Produce the V4.1 runtime image as a fleet-converge mode, and key its PRODUCED digest against the candidate

[gunbai-bot]

What this is

docs/plans/dsv41-cut-d-redesign.md D1: the authorization for the V4.1 experiment names the PRODUCED runtime image digest, and candidate identity is not authorization. gunbc.spark.v41_runtime_candidate keys the runtime axis today from a recipe, three FlashInfer wheels and the two storage-backed Engram patches — and nothing has ever produced the image. It could not: vllm_runtime_image_build_ci_wet needs the Spark administrator credential, which only the fleet job materializes, and gunbc.spark.v41_source_patch_converge's own frontier row named the missing sibling entry by name.

This lands that entry, as a mode, and the PRODUCED standing it feeds.

1 — the mode

spark_v41_runtime_image_build, beside spark_runtime_image_probe in the same dispatch-only fleet job. Four legs, each a precondition of the next:

1. verify the kernel wheels against the digests the candidate keys, before the build — an hours-long compile is an expensive place to learn that upstream re-published a wheel. The strength of this leg is stated at what it is (upstream drift) and not at what its name suggests: upstream's Dockerfile pip-installs flashinfer during the build, so these verified files are not, by this leg alone, the bytes the image carries. The binding readback is a declared frontier beside it, not an unstated gap.
2. converge the patched source and build from it — converge_vllm_runtime_image_with_patches, which digests each declared patch on the host and refuses on mismatch. This module chooses neither the revision nor the population.
3. read the produced digest back from inside the image through the probe route (v41_probe_image_in_place, factored out of the published probe: the pull is the published entry's precondition, not the question's).
4. admit the produced digest against the candidate.

Target is SPARK_CONVERGE_TARGET against the administrator roster; observe-only refuses; the host claim is the build's own (vllm_build_host_effect_term, 3 h, source-directory residue).

2 — PRODUCED is a third grain

	what it says	where
KEYED	what would be built — recipe, wheels, patches. No bytes.	v41_runtime_candidate
PRODUCED	bytes that exist on a host whose build key recomputes from the candidate's own recipe over the tree the build observed	new, v41_runtime_realized
REALIZED	an OCI-identified image joined to a rank-local row store — strictly more	v41_runtime_realized (already stood)

Produced does not mint realized: a never-pushed image has no manifest digest, and filling that field with the config digest would be two content addresses under one name. Produced mints no key of its own either — its whole content is the correspondence, so there is nothing new to hash. The join to REALIZED is a declared frontier (publication).

3 — the discriminating RED

A recomputation, not a comparison of two transcribed hashes: take the candidate's recipe, re-derive the key that observed tree would have to produce, require the build's key and tag to be exactly those. Five witnesses, all passing locally (claim_batch):

• an_image_built_from_this_candidates_recipe_and_tree_is_produced — the positive control
• a_produced_image_keyed_from_another_recipe_refuses — a real key (GLM 5.3 SM121 over the same tree), not a malformed value
• a_produced_image_built_from_another_revision_refuses
• a_produced_image_wearing_another_tag_refuses
• an_image_adopted_under_the_expected_tag_is_not_produced — the one a key comparison can never catch, since an adopted image carries the right key by construction

4 — the step budget, derived

A cold build of this image took ~75 min; the 60 min serving budget cuts it off mid-compile — the exact reason vllm_runtime_image_build's dissolve-on gave for the entry having no mode. The new budget is vllm_build_host_effect_term converted to minutes: a step allowed to outlive the claim that fences its host would be running in precisely the state that term exists to make visible. Job backstop moves 115 → 295, under the 360 ceiling.

5 — one preamble, not two

Reaching a Spark as the administrator is five facts in a fixed order; a second entry would have copied all of them. with_spark_build_host is that fold and the vanilla entry now consumes it. It hands back text and a verdict rather than the caller's own type because the compiler refuses a generic effectful declaration by name (carries both type parameters and a uses row); that refusal is quoted and its restoring capability declared as the trigger.

Evidence

• whole-corpus regen (generated_artifact_gate main_wet) exits 0 and rewrites only .github/workflows/fleet-converge.yml
• the five witnesses PASS under claim_batch

Not dispatched

No fleet dispatch has been made. The mode is the deliverable; the first build needs the operator's go, which I am asking for separately.

🤖 Generated with Claude Code