mtcollins1_boot: WIF-trusted recurring effect via auth pattern selection, with an operator maintenance hold

dag/extdeps/cloud/gcp/gcp.dag

@@ -76,6 +76,35 @@ type WifProvider {
   attribute_condition: String?
 }
 
+// THE WIRE SHAPES A READ OF A POOL AND ITS PROVIDERS RETURNS (cloud.google.com/iam/docs/reference/rest,
+// projects.locations.workloadIdentityPools get and .providers list, read 2026-09-23). A provisioning
+// run that finds a pool, provider or account already present must READ what is there before it
+// grants anything through it; these are what it reads. Names are the full resource names the service
+// answers in; state is ACTIVE or DELETED.
+type WifOidcWire {
+  issuer_uri: String
+}
+
+type WifProviderWire {
+  name: String
+  disabled: Bool?
+  state: String?
+  attribute_mapping: Map<String, String>?
+  attribute_condition: String?
+  oidc: WifOidcWire?
+}
+
+type WifPoolWire {
+  name: String
+  display_name: String?
+  disabled: Bool?
+  state: String?
+}
+
+type WifProviderListWire {
+  workload_identity_pool_providers: List<WifProviderWire>?
+}
+
 fn wif_pool_resource(project_number: String, pool_id: String) -> String {
   concat(
     concat(concat("projects/", project_number), "/locations/global/workloadIdentityPools/"),

dag/extdeps/cloud/gcp/iam_admin.dag

@@ -3,9 +3,9 @@ module extdeps.cloud.gcp.iam_admin
 
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
-import extdeps.cloud.gcp.gcp { GcpProjectId, ServiceAccountEmail }
+import extdeps.cloud.gcp.gcp { GcpProjectId, ServiceAccountEmail, WifPoolWire, WifProviderWire, WifProviderListWire }
 import extdeps.cloud.gcp.iam { GcpPolicy, GcpBinding }
-import std.types { Int, List, Map, NonEmptyStr, Secret, String }
+import std.types { Bool, Int, List, Map, NonEmptyStr, Secret, String }
 import extdeps.transports.rest { RestOutcome }
 import v2.std.network { POST }
 import extdeps.transports.rest { RestOutcome }
@@ -54,6 +54,11 @@ data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
 // goes through. The WRITE carries the same optionality for the same reason and one nobody had hit:
 // setIamPolicy returns the policy it stored, so revoking the LAST binding answers with an etag alone.
 // Rostered as gunbc.recurring_failure_mode required_output_field_absent_for_an_empty_upstream_resource.
+// ListWorkloadIdentityPoolProviders READS THE WHOLE PROVIDER POPULATION OF ONE POOL, deleted ones
+// included: a soft-deleted provider can be undeleted into the pool within its retention window, so a
+// classification that could not see it would call a pool single-provider while a second admission
+// rule waits one call away. GetWorkloadIdentityPool and it are what a provisioning run reads before
+// it writes anything through an existing pool (gunbc.auth.heal_publisher_provision).
 service gcp.IamAdmin {
   config {
     endpoint: "https://iam.googleapis.com"
@@ -217,4 +222,41 @@ service gcp.IamAdmin {
       5xx => GcpErrorShape
     }
   }
+
+  operation GetWorkloadIdentityPool {
+    input { access_token: Secret, project_id: GcpProjectId, pool_id: NonEmptyStr }
+    output { pool_name: String from "name", display_name: String?, disabled: Bool?, state: String?, outcome: RestOutcome }
+    readonly
+    transport rest {
+      method: GET,
+      path: "/v1/projects/\{project_id\}/locations/global/workloadIdentityPools/\{pool_id\}"
+    }
+    response {
+      200 => WifPoolWire
+      401 => GcpErrorShape
+      403 => GcpErrorShape
+      404 => GcpErrorShape
+      429 => GcpErrorShape
+      5xx => GcpErrorShape
+    }
+  }
+
+  operation ListWorkloadIdentityPoolProviders {
+    input { access_token: Secret, project_id: GcpProjectId, pool_id: NonEmptyStr }
+    output { providers: List<WifProviderWire>? from "workloadIdentityPoolProviders", outcome: RestOutcome }
+    readonly
+    transport rest {
+      method: GET,
+      path: "/v1/projects/\{project_id\}/locations/global/workloadIdentityPools/\{pool_id\}/providers",
+      query: { showDeleted: true }
+    }
+    response {
+      200 => WifProviderListWire
+      401 => GcpErrorShape
+      403 => GcpErrorShape
+      404 => GcpErrorShape
+      429 => GcpErrorShape
+      5xx => GcpErrorShape
+    }
+  }
 }

dag/extdeps/github/actions.dag

@@ -191,10 +191,15 @@ type WorkflowSecret {
   scope: SecretScope
 }
 
+// `environment` is the job's deployment environment (docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idenvironment,
+// read 2026-09-23). It is a real job key with a security consequence: a job that names one carries it
+// in its OIDC token as the `environment` claim and its `sub` becomes
+// repo:<owner>/<repo>:environment:<name>, so a federation can pin one job by it.
 type Job {
   id: String
   name: String?
   runner: RunnerSpec
+  environment: String?
   steps: List<Step>
   needs: List<String>
 

dag/extdeps/languages/yaml/gha_workflow.dag

@@ -456,20 +456,23 @@ fn job_yaml(job: Job) -> YamlValue {
       concat(
         optional_string_list_kv(key: "needs", items: job.needs),
         concat(
-          optional_int_kv(key: "timeout-minutes", value: job.timeout_minutes),
+          optional_string_kv(key: "environment", value: job.environment),
           concat(
-            optional_string_kv(key: "if", value: job.if_condition),
+            optional_int_kv(key: "timeout-minutes", value: job.timeout_minutes),
             concat(
-              optional_job_permissions_kv(perms: job.permissions),
+              optional_string_kv(key: "if", value: job.if_condition),
               concat(
-                optional_job_concurrency_kv(spec: job.concurrency),
+                optional_job_permissions_kv(perms: job.permissions),
                 concat(
-                  optional_job_outputs_kv(entries: job.outputs),
+                  optional_job_concurrency_kv(spec: job.concurrency),
                   concat(
-                    [kv(key: "steps", value: steps_yaml(steps: job.steps))],
+                    optional_job_outputs_kv(entries: job.outputs),
                     concat(
-                      optional_env_mapping(entries: job.env),
-                      optional_bool_kv(key: "continue-on-error", value: job.continue_on_error)
+                      [kv(key: "steps", value: steps_yaml(steps: job.steps))],
+                      concat(
+                        optional_env_mapping(entries: job.env),
+                        optional_bool_kv(key: "continue-on-error", value: job.continue_on_error)
+                      )
                     )
                   )
                 )

dag/gunbc/assimilate/bmc_token_federation.dag

@@ -200,6 +200,7 @@ fn bmc_token_smoke_job() -> Job {
     id: "bmc_token_smoke",
     name: none,
     runner: gunbc_ci_runner_spec(),
+    environment: none,
     steps: [bmc_checkout_step(), gcp_wif_auth_step(), gcp_token_smoke_step()],
     needs: [],
     env: none,

dag/gunbc/auth/authorization_pattern_selection.dag

@@ -91,6 +91,36 @@ type BillingConsequence
   = BillsExternally
   | NoBillingConsequence
 
+// A STANDING AUTHORIZATION FOR A RECURRING DESTRUCTIVE EFFECT (operator ruling 2026-09-23, the Mt.
+// Collins boot; side-chat review 5286225278 on gunbc#12101). An irreversible effect owes a human
+// witness; a RECURRING one must run unattended; the two together select nothing (NoAdmissiblePattern),
+// and relabelling the effect reversible to escape that is the fabricated input the review refused.
+// The honest third reading is that the operator has witnessed the CLASS once, ahead of every
+// instance, and made that consent conditional on a durable physical-safety interlock the run must
+// observe released. That is what this carries: who ruled, when, over which effect, and the interlock
+// the consent is conditional on. It discharges ONLY the irreversibility ground of the witness
+// obligation -- a wide credential, a third-party bill or a break-glass effect is still witnessed per
+// instance.
+//
+// THIS RECORD IS NOT THE CONSENT, AND IT MUST NAME WHAT IS (review 70369). A row in the corpus is
+// author-written, so it cannot attest that the operator agreed (DESIGN §5: approval is external to
+// the diff). confirmation_read names the effectful read that finds the operator's stored approval of
+// the ruling's exact words; the site's realization must require its result before any write, so a
+// forged row yields a selection but no effect. What the census checks statically is only that the
+// interlock and the confirmation route are named against the site
+// (gunbc.auth.privileged_effect_census rulings_without_a_rostered_interlock); the attestation itself
+// is the operator's tap, read at run time.
+type StandingDestructiveAuthorization {
+  ruling_text: NonEmptyStr
+  effect_subject: NonEmptyStr
+  interlock: DeclarationRef
+  confirmation_read: DeclarationRef
+}
+
+type WitnessDischarge
+  = NoWitnessDischarge
+  | StandingRulingUnderInterlock { ruling: StandingDestructiveAuthorization }
+
 type PrivilegedEffect {
   subject: NonEmptyStr
   frequency: HumanInterventionFrequency
@@ -99,6 +129,7 @@ type PrivilegedEffect {
   workload_identity: WorkloadIdentityStanding
   minted_reach: MintedCredentialReach
   billing: BillingConsequence
+  witness_discharge: WitnessDischarge
 }
 
 // ── Two obligations DERIVED from the characteristics, never accepted as input ─────────────────
@@ -109,8 +140,12 @@ type PrivilegedEffect {
 // file, and §5 says a check that can be satisfied by editing the declaration while the realization
 // still lies was validation standing where construction was available.
 fn witness_required(e: PrivilegedEffect) -> Bool {
-  let irreversible = match e.reversibility {
-    IrreversibleEffect { what_is_lost: _ } => true
+  let irreversible_undischarged = match e.reversibility {
+    IrreversibleEffect { what_is_lost: _ } =>
+      match e.witness_discharge {
+        NoWitnessDischarge => true
+        StandingRulingUnderInterlock { ruling: _ } => false
+      }
     ReversibleByReapply => false
   }
   let wide = match e.minted_reach {
@@ -129,7 +164,7 @@ fn witness_required(e: PrivilegedEffect) -> Bool {
     DeviceOnce => false
     EveryProvision => false
   }
-  irreversible || wide || bills || break_glass
+  irreversible_undischarged || wide || bills || break_glass
 }
 
 // AN EFFECT PAID ON EVERY PROVISION MUST RUN UNATTENDED. There is no human at the end of a cron, and
@@ -438,6 +473,7 @@ data id_param_surface: DeclarationRef = decl_ref(module_path: "gunbc.auth.author
 data id_param_workload_identity: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "param_workload_identity")
 data id_param_minted_reach: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "param_minted_reach")
 data id_param_billing: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "param_billing")
+data id_param_witness_discharge: DeclarationRef = decl_ref(module_path: "gunbc.auth.authorization_pattern_selection", decl_name: "param_witness_discharge")
 
 data var_authorization_pattern: DecisionVariable = DecisionVariable { identity: id_var_pattern }
 
@@ -467,9 +503,10 @@ data param_surface: ContextParameter = ContextParameter { identity: id_param_sur
 data param_workload_identity: ContextParameter = ContextParameter { identity: id_param_workload_identity }
 data param_minted_reach: ContextParameter = ContextParameter { identity: id_param_minted_reach }
 data param_billing: ContextParameter = ContextParameter { identity: id_param_billing }
+data param_witness_discharge: ContextParameter = ContextParameter { identity: id_param_witness_discharge }
 
 fn context_parameters() -> List<ContextParameter> {
-  [param_frequency, param_reversibility, param_surface, param_workload_identity, param_minted_reach, param_billing]
+  [param_frequency, param_reversibility, param_surface, param_workload_identity, param_minted_reach, param_billing, param_witness_discharge]
 }
 
 fn frequency_text(f: HumanInterventionFrequency) -> String {
@@ -511,6 +548,16 @@ fn minted_reach_text(m: MintedCredentialReach) -> String {
   }
 }
 
+// THE RULING IS QUOTED WITH ITS AUTHOR, DATE AND INTERLOCK, so a receipt minted under a standing
+// authorization is a different decision scope from one minted without it.
+fn witness_discharge_text(d: WitnessDischarge) -> String {
+  match d {
+    NoWitnessDischarge => "NoWitnessDischarge"
+    StandingRulingUnderInterlock { ruling: r } =>
+      join(["StandingRulingUnderInterlock: confirmed by ", declaration_ref_display_key(ref: r.confirmation_read), " under ", declaration_ref_display_key(ref: r.interlock), "; ruling ", r.ruling_text as String], "")
+  }
+}
+
 fn billing_text(b: BillingConsequence) -> String {
   match b {
     BillsExternally => "BillsExternally"
@@ -528,6 +575,7 @@ fn parameter_dispositions(e: PrivilegedEffect) -> List<ParameterDisposition> {
     ParameterBound { parameter: id_param_workload_identity, evidence: workload_identity_text(w: e.workload_identity) as NonEmptyStr },
     ParameterBound { parameter: id_param_minted_reach, evidence: minted_reach_text(m: e.minted_reach) as NonEmptyStr },
     ParameterBound { parameter: id_param_billing, evidence: billing_text(b: e.billing) as NonEmptyStr },
+    ParameterBound { parameter: id_param_witness_discharge, evidence: witness_discharge_text(d: e.witness_discharge) as NonEmptyStr },
   ]
 }