D13 audit: requires none / opaque on extdeps ops (134 none, 120 opaque; 267 Network)

dag/extdeps/access/posix_effective_principal_read_op.dag

@@ -39,6 +39,7 @@ fn effective_posix_principal_read(
 
 service access.PosixEffectivePrincipal {
   operation Read {
+    requires none
     input { read: EffectivePosixPrincipalRead }
     output {
       exit_code: Int from "exit_code"

dag/extdeps/bmc/openbmc_fan_control.dag

@@ -794,6 +794,7 @@ fn openbmc_execute(
 
 service openbmc.JsonProjection {
   operation ProjectFanConfig {
+    requires none
     input {
       desired_json: String
       path: NonEmptyStr

dag/extdeps/browser/browser.dag

@@ -37,12 +37,14 @@ type Element        = String where brand("Element")
 
 service browser.Context {
   operation Launch {
+    requires Network
     input { headless: String = "false", profile_path: FilePath }
     output { context: BrowserContext from "stdout" }
     transport shell { argv: ["playwright-runner", "launch", "--headless", "{headless}", "--profile", "{profile_path}"] }
   }
 
   operation Close {
+    requires opaque
     input { context: BrowserContext }
     output {}
     transport shell { argv: ["playwright-runner", "close", "{context}"] }
@@ -60,61 +62,71 @@ service browser.Page {
   }
 
   operation CurrentUrl {
+    requires Network
 
     input {}
     output { url: String from "stdout" }
     transport shell { argv: ["playwright-runner", "url"] }
   }
 
   operation Title {
+    requires Network
     input {}
     output { title: String from "stdout" }
     transport shell { argv: ["playwright-runner", "title"] }
   }
 
   operation WaitForSelector {
+    requires opaque
     input { selector: String, timeout_ms: Int = 30000 }
     output { found: String from "stdout" }
     transport shell { argv: ["playwright-runner", "wait-for", "{selector}", "--timeout", "{timeout_ms}"] }
   }
 
   operation QueryAll {
+    requires opaque
     input { selector: String }
     output { count: String from "stdout" }
     transport shell { argv: ["playwright-runner", "query-all", "{selector}"] }
   }
 
   operation Click {
+    requires opaque
     input { selector: String }
     output {}
     transport shell { argv: ["playwright-runner", "click", "{selector}"] }
   }
 
   operation Fill {
+    requires opaque
     input { selector: String, text: String }
     output {}
     transport shell { argv: ["playwright-runner", "fill", "{selector}", "{text}"] }
   }
 
   operation Evaluate {
+    requires opaque
     input { expression: String }
     output { result: String from "stdout" }
     transport shell { argv: ["playwright-runner", "evaluate", "{expression}"] }
   }
 
   operation UploadFile {
+    requires opaque
     input { selector: String, path: FilePath }
     output {}
     transport shell { argv: ["playwright-runner", "upload", "{selector}", "{path}"] }
   }
 
   operation Screenshot {
+    requires opaque
     input { path: FilePath }
     output {}
     transport shell { argv: ["playwright-runner", "screenshot", "{path}"] }
   }
 
   operation Wait {
+    requires opaque
     input { ms: Int }
     output {}
     transport shell { argv: ["playwright-runner", "wait", "{ms}"] }
@@ -124,18 +136,21 @@ service browser.Page {
 service browser.Element {
 
   operation IsVisible {
+    requires opaque
     input { selector: String }
     output { visible: String from "stdout" }
     transport shell { argv: ["playwright-runner", "is-visible", "{selector}"] }
   }
 
   operation InnerText {
+    requires opaque
     input { selector: String }
     output { text: String from "stdout" }
     transport shell { argv: ["playwright-runner", "inner-text", "{selector}"] }
   }
 
   operation EvaluateOn {
+    requires opaque
     input { selector: String, expression: String }
     output { result: String from "stdout" }
     transport shell { argv: ["playwright-runner", "evaluate-on", "{selector}", "{expression}"] }

dag/extdeps/clock/clock.dag

@@ -27,6 +27,7 @@ data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
 
 service Clock {
   operation Now {
+    requires none
     input {}
     output { timestamp: Timestamp from "stdout" }
     readonly
@@ -38,6 +39,7 @@ service Clock {
   }
 
   operation UnixMillis {
+    requires none
     input {}
     output { unix_millis: String from "stdout" }
     readonly
@@ -49,6 +51,7 @@ service Clock {
   }
 
   operation UnixSecs {
+    requires none
     input {}
     output { unix_secs: String from "stdout" }
     readonly
@@ -60,6 +63,7 @@ service Clock {
   }
 
   operation TimestampOffset {
+    requires none
     input { timestamp: Timestamp, offset: Nat }
     output { result: Timestamp from "stdout" }
     readonly
@@ -71,6 +75,7 @@ service Clock {
   }
 
   operation TimestampAdd {
+    requires none
     input { timestamp: Timestamp, offset: Nat }
     output { result: Timestamp from "stdout" }
     readonly
@@ -82,6 +87,7 @@ service Clock {
   }
 
   operation TimestampToUnixSecs {
+    requires none
     input { timestamp: Timestamp }
     output { unix_secs: String from "stdout" }
     readonly

dag/extdeps/cron/cron.dag

@@ -14,6 +14,7 @@ data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
 
 service cron.Tab {
   operation List {
+    requires none
     input {}
     output { entries: String from "stdout" }
     readonly
@@ -25,6 +26,7 @@ service cron.Tab {
   }
 
   operation Replace {
+    requires none
     input { entries: String }
     output { success: Bool from "exit_success", stdout: String from "stdout", stderr: String from "stderr" }
     transport shell {

dag/extdeps/crypto/hash.dag

@@ -96,6 +96,7 @@ fn sha512_digest_content_hash(digest: Digest) -> ContentHash? {
 // transport row can be read from the operation itself.
 service crypto.Sha256Sum {
   operation File {
+    requires none
     input { path: String }
     output {
       line: String from "stdout"

dag/extdeps/docker/container_inspect.dag

@@ -7,6 +7,7 @@ import std.measure { ByteSize, byte_size, byte_size_count, Microsecond, microsec
 import extdeps.docker.endpoint { docker_default_endpoint }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
+import extdeps.ietf.http_semantics { GET }
 import extdeps.docker.container_inspect_contracts { container_state_wire_contract }
 import std.roster_frontier { FrontierRow, frontier_row_decl }
 import std.dissolution { unbound_dissolution }
@@ -248,6 +249,7 @@ service docker.Container {
   }
 
   operation Inspect {
+    requires none
     input {
       container_id: String
       size: Bool = false

dag/extdeps/docker/container_stats.dag

@@ -7,6 +7,7 @@ import std.measure { ByteSize, byte_size, byte_size_count, Nanosecond, nanosecon
 import extdeps.docker.endpoint { docker_default_endpoint }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
+import extdeps.ietf.http_semantics { GET }
 import std.roster_frontier { FrontierRow, frontier_row_decl }
 import std.dissolution { unbound_dissolution }
 import std.decl_ref { decl_ref, decl_field_ref }
@@ -91,6 +92,7 @@ service docker.ContainerStats {
   }
 
   operation GetStats {
+    requires none
     input {
       container_id: String
       stream: Bool = false

dag/extdeps/entropy/entropy.dag

@@ -80,6 +80,7 @@ data entropy_read_password_shell_emit_dissolution_trigger: DissolutionCondition
 data urandom_read_bytes_shell_emit_dissolution_trigger: DissolutionCondition = unbound_dissolution(description: "dissolve-on: Urandom.ReadBytes / Urandom.ReadPassword transport argv -- hand-authored shell program expanded as a string literal to capture the producing stage's exit status; this edits the failure arm of an EXISTING transport and adds no new emission site, per the gunbc.githooks_pre_push_emit precedent. DISSOLVES WHEN [C7 producer-status-pipeline] (an extdeps shell transport cannot declare a producer-then-consumer argv pair whose realization reports the PRODUCING stage's exit status; dash has no pipefail) lands and these operations declare that argv pair in place of an sh -c program.")
 service Urandom {
   operation ReadBytes {
+    requires none
     input { count: Int }
     output { octets_b64: String from "stdout" }
     readonly
@@ -91,6 +92,7 @@ service Urandom {
   }
 
   operation ReadPassword {
+    requires none
     input { count: Int }
     output { password: String from "stdout" }
     readonly

dag/extdeps/filesystem/filesystem_io.dag

@@ -685,6 +685,7 @@ data filesystem_absence_establishment_adoption_standing: String = "RUNG: structu
 service Filesystem {
 
   operation Write {
+    requires none
     input { path: String, content: String }
     output {
       success: Bool from "write_success"
@@ -696,6 +697,7 @@ service Filesystem {
   }
 
   operation WriteOwnerOnly {
+    requires none
     input { path: String, content: String }
     output {
       success: Bool from "write_success"
@@ -707,6 +709,7 @@ service Filesystem {
   }
 
   operation WriteCreateNew {
+    requires none
     input { path: String, content: String }
     output {
       success: Bool from "write_success"
@@ -719,6 +722,7 @@ service Filesystem {
   }
 
   operation WriteCreateNewWithMode {
+    requires none
     input { path: String, content: String, mode: Int }
     output {
       success: Bool from "write_success"
@@ -731,6 +735,7 @@ service Filesystem {
   }
 
   operation Read {
+    requires none
     input { path: String }
     output {
       content: String from "content"
@@ -743,6 +748,7 @@ service Filesystem {
   }
 
   operation Delete {
+    requires none
     input { path: String }
     output {
       success: Bool from "delete_success"
@@ -752,6 +758,7 @@ service Filesystem {
   }
 
   operation List {
+    requires none
     input { path: String }
     output {
       entries: String from "entries"