gunbai-bot · Sep 29, 2026 · Sep 28, 2026
diff --git a/.github/workflows/fleet-converge.yml b/.github/workflows/fleet-converge.yml
@@ -331,9 +331,8 @@ jobs:
         if: steps.release_bins_outcome.outputs.outcome != 'reuse'
       - name: Build release bins (claim_executor + gunbc)
         id: release_build
-        run: |-
-          # 🟡 dissolve-on: ci_release_build_script — concat-built foreign-executor (GitHub Actions run:) release-build runner (ROOT stamp + verify-artifacts + sccache stats wrapping the orch-emitted EAGAIN retry core); membership of --bin / verify paths is derived from gunbc.ci_release_bins, but the runner transport itself remains hand-shell; DISSOLVES WHEN the runner is authored as v2.extdeps.languages.bash_build nodes (typed, grammar-quoted words; command substitution; assignment; pipe; if/test; redirect; || true) emitted by v2.workflow.bash_emit bash_emit_stmts -- a route AVAILABLE today (#12422 retired the sibling pack runner on it), so this migration is unauthored, not blocked on a missing capability; the orch-emitted EAGAIN retry core stays the v2.std.orchestration Retry it already is
-          ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+        run: |
+          ROOT=$('git' 'rev-parse' '--show-toplevel')
           set -o pipefail
           BUILD_LOG=$(mktemp)
           if ! ("$CARGO_BIN" build -p v1-compiler --release --features text_lookup_work_counter,interp_test_witness,test_hooks --bin claim_executor --bin gunbc --bin discover_source_root_ingest --bin claim_batch --bin interp_recorded_fixture_witness --bin v1_src_dag_parse --bin auth_declared_but_unwired_witness --bin bootstrap_witness --bin dag_collect_fingerprint_witness --bin diagnostics_witness --bin effects_rest_transport_witness --bin infer_semantics_witness --bin parse_witness --bin cssl_assemble --bin namespace_structural_root_exposure_generated_witness --bin codex_app_server_stdio_session) 2>&1 | tee "$BUILD_LOG"; then
@@ -345,8 +344,8 @@ jobs:
             fi
           fi
           rm -f "$BUILD_LOG"
-          "$ROOT/target/release/claim_executor" --verify-build-artifacts "$ROOT/target/release/claim_executor" "$ROOT/target/release/gunbc" "$ROOT/target/release/discover_source_root_ingest" "$ROOT/target/release/claim_batch" "$ROOT/target/release/interp_recorded_fixture_witness" "$ROOT/target/release/v1_src_dag_parse" "$ROOT/target/release/auth_declared_but_unwired_witness" "$ROOT/target/release/bootstrap_witness" "$ROOT/target/release/dag_collect_fingerprint_witness" "$ROOT/target/release/diagnostics_witness" "$ROOT/target/release/effects_rest_transport_witness" "$ROOT/target/release/infer_semantics_witness" "$ROOT/target/release/parse_witness" "$ROOT/target/release/cssl_assemble" "$ROOT/target/release/namespace_structural_root_exposure_generated_witness" "$ROOT/target/release/codex_app_server_stdio_session"
-          sccache --show-stats 2>/dev/null || true
+          "$ROOT"'/target/release/claim_executor' '--verify-build-artifacts' "$ROOT"'/target/release/claim_executor' "$ROOT"'/target/release/gunbc' "$ROOT"'/target/release/discover_source_root_ingest' "$ROOT"'/target/release/claim_batch' "$ROOT"'/target/release/interp_recorded_fixture_witness' "$ROOT"'/target/release/v1_src_dag_parse' "$ROOT"'/target/release/auth_declared_but_unwired_witness' "$ROOT"'/target/release/bootstrap_witness' "$ROOT"'/target/release/dag_collect_fingerprint_witness' "$ROOT"'/target/release/diagnostics_witness' "$ROOT"'/target/release/effects_rest_transport_witness' "$ROOT"'/target/release/infer_semantics_witness' "$ROOT"'/target/release/parse_witness' "$ROOT"'/target/release/cssl_assemble' "$ROOT"'/target/release/namespace_structural_root_exposure_generated_witness' "$ROOT"'/target/release/codex_app_server_stdio_session'
+          'sccache' '--show-stats' 2>/dev/null || 'true'
         if: steps.release_bins_outcome.outputs.outcome != 'reuse'
         timeout-minutes: 45
       - name: "Reset-return dispatch admission: refuse an unnamed observer before anything is scheduled"

diff --git a/dag/gunbc/ci/ci_spec.dag b/dag/gunbc/ci/ci_spec.dag
@@ -91,9 +91,14 @@ import gunbc.ci_layer_roots {
   witness_layer_roots,
   witness_discovery_scan_dirs
 }
-import gunbc.cli_invoke {
-  claim_executor_verify_artifacts_shell
-}
+import v2.extdeps.languages.bash_build {
+  bash_build_command_with_words,
+  bash_build_word_concat_from_nodes,
+  bash_build_word_lit,
+  bash_build_word_var,
+}
+import v2.workflow.bash_emit { bash_emit_stmts }
+import v2.std.node { Node }
 import v2.workflow.gunbc_invoke_step_emit {
   gunbc_run_step_script,
   gunbc_run_step_script_with_prelude,
@@ -146,7 +151,7 @@ import v2.std.orchestration {
   Run
 }
 import v2.std.collection { Absent, Present }
-import v2.std.diagnostic { EmitDirective, SeverityWarning }
+import v2.std.diagnostic { EmitDirective, SeverityWarning, Accepted, Rejected }
 import std.disposition { Disposition, Scaffold, SingleAuthority }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 
@@ -561,7 +566,7 @@ fn ci_fmt_gate_line() -> String {
   "\"$CARGO_BIN\" fmt --all --check"
 }
 
-data ci_v1_compiler_tests_compile_gate_note: String = "cargo test -p v1-compiler-tests --release (RETAINED-KERNEL EXECUTION gate; the tests RUN). --no-run was removed 2026-08-11 with the suite cutover: the crate is now the declared retained kernel (test.retirement.model retained_legacy_rust_test_modules), 9 modules / 30 tests, down from 98 / 740 of which zero executed. There is no compile-only arm — a retained test either executes or the gate refuses. Originally RE-ORDERED 2026-08-05 (operator ruling, PR A / fierce-heron-177 / #7868): runs AFTER the release build so the gate reuses the release-profile v1-compiler artifact instead of forcing a second dev-profile compile. ci_release_features carries text_lookup_work_counter,interp_test_witness,test_hooks so release bins and the test crate share ONE release-profile v1-compiler artifact (feature-set union). Per-call depth instrumentation is default-off armed (record_call_env_depth is a relaxed-load guard until a test calls arm_call_env_depth_witness_for_test). Affected-set admission (compile_contract_admission_witness + CompileContractAdmissionReceipt) was built per lane brief step 3, measured at 84-133s to skip an 18s compile (resolve_entry_graph_shared for one git diff), and REMOVED 2026-08-06 — the gate runs unconditionally on every build job. CI-performance status authority gunbc.ci_build_job_v1_compiler_unit_receipt (one_profile_ordering_status, one_compiler_unit_status, wall_benefit_status, fleet_build_job_log_evidence_note). A2 fix (#7910): delete broken package-relative .git rerun-if-changed lines in src/v1/stage0/build.rs (StaleItem(MissingFile) on second cargo invocation); machine unit evidence in ci_build_job_v1_compiler_unit_receipt machine_unit_identity_note. Operation shape: v2.workflow.ci_v1_compiler_tests_compile_gate_emit (extdeps.cargo_build cargo.Build.Test)."
+data ci_v1_compiler_tests_compile_gate_note: String = "cargo test -p v1-compiler-tests --release (RETAINED-KERNEL EXECUTION gate; the tests RUN). --no-run was removed 2026-08-11 with the suite cutover: the crate is now the declared retained kernel (test.retirement.model retained_legacy_rust_test_modules), 9 modules / 30 tests, down from 98 / 740 of which zero executed. There is no compile-only arm — a retained test either executes or the gate refuses. Originally RE-ORDERED 2026-08-05 (operator ruling, PR A / fierce-heron-177 / #7868): runs AFTER the release build so the gate reuses the release-profile v1-compiler artifact instead of forcing a second dev-profile compile. ci_release_features carries text_lookup_work_counter,interp_test_witness,test_hooks so release bins and the test crate share ONE release-profile v1-compiler artifact (feature-set union). Per-call depth instrumentation is default-off armed (record_call_env_depth is a relaxed-load guard until a test calls arm_call_env_depth_witness_for_test). Affected-set admission (compile_contract_admission_witness + CompileContractAdmissionReceipt) was built per lane brief step 3, measured at 84-133s to skip an 18s compile (resolve_entry_graph_shared for one git diff), and REMOVED 2026-08-06 — the gate runs unconditionally on every build job. CI-performance status authority gunbc.ci_build_job_v1_compiler_unit_receipt (one_profile_ordering_status, one_compiler_unit_status, wall_benefit_status, fleet_build_job_log_evidence_note). A2 fix (#7910): delete broken package-relative .git rerun-if-changed lines in src/v1/stage0/build.rs (StaleItem(MissingFile) on second cargo invocation); machine unit evidence in ci_build_job_v1_compiler_unit_receipt machine_unit_identity_note. The step no longer runs: the rust-unit-tests job was cut on 2026-09-04 (gunbc.rung_drop rust_unit_tests_off_the_merge_path), and its unconsumed emitter v2.workflow.ci_v1_compiler_tests_compile_gate_emit was deleted on 2026-09-28. A restored lane is authored fresh against the route that exists then."
 
 fn ci_retry_body_run(command: String) -> Run {
   Run {
@@ -610,13 +615,30 @@ fn ci_cargo_eagain_retry_intent(command: String) -> PipelineStep {
 // ruling 2026-07-11 still applies to the handoff shape. The intentionally-absent negative control
 // (no_such_witness_bin_zzz) is excluded. The build-if-absent stale-binary class (#6352) is out of
 // scope: a same-run artifact is fresh by construction.
-fn artifact_shell_path(name: String) -> String {
-  concat(concat("\"$ROOT/target/release/", name), "\"")
+fn ci_release_artifact_word(name: String) -> Node {
+  bash_build_word_concat_from_nodes(parts: [
+    bash_build_word_var(name: "ROOT"),
+    bash_build_word_lit(text: concat("/target/release/", name)),
+  ])
+}
+
+// claim_executor verifies every roster bin it was built beside, itself included.
+fn ci_floor_build_verify_stmt() -> Node {
+  bash_build_command_with_words(words: concat(
+    [ci_release_artifact_word(name: "claim_executor"), bash_build_word_lit(text: "--verify-build-artifacts")],
+    map(ci_floor_required_artifact_names(), name => ci_release_artifact_word(name: name))
+  ))
 }
 
+// A refused emission is a marker that is not valid workflow shell, so the committed-workflow drift
+// gate turns red. It is never a partial script (DESIGN 5: refuse, never widen).
+data ci_floor_build_verify_refused_poison: String = "__GUNBC_BASH_EMIT_REFUSED__ gunbc.ci_spec ci_floor_build_verify_script: the bash serializer refused the verify statement; this marker is not valid workflow shell\n"
+
 fn ci_floor_build_verify_script() -> String {
-  let paths = map(ci_floor_required_artifact_names(), name => artifact_shell_path(name: name))
-  claim_executor_verify_artifacts_shell(artifact_paths: paths)
+  match bash_emit_stmts(statements: [ci_floor_build_verify_stmt()], set_e: false) {
+    Accepted { value: text, diagnostics: _ } => text
+    Rejected { diagnostics: _ } => ci_floor_build_verify_refused_poison
+  }
 }
 
 data ci_release_bins_archive_name: String = "release-bins.tgz"

diff --git a/dag/test/claim/gunbc_invoke_witness_test.dag b/dag/test/claim/gunbc_invoke_witness_test.dag
@@ -15,7 +15,6 @@ import gunbc.ci_spec {
   gunbc_ci_deploy_srv1_stage,
   gunbc_ci_deploy_invoke,
   ci_floor_build_verify_script,
-  artifact_shell_path
 }
 import gunbc.ci_release_bins {
   ci_floor_required_artifact_names
@@ -94,8 +93,15 @@ test fn gunbc_invoke_verify_artifacts_shell_nonempty_holds() -> Bool {
   let script = claim_executor_verify_artifacts_shell(artifact_paths: ["\"$ROOT/target/release/gunbc\""])
   string_contains(s: script, pattern: "--verify-build-artifacts")
     && string_contains(s: script, pattern: "\"$ROOT/target/release/gunbc\"")
-    && ci_floor_build_verify_script() == claim_executor_verify_artifacts_shell(
-      artifact_paths: map(ci_floor_required_artifact_names(), name => artifact_shell_path(name: name))
+    && ci_floor_build_verify_script() == concat(
+      join(
+        concat(
+          ["\"$ROOT\"'/target/release/claim_executor' '--verify-build-artifacts'"],
+          map(ci_floor_required_artifact_names(), name => concat("\"$ROOT\"'/target/release/", concat(name, "'")))
+        ),
+        " "
+      ),
+      "\n"
     )
 }
 

diff --git a/src/v2/workflow/ci_release_build_emit.dag b/src/v2/workflow/ci_release_build_emit.dag
@@ -1,36 +1,56 @@
 module v2.workflow.ci_release_build_emit
 
-import std.dissolution { DissolutionCondition, dissolution_description, unbound_dissolution }
-
-import std.disposition { Disposition, Scaffold, SingleAuthority }
-import std.decl_ref { DeclarationRef, WholeDeclaration }
 import gunbc.ci_spec {
-  ci_floor_build_verify_script,
+  ci_floor_build_verify_stmt,
   ci_release_build_line
 }
-import gunbc.merge_admission_produce { ci_repo_root_shell }
+import gunbc.fleet_release_bins_key { root_statement }
+import v2.extdeps.languages.bash_build {
+  bash_build_command_from_lits,
+  bash_build_or_else,
+  bash_build_with_redir
+}
 import v2.workflow.ci_retry_emit { ci_cargo_eagain_retry_script }
-import v2.workflow.bash_emit { bash_emit_program_sequence_script }
+import v2.workflow.bash_emit { bash_emit_program_sequence_script, bash_emit_stmts }
+import v2.std.diagnostic { Accepted, Rejected }
+import v2.std.node { Node }
+import std.types { List }
 
-// Release-build shell emission (retry + verify) lives here, separate from ci_workflow_run_emit, so gunbc.ci_materialization can import ci_release_build_script without a module cycle (ci_materialization ↔ ci_workflow_run_emit via ci_sccache_provider_shell_injection).
-data ci_release_build_shell_emit_scaffold: Disposition = Scaffold {
-  dissolves_to: SingleAuthority,
-  bind: DeclarationRef {
-    module_path: "v2.workflow.ci_release_build_emit",
-    decl_name: "ci_release_build_script",
-    field: WholeDeclaration
-  }
+// Release-build shell emission (retry + verify) lives here, separate from ci_workflow_run_emit, so
+// gunbc.ci_materialization can import ci_release_build_script without a module cycle
+// (ci_materialization ↔ ci_workflow_run_emit via ci_sccache_provider_shell_injection).
+//
+// The ROOT stamp, the artifact verification and the sccache report are v2.extdeps.languages.bash_build
+// statements serialized by v2.workflow.bash_emit. ROOT is gunbc.fleet_release_bins_key
+// root_statement, the same stamp the release-bins steps of this job use. The EAGAIN retry core between
+// them stays the v2.std.orchestration Retry that v2.workflow.ci_retry_emit already emits, joined by
+// the one program join.
+
+fn ci_release_build_sccache_stats_stmt() -> Node {
+  bash_build_or_else(
+    left: bash_build_with_redir(
+      inner: bash_build_command_from_lits(lits: ["sccache", "--show-stats"]),
+      redir: ^bash_production_fold_redir_stderr_null
+    ),
+    right: bash_build_command_from_lits(lits: ["true"])
+  )
 }
 
-data ci_release_build_shell_emit_dissolution_trigger: DissolutionCondition = unbound_dissolution(description: "🟡 dissolve-on: ci_release_build_script — concat-built foreign-executor (GitHub Actions run:) release-build runner (ROOT stamp + verify-artifacts + sccache stats wrapping the orch-emitted EAGAIN retry core); membership of --bin / verify paths is derived from gunbc.ci_release_bins, but the runner transport itself remains hand-shell; DISSOLVES WHEN the runner is authored as v2.extdeps.languages.bash_build nodes (typed, grammar-quoted words; command substitution; assignment; pipe; if/test; redirect; || true) emitted by v2.workflow.bash_emit bash_emit_stmts -- a route AVAILABLE today (#12422 retired the sibling pack runner on it), so this migration is unauthored, not blocked on a missing capability; the orch-emitted EAGAIN retry core stays the v2.std.orchestration Retry it already is")
+// A refused emission is a marker that is not valid workflow shell, so the committed-workflow drift
+// gate turns red. It is never a partial script (DESIGN 5: refuse, never widen).
+data ci_release_build_refused_poison: String = "__GUNBC_BASH_EMIT_REFUSED__ v2.workflow.ci_release_build_emit ci_release_build_script: the bash serializer refused a release-build statement; this marker is not valid workflow shell\n"
+
+fn ci_release_build_emit_stmts(statements: List<Node>) -> String {
+  match bash_emit_stmts(statements: statements, set_e: false) {
+    Accepted { value: text, diagnostics: _ } => text
+    Rejected { diagnostics: _ } => ci_release_build_refused_poison
+  }
+}
 
 fn ci_release_build_script() -> String {
   bash_emit_program_sequence_script(programs: [
-    concat("# ", concat(dissolution_description(condition: ci_release_build_shell_emit_dissolution_trigger), "\n")),
-    concat("ROOT=", ci_repo_root_shell(), "\n"),
+    ci_release_build_emit_stmts(statements: [root_statement()]),
     ci_cargo_eagain_retry_script(command: ci_release_build_line()),
-    ci_floor_build_verify_script(),
-    "sccache --show-stats 2>/dev/null || true"
+    ci_release_build_emit_stmts(statements: [ci_floor_build_verify_stmt(), ci_release_build_sccache_stats_stmt()])
   ])
 }
-