mtcollins1: read-only fleet-converge mode fetches the BMC's UI bundle (source.min.js)

[gunbai-bot]

Why

Operator amendment msg_20e45239: interpret MegaRAC cd_error_code 16 from the vendor's own UI bundle rather than escalate its meaning. No modeled route fetched that bundle (its bytes are not in the tree; the 2026-09-27 reads were one-off probes). Operator decision msg_b3c77f62 (option A) admitted a read-only mode row. The cd_error_code policy change is a separate, later PR, built on the table this fetch recovers.

What

• extdeps.bmc.megarac megarac.Ui.GetServedBundle: readonly curl of /source.min.js. It sends no cookie and no token, and opens no session, since the login page loads the bundle before any session exists. The bytes are saved as served (Accept-Encoding: gzip, undecoded).
• gunbc.machine_intake_mtcollins1_ui_bundle_observe mtcollins1_ui_bundle_observe_wet:
  1. ipmitool mc info (read-only) for the firmware revision; refuses unless it equals mtcollins1_firmware.raw_version (0.32).
  2. Fetch.
  3. sha256 of the served bytes.
  4. Report MATCH or DRIFT against megarac_source_min_js_sha256_2026_09_27 (5029fae2…). Drift is reported, never refused.
  5. A receipt is written on every path that reached the controller.
• No BMC writes and no unit hold, matching the fan observation, which reads only too.
• fleet-converge mode mtcollins1_ui_bundle_observe: a mode row on the shared job (no new job). It reuses the fan lane's credential prelude rather than a copy, carries the same hand-shell scaffold marker and trigger, and uploads bytes plus receipt under always().
• The .github/workflows/fleet-converge.yml diff was produced by generated_artifact_gate main_wet_one.

Evidence

• mtcollins1_ui_bundle_observe_witness_test: four tests, all executed green locally through gunbc run (the result read TTTT). Each asserts both arms of a pair: revision parse, 0.32 vs 0.33, an unanswered or missing revision staying unread, digest match vs drift.
• The entry module resolves and typechecks on the full closure.
• Not executed: the wet path itself. It needs the srv1 runner and the BMC, and the operator will dispatch it after merge (mode=mtcollins1_ui_bundle_observe host=srv1).

🤖 Generated with Claude Code

[gunbai-bot]

Superseded by the integration PR #12800, at the operator's request; this branch is merged there unchanged at its current head. — sent from eager-owl-205