Fleet host identities move to the leaf gunbc.fleet_host_identity (broker closure 196 → 192)

dag/gunbc/auth/approval_device_enrolment_code_issue.dag

@@ -14,7 +14,7 @@ import gunbc.live_deploy.slice_bounds { approval_broker_slice_memory_max, approv
 import extdeps.tools.env { env_prefixed_argv }
 import v2.std.orchestration { EnvSet }
 import gunbc.cli_run_workspace_root_scaffold { gunbc_workspace_root_env_name }
-import gunbc.fleet_intent_network { operator_host_srv1 }
+import gunbc.fleet_host_identity { operator_host_srv1 }
 import gunbc.actions_run_binding {
   actions_variable_read, ActionsVariablePresent, ActionsVariableAbsent, fleet_converge_expected_host_env_name,
   read_expected_revision, ExpectedRevisionPresent, ExpectedRevisionAbsent,

dag/gunbc/auth/approval_keyring_converge.dag

@@ -19,7 +19,7 @@ import extdeps.tools.sha256sum { sha256sum_file_digest_via_shell, Sha256FileDige
 import extdeps.sudo.elevation { sudo_elevate }
 import extdeps.tools.chown { chown_argv, ChownOwnerNames }
 import extdeps.posix.identity { PosixOwnerNames }
-import gunbc.fleet_intent_network { operator_host_srv1 }
+import gunbc.fleet_host_identity { operator_host_srv1 }
 import gunbc.actions_run_binding { actions_variable_read, ActionsVariablePresent, ActionsVariableAbsent, fleet_converge_expected_host_env_name, actions_variable_trimmed }
 import gunbc.auth.approval_keyring_pins {
   approval_submission_mac_key_path_env,

dag/gunbc/auth/approval_ntfy_publish.dag

@@ -5,7 +5,7 @@ import extdeps.ntfy.ntfy { NtfyTopic, NtfyPublishReceipt, NtfyErrorShape }
 import extdeps.transports.rest { RestOutcome, RestOk }
 import extdeps.ietf.http_semantics { POST }
 import std.resources { Network }
-import gunbc.fleet_intent_network { operator_host_srv1 }
+import gunbc.fleet_host_identity { operator_host_srv1 }
 import gunbc.fleet_tailnet { fleet_tailnet_domain, tailnet_base_url_from }
 
 // ── The publish binding: transport and address, in the layer that owns them ──────────────────

dag/gunbc/auth/managed_host_boot_federation.dag

@@ -10,7 +10,7 @@ import gunbc.auth.github_gcp_federation { fleet_secrets_project_number, github_w
 import gunbc.auth.gcp_secret_access { SecretAccessGrant }
 import gunbc.auth.oidc_claim_pins { OidcClaimPin, claim_pins_attribute_condition, claim_pins_admit, fleet_converge_job_claim_pins }
 import gunbc.fleet_ssh_access { fleet_automation_ssh_privkey_secret }
-import gunbc.fleet_intent_network { operator_host_mtcollins1 }
+import gunbc.fleet_host_identity { operator_host_mtcollins1 }
 import gunbc.machine_intake_bmc_secure { BmcSecured, BmcSecureRefused }
 import gunbc.managed_host {
   ManagedHost, ManagedHostBindingStanding, ManagedHostBound, ManagedHostAccessUnobserved, ManagedHostNotSecured,

dag/gunbc/auth/privileged_effect_census.dag

@@ -15,7 +15,7 @@ import gunbc.spark.bootstrap_provision {
 }
 import gunbc.cloudflare.r2_token_mint { cloudflare_account_token_bootstrap_intervention }
 import gunbc.github_app_acquisition { census_app_registration_submit_step }
-import gunbc.fleet_intent_network { operator_host_mtcollins1 }
+import gunbc.fleet_host_identity { operator_host_mtcollins1 }
 import gunbc.auth.managed_host_boot_federation { BootFederationProvisioned, BootFederationUnprovisioned, boot_federation_for, boot_federation_service_account_member }
 import gunbc.auth.authorization_pattern_selection {
   PrivilegedEffect, ProviderSurface, ApiSurface, HumanSurfaceOnly,

dag/gunbc/auth/standing_operator_grant.dag

@@ -5,7 +5,7 @@ import product.placement_supply { HostIdentity, host_identity_eq }
 import std.list { list_member }
 import std.scoped_authorization { OperatorGrant, ScopedAuthorization, AuthorizationGranted, AuthorizationRequest, Unclaimed }
 import std.decl_ref { DeclarationRef, decl_ref }
-import gunbc.fleet_intent_network { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8 }
+import gunbc.fleet_host_identity { operator_host_srv5, operator_host_srv6, operator_host_srv7, operator_host_srv8 }
 import gunbc.spark.fabric_switch_observed { FabricGroup, FabricGroupA, fabric_group_wire }
 import gunbc.auth.authorization_pattern_selection { StandingDestructiveAuthorization }
 

dag/gunbc/bmc/bmc_fan_alignment_standing.dag

@@ -3,12 +3,7 @@ module gunbc.bmc_fan_alignment_standing
 import std.types { Bool, List, NonEmptyStr }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
 import product.placement_supply { HostIdentity }
-import gunbc.fleet_intent_network {
-  operator_host_srv1,
-  operator_host_srv2,
-  operator_host_srv3,
-  operator_host_srv4,
-}
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
 
 // WHETHER THE INTENT CAN DESCRIBE WHAT IS ACTUALLY RUNNING ON A HOST'S FAN CONTROLLER.
 //

dag/gunbc/bmc/bmc_fan_alignment_standing_witness.dag

@@ -33,11 +33,7 @@ import gunbc.bmc_fan_projection {
 }
 import gunbc.fleet_bmc_state { srv4_bmc_fan_projection_capability }
 import gunbc.fleet_bmc_observation { srv4_bmc_fan_converged_policy_observation }
-import gunbc.fleet_intent_network {
-  operator_host_srv1,
-  operator_host_srv3,
-  operator_host_srv4,
-}
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv3, operator_host_srv4 }
 
 // THE HOSTS I RECONFIGURED BY HAND MUST REFUSE ACTUATION. This is the conjunct that makes the
 // interlock real rather than declared: it fails the moment someone marks srv3 or srv4 adopted.

dag/gunbc/bmc/bmc_onboarding.dag

@@ -10,7 +10,7 @@ import gunbc.auth.access_token_source { AccessEnsurePlan }
 import extdeps.bmc.openbmc { openbmc_factory_login }
 import extdeps.boards.asrock_rack { asrock_altrad8ud_redfish_system_id }
 import gunbc.fleet_intent { srv1_baseboard, srv2_baseboard, srv3_baseboard, srv4_baseboard }
-import gunbc.fleet_intent_network { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
 import product.placement_supply { HostIdentity }
 
 // QUARANTINED LEGACY LIFECYCLE (machine-intake ruling 2026-08-29, answer (b)).

dag/gunbc/build_cache/build_cache_instance.dag

@@ -7,9 +7,7 @@ import std.cache_identity { CacheInterfaceId }
 import std.disposition { ConstructionMechanism, SingleAuthority }
 import product.placement_supply { HostIdentity }
 import extdeps.cache.sccache { SccacheServerEndpoint, SccacheServerUnixSocket, sccache_local_id }
-import gunbc.fleet_intent_network {
-  operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4,
-}
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
 import gunbc.host_layout {
   gunbc_managed_compile_pool_slice,
   CompilePoolPlacement, CompilePoolSliceDeclared, CompilePoolInRunnerSlots,

dag/gunbc/build_cache/build_cache_latency_probe.dag

@@ -4,9 +4,7 @@ import std.types { NonEmptyStr, String, Int, Bool, List }
 import std.measure { Millisecond, millisecond, measure_count }
 import std.disposition { ConstructionMechanism, Disposition, Terminal, SingleAuthority }
 import product.placement_supply { HostIdentity }
-import gunbc.fleet_intent_network {
-  operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4,
-}
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
 
 data build_cache_latency_probe_disposition: Disposition = Terminal {
   reason: "The acceptance metric for the srvN build-cache placement lane, and the falsifier for any fix to it. It measures ONE thing — how long the CI `build` job takes, per host — because that duration is dominated by whether cache-miss compiles are served by a healthy sccache server, and because it is derivable from GitHub Actions job timings that already exist. No host access, no new instrumentation, no agent on the box."

dag/gunbc/ci/ci_deploy_access.dag

@@ -10,7 +10,7 @@ import std.materialization_ladder { Frame, SharedStateFrame }
 import std.effect_grant { Grant, Envelope, verb_of_effect_shape, admit_effect }
 import std.effects { ExecuteEffect }
 import gunbc.fleet_intent { ComputeHost, srv1_host }
-import gunbc.fleet_intent_network { operator_host_srv1 }
+import gunbc.fleet_host_identity { operator_host_srv1 }
 import gunbc.fleet_posix_accounts {
   GroundedPosixPrincipal,
   PosixSudoGrant,

dag/gunbc/ci/ci_deploy_target_host.dag

@@ -13,7 +13,7 @@ import gunbc.hostname_read {
   HostnameShortCaptureRefused,
 }
 import product.placement_supply { HostIdentity }
-import gunbc.fleet_intent_network { operator_host_srv1 }
+import gunbc.fleet_host_identity { operator_host_srv1 }
 import gunbc.ci_fleet { srv1_offer, ComputeOffer }
 import gunbc.host_effect { HostEffectTransport, LocalShell, SshShell, EmitArtifactThenThinRun }
 import gunbc.runner_spec_from_offer { runner_spec_from_offer }

dag/gunbc/deployed_intent_v1.dag

@@ -3,7 +3,7 @@ module gunbc.deployed_intent_v1
 import std.disposition { Disposition, Terminal }
 import product.placement_supply { HostIdentity }
 import gunbc.fleet_intent { ComputeHost, srv1_host, srv2_host, srv3_host, srv4_host }
-import gunbc.fleet_intent_network { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
 import extdeps.dns.domain_name { DnsLabel }
 import gunbc.hostname_allocation { canonical_hostname_for_fleet_slot }
 

dag/gunbc/fabric/fabric_storage_placement.dag

@@ -4,7 +4,8 @@ import gunbc.fabric_storage_address { fabric_storage_route_prefix, fabric_storag
 
 import std.types { String, NonEmptyStr, FilePath, Int, Bool, Port, List }
 import product.placement_supply { HostIdentity }
-import gunbc.fleet_intent_network { operator_host_srv1, fleet_intent_network }
+import gunbc.fleet_intent_network { fleet_intent_network }
+import gunbc.fleet_host_identity { operator_host_srv1 }
 import gunbc.roadmap_dashboard_instance { HostDashboardInstance, dashboard_instance_fabric_storage_root, srv1_live_dashboard_instance, dashboard_instance_child }
 import std.effect_grant { Read, Write, Execute }
 import gunbc.ownership { Ensured }

dag/gunbc/fleet/fleet_capacity_control.dag

@@ -3,9 +3,7 @@ module gunbc.fleet_capacity_control
 import std.types { String, NonEmptyStr, Bool, List, Int }
 import product.placement_supply { HostIdentity }
 import extdeps.llm.cli_lifecycle { ProviderKind, ClaudeCliProvider, CodexCliProvider, CursorCliProvider, provider_kind_label }
-import gunbc.fleet_intent_network {
-  operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4,
-}
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
 
 // THE OPERATOR'S CONTROL OVER ACTIVE FLEET CAPACITY, ON TWO AXES THAT ARE NOT THE SAME FACT.
 //

dag/gunbc/fleet/fleet_converge_cli.dag

@@ -50,14 +50,7 @@ import gunbc.ci_runner_placement {
   runner_deployment_plan, runner_host_deployment_for,
   host_deployment_refusal_text,
 }
-import gunbc.fleet_intent_network {
-  operator_host_srv1,
-  operator_host_srv2,
-  operator_host_srv3,
-  operator_host_srv4,
-  operator_host_srv5,
-  operator_host_srv6,
-}
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4, operator_host_srv5, operator_host_srv6 }
 import std.types { FilePath }
 
 data gunbc_converge_cli_stage0_receiver_disposition: Disposition = Terminal {

dag/gunbc/fleet/fleet_converge_workflow.dag

@@ -114,7 +114,7 @@ import gunbc.managed_host_unit_hold {
   UnitHoldHostAdmission, UnitHoldHostAdmitted, UnitHoldHostNotManaged, UnitHoldHostNotRequired,
   unit_hold_admission_for, unit_hold_host_admission_refusal,
 }
-import gunbc.fleet_intent_network { operator_host_mtcollins1 }
+import gunbc.fleet_host_identity { operator_host_mtcollins1 }
 import gunbc.auth.gcp_iam_converge_federation { gcp_iam_converge_environment, gcp_iam_observe_wif_provider_resource }
 import gunbc.auth.gcp_iam_converge { iam_observe_service_account, iam_converge_service_account, iam_converge_token_lifetime }
 import gunbc.auth.gcp_iam_converge_run { gcp_iam_converge_step_timeout_minutes, iam_converge_token_env, gcp_iam_converge_approved_output }
@@ -123,7 +123,7 @@ import gunbc.auth.managed_host_boot_federation {
   ManagedHostBootFederationStanding, BootFederationProvisioned, BootFederationUnprovisioned,
   boot_federation_for, boot_federation_provider_resource,
 }
-import gunbc.fleet_intent_network { operator_host_mtcollins1 }
+import gunbc.fleet_host_identity { operator_host_mtcollins1 }
 import gunbc.auth.ci_app_key_rotation {
   app_key_version_env_name,
   app_key_verify_record_env_name,

dag/gunbc/fleet/fleet_fan_tach_expectation.dag

@@ -2,12 +2,7 @@ module gunbc.fleet_fan_tach_expectation
 
 import std.types { Bool, Int, List, NonEmptyStr }
 import product.placement_supply { HostIdentity }
-import gunbc.fleet_intent_network {
-  operator_host_srv1,
-  operator_host_srv2,
-  operator_host_srv3,
-  operator_host_srv4,
-}
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
 
 // WHAT THIS MODULE ANSWERS, AND THE NARROWNESS IS THE POINT:
 //

dag/gunbc/fleet/fleet_fan_tach_observation.dag

@@ -4,12 +4,7 @@ import std.types { Int, List, NonEmptyStr }
 import std.measure { rpm }
 import product.placement_supply { HostIdentity }
 import product.fan_tach { FanTachEndpointIdentity, FanTachWindow }
-import gunbc.fleet_intent_network {
-  operator_host_srv1,
-  operator_host_srv2,
-  operator_host_srv3,
-  operator_host_srv4,
-}
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
 
 // A WINDOW PER ENDPOINT, NOT A READING, AND MEASUREMENT FORCED IT.
 //

dag/gunbc/fleet/fleet_fan_wiring.dag

@@ -21,12 +21,7 @@ import gunbc.fleet_fan_tach_expectation {
   srv3_fan_tach_expectation,
   srv4_fan_tach_expectation,
 }
-import gunbc.fleet_intent_network {
-  operator_host_srv1,
-  operator_host_srv2,
-  operator_host_srv3,
-  operator_host_srv4,
-}
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
 
 // THREE POPULATIONS, NOT ONE, AND THIS MODULE IS THE MIDDLE ONE.
 //

dag/gunbc/fleet/fleet_host_assembly.dag

@@ -23,12 +23,7 @@ import product.inventory {
   inventory_lot_identities_contain,
 }
 import std.decl_ref { DeclarationRef, WholeDeclaration }
-import gunbc.fleet_intent_network {
-  operator_host_srv1,
-  operator_host_srv2,
-  operator_host_srv3,
-  operator_host_srv4,
-}
+import gunbc.fleet_host_identity { operator_host_srv1, operator_host_srv2, operator_host_srv3, operator_host_srv4 }
 import gunbc.fleet_asset_identity {
   chassis_srv1,
   chassis_srv2,