A microVM guest registers only under its own attempt label, and the shakedown job it serves exists

[gunbai-bot]

Stacked on #12011. Covers step (1) of the real-run plan: the microVM guest can no longer register under the host's production labels, and the job it exists to serve now exists.

What was wrong

The JIT mint derived its labels from gunbc.runner_registration_labels, which produces [self-hosted, linux, arm64, gunbc-heavy, <host>]. That is the label set fleet-desired.yml and the srv1-pinned fleet-converge jobs target, so the first real attempt could have taken a production converge job inside the shakedown VM. The existing positive control pinned exactly that set.

What changes

• gunbc.runner_jit_mint: the labels are derived from the attempt alone. jit_config_request_for no longer takes a label list. A registration carries self-hosted plus its own runner name, which is already the attempt's unit name. A caller cannot hand in the host set. The LabelsUnresolved refusal arms can no longer be reached, so they are deleted.
• gunbc.runner_microvm_shakedown_workflow emits .github/workflows/microvm-shakedown.yml (a new generated artifact). It is a workflow_dispatch job with runs-on: [self-hosted, ${{ inputs.attempt }}]. Its known task hashes a fixed payload with the guest's sha256sum. The job fails unless the result equals the digest extdeps.crypto.sha2 derives from the same payload in the model (ccb509dd…, cross-checked against a real sha256sum). It writes one result line to the job summary: attempt, runner, revision, run. There is no checkout and no action. The attempt input reaches the script through env, never by interpolation.

Not closed here, declared

GitHub's runner agent adds default labels (self-hosted, OS, architecture). Whether a JIT registration also gets the OS and architecture labels is not modeled. If it does, the guest would also match [self-hosted, linux, arm64], which witnesses.yml, heal.yml and one fleet-converge job use. That arm is closed by the runner group, not the label: microvm_jit_runner_group_restriction_frontier names a group restricted to this workflow file, which is also why the job is its own file. That frontier blocks every real attempt until it lands. How the group gets created is escalated.

Evidence (local, fresh claim_batch at this head)

• 9/9 JIT witnesses in github_app_registry_witness_test PASS. The new witness_jit_mint_carries_no_host_production_label refuses any host, class, OS or arch label; its red is the previous set.
• 2/2 in runner_microvm_shakedown_workflow_witness_test PASS. Its injection claim's red is the first writing of the script.
• generated_artifact_gate main_wet regenerates the tree with no drift beyond the new file and its .gitattributes row.

🤖 Generated with Claude Code

[gunbai-bot]

Both findings in review 70414 held; fixed in 7340d67.

1. Bash-emit marker. microvm_shakedown_known_task_shell_emit_dissolution_trigger names bash-emit (General orchestration intent to Bash emit fold over grammar rows #5828) and is rendered as the first line of the emitted script, like the ci_spec siblings.
2. The frontier's block was prose, not code. You were right: plan_jit_mint authorized a mint into any group. It now takes a MicrovmRunnerGroupStanding (RunnerGroupRestrictedToShakedownWorkflow | RunnerGroupRestrictionUnobserved) instead of a bare id. The unobserved arm refuses (JitMintRefusedRunnerGroupUnrestricted, carried through dispatch_jit_mint as DispatchRefusedRunnerGroupUnrestricted). runner_microvm_slot_controller mint_attempt_credential passes the unobserved arm today, so every real attempt refuses at the mint until an observer produces the restricted arm. The frontier row now names that match as its consumer. New red: witness_jit_mint_refuses_a_runner_group_not_observed_restricted (owned cell, sufficient credential, required binding; only the group can refuse). The positive controls pass the restricted arm.

Local: 10/10 JIT witnesses and 2/2 shakedown-workflow witnesses PASS on a fresh claim_batch; the slot controller typechecks; main_wet regenerated the yml.

— sent from quiet-koi-746

[gunbai-bot]

Review 70427: fixed in 740137f by finishing the construction rather than asking for scaffold approval.

The capability my dissolution row named already exists: v2.extdeps.languages.bash_build constructors folded by v2.workflow.bash_emit. So the concat script and its row are both deleted. microvm_shakedown_known_task_statements builds the step as a bash node tree, and bash_emit_stmts renders it. A serializer refusal becomes MicrovmShakedownWorkflowGenerationRefused, so no yml is emitted from a refused program.

Two consequences of using the real emitter:

• It supplies set -e but not pipefail. The comparison is therefore [ observed = expected ] with the report in the THEN arm and the refusal in ELSE. An empty or erroring digest takes the refusing arm; the inverse spelling would let an erroring [ skip the refusal.
• The result line reads only the runner's own env (GITHUB_SHA, GITHUB_RUN_ID, GITHUB_RUN_ATTEMPT, RUNNER_NAME, and the attempt via step env), so the rendered script carries no ${{ }} at all. The witness now asserts that over the rendered text.

Executed, not just rendered: the emitted script run locally takes the held arm (exit 0, result line written to GITHUB_STEP_SUMMARY). With sha256sum absent from PATH it takes the refusing arm (exit 1, observed= empty). 2/2 shakedown-workflow witnesses PASS.

— sent from quiet-koi-746

[gunbai-bot]

Closing as landed via #12178 (59aaecb). #12178 had this branch merged into it, and every file this PR changes is now identical on main: the attempt-only JIT labels, the runner-group standing, the shakedown workflow and its census claim. Nothing is left to merge here.

— sent from quiet-koi-746