Journal initial commissioning and gate workspace supply on committed readback

[briansrls]

Initial commissioning runs through the existing fleet plan/apply and slot controller. A host-owned executor retains the reviewed subject through exact controller completion, protected provenance/readiness readback, credential removal, and durable fleet-generation publication. Supply remains unavailable until that transaction commits. Executor lock and helper waits are bounded.

The branch is reconciled with main at a5e08e4dff9 and includes the stable-source lexer cursor for changed-witness classification. Merge resolution preserves all 62 workflow modes. The latest source repairs resolve qualified service prefixes without pulling unrelated bare helpers, preserve genuine missing-import checks, and explicitly import the live-tree authority in the three affected lexer/pipeline witnesses.

Current head: e7c4426229c. Required CI: run 37027879359. This run completed red: generated and emit-build passed, while floor/witnesses refused NonFoldResidueRosterDiverged unrostered=290. It is not a green qualification verdict.

Qualification evidence, scoped to its actual source:

• At 1296fb5f713, the release compiler built, 17 closure-admission controls passed, and the separate live-corpus comparison passed over 621 sources. The ten native indexed-read cases passed with that compiler.
• The full serve entry at 1296fb5f713 reached loopback readiness in 236 seconds under 12 GiB/no swap, with about 11.2 GiB peak and no OOM. The temporary server was stopped. This is startup evidence, not deployment or VM acceptance.
• At 01a43aa013a, the three repaired lexer/pipeline files passed the full-repository batch import-admission gate and all four assertions (exit 0). Its OverAttributed cost diagnostic supports no cost conclusion. The current head adds only its receipt. See receipts.
• The earlier reconciled workflow at 305283996bf passed all 38 workflow controls. Its generated 324,285-byte YAML matched the committed workflow exactly. Build and workflow evidence. This is not relabeled as latest-head evidence.
• The local whole-floor runs for main, the cursor branch, and the earlier allocation head completed with the same seven browser-host prerequisite refusals: srv2 is outside the declared browser-test pool. None is a green full-floor verdict. Full CI uses its existing modeled 26 GiB envelope; server and VM limits remain 12 GiB and 28 GiB. No runner configuration was changed.

The PR remains draft. No release installation, initial readiness, reservation, guest boot, SSH, release, or reuse is claimed.

After qualification: install and read back the exact release, review the commissioning plan, exercise cancellation/reattachment, commission and replan to a no-op, then boot, verify SSH, release, reuse the same slot, and exercise expiry. Automatic website preparation, selected-host dispatch, and recurring readiness/expiry reconciliation remain subsequent integration work.

Landing update (2026-10-02): #13000 now extracts the compiler prerequisite directly onto main (20 files, one source commit). This PR still targets codex/allocation-vertical; no retarget, history rewrite, or merge has occurred. Of its 279 commits beyond that parent, 229 are already ancestors of main and 50 are child-specific. The full net diff to main still includes the unlanded parent work and needs separation.

Recorded landing path: compiler prerequisite → authentication/protected state → workspace request/lifecycle → commissioning, with broad task-history migration and unrelated presentation work separate. The isolated allocation-main-landing branch preserves the integration reconciled with main; it is not a replacement mega-PR or a commissioned artifact.

[briansrls]

HOLD at exact head 59a8744b5c91e60a769db3fe0ea571a405e57b1c, with the architecture accepted.

The source now closes the important internal commissioning gap: protected prepared/committed provenance, generation-CAS publication, restartable readiness publication, a sole-constructor committed-supply readback, fresh hold/sanitation checks before every phase, installed runtime/image/boundary checks, and offer/preparation consumers that can no longer accept fixture admission or a bare generation-zero readiness row. Preserve this shape.

P1 remains, and the PR already names it: there is still no reviewed fleet plan/apply subject that proves and retains the commissioning exclusion. The current controller can reach journal/readiness writes from a canonical credential whose plan_hash is supplied by that credential. The ordinary launch operation installs a credential and issues SystemdStartUnit; because the slot unit is Type=exec, that start completes before the controller's commissioning transaction completes. That is not yet an apply transaction.

The bounded next cut should add one commissioning-only fleet scope/request. Its plan should bind the exact host/slot, source and installed tree/controller/image identities, cell/controller budgets, hold/journal/readiness heads, prior-purpose withdrawal and sanitation identity. Apply must reobserve that subject under the host-generation and slot-start exclusion, stage the canonical credential, start and capture the exact unit invocation, wait for that invocation's terminal, verify its receipt plus committed journal and coherent readiness readback, and remove/read back the commissioning credential. Only then may the fleet terminal be FullyApplied and the generation commit. Timeout, cancellation and an already-running/prepared incarnation must remain nonterminal and recover through the same subject rather than starting another commissioning.

P2: cpu_budget is still authored by the directive. Runtime proves the installed cell boundary separately, but no join requires the provenance CPU figure to equal that observed/desired boundary; admission accepts any value >= the large profile, and offer production later reads the provenance value. Derive the CPU budget from the commissioned slot authority, or require exact equality before the journal can commit.

Separate live blocker discovered after this head: follow-up storage plan run 36637771191 completed red because the unprivileged planner could not list the correctly installed root:root 0700 /var/lib/gunbc/fabric namespace. Keep 0700; move that observation through the administrator/read-only privileged edge. Until that is repaired, convergence cannot establish the intended no-op prestate.

No VM launch is claimed or established. After the observer and guarded apply are connected, the next useful operation is the wet commissioning plan/apply, then one manually prepared selected-host allocation, SSH, release, and same-slot reuse. No memory ceiling increase is indicated.

[briansrls]

Exact-head follow-up at 52b532e0ec896b82187556f369beaa572921e69f: HOLD remains, narrowed to the guarded fleet commissioning apply and integrated qualification.

Accepted repairs:

• the storage no-op is now genuine: the administrator observer can read the root:root 0700 substrate and the reviewed no-op emits zero ensure operations;
• commissioning CPU provenance is derived from, and required to equal, the installed slot boundary rather than being an independent credential assertion;
• installed-tree identity is now bound by both release revision and installed-tree digest;
• the start/wait helper binds completion and receipt readback to the exact new systemd InvocationID and refuses unread or changed invocations.

The source-critical blocker is still the enclosing fleet transaction. microvm_slot_start_admitted deliberately means only “this exact invocation terminated and its receipt was readable”; it admits a readable refusal receipt as a successful observation. The commissioning apply must add the stronger terminal: retain shared start/acquisition exclusion, install the exact commissioning credential, start and wait for the exact invocation, require the receipt text to be the commissioning-success arm, reread Committed provenance plus generation-zero CellReady and unchanged artifact/budget/hold facts, remove and read back credential absence, and only then publish FullyApplied/advance fleet generation. Timeout, cancellation, an unread receipt, or any refused: receipt must leave the operation unsettled/recoverable, never expose supply.

Exact-head CI is red, but the published floor receipt points to stale-base failures outside this commissioning delta: Optional unwrapping in the BMC/PID/host-hygiene witnesses and a stale WorkRowView literal. This stack is 34 commits behind current main, and current main already contains at least the BMC total-match repair. Reconcile current main into the allocation stack rather than repairing those predecessor files again here, then rerun the exact integrated floor.

After a clean rebase, the next useful artifact is a read-only commissioning plan—not another fixture pass—showing the complete subject, exclusion, exact credential, invocation wait, terminal receipt, protected readbacks, credential cleanup, and recovery behavior. No VM boot or memory-ceiling increase is justified yet.

[gunbai-bot]

Closed without folding in the v1 closeout bankruptcy (#13641). A stale draft on codex/allocation-vertical (2026-09-29), not targeting main. Under the bankruptcy rule, only work that serves the frozen seed emission, v2-native development or live operations, and that is complete, survives. The branch is kept for archaeology; no follow-up obligation is created. — sent from neat-wolf-604