Managed-host cut 4c: operation-keyed boot federation standing

[gunbai-bot]

Managed-host cut 4c (docs/plans/managed-host-untangle.md, ruling (b)). gunbc.auth.mtcollins1_boot_federation and _provision are deleted. The replacement is one operation-keyed authority.

Shape (follows #13055)

• gunbc.auth.managed_host_boot_federation:
  • ManagedHostBootFederation is sole_constructor with fields {host, names, claim_pins, secret_grants}. Its only mint is admit_boot_federation(host: ManagedHost).
  • Admission requires managed_host_binding to be Bound and a row in the binding table boot_federation_names.
  • mtcollins1 is bound to the live names, kept byte-identical: pool github-mtcollins1-boot, provider -oidc, SA mtcollins1-boot@…, environment, cell title prefix and cell description.
  • Any other host is BootFederationUnprovisioned {HostNotManaged | HostUnbound | NoPolicy}.
  • The BMC credential cell is now the row's own secure BmcSecured.reference.secret (same value as mtcollins1_bmc_gunbc_secret_ref), so the unit observation enters as the ManagedHost row's value.
  • None of these ids is on ManagedHost.
• gunbc.auth.managed_host_boot_federation_provision:
  • boot_dedicated_federation(f) takes only the admitted value.
  • The out-of-band entry managed_host_boot_federation_provision_with_supplied_token provisions every provisioned pair and refuses when there are none.
• Consumers read only the admitted value:
  • gcp_iam_converge: targets are heal, private, provisioned_boot_federations()…, namecheap, in the same order.
  • privileged_effect_census: Unbindable when unprovisioned. The site moves to the new provision entry.
  • fleet_converge_workflow: the mtcollins1_boot job (a mode-named surface, cut 7) reads boot_federation_for(operator_host_mtcollins1). An unprovisioned standing refuses emission (FleetConvergeYamlGenerationRefused), on the same pattern as fleet_converge_job_needs.
• The operation field was dropped deliberately. The type and module name the operation (boot), so a one-arm operation enum would be a value no consumer branches on (§3c). A second operation is a second standing.
• managed_host_fixture admit_callers gains one decl, the new same-path RED.

Terminal receipt

Binary /tmp/vs611/gunbc, built from a5a9957 (cargo build --release --bin gunbc), sha256 5175b040f18cb846928a2a99c92184819c5a940bfc64404ebabe043ba0806b31. Commit b991e91 contains only .dag files, so one binary serves head and base. Runs were made at b991e91 and at merge-base a5a9957, before the merge of main (ba69ed6, which auto-merged with no conflict in touched lines).

Byte identity.

• The generated fleet-converge.yml (expected_fleet_converge_yml) is cmp-identical between head and base, at 323271 bytes. It also equals the committed .github/workflows/fleet-converge.yml modulo its 2-line header. The diff is empty.
• IAM: at head, a scratch probe compared the gcp_iam_converge_targets row for pool github-mtcollins1-boot field by field (label, pool, display name, provider, mapping, condition, principal set, SA, SA id/display/member, secret_grants list) against the deleted module's mtcollins1_boot_dedicated_federation(), re-hosted verbatim under a scratch name. Result: IDENTICAL. The census mtcollins1_boot_effect member is also identical. Target order is unchanged: github-heal-publisher, github-heal-publisher-private, github-mtcollins1-boot, github-namecheap-dns.
• No live IAM call was made.

(1) Consumer roster (plan census method, recomputed at head):

root	consumers
deleted gunbc.auth.mtcollins1_boot_federation (base)	gcp_iam_converge, mtcollins1_boot_federation_provision, privileged_effect_census, fleet_converge_workflow · witness mtcollins1_maintenance_hold
deleted gunbc.auth.mtcollins1_boot_federation_provision (base)	gcp_iam_converge · witness heal_publisher_provision
new gunbc.auth.managed_host_boot_federation	gcp_iam_converge, managed_host_boot_federation_provision, privileged_effect_census, fleet_converge_workflow · witnesses heal_publisher_provision, managed_host_boot_federation
new …_provision	gcp_iam_converge · witness heal_publisher_provision
changed gcp_iam_converge / privileged_effect_census / fleet_converge_workflow / managed_host / fleet_workflow_steps (comment) / heal_publisher_provision (comment) / gcp_iam_converge_federation (comment)	gcp_iam_converge_run, census_closure_frontier, generated_artifact_emit, host_reset_*; witnesses below

fleet_secret_accessor_roster never imported the root, so it is not a consumer.

gunbc run --claim-run results, head vs base (pass/fail):

witness	head	base
managed_host_boot_federation (new)	6/0	—
managed_host_boot_federation_forged_probe (new)	2/0	—
heal_publisher_provision	18/0	18/0
mtcollins1_maintenance_hold	9/0	12/0 (3 federation claims moved to the new witness)
gcp_iam_converge_witness_test	21/0	21/0
authorization_pattern_selection	23/0	23/0
approval_broker_helper_grant	18/1	18/1
managed_host / managed_host_forged_probe	3/0, 3/0	3/0, 3/0
approval_device_enrolment_code	6/1	6/1
fleet_converge_checkout_pin / fleet_converge_plan	7/0, 87/0	same
mtcollins1_boot_run	35/0	35/0
namecheap_workflow / organization_runner_roster_read	4/0, 42/0	same
toolchain_home_standing / workflow_capability_closure	10/0, 8/0	same
witness_floor_workflow_consolidation	21/1	21/1
workflow_dispatch_input	36/1	36/1
repository_convergence_placement	19/0	19/0

Every red matches base claim for claim. They are pre-existing:

• the_helper_argv_is_pinned_word_for_word
• the_delivered_receipt_comes_from_the_published_message_and_its_line_never_carries_the_code
• w_the_required_workflow_carries_both_lanes
• the_mtcollins1_boot_prelude_carries_the_shared_total_bound

Mode check (per the #13153 triage). gunbc run --claim-run executes Wet. Each of the four reds above is a plain FAIL <claim>, meaning the claim returned false, and every sibling claim in the same module PASSes under the same run. None of them prints a refusal, and nothing is a Wet refusal of a Hermetic-only realization (a mode refusal would refuse every claim in its module). So the head-vs-base comparison compares claim values.

mtcollins1_boot_acceptance_matrix does not import any deleted or changed root, so it is not in this cut's consumer roster and was not run.

sol_hold_stdin_wet was not run. Running it in a session SIGKILLs pid 1 (the 'container restarts'), so it stays unrun until #13153 lands, and nothing is claimed about it.

(2) Same-path REDs.

• In a throwaway worktree, the mtcollins1 row of boot_federation_names was disabled (if false && …). Results:
  • workflow emission → REFUSED gunbc.fleet_converge_workflow: the mtcollins1_boot mode's host has no admitted boot federation …, with no yaml emitted.
  • IAM probe → DIFFERENT, with targets heal, private, namecheap.
  • the new witness's 4 provisioned claims FAIL, and its 2 refusal claims stay PASS.
• Restored, all are green as above.
• In-witness REDs:
  • w_a_bound_host_with_no_boot_policy_is_unprovisioned: a fixture row is renamed, it binds, and admission refuses it with NoPolicy.
  • w_a_host_that_is_not_managed_is_unprovisioned: srv1 → HostNotManaged.
  • The forged probe pins SoleConstructorViolation at ManagedHostBootFederation, with a class-scoped clean control.

(3) Corpus sweep (git grep across dag, src, docs, .github, artifacts) for the deleted modules and symbols:

• fleet_converge_mtcollins1_boot_*: workflow-local, mode-named (cut 7). Left as is.
• The cell description literal "gunbc.auth.mtcollins1_boot_federation: the one version …": a live provisioned IAM condition string (ruling b). It is kept byte-identical, and the witness asserts it.
• recurring_failure_mode/rest_response_nested_from_key_ignored: a dated receipt.
• docs/plans/managed-host-untangle.md: the plan.
• Entry-path strings: no gunbc.non_fold_residue, gunbc.ci_spec or v2.workflow.floor_unimported_bare_provider_debt_roster entry named the deleted files, so none were changed.

(4) No aliases. No module re-exports or wraps the deleted names, and no mtcollins1_* function calls into the generic one.

Cut 1 (#13121) files: the only edit is one comment line in mtcollins1_boot_run_witness_test (535).

🤖 Generated with Claude Code

[briansrls]

Reviewed exact current head 09ee33adfd182c150c6a745684b48e522b72e734. The cut is sound.

ManagedHostBootFederation is correctly operation-keyed by its type and module. Retaining an operation field would create a second, authorable copy of the fact already carried by the type, with no consumer that legitimately branches on it. A future non-boot operation should receive its own standing rather than an enum tag beside this one.

The carrier is construction-confined and can be minted only from a real ManagedHost whose access/security join is ManagedHostBound and whose host has a boot-federation policy row. The admitted value retains the host, exact live IAM names, claim pins, and the secret grants derived from that row's secured credential reference. HostNotManaged, HostUnbound, and NoPolicy remain typed non-provisioned states rather than defaults.

The consumer migration has one authority: IAM convergence, federation provisioning, the privileged-effect census, and workflow emission all project from the admitted boot-federation population. In particular, removing the mtcollins1 policy row makes workflow emission refuse and removes the IAM target; it does not silently retain a second static route. The old mtcollins1-specific modules are deleted with no aliases.

Keeping the live pool/provider/service-account identifiers byte-identical is correct under the earlier ruling. The generated workflow comparison and the field-by-field IAM comparison support that the source recut changes ownership, not deployed identity or behavior.

The forged-literal compiler probe closes direct construction of ManagedHostBootFederation, and the host-not-managed/no-policy controls exercise the real admission path. The later head commit moves the display-name note to module-item grain and changes no semantics.

Exact-head required CI is still pending. This approval is semantic; land only after the required workflow is green and the branch is reconciled with current main.