alloc unit 2: workspace request lifecycle

[gunbai-bot]

Unit 2 of docs/plans/allocation-main-landing.md: the workspace request lifecycle, extracted from #12505 (codex/allocation-vertical) without retargeting, merging or rewriting #12465 / #12505 / #12691.

Base: main, with #13004 (unit 1, auth + protected state) now landed. This diff is the unit-2 delta only. Unit 3 (initial commissioning, from #12691) will be a separate PR stacked on this branch.

What this carries

Sized durable workspace requests and their HTTP read routes (GET /allocations.json and /allocations/{id}, wired into gunbc.roadmap_serve; create/release are not mounted — see below), owner admission through a dedicated allocation authority, resource-budget selection over eligible hosts, money + slot reservation binding (workspace_allocation_plan, durable exclusive hold), workspace guests through the existing microVM lifecycle and slot controller (extended, not forked), recoverable discovery, expiry / cancel retirement including never-launched requests, fleet-managed SSH access through the gateway, and cleanup before release. The srv1 sudoers projection gains the three workspace grants declared in gunbc.runner_host_grants; nothing is installed on a host.

Fixes for GitHub reviews 5403489707 and 5403494247

1. Writes are unmounted, policy unchanged. POST /allocations and /allocations/{id}/release require tailnet_path_required: true, but roadmap_serve_request_security reads no serve route, so AccessPathTailnetProxy cannot be constructed at that seam and a mounted write could never admit. Rather than weaken the policy, both routes and their wrappers are removed from the served table until that seam executes a serve-route/ACL readback (a change to the shared unit-1 seam, which affects every write route). workspace_http_create_over / workspace_http_release_over remain the handlers that mount then. allocation_write_requires_an_observed_tailnet_route runs them under the required policy through the real request_access_path_of producer: observed route admits; no readback refuses; LocalDev refuses. workspace_demo_image_identity, consumed only by the create route, is removed with it.
2. Dead elected actor no longer wedges an owner. workspace_actor_takeover_decision (pure) reads the prior actor's standing from the slot unit's InvocationID, then a fresh hold observation: matching hold → recover; no/free hold + terminal → CAS the actor slot from its exact recorded generation to this invocation (wanted) or to a cancelled_after_actor tombstone (retired); running or unreadable → retain. workspace_take_over_actor orchestrates; the retired path settles through it. Claims: every decision arm (hermetic) and, in the wet lane, terminal actor + no hold settles retirement, running actor retains, and two replacements on one generation admit exactly one (no double hold). The wanted re-arm path is witnessed at the decision and CAS-fence level; its end-to-end form needs a real systemd invocation the wet lane does not have.
3. Allocation ids are one route segment. WorkspaceAllocationId (sole_constructor, [A-Za-z0-9_-]{1,128}, the AuthStoreKey alphabet) is the only constructor for the HTTP submission and the durable-record decode. unaddressable_allocation_keys_are_refused (a/b, a?b, a b, %2F, unicode, empty, a.b) and admitted_allocation_id_round_trips_through_the_release_route (real path matcher).

All executed on ea948db55c (floor: 9 hermetic planned-and-passed, 5 wet hermetic-route-gap-held-and-wet-passed).

Changes made during extraction (beyond moving code)

• Defect fixed — a withdrawn cell could receive a new workspace. workspace_slot_from_current_ledger sent CellWithdrawn / HostWithdrawn readiness down the launch path through a wildcard arm. The decision is now the pure workspace_slot_readiness_route: withdrawn readiness refuses a new incarnation and still permits retirement. Witnessed by test.claim.runner.workspace_slot_readiness_route_witness_test: a discriminating red (withdrawn cell/host never launches a wanted workspace; false before the fix), a positive control (admitted + wanted launches), retirement, and one claim through the real cell_incarnation_admission producer over a quarantined record.
• NonFoldResidue: 46 unrostered wildcard sites, zero enrolled. Every arm over a closed coproduct is now explicit; the JSON decoders read through the existing extdeps.languages.json.parse json_field* authority instead of restating the lookup coproduct. The two stale rows were renames of already-rostered sites (stage_jit_device → stage_bootstrap_device, observe_firecracker_host_standing_wet → …_at_binary_wet) and moved with them.
• Allocation route actions ServeActionCreateAllocation / ServeActionReleaseAllocation added to the generic human write gate as refusals; their authority is gunbc.workspace_allocation_admission.
• Import debt: two UnimportedBareProviderDisposition rows retired as ImportsFixed (the slice imports them); none added.
• Wet routing (existing mechanism, not debt): eight claims whose first effect is shell.Mktemp.Dir (no mock_response by ruling) are routed exactly as login_callback_hold_wet already is — LocalRepoWetLane exclusion per file, every function on local_repo_wet_schedule, and the measured Dir/NoMockResponse gaps as floor_route_gap_expectation_chunk_34. Floor log on 75199db: each shows hermetic-route-gap-held-and-wet-passed.
• Two test fns that Discover workspace requests and settle unplanned expiry before placement #12505 placed inside gunbc.runner_microvm_cell_readiness now live in runner_microvm_cell_readiness_release_witness_test, minting through the admitted cell_reservation_released_write.
• extdeps.ssh.openssh_client_commands gains openssh_client_program() (admitted in the uncataloged_program caller roster) for the stdio-forward command; install_file_owned_command uses install_program().

Evidence

Required floor green on 75199db296 and on 1fd9360603 (before #13004 landed) and on the post-landing merge b6cadd78a8; review fixes on ea948db55c (run 37139096600; 75199db was run 37136141493). On 75199db the floor log shows every new identity planned-and-passed within the 302 ms enrolment margin, including the four route claims and the two release claims. On the earlier head 9d9da3d the floor adjudicated 107 newly enrolled workspace/commissioning/network/gateway/request-consumer witnesses with zero claim failures (it refused only on the eight route gaps now routed above). Generated artifacts adopted from the sealed repair candidate of run 37131097100.

Omissions vs the integration checkpoint (codex/allocation-main-landing e7c4426)

Compared over the files the integration branch itself changed (git diff $(git merge-base CP main) CP, excluding docs/plans/docs/notes), not an endpoint diff — 254 differ from this branch:

• Unit 3 — initial commissioning (Journal initial commissioning and gate workspace supply on committed readback #12691 child history), deferred to the next PR: 110 files. Commissioning executor/journal/fence/recovery/dispatch modules, fleet converge plan/workflow/terminal/publication changes, live-deploy apply/emit receipts, slot start/unit, boot probe, and their witnesses. workspace_commissioning and workspace_commissioning_evidence are carried here at their Discover workspace requests and settle unplanned expiry before placement #12505 revision because runner_microvm_cell_readiness consumes the readiness permit.
• Tracker / task-history / presentation (excluded by the landing plan): 17 not carried, 6 kept at alloc unit 1: auth + protected state (browser-bound Google login, cookie transport, owner admission, protected fabric state) #13004's revision.
• dag/gunbc/git_use_census/roadmap_event_git_execution.dag
• dag/gunbc/roadmap/roadmap_event_carrier_instance.dag
• dag/gunbc/roadmap/roadmap_event_migration.dag
• dag/gunbc/roadmap/roadmap_issue_routes.dag
• dag/gunbc/roadmap/roadmap_task_editorial.dag
• dag/gunbc/roadmap/roadmap_task_migration.dag
• dag/gunbc/roadmap/roadmap_task_projection.dag
• dag/gunbc/roadmap/roadmap_task_routes.dag
• dag/gunbc/roadmap/roadmap_task_wire.dag
• dag/test/claim/roadmap/roadmap_approval_transport_witness_test.dag
• dag/test/claim/roadmap/roadmap_event_carrier_wet_witness_test.dag
• dag/test/claim/roadmap/roadmap_task_projection_witness_test.dag
• dag/test/claim/roadmap/roadmap_task_wire_witness_test.dag
• dag/test/manual/roadmap_carrier_process_wet.dag
• dag/test/manual/roadmap_import_audit.dag
• dag/test/manual/roadmap_served_storage_hold_wet.dag
• tools/tests/roadmap_preview_readiness.py
• Unit 1 domain left to alloc unit 1: auth + protected state (browser-bound Google login, cookie transport, owner admission, protected fabric state) #13004's revision (17 files) or not carried (8):
• dag/gunbc/auth/approval_transport.dag
• dag/gunbc/auth/serve_route_readback.dag
• dag/gunbc/fabric/fabric_storage_state_bootstrap.dag
• dag/test/claim/auth/login_callback_hold_witness_test.dag
• dag/test/manual/fabric_state_hold_server.dag
• dag/test/manual/fabric_state_socket_hold_server.dag
• dag/test/manual/login_consumer_race.dag
• tools/tests/allocation_login_race.py
• No consumer even on Journal initial commissioning and gate workspace supply on committed readback #12691 — omitted rather than landed dangling (§3c):
• dag/gunbc/workspace_preparation.dag
• dag/gunbc/workspace_allocation_budget.dag
• dag/gunbc/workspace_allocation_supply.dag
• dag/gunbc/workspace_tool_observer.dag
• dag/gunbc/workspace_commissioning_observe.dag (consumed by unit 3)
• dag/gunbc/workspace_request_consumer_cli.dag
• dag/test/claim/workspace_supply_host_boundary_witness_test.dag
• dag/test/manual/workspace_preparation_typecheck.dag
• dag/test/manual/workspace_image_demo_wet.dag
  (workspace_offer_producer / workspace_prepare_convergence belong to unit 3's file set.) Automatic preparation and supply exposure therefore arrive with unit 3, which owns "read back committed provenance and initial readiness before exposing supply".
• Superseded by main: fabric_floor_policy.dag (main's gunbc.floor_demand owns floor requirements) and its import re-routes in fabric_witness_run, fabric_floor_dispatch, floor_cold_build_receipt and three witnesses; rfc_8118, e0599_probe_census, v2.lens.synthesis, github_merge_state_witness_test import edits; and the spark/v41_* repairs from the integration's main-reconcile commit dd5df8d — main's current revisions are kept.
• Integration narrative notes not carried: the seven docs/notes/allocation-*.md, approval-gcp-access.md and workspace-runtime-handoff.md receipts (transcribed run results describing the integration tree; review 75077).
• Ad-hoc qualification scripts not carried: tools/tests/allocation_served_storage.py, tools/tests/dag_validation_closure.py, tools/tests/allocation_login_race.py, tools/tests/roadmap_preview_readiness.py, dag/test/claim/fabric/fabric_closure_budget_witness_test.dag (storage-layer, unit 1).
• Kept with different content (reconciled to current main / alloc unit 1: auth + protected state (browser-bound Google login, cookie transport, owner admission, protected fabric state) #13004, or rewritten here): 23 files, listed above under the extraction changes (wildcard closure, program identities, route wiring, sudoers projection).

Known residue, stated rather than hidden

• extdeps.linux.tun_fdinfo (from Discover workspace requests and settle unplanned expiry before placement #12505) carries an inline Python program in a shell transport to count tap holders. That is raw shell standing where a modeled observation could; it is consumed by runner_microvm_network_observe and its witnesses, so it is carried rather than dropped, and its replacement by a modeled /proc fdinfo reader is a follow-up.
• No VM, host, deploy or commissioning action was performed.

🤖 Generated with Claude Code

[briansrls]

HOLD at exact head 033f89a055cd842441239f93aa103d9f29625489.

The core architecture is directionally right: sized 2/4-vCPU and 4/8-GiB requests issue exact memory grants; resource selection is explicit and host-agnostic over a supplied dedicated roster; the durable plan binds request/work/demand/offer/slot/generation/grant; the workspace path extends the existing microVM controller rather than forking it; fleet-managed SSH evidence is incarnation- and host-key-bound; and release remains behind durable shared teardown/readiness plus exact hold-generation settlement. The new workspace_slot_readiness_route is also correct: CellWithdrawn / HostWithdrawn cannot launch a wanted workspace, while retirement remains possible.

Two blockers remain.

P1 — the mounted create/release routes cannot satisfy their own deployment-path conjunct

workspace_route_create and workspace_route_release both call the write admission with DeploymentAccessPolicy { tailnet_path_required: true }. But the one actual server seam, roadmap_serve_request_security, still constructs every request with ServeStatusUnreadable and serve_route: none. request_access_path_of therefore cannot produce AccessPathTailnetProxy; it yields AccessPathLocalDev on a loopback bind or AccessPathDirectHttps otherwise, and deployment_path_decision rejects both when the policy requires tailnet.

So the GET routes can read an owner ledger, but no request through the mounted production handler can create or release an allocation. The current allocation HTTP witness avoids this exact join by supplying AccessPathLocalDev with tailnet_path_required: false.

Please either connect the real serve-route/ACL readback before mounting these writes, or leave the mutating routes out until that observation exists. Do not weaken the policy merely to make the test pass. Add an exact server-seam control showing a valid logged-in allocation POST reaches the protected store under the intended deployment path; the no-readback neighbor must refuse.

P1 — an elected acquisition actor can wedge an owner forever if it dies before the hold CAS

The immutable actor record is written before workspace_reservation_apply. A replacement slot-controller invocation cannot win that actor slot because the stored value names the prior InvocationID. It then falls back to read-only hold recovery. If the old controller died after actor election but before the hold operation committed, recovery observes no matching hold and refuses. After release/expiry, workspace_settle_unelected_retirement also refuses because an actor exists. The committed control explicitly establishes that an elected actor cannot be cancelled from an absent-hold observation, but there is no subsequent path that proves the old invocation terminal and either rearms acquisition or settles retirement.

That is a permanent quota/request wedge in a real crash window, despite no VM ever launching and no hold existing. It conflicts with this unit's restart/recoverable-never-launched claim.

Please add a generation-fenced takeover/settlement path based on the exact old systemd invocation being terminal plus a fresh authoritative hold observation:

• matching hold present -> recover and publish that reservation;
• hold absent/free and old invocation terminal -> CAS the actor from the exact old record to a new actor or cancellation tombstone;
• hold or invocation unreadable -> retain the obligation.

Controls should kill/replace the actor after actor publication but before hold acquisition and prove wanted retry, retired settlement, matching-hold recovery, and unreadable-state retention without a duplicate hold.

I am not holding this unit for the explicitly deferred unit-3 supply producer or full commissioning transaction. Carrying the lightweight readiness-permit dependency is acceptable, provided unit 3 remains the only production route that exposes commissioned supply. Exact-head CI is green, but the current claims do not execute either failing end-to-end join above.

[briansrls]

Supplemental finding on the same exact head:

P1/P2 — the API admits allocation IDs that its own GET/release routes cannot address

workspace_create_submission accepts any nonempty idempotency_key up to 128 characters. The durable allocation uses that value as its public allocation_id. But /allocations/{allocation_id} and /allocations/{allocation_id}/release bind one raw nonempty path segment; the route matcher splits on /, strips ?…, and does not percent-decode the bound value.

Therefore an admitted key such as a/b, a?b, a b, or a Unicode value can be durably recorded but cannot be presented back as the same route parameter through an ordinary encoded URL. This can leave the owner unable to GET or release the allocation through the API that created it.

Please give the public allocation/idempotency key one path-segment-safe constructor (the same unreserved/base64url-style alphabet is sufficient), use it in the submission and durable request, and add a route round-trip control. Alternatively change the API to carry the exact key in a decoded request body and keep the route on a separately derived safe allocation ID. Do not rely on a future frontend to generate only safe strings when the server currently admits more.

[briansrls]

APPROVE at exact head ea948db55c476075ef85e15b71f4b2551b245eb8.

The three blockers from reviews 5403489707/5403494247 are addressed:

1. Create/release remain unmounted while retaining tailnet_path_required: true; the handler controls now exercise the real request_access_path_of boundary and distinguish observed matching proxy readback from absent readback and LocalDev.
2. The dead acquisition actor has a generation-fenced recovery decision over the recorded invocation and a fresh hold observation. Matching holds recover, terminal/no-hold actors may rearm or tombstone by desired state, and active/unreadable/foreign states retain the obligation. The disclosed wanted-rearm real-systemd E2E remains live acceptance, not a source blocker for this unit.
3. Public allocation IDs are admitted through a sole-constructor [A-Za-z0-9_-]{1,128} wall, with route round-trip and invalid-spelling controls.

The sized grant, immutable selected-slot plan, existing microVM lifecycle extension, fleet-managed SSH, withdrawn-readiness launch wall, and sanitation-before-release structure remain sound. Exact-head required checks are green. This approval does not claim live commissioning, VM boot, SSH, release, or same-slot reuse.

LAND.