Deployment risk D2: role-following singletons resolve the prod-role holder

.github/workflows/fleet-converge.yml

@@ -1543,7 +1543,7 @@ jobs:
           compression-level: 0
         if: always() && github.event.inputs.mode == 'workspace_checkpoint_restore'
         timeout-minutes: 10
-      - name: Materialize approval MAC keys on srv1 (SM pinned -> sha256 prefix -> /etc/gunbc-roadmap 0640)
+      - name: Materialize approval MAC keys on the approval broker host (SM pinned -> sha256 prefix -> /etc/gunbc-roadmap 0640)
         id: approval_keyring_converge
         run: |-
           # 🟡 dissolve-on: gunbc_ci_approval_keyring_converge_invoke - orch-emitted foreign-executor (GitHub Actions run:) credential runner: WIF access token by env, two PINNED secret versions (capability and submission MAC keys) fetched over curl, 0600 files under RUNNER_TEMP with a trap armed BEFORE the credentials touch disk. The pipeline steps are modeled (gunbc_ci_approval_keyring_converge_prelude) but the runner transport itself remains hand-shell; DISSOLVES WHEN the runner is authored as v2.extdeps.languages.bash_build nodes (typed, grammar-quoted words; command substitution; assignment; pipe; if/test; redirect; || true) emitted by v2.workflow.bash_emit bash_emit_stmts -- a route AVAILABLE today (#12422 retired the sibling pack runner on it), so this migration is unauthored, not blocked on a missing capability; set -euo pipefail, umask, export and trap are ordinary commands on that route, and the trap body is itself built from nodes and passed as one grammar-quoted word, so no new orchestration intent is a prerequisite
@@ -1572,7 +1572,7 @@ jobs:
           FLEET_CONVERGE_EXPECTED_HOST: ${{ github.event.inputs.host }}
         if: github.event.inputs.mode == 'approval_keyring_converge'
         timeout-minutes: 5
-      - name: Issue a device enrolment code on srv1 and deliver it to the operator channel (receipt only in this log)
+      - name: Issue a device enrolment code on the approval broker host and deliver it to the operator channel (receipt only in this log)
         id: approval_device_enrolment_code_issue
         run: |-
           ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
@@ -3052,7 +3052,7 @@ jobs:
         env:
           RELEASE_BINS_KEY: ${{ needs.build.outputs.release_bins_key }}
         timeout-minutes: 5
-      - name: Install the approval broker dark on srv1 (additive unit + slice; does not restart gunbc-roadmap.service)
+      - name: Install the approval broker dark on the approval broker host (additive unit + slice; does not restart gunbc-roadmap.service)
         id: approval_broker_dark_install
         run: |-
           ROOT=$(git rev-parse --show-toplevel 2>/dev/null || pwd)

dag/extdeps/shell.dag

@@ -528,6 +528,22 @@ service shell.Stat {
       nonzero => String "stat could not read the path"
     }
   }
+
+  operation GroupOf {
+    requires none
+    input { path: FilePath }
+    output {
+      success: Bool from "exit_success"
+      stdout: String from "stdout"
+      stderr: String from "stderr"
+    }
+    readonly
+    transport shell { argv: ["stat", "-c", "%G", "--", "{path}"] }
+    exit {
+      0 => Unit "the path exists and its owning group is on stdout"
+      nonzero => String "stat could not read the path"
+    }
+  }
 }
 
 service shell.Move {

dag/gunbc/approve_ios_project.dag

@@ -14,7 +14,8 @@ import extdeps.apple.build_settings {
   MarketingVersion, CurrentProjectVersion
 }
 import gunbc.auth.approval_app_attest_config { approval_app_bundle_id, approval_app_bundle_version }
-import gunbc.auth.approval_broker_endpoint { approval_broker_public_host_from, approval_broker_public_port }
+import gunbc.auth.approval_broker_endpoint { approval_broker_public_port, ApprovalBrokerAddressResolved, ApprovalBrokerAddressRefused }
+import gunbc.auth.approval_broker_placement { approval_broker_public_host_from }
 import gunbc.fleet_intent_network { fleet_intent_network }
 import extdeps.apple.xcode { xcode_26_6 }
 import extdeps.xcodegen.project_spec {
@@ -45,7 +46,7 @@ import extdeps.languages.yaml.emit { emit_yaml, EmittedYaml, YamlEmitRefused, ya
 //   server_host        ApproveServerHost -- read by ServerConfig at launch.
 //   apns_environment   ApproveApnsEnvironment -- read by ServerConfig at launch.
 // apns_environment is xcconfig-substituted from Config/Team.xcconfig. server_host is NOT: it is the
-// broker's public host (gunbc.auth.approval_broker_endpoint approval_broker_public_host_from), the
+// broker's public host (gunbc.auth.approval_broker_placement approval_broker_public_host_from), the
 // same composition the approval links are issued against, written into the spec as a value. It was
 // an operator-typed APPROVE_SERVER_HOST, a second authority for where the broker answers.
 type ApproveAppInfo {
@@ -194,9 +195,12 @@ fn approve_ios_project_yml_from(domain: NonEmptyStr?, port: Port?) -> ApproveIos
       "gunbc.approve_ios_project: approval_broker_public_port is ", to_string(p),
       " and the app's ServerConfig carries no port; project it (an ApproveServerPort Info.plist key read by gunbc.approve_ios_swift_wire ServerConfig) before publishing the broker off the default TLS listener"
     ], "") }
-    Absent => match emit_yaml(v: project_spec_yaml(p: approve_ios_project_spec(server_host: approval_broker_public_host_from(domain: domain)))) {
-      EmittedYaml { text: t } => ApproveIosProjectGenerated { content: concat(approve_ios_project_header, t) }
-      YamlEmitRefused { path: p, reason: r } => ApproveIosProjectRefused { reason: yaml_emit_refusal_text(module_path: "gunbc.approve_ios_project", path: p, reason: r) }
+    Absent => match approval_broker_public_host_from(domain: domain) {
+      ApprovalBrokerAddressRefused { detail } => ApproveIosProjectRefused { reason: join(["gunbc.approve_ios_project: ", detail as String], "") }
+      ApprovalBrokerAddressResolved { value: host } => match emit_yaml(v: project_spec_yaml(p: approve_ios_project_spec(server_host: host))) {
+        EmittedYaml { text: t } => ApproveIosProjectGenerated { content: concat(approve_ios_project_header, t) }
+        YamlEmitRefused { path: p, reason: r } => ApproveIosProjectRefused { reason: yaml_emit_refusal_text(module_path: "gunbc.approve_ios_project", path: p, reason: r) }
+      }
     }
   }
 }

dag/gunbc/auth/approval_broker_endpoint.dag

@@ -7,7 +7,8 @@ import extdeps.tailscale.serve {
 import extdeps.external_authority { ExternalAuthority, CitedFigureStanding, CitedToAuthority, TranscribedUncited }
 import gunbc.fleet_tailnet { fleet_tailnet_domain, tailnet_base_url_from, tailnet_host_from }
 import gunbc.serve_liveness { serve_liveness_path }
-import gunbc.srv1_dashboard_bind { srv1_dashboard_host_identity }
+import extdeps.shell
+import v2.std.collection { Present, Absent }
 import gunbc.auth.approval_device_wire { approval_device_request_path_prefix, approval_device_enrollment_path_prefix }
 
 // ── WHERE THE APPROVAL BROKER ANSWERS ────────────────────────────────────────────────────────
@@ -95,12 +96,6 @@ data approval_broker_listen_port: Port = 8085
 // door is the only public path" true rather than merely intended.
 data approval_broker_listen_host: NonEmptyStr = "127.0.0.1"
 
-// THE HOST THE BROKER RUNS ON, derived from the instance that owns its unit rather than spelled: a
-// run that files and polls over the loopback approval client (the GCP IAM converge job) has to run
-// there.
-fn approval_broker_host_identity() -> NonEmptyStr {
-  srv1_dashboard_host_identity
-}
 
 fn approval_broker_loopback_base_url(port: Port) -> NonEmptyStr {
   join(["http://", approval_broker_listen_host as String, ":", to_string(port)], "") as NonEmptyStr
@@ -235,15 +230,43 @@ data approval_broker_front_door_path_preservation: CitedFigureStanding = Transcr
 // (gunbc.approve_ios_project) -- read one port rather than each assuming 443.
 data approval_broker_public_port: Port? = none
 
-fn approval_broker_base_url_from(domain: NonEmptyStr?) -> NonEmptyStr {
-  tailnet_base_url_from(host: approval_broker_host_identity(), domain: domain, port: approval_broker_public_port)
-}
+// THE BROKER'S PUBLIC ADDRESS ON A GIVEN HOST. Which host is a placement fact, not this module's:
+// the prod role decides WHERE the broker is installed (gunbc.auth.approval_broker_placement, over
+// gunbc.live_deploy.spec RoleSingletonHolding), and a broker-side reader receives the host it was
+// installed on rather than resolving the role -- so the broker's closure never reaches the instance
+// roster (#13132).
+type ApprovalBrokerAddress
+  = ApprovalBrokerAddressResolved { value: NonEmptyStr }
+  | ApprovalBrokerAddressRefused { detail: NonEmptyStr }
 
-fn approval_broker_base_url() -> NonEmptyStr {
-  approval_broker_base_url_from(domain: fleet_tailnet_domain)
+fn approval_broker_base_url_on(host: NonEmptyStr, domain: NonEmptyStr?) -> NonEmptyStr {
+  tailnet_base_url_from(host: host, domain: domain, port: approval_broker_public_port)
 }
 
 // THE BARE HOST OF THAT SAME ADDRESS, for a client that composes scheme, host and path itself.
-fn approval_broker_public_host_from(domain: NonEmptyStr?) -> NonEmptyStr {
-  tailnet_host_from(host: approval_broker_host_identity(), domain: domain)
+fn approval_broker_public_host_on(host: NonEmptyStr, domain: NonEmptyStr?) -> NonEmptyStr {
+  tailnet_host_from(host: host, domain: domain)
+}
+
+// THE SERVING BROKER'S OWN ADDRESS IS GIVEN, NOT DISCOVERED. Placement already knows which host the
+// broker is installed on (gunbc.auth.approval_broker_placement, from the prod-role holder token the
+// spec carries), so the emitter binds the base URL into the process's environment: the broker unit's
+// Environment= line (gunbc.live_deploy.emit) and the enrolment verb's env prefix
+// (gunbc.auth.approval_device_enrolment_code_issue). The broker reads the value it was given -- no
+// host-effect read, so its closure never reaches the instance roster (#13132) and there is one
+// authority for where it runs. An unset binding, or one that is not an https URL (the emitter's
+// refusal marker), refuses; it is never replaced by a host.
+data approval_broker_base_url_env_name: NonEmptyStr = "GUNBC_APPROVAL_BROKER_BASE_URL"
+
+fn approval_broker_serving_base_url_of(bound: String?) -> ApprovalBrokerAddress {
+  match bound {
+    Present { value: v } =>
+      if starts_with(s: v, prefix: "https://") { ApprovalBrokerAddressResolved { value: v as NonEmptyStr } }
+      else { ApprovalBrokerAddressRefused { detail: join(["approval broker address unresolved: ", approval_broker_base_url_env_name as String, " is bound to '", v, "', not an https URL"], "") as NonEmptyStr } }
+    Absent => ApprovalBrokerAddressRefused { detail: join(["approval broker address unresolved: ", approval_broker_base_url_env_name as String, " is not bound in this process"], "") as NonEmptyStr }
+  }
+}
+
+fn approval_broker_serving_base_url() -> ApprovalBrokerAddress {
+  approval_broker_serving_base_url_of(bound: shell.Env.Get(name: approval_broker_base_url_env_name).value)
 }

dag/gunbc/auth/approval_broker_placement.dag

@@ -0,0 +1,70 @@
+module gunbc.auth.approval_broker_placement
+
+import gunbc.live_deploy.desired { prod_role_actuated_realization }
+import std.types { NonEmptyStr }
+import gunbc.roadmap_dashboard_instance {
+  ProdRoleHolder,
+  ProdRoleRealization,
+  ProdRoleRealizedBy,
+  ProdRoleRealizationRefused,
+  ProdRoleRealizationRefusal,
+  prod_role_realization,
+  prod_role_realization_refusal_detail,
+}
+import gunbc.auth.approval_broker_endpoint {
+  ApprovalBrokerAddress,
+  ApprovalBrokerAddressResolved,
+  ApprovalBrokerAddressRefused,
+  approval_broker_public_host_on,
+  approval_broker_base_url_on,
+}
+import gunbc.fleet_tailnet { fleet_tailnet_domain }
+
+// WHERE THE APPROVAL BROKER IS INSTALLED, for readers OUTSIDE the broker process: the GCP IAM
+// converge job that must run beside it (gunbc.fleet_converge_workflow) and the approvals app's build
+// config (gunbc.approve_ios_project). It is the host of the prod-role holder -- the same token
+// (gunbc.roadmap_dashboard_instance ProdRoleHolder) from which gunbc.live_deploy.spec builds the
+// broker's unit, so the job and the app name the host the unit is actually on. Under a refused
+// realization there is no such host and each reader refuses through its own arm.
+//
+// This module is deliberately NOT imported by any broker-side module (gunbc.auth.approval_broker_endpoint,
+// approval_decision_store, approval_request_submission, approval_device_enrolment_code): the broker
+// receives its own host at serve time (approval_broker_serving_base_url) and never reaches the
+// instance roster, which keeps the native broker's closure as #13132 narrowed it.
+type ApprovalBrokerHost
+  = ApprovalBrokerHostResolved { host: NonEmptyStr }
+  | ApprovalBrokerHostRefused { cause: ProdRoleRealizationRefusal }
+
+fn approval_broker_host_under(realization: ProdRoleRealization) -> ApprovalBrokerHost {
+  match realization {
+    ProdRoleRealizedBy { holder } => ApprovalBrokerHostResolved { host: holder.instance.host_identity }
+    ProdRoleRealizationRefused { cause } => ApprovalBrokerHostRefused { cause: cause }
+  }
+}
+
+fn approval_broker_public_host_under(realization: ProdRoleRealization, domain: NonEmptyStr?) -> ApprovalBrokerAddress {
+  match approval_broker_host_under(realization: realization) {
+    ApprovalBrokerHostResolved { host } => ApprovalBrokerAddressResolved { value: approval_broker_public_host_on(host: host, domain: domain) }
+    ApprovalBrokerHostRefused { cause } =>
+      ApprovalBrokerAddressRefused { detail: ("approval broker address unresolved: " + prod_role_realization_refusal_detail(cause: cause)) as NonEmptyStr }
+  }
+}
+
+// THE BASE URL THE BROKER IS GIVEN, from the holder token itself: the emitter binds it into the unit
+// and the enrolment verb's environment (gunbc.auth.approval_broker_endpoint
+// approval_broker_base_url_env_name), so the serving broker never resolves its own host.
+fn approval_broker_base_url_of_holder(holder: ProdRoleHolder) -> NonEmptyStr {
+  approval_broker_base_url_on(host: holder.instance.host_identity, domain: fleet_tailnet_domain)
+}
+
+fn approval_broker_base_url_under(realization: ProdRoleRealization) -> ApprovalBrokerAddress {
+  match realization {
+    ProdRoleRealizedBy { holder } => ApprovalBrokerAddressResolved { value: approval_broker_base_url_of_holder(holder: holder) }
+    ProdRoleRealizationRefused { cause } =>
+      ApprovalBrokerAddressRefused { detail: ("approval broker address unresolved: " + prod_role_realization_refusal_detail(cause: cause)) as NonEmptyStr }
+  }
+}
+
+fn approval_broker_public_host_from(domain: NonEmptyStr?) -> ApprovalBrokerAddress {
+  approval_broker_public_host_under(realization: prod_role_actuated_realization(), domain: domain)
+}

dag/gunbc/auth/approval_broker_serve.dag

@@ -15,7 +15,7 @@ import gunbc.clock_read { clock_now_probed_at }
 import gunbc.auth.approval_request_submission {
   admit_parsed_submission, SubmissionVerified, SubmissionNotAdmitted, file_and_notify, submission_outcome_http_body, read_submission_keyring, read_publisher_token, escalation_status,
   parse_submission_envelope, SubmissionEnvelopeParsed, SubmissionEnvelopeUnreadable,
-  SubmissionFiledAndNotified, SubmissionFiledNotNotified, SubmissionFiledPublisherTokenUnavailable, SubmissionFiledLinksNotIssued,
+  SubmissionFiledAndNotified, SubmissionFiledNotNotified, SubmissionFiledPublisherTokenUnavailable, SubmissionFiledLinksNotIssued, SubmissionFiledBrokerAddressRefused,
   SubmissionAlreadyFiled, SubmissionStoreRefused, SubmissionRefused, SubmissionFiledCapabilityKeyUnavailable,
   SubmissionUnreadable, SubmissionKeyUnavailable, SubmissionNotEnrolled, SubmissionAuthorityRefused,
 }
@@ -51,6 +51,7 @@ import gunbc.auth.approval_broker_endpoint {
   approval_device_request_path_template,
   approval_device_enrollment_path_template,
   approval_broker_listen_host,
+  approval_broker_serving_base_url,
 }
 import gunbc.auth.approval_device_wire { approval_device_enrol_path, approval_device_redeem_path, approval_device_pending_path, approval_device_push_path }
 import gunbc.auth.approval_device_routes {
@@ -414,6 +415,7 @@ fn approval_submit_admitted_response(request: ServeHttpRequest<RequestAccessPath
             capability_keyring: read_approval_keyring(),
             publisher: read_publisher_token(),
             request: admitted,
+            broker: approval_broker_serving_base_url(),
           )
       }
   }
@@ -422,6 +424,7 @@ fn approval_submit_admitted_response(request: ServeHttpRequest<RequestAccessPath
     SubmissionFiledNotNotified { escalation_id: _, publish: _ } => 502
     SubmissionFiledPublisherTokenUnavailable { escalation_id: _, detail: _ } => 503
     SubmissionFiledLinksNotIssued { escalation_id: _, key_id: _ } => 503
+    SubmissionFiledBrokerAddressRefused { escalation_id: _, detail: _ } => 503
     SubmissionAlreadyFiled { escalation_id: _ } => 409
     SubmissionStoreRefused { detail: _ } => 503
     SubmissionRefused { refusal: v } => match v {