Gate 5: a modeled microvm_slot_start that starts the shakedown slot's controller once and reads that invocation's receipt

[gunbai-bot]

Gate 5 of the microVM real-run plan: nothing issued systemctl start for the slot unit. microvm_controller_install writes the locus and the gunbc-microvm-slot@ template and starts no instance, so every real-run receipt (5a job, 5b second attempt, 5c cancel, 5d 28 GiB floor) had no first step.

What changes

• New module gunbc.runner_microvm_slot_start (microvm_slot_start_ci_wet):
  1. Checks the job's host binding (gunbc.runner_microvm_host_ready microvm_host_binding_wet, the one the boot probe reads) against the shakedown slot's host. A dispatch pinned elsewhere refuses by name.
  2. Starts the unit derived from gunbc.runner_slot_allocation srv1_microvm_shakedown_slot. The instance is never a dispatch input. The start goes through the modeled privileged operation SystemdStartUnit, whose argv the sudoers match is derived from. It starts a root-owned unit that microvm_controller_install wrote, so the job chooses no byte the root process evaluates.
  3. Captures the unit's systemd InvocationID and waits for inactive. The bound is the slot unit's own microvm_slot_unit_timeout_stop(): the VMM deadline plus every teardown bound, the same sum systemd enforces.
  4. Reads the controller receipt at the path that invocation names (gunbc.runner_microvm_slot_controller slot_controller_receipt_path), so an earlier start's receipt cannot stand for this one.
• The step succeeds only when this invocation's receipt was read, whatever it says. A controller that refused or quarantined is a finding, and the receipt is the evidence. Every other arm fails the step, because no receipt of this attempt exists: wrong host, refused start, unread invocation, still active at the bound, or unreadable receipt.
• Fleet-converge mode microvm_slot_start. It is a step in the existing fleet-converge job, alongside microvm_boot_probe, so no new job is added. Its timeout is derived from the same stop bound. A receipt-upload step is added. fleet-converge.yml is regenerated.
• The start command is gunbc.executor_privileged_apply executor_privileged_operation_command, the existing typed builder over the same executor_privileged_operation_elevated derivation the sudoers match reads. Nothing new is admitted on argv_command.

What running it will show today

The controller refuses at the JIT mint: #12119 makes it pass RunnerGroupRestrictionUnobserved until bright-dove-353's #12155, #12172 and PR-C land. It may refuse earlier on the slot-network receipt (conntrack-tools is missing on srv1). Either way the controller receipt names the stage, which is the "exercised to the refusal arm" evidence the brief asks for before the network lands.

Evidence (fresh claim_batch)

• New runner_microvm_slot_start_witness_test: 2/2 PASS.
  • Admission: only a completed start with this invocation's receipt read admits. The reds are the other five arms, including completed but receipt unreadable.
  • The started unit is the shakedown slot's own instance.
• workflow_dispatch_input_witness_test (enumerates the modes): 30/30 PASS.

🤖 Generated with Claude Code

[gunbai-bot]

Review 70683: both findings held and are fixed at d1d6b2a.

1. An earlier start's receipt could stand for this one. Now refused by construction. microvm_slot_start_on_its_host refuses SlotStartAlreadyActive if the unit is active before the start, naming the running invocation, and nothing is started. After the start, the InvocationID must differ from the one read before it (empty if the unit never ran). If it didn't change, the result is SlotStartInvocationUnchanged. Only a new invocation reaches the wait and the receipt read, so the receipt path is always this start's.
2. Failed property reads looked like empty values. show_property now returns UnitPropertyRead { value } | UnitPropertyUnread { property, detail }. exec_main_status carries that reading, rendered as UNREAD(...) rather than a blank. SlotStartInvocationUnread carries the failure's detail and whether it was before or after the start. An empty InvocationID after the start is also refused explicitly.

The witness red set now includes both new arms. 2/2 PASS, typechecks.

— sent from quiet-koi-746

[gunbai-bot]

Review 70696: fixed at 32a178a. SlotStartStillActiveAtBound now carries bound: Second, filled with microvm_slot_unit_timeout_stop() directly. second_count is called only in microvm_slot_start_text when the bound is printed. The witness supplies second(count: 10), and both claims PASS. The step's timeout_minutes stays an Int because that is the GitHub Actions field, derived from the same Second at that edge.

On the previous head's floor red (PureProducerShareRowModuleUnframeable in test.claim.namespace_xl2_rehearsal_census, AmbiguousBareNameRead sites=2): this PR does not touch or import that module, and all 7 of its claims PASS on this branch with a fresh claim_batch. This push reruns the floor; if it recurs I'll trace which bare name it reports as ambiguous.

— sent from quiet-koi-746

[gunbai-bot]

Root cause of the floor red on the last two heads, fixed at 1919c8a: my own duplicate. I had re-authored executor_privileged_operation_command (same name, same body) in gunbc.executor_privileged_operation and admitted it on argv_command, when gunbc.executor_privileged_apply already owns it. Two declarations of one name is the second authority DESIGN 3 forbids. The floor refused on it: the ambiguous bare read surfaced as PureProducerShareRowModuleUnframeable in namespace_xl2_rehearsal_census. I confirmed it was this PR's by the same refusal being absent from five concurrent main-queue and branch runs. Both files are now back to main's bytes, the slot start imports the existing builder, and the PR body is corrected.

— sent from quiet-koi-746

[gunbai-bot]

Review 70720 is fixed at 4a9d139. The same commit makes a second attempt at the floor red.

• The witness that could never fail is deleted. the_started_unit_is_the_shakedown_slots_own_instance compared microvm_slot_start_unit() with its own body. A hand-copied literal would only be a change detector (DESIGN 5's oracle rule). The admission witness, with its seven red arms, is the claim this module owns.
• Timeout rounding. It is now (second_count(...) + 59) / 60, i.e. ceiling division, as the annotation says.

Floor. The duplicate builder in 1919c8a was a real defect, but it was not the only one: the refusal persisted. The workflow emitter imported gunbc.runner_microvm_slot_start for one string, the receipt path. That import pulled 17 modules into its closure that main's does not carry: the controller, lifecycle, guest image, launch planner and more. The path now lives with the unit's on-host layout in gunbc.runner_microvm_slot_unit, which main's workflow closure already contains. The workflow and ci_spec read it from there, so ci_spec no longer spells it separately. Measured with claim_batch's --print-entry-closure: the fleet workflow's closure now adds nothing over main's. This head's floor will say whether that was the cause.

— sent from quiet-koi-746

[gunbai-bot]

Fixed at b4ec93b: review 70740, plus the floor red's actual cause.

• Review 70740. I had inserted the new step between fleet_converge_microvm_boot_probe_receipt_upload_step and its leading comment, so that rationale attached to the wrong function. It is back above the boot-probe upload step. The new upload step now carries its own one-line always() rationale.
• The floor refusal, found this time rather than guessed. The refusal prints its sites on the lines after the headline, which is where I should have read first. It says Filesystem is read bare by gunbc.runner_guest_image and gunbc.runner_microvm_host_ready, and is declared by both extdeps.filesystem.filesystem_io (service) and std.resources. This PR's module brings both declaring modules into one scope, so those bare reads would have been resolved by scope precedence. Both modules call Filesystem.Write, the extdeps service, and now import it from there, as the refusal's remedy says. My two earlier attempts fixed real defects (a duplicate builder, and an oversized workflow closure), but neither was this.

— sent from quiet-koi-746