Repository navigation

Managed-host cut O1a-2: IPMI Set User Access as a second route request shape - #13242

Merged

gunbai-bot[bot] merged 25 commits into

mainfrom

session/bright-wolf-485-o1a2

Oct 5, 2026

Commits on Oct 3, 2026
- Managed-host cut O1a: evidence-bound rotation route standing + qualification bootstrap
  
  Brian Searls
  and
  claude
  committed
  4523d79
- Census: hoist the route-qualification row's reasoning to module grain (annotation inside a list literal refuses)
  
  Brian Searls
  and
  claude
  committed
  a987c3c
Commits on Oct 4, 2026
- Rotation Apply: bind the approval to the controller, build and request; type every refusal (review 75181)
  
  Brian Searls
  and
  claude
  committed
  c05714a
- Route module sits below bmc_secure: drop the rotation-event mapping; frontier retires with O1b's Apply
  
  Brian Searls
  and
  claude
  committed
  afcc512
- O1a side-chat review: modeled run cannot ground; response bound to subject; structural request identity; mtjade1 historical
  
  Brian Searls
  and
  claude
  committed
  8e5b038
- Managed-host cut O1a-2: IPMI Set User Access as a second route request shape
  
  Brian Searls
  and
  claude
  committed
  0f35b65
- O1a-2: the lockout hazard is a refusal — a privilege-lowering channel-access write needs the managed account read back at administrator on that channel in the same run
  
  Brian Searls
  and
  claude
  committed
  6ee95d0
- O1a-2: admit the lockout helper (the citation mint's actual caller)
  
  Brian Searls
  and
  claude
  committed
  7887d74
- O1a-2: ManagedAdministratorReadback is sealed and bound to the route's endpoint and build
  
  Brian Searls
  and
  claude
  committed
  b66626e
- Merge main (#13177 squash-landed) into O1a-2; census takes main's managed_host_unit_hold rename
  
  Brian Searls
  and
  claude
  committed
  cc8d6cd
- O1a-2 side-chat items 1, 3, precision: pre-write qualification admission, per-shape entrypoints, privilege-limit-only operation
  
  Brian Searls
  and
  claude
  committed
  44f35f6
- O1a-2: an executed grounding states whether its effect was observed; a privilege-lowering Apply requires EffectObserved
  
  Brian Searls
  and
  claude
  committed
  6d27741
Commits on Oct 5, 2026
- O1a-2 side-chat review of 6d277411fd: no carrier-returning facades; idempotent qualification must re-assert the managed account's own current value; full live frontiers
  
  Brian Searls
  and
  claude
  committed
  4fe9f69
- O1a-2: discriminating target-pair controls; drop the implied (dead) holds-value check
  
  Brian Searls
  and
  claude
  committed
  e12070a
- Merge main (#13221 O1b, O1c-1) into O1a-2; O1b consumes the new Apply signature, channel-access reclassification, projected readback
  
  Brian Searls
  and
  claude
  committed
  8960bbe
- O1a-2 integration: one-arm MissingAccountOperation spelled as a coproduct; arrival witness match covers the privilege-limit arm (floor findings at 8960bbe5)
  
  Brian Searls
  and
  claude
  committed
  a68bb7a
- O1a-2 integration, side-chat review of 8960bbe511: producer-bound readback inputs, confined projection, channel access read from the world
  
  Brian Searls
  and
  claude
  committed
  7264e4e
- O1a-2: admit the two new channel-close claims to the citation mint (floor finding at 7264e4e)
  
  Brian Searls
  and
  claude
  committed
  8a24066
- O1a-2: exhaustive arms over RotationApplyAdmission in admitted_channel_writes (non-fold residue finding at 8a24066)
  
  Brian Searls
  and
  claude
  committed
  111316f
- O1a-2: O1b witness expectations follow the labels the code produces (route-for-user-2 approval refuses as another request; Apply decision label carries its finding; retention cause suffix)
  
  Brian Searls
  and
  claude
  committed
  d5affb1
- O1a-2: one equality for IpmiChannelPrivilegeLimit (direct ==); readback channel typed IpmiChannelNumber; no placeholder channel (reviews 76265, 76211)
  
  Brian Searls
  and
  claude
  committed
  e2e8259
- O1a-2: the controller-clock read-floor wall re-pointed at the dry read's schedule argument (the mint now admits only the dry read)
  
  Brian Searls
  and
  claude
  committed
  ca9ca59
- Merge main (#13285 risk-model rename) into O1a-2
  
  Brian Searls
  and
  claude
  committed
  3e819eb
- O1a-2: the read-floor wall is the observation mint's admission (the argument-type diagnostic is no longer reached)
  
  Brian Searls
  and
  claude
  committed
  74b10e4
- O1a-2: the idempotent mtcollins1 qualification grounds acceptance only; the factory-admin close needs an effect-observing qualification (frontier) (review 76375)
  
  Brian Searls
  and
  claude
  committed
  5cec3b2

Navigation Menu

Repository navigation

Managed-host cut O1a-2: IPMI Set User Access as a second route request shape - #13242

Managed-host cut O1a-2: IPMI Set User Access as a second route request shape#13242
gunbai-bot[bot] merged 25 commits into
mainfrom
session/bright-wolf-485-o1a2

Commits on Oct 3, 2026

Managed-host cut O1a: evidence-bound rotation route standing + qualification bootstrap

Census: hoist the route-qualification row's reasoning to module grain (annotation inside a list literal refuses)

Commits on Oct 4, 2026

Rotation Apply: bind the approval to the controller, build and request; type every refusal (review 75181)

Route module sits below bmc_secure: drop the rotation-event mapping; frontier retires with O1b's Apply

O1a side-chat review: modeled run cannot ground; response bound to subject; structural request identity; mtjade1 historical

Managed-host cut O1a-2: IPMI Set User Access as a second route request shape

O1a-2: the lockout hazard is a refusal — a privilege-lowering channel-access write needs the managed account read back at administrator on that channel in the same run

O1a-2: admit the lockout helper (the citation mint's actual caller)

O1a-2: ManagedAdministratorReadback is sealed and bound to the route's endpoint and build

Merge main (#13177 squash-landed) into O1a-2; census takes main's managed_host_unit_hold rename

O1a-2 side-chat items 1, 3, precision: pre-write qualification admission, per-shape entrypoints, privilege-limit-only operation

O1a-2: an executed grounding states whether its effect was observed; a privilege-lowering Apply requires EffectObserved

Commits on Oct 5, 2026

O1a-2 side-chat review of 6d277411fd: no carrier-returning facades; idempotent qualification must re-assert the managed account's own current value; full live frontiers

O1a-2: discriminating target-pair controls; drop the implied (dead) holds-value check

Merge main (#13221 O1b, O1c-1) into O1a-2; O1b consumes the new Apply signature, channel-access reclassification, projected readback

O1a-2 integration: one-arm MissingAccountOperation spelled as a coproduct; arrival witness match covers the privilege-limit arm (floor findings at 8960bbe5)

O1a-2 integration, side-chat review of 8960bbe511: producer-bound readback inputs, confined projection, channel access read from the world

O1a-2: admit the two new channel-close claims to the citation mint (floor finding at 7264e4e)

O1a-2: exhaustive arms over RotationApplyAdmission in admitted_channel_writes (non-fold residue finding at 8a24066)

O1a-2: O1b witness expectations follow the labels the code produces (route-for-user-2 approval refuses as another request; Apply decision label carries its finding; retention cause suffix)

O1a-2: one equality for IpmiChannelPrivilegeLimit (direct ==); readback channel typed IpmiChannelNumber; no placeholder channel (reviews 76265, 76211)

O1a-2: the controller-clock read-floor wall re-pointed at the dry read's schedule argument (the mint now admits only the dry read)

Merge main (#13285 risk-model rename) into O1a-2

O1a-2: the read-floor wall is the observation mint's admission (the argument-type diagnostic is no longer reached)

O1a-2: the idempotent mtcollins1 qualification grounds acceptance only; the factory-admin close needs an effect-observing qualification (frontier) (review 76375)