/device/redeem — decode → writer gate → redeem_device_over_store with verify_signature under the enrolment's decision key and verify_assertion over the signing input as verdicts.
• POST /approve/device/pending / …/requests/<segment> / …/enrollments/<segment> — admit_device_read (active enrolment, requested_at inside the ±60 s skew of the observed instant, assertion over the route's framed client data) then the pending listing / a FetchedRequest (stored request text, a MAC-keyed RedemptionChallenge with a 5-minute window, both verb capabilities via issue_capability) / the readback.
• POST /approve/device/push — writer gate + read admission, then the registration.
• The operator's verb issue_device_enrolment_code (a CliWireResponse): 4 entropy octets → 8 hex chars, 10-minute window, written through issue_enrolment_code; never a route.
• gunbc.roadmap_serve roadmap_mounts_during_cutover classifies all six as false — the total match the module built for exactly this reason.

Supporting authorities: gunbc.durable_cas_file_store cas_slot_keys (the store's own inverse of its layout — the one place a name becomes a key), gunbc.auth.approval_decision_store pending_escalations (keys from the listing, each standing through observe_escalation; an unreadable slot is carried, not dropped), and gunbc.auth.approval_app_attest_config — AppAttestVerifierAwaitingOperator today: bundle id ai.gunb.approve and the production environment are known; the App ID prefix and the distributed bundle version are the operator's, and until that row changes every route that needs the verifier refuses 503 naming what is missing (no guessed prefix).

Established by execution (claim_batch, exact head ba3dda3)

test.claim.approval_device_routes_witness_test (8): malformed bodies 400 on all six routes naming where; bad/non-canonical segment 400; readback for another enrolment 403 before any verification; the non-writer process 503 with the writer reason on a mutating route (which process is the non-holder is read from the gate); reads 503 "not configured" while the config row is awaiting the operator (the claim reads the row's arm, so it flips when the row does); the skew window brackets exactly [−60 s, +60 s) (on the wet route — Clock.TimestampAdd); the redemption status map; the roadmap mounts none of the six.
test.claim.approval_broker_serve_witness_test: the table selects the ten routes, the six device routes only as POST (GET → 405), and carries exactly ten.
test.claim.approval_device_wire_witness_test (28): the new bodies round-trip and refuse strictly at auth / assertion_b64 / push.

Mutation control: readback identity check inverted → a_readback_for_another_enrolment_refuses_403 FAIL, a_bad_segment_refuses_400 PASS; restored.

What this does not establish (honest)

The admitted paths — a real enrolment committing, a real redemption deciding, a real read answering — need (a) the operator's App ID prefix + bundle version in approval_app_attest_config, (b) a live store, and (c) the ECDSA execution route (decision A). They are the declared frontier ecdsa_verification_realization_frontier and are not faked with designed fixtures.

Nothing fired at srv1.

🤖 Generated with Claude Code

[briansrls]

APPROVE-MERGE at exact head 70687a30413d3797c53b3e870762f2fd2750f68c.

The current main-based tree preserves the reviewed App Attest step-4 design and resolves the two source conflicts correctly.

• approval_broker_serve consumes the relocated HttpMethod/GET/POST authority and still carries exactly six device handlers, each mounted only as POST and dispatched to its corresponding route fold.
• floor_route_gap keeps main's chunk-13 population and appends exactly the bound-realization wet control. That identity is also in local_repo_wet_schedule; its first unmocked effect is the enrolment-store Filesystem.Read, so the wet standing is honest rather than a designed substitute.
• docs/design-rung-drops.md is regenerated, and the exact-head generated-artifact gate passes.

The security-critical route seams remain coherent:

• the three unreadable X-Approval-* header authorities are deleted; reads carry strict ReadAuthentication JSON and push carries { auth, push };
• the Swift client sends the same six POST shapes and signs the same canonical route/client-data projections the server reconstructs;
• writer admission precedes decoding on enrolment, redemption and push-update writes;
• native crypto admission precedes store reads or verifier calls and remains fail-closed until one receipt covers P-256 signature verification, App Attest attestation and assertion verification, and the P-256 base-point-order fact;
• read admission requires an active enrolment, canonical timestamps in the [-60s,+60s) window, an assertion over the exact route bytes, and an atomic per-enrolment counter advance before the operation;
• path identities are canonicalized and the store rejects non-slot-addressable keys before any filesystem read.

The later repairs are accepted:

1. device_instant_minus is deleted. Skew is now pure signed-second arithmetic over fully canonical UTC instants, with leap-day, year-boundary, exact-boundary and non-canonical controls.
2. The redemption-gate claim supplies a decodable signed-redemption body at the route interface instead of paying to mint capability tags it never inspects. The real body decoder remains executed by the wire witness, so this is a legitimate witness split rather than lost evidence.
3. The one bound-realization control remains wet for the structural reason stated: device_pending_response_at owns the store read and accepts no store observation. Its route-gap and wet-schedule enrollments agree.
4. CasGenerationSpaceExhausted is carried through gunbc.compute.attempt_lifecycle as its own typed store refusal rather than becoming a non-exhaustive or generic failure.
5. The prior linear-generation lifetime cliff is absent; the counter wet population covers replay, per-enrolment standing, races, interleaving and operation beyond the former 4096 bound.

Run 36060763867 passes compiler, clippy, emit-build, floor and witnesses at this exact SHA. GitHub reports CLEAN and mergeable.

No source condition remains. Current main has advanced by two emitter commits since this head; the merge queue must adjudicate that composed revision normally. A queue red is a repair/requeue event, never grounds to bypass the queue.