Managed-host cut 4a: host-generic boot subject, medium as a parameter

[gunbai-bot]

Cut 4a of the managed-host untangle (docs/plans/managed-host-untangle.md, "Ordered cut list" row 4a). MtCollins1BootSubject and its feeders become a host-generic boot subject over a ManagedHost. The boot medium is now a value passed in, and the boot subject no longer imports the census image module.

Head efc4b37: merges main after cut 3 (#13261) and #13230, both carried, and addresses the side-chat REQUEST_CHANGES at cad3011 and 458978d and reviews 76286 and 76309.

What changed

New authority	Replaces	Shape
gunbc.boot_medium BootMedium { image_name, digest, export: BootImageExport, terminal: BootMediumTerminal }	MtCollins1BootMedium, mtcollins1_boot_export_dir, mtcollins1_boot_export_host_target, mtcollins1_diskless_image_name, mtcollins1_boot_image_sha256, mtcollins1_boot_medium_{image_name,image_sha256,label}	Medium is boot policy carried as a value. The export dir is read from gunbc.machine_intake_boot_image_export_ownership boot_image_export_ownership_requirement.export_path, so it is one fact. stock_installer_boot_medium is read off the upstream extdeps.provisioning.ubuntu_install_media row. boot_medium_readback is the one readback rule: a different digest refuses. A new medium is a row, and a new terminal is a BootMediumTerminal arm, with no edit to the subject.
gunbc.managed_host_boot AdmittedBootSubject (sole_constructor) { binding: ManagedHostBinding, medium, selection, execution_revision }, minted only by admit_boot_subject / boot_subject_admission_for	MtCollins1BootSubject, mtcollins1_boot_subject*, mtcollins1_boot_machine, mtcollins1_endpoint as a subject input	Admission includes the boot policy (boot_selection). It refuses BootSubjectHostNotManaged, BootSubjectHostUnbound { standing } and BootSubjectNoSelection. The machine, controller and account are read off the binding.
gunbc.managed_host_boot_handoff boot_drive_handoff(proof, subject, label, password_file_raw)	gunbc.machine_intake_mtcollins1_actuate (mtcollins1_drive_handoff, mtcollins1_cdrom_selection, mtcollins1_bmc_username, MtCollins1HandoffResult), gunbc.machine_intake_mtcollins1_handoff_probe	It reads the selection, account, controller and capability row from the one subject, so it takes no selection parameter. The reset arm's reset_boot_selection cannot reach it. The admission probe now runs over every managed_hosts() row.
gunbc.managed_host_boot_phase_timing	gunbc.machine_intake_mtcollins1_boot_phase_timing (incl. MtCollins1BootStart → BootStart)	Pure rename and move; the module was generic apart from its names.
gunbc.managed_host_boot_milestone (BootTopologyExpectation, boot_placement_reading)	the generic half of gunbc.machine_intake_mtcollins1_boot_milestone	The unit expectation rows (socket count, workloads, the one-socket milestone, census stages) stay unit-named in gunbc.machine_intake_mtcollins1_boot_milestone, now with the monolithic-NUMA premise stated on the row.
gunbc.managed_host_boot_image_fetch fetch_boot_medium(medium, url) and stock controls	gunbc.machine_intake_mtcollins1_boot_image_fetch	The fetch reads the export, name and digest off the medium. The stock URL comes from the upstream mirror row.
census medium rows mtcollins1_census_boot_medium, mtcollins1_census_medium_digest, mtcollins1_boot_medium in gunbc.machine_intake_mtcollins1_census_image (cut 4b's module, which owns the stem and volume id)	the census arm of MtCollins1BootMedium in _boot_authorization	That removes the import cycle the old census module noted.

Deleted files: mtcollins1_boot_authorization.dag, mtcollins1_boot_artifact.dag, mtcollins1_actuate.dag, mtcollins1_handoff_probe.dag, mtcollins1_boot_image_fetch.dag, test/claim/machine_intake/mtcollins1_boot_authorization_witness_test.dag (its claim moved to test.claim.managed_host_boot_witness).

Not moved, and why:

• gunbc.machine_intake_mtcollins1_boot_admission keeps its path, name and content. .github/workflows/fleet-converge.yml invokes --entry dag/gunbc/machine_intake/mtcollins1_boot_admission.dag --function mtcollins1_boot_admit_executor, and that surface is cut 7. It references none of this cut's deleted roots.
• 4d modules (mtcollins1_boot_run, _dry_realization, _diagnostic_bundle): only imports and call sites changed. mtcollins1_boot_on_srv1_resolving_toolchain now mints the subject by admission and returns early on refusal. mtcollins1_boot_handoff_when_media_ready takes the subject instead of image_name + selection. mtcollins1_boot_terminal_verdict takes (capture, subject) and dispatches on subject.medium.terminal. Their remaining mtcollins1_endpoint.host reads for SOL/KVM/IPMI are 4d's.
• gunbc.managed_host_unit_hold admit lists: no caller renamed (the boot run keeps its names), so nothing to move. ResetUnitHold was not touched, so it was not renamed.
• Cut 3 landed first and moved the attach to gunbc.machine_intake_megarac_boot_media_attach. The 4a adaptation: megarac_attach_boot_image takes the AdmittedBootSubject instead of a separately passed image_name + image_sha256. It reads both off subject.medium and refuses a unit hold whose host is not the subject's host ("the unit hold and the boot subject name different hosts; controller untouched"). The function is admit_callers-sealed to the boot run, so this guard has no direct hermetic witness; the attach route is executed by the acceptance matrix (29/29). mtcollins1_bmc_username moves from the deleted unit actuation module into the boot run with cut 3's value unchanged (the bound managed host's account), and the boot run's share row reads bmc_boot_image_export.dir.
• Residue left on main by cut 3, not touched here: gunbc.rung_drop mtcollins1_bmc_secure_standing_predates_reflash names mtcollins1_secured_account in a population string.

Refusals: preserved, dissolved, new

New refusals (required controls), all in test.claim.managed_host_boot_witness (dag/test/claim/host/managed_host_boot_witness_test.dag)

Control	Refusal	Witness claim
Boot of a host that is not a managed host	BootSubjectRefused { cause: BootSubjectHostNotManaged }	w_a_boot_of_a_host_that_is_not_managed_is_refused (srv1)
Boot of an unbound host (secured account beside another controller's access)	BootSubjectHostUnbound { standing: ManagedHostEndpointMismatch }	w_a_boot_of_an_unbound_host_is_refused
Bound host with no boot policy	BootSubjectNoSelection	w_a_bound_host_with_no_boot_selection_is_refused
Medium whose readback digest differs	BootMediumReadbackDigestDiffers, consumed by the census served-image readback	w_a_medium_read_back_with_another_digest_is_refused; test.claim.machine_intake.mtcollins1_census_medium_readback_witness_test a_file_whose_bytes_differ_from_the_record_diverges
Reset and boot selections cannot be cross-wired	Neither admission takes a selection as a parameter; boot_drive_handoff reads subject.selection only. A forged AdmittedBootSubject carrying reset_boot_selection's value is a SoleConstructorViolation, and calling boot_drive_handoff from outside is ConstructorCallAdmissionRefused	test.claim.managed_host_forged_probe_witness a_forged_boot_subject_carrying_the_reset_selection_is_refused_at_its_literal, the_fixture_mint_and_the_issuing_step_refuse_an_outside_caller; positive: w_the_reset_and_boot_arms_each_decide_their_own_selection
Forged carrier	AdmittedBootSubject is sole_constructor	same forged-probe witness

Existing refusals of boot admission and authorization: preserved

Refusal (before)	Where it is now	Witness that executes it
Boot dispatch naming a host other than the store host (mtcollins1_boot_refuses_off_srv1)	unchanged (_boot_admission)	mtcollins1_boot_run_witness_test boot_is_srv1_only_where_the_unit_hold_store_is, a_boot_dispatch_naming_another_host_is_refused_on_srv1_before_any_credential
Stock installer medium refused at the gate (mtcollins1_boot_medium_refusal)	same fn, now matching medium.terminal BootMediumNoTerminal	the_stock_installer_medium_refuses_the_census_boot_at_the_gate; positive the_census_medium_passes_the_gate_and_binds_the_verdict_to_its_label
Census readback refusals (NotCensus, record unreadable/malformed/disagrees, image unreadable, measure malformed, diverged, input underived)	same module; "is census" is now mtcollins1_census_medium_digest, and the served-bytes comparison goes through boot_medium_readback	mtcollins1_census_medium_readback_witness_test (13 claims, including the_stock_medium_has_no_census_readback) and mtcollins1_census_member_readback_witness_test
Boot attempt admission (#13230, carried unchanged): admit_boot_attempt(proof, revision: subject.execution_revision) right after UnitHeld and before actuation; BootAttemptRefused releases the hold and writes nothing	unchanged, in mtcollins1_boot_under_live_unit_hold; the held actuation now takes AdmittedBootSubject	test.claim.host.host_boot_attempt_admission_witness_test (14 claims, including every refusing receipt shape), 14/14 at 4ba46ac
Handoff with a unit-hold proof for another host	boot_drive_handoff → unit_hold_proof_refusal(host: boot_subject_host(subject))	mtcollins1_unit_hold_forged_probe_witness_test (seal; boot_drive_handoff subject); managed_host_unit_hold_witness_test
Handoff with an empty credential path	boot_handoff_password_file	w_an_empty_credential_path_is_missing_not_a_filename
Handoff when the BMC is not BmcSecured ("refusing before any controller write")	moved earlier: an unsecured host has no ManagedHostBinding, so no subject is admitted and the boot ends before the BMC (mtcollins1_boot_ended_before_bmc)	w_a_boot_of_an_unbound_host_is_refused (unbound arm); managed_host_witness_test
Every OobBootHandoffOutcome arm rendered as its own reason	boot_handoff_render_outcome, moved verbatim	the boot acceptance matrix (28/28) drives the handoff through each modeled world
Admission probe: measured rows admit, and the empty-capability control refuses	boot_handoff_admission_probe, now over every managed_hosts() row; an unbound row is reported, not probed	w_the_handoff_admission_discriminates_on_every_managed_hosts_rows

Refusals dissolved by construction (no state left to refuse)

• TerminalSubjectMediumDisjoint in the boot run's terminal verdict, and the media attach's two checks (subject vs medium row: "names a different image / image digest than the medium row"). Each compared two copies of one fact: the signed subject's image and digest against mtcollins1_boot_medium. The subject now carries the medium it was admitted with, the attach presents subject.medium and the verdict judges subject.medium. There is no second copy to disagree, and a subject cannot be authored field-for-field (forged-probe RED above). This is a §4b climb from validation to construction. The evidence that stays is the forged-carrier RED. The terminal verdict's stock-medium arm is now TerminalMediumPrintsNoTerminal (boot_terminal_is_the_host_capture_not_boot_control_issued).

Same-path REDs (binary sha256 2b656c984b1668e65f8bd8716e025fba5487316c9401f42bfcd209d775926cac, claim_batch --hermetic, built at e94c290 on BuildBuddy)

• Green at e94c290: managed_host_boot_witness 9/9, managed_host_witness 5/5.
• RED 1: boot_selection decides none for mtcollins1 (the binding this cut introduced). Three claims FAIL: w_the_real_row_admits_a_boot_with_its_medium_and_the_boot_selection and w_the_reset_and_boot_arms_each_decide_their_own_selection, plus w_a_boot_of_a_host_that_is_not_managed_is_refused, whose positive control asserts mtcollins1 is admitted.
• RED 2: boot_medium_readback admits any digest. FAIL: w_a_medium_read_back_with_another_digest_is_refused, and in mtcollins1_census_medium_readback_witness_test a_file_whose_bytes_differ_from_the_record_diverges and only_an_agreed_readback_lets_the_boot_proceed. Restored, all green.

Terminal receipt

Census exporter binding (side-chat REQUEST_CHANGES at cad3011)

gunbc.machine_intake_mtcollins1_census_image mtcollins1_census_medium_qualification replaces the old digest check. It returns CensusMediumQualified { digest, export } | CensusMediumNotCensus | CensusMediumExporterUnsupported { supported, named }.

• A medium is qualified only when it is the census medium for its own digest and names the complete supported export: directory, SSH endpoint and principal (gunbc.boot_medium boot_image_export_eq).
• Both mtcollins1_census_medium_readback and census_member_readback qualify before any leg is dispatched. They read from the qualified export's own target; the global-target helpers are deleted.
• An unsupported exporter refuses as CensusMediumReadbackExporterUnsupported / BootChainMediumExporterUnsupported, naming both exports.

Discriminators, on the existing hermetic fixtures:

Control	Witness claims	Result at head
Endpoint changed	a_census_medium_naming_another_exporter_endpoint_is_refused_not_read_back (production entry, no leg dispatched)	refuses
Principal changed at the same endpoint	a_census_medium_naming_another_principal_at_the_same_endpoint_is_refused_not_read_back (production entry)	refuses
Both, with healthy answers	healthy_answers_cannot_buy_agreement_for_a_medium_naming_another_exporter (pure composition)	no agreement
Both, member side	the_pin_gate_refuses_a_census_medium_naming_another_exporter, the_member_readback_refuses_another_exporter_before_any_leg	refuses
Unchanged export	the_census_medium_at_its_supported_export_is_admitted_and_agrees; the pin-gate claim's control arm	admitted

Same-path RED (run at 458978d; the exporter logic is unchanged since): boot_image_export_eq reduced to directory equality makes healthy_answers_cannot_buy_agreement_for_a_medium_naming_another_exporter and the_pin_gate_refuses_a_census_medium_naming_another_exporter FAIL on their pure logic. The production-entry claims also fail: the mutant now dispatches a read, which the hermetic route has no mock for. Restored, both census witnesses are green: medium readback 17/17, member readback 19/19.

No unchecked exporter bypass (side-chat REQUEST_CHANGES at 458978d)

• census_member_readback_on(medium, export) is deleted. Its body now sits inside census_member_readback's CensusMediumQualified arm, so the member legs can only target the export the qualification returned. No entry takes a medium and an export as two separately supplied values.
• Sweep of this PR for helpers that take a medium or export and perform an effect:
  • gunbc.managed_host_boot_image_fetch fetch_boot_medium(medium, url) was the one other case. It publishes into medium.export.dir on whatever host runs it, without reaching medium.export.target. It is now admit_callers-sealed to its three entries (fetch_stock_installer_boot_medium and the two controls).
  • Compile RED: test.claim.managed_host_forged_probe_witness a_boot_medium_fetch_from_outside_its_entries_is_refused (an outside call is ConstructorCallAdmissionRefused). Its control is the witness's class-scoped harness control.
  • Seal-removal RED at efc4b37: deleting fetch_boot_medium's admit_callers makes exactly that claim FAIL; restored, the witness is green.
  • The remaining host- or target-taking helpers in mtcollins1_census_member_readback (answer_on, remote, remote_leg, read_member_on, census_member_readings_on, census_mapped_attributes_on) predate this PR on main. They are transport legs: none takes a medium, and none yields a census verdict without the qualified entry.
  • boot_medium_readback, mtcollins1_census_medium_served_path, mtcollins1_census_record_standing and census_pin_gate are pure classifiers over supplied values; the last two qualify the medium themselves.

Review follow-ups

• Review 76286: boot_medium_readback_refusal had no production consumer (DESIGN §3c), so it is deleted.
• Review 76309: the CD-ROM selection is now one unit row, gunbc.machine_intake_mtcollins1_access_observation mtcollins1_virtual_media_boot_selection, read by both boot_selection and reset_boot_selection. The pinned census sample list is unchanged; the reason is in the PR thread.

At the exact head efc4b37 (claim_batch --hermetic on BuildBuddy, binary cb7e1e01…, 20 GiB self-bound cgroup):

• The direct consumer roster, recomputed at this head, is 43 witness modules that import a changed module. 41 were executed, adding host_boot_attempt_admission_witness_test and megarac_managed_host_forged_probe_witness_test; the unexecuted ones are sol_hold_stdin_wet (never in a session), the wet-only mtcollins1_census_image_local_wet and mtcollins1_kvm_observer_protocol_wet, and the probe source.
• Result: 899 PASS, 1 FAIL. The FAIL is approval_broker_helper_grant_test the_helper_argv_is_pinned_word_for_word, identical at merge-base 0360849 and at main 3df9c00.
• Acceptance matrix 29/29. Main grew it from 28 to 29.
• managed_host_boot_witness 9/9 and host_boot_attempt_admission_witness_test 14/14.
• Cut 3's witnesses all pass: megarac_managed_host_witness 11/11, megarac_managed_host_forged_probe 7/7, megarac_media_convergence 79/79, megarac_kvm_still 21/21, megarac_stale_power_off 13/13.

(1) Consumer roster (plan census method, at e94c290): 105 witness modules reach a changed or new module

Instrument: claim_batch --hermetic --source-root dag --source-root src/v2 --entry <file> --functions <all test fns>, built at the pinned sha on BuildBuddy inside a 20 GiB self-bound memory cgroup, one witness at a time. sol_hold_stdin_wet_witness_test is excluded by rule (never run in a session).

Direct boot / host / census witnesses. Binary 51396966… built at e060853, plus the boot witness again at e94c290 (binary 2b656c98…). 14 entries: 232 PASS, 0 FAIL.

Witness	Result
mtcollins1_boot_acceptance_matrix_test	28/28
mtcollins1_boot_run_witness_test	35/35
mtcollins1_boot_diagnostic_bundle_witness_test	all PASS
mtcollins1_boot_phase_timing_witness_test	all PASS
host_capture_sol_crlf, host_capture_sol_nul_fill	all PASS
mtcollins1_census_medium_readback, _member_readback, _image, _image_publish	all PASS
managed_host_witness	5/5
managed_host_forged_probe_witness	all PASS
mtcollins1_unit_hold_forged_probe_witness	all PASS
managed_host_boot_witness (new)	9/9 at e94c290

Wide roster: the other 91 modules. These reach the change only through gunbc.auth.privileged_effect_census, gunbc.managed_host or the fleet-converge authority. Run at e94c290 (binary 2b656c98…) and dba8216 (binary b95ae389… and siblings).

• Every executed claim PASSes except the classes below.

• Route gaps, UNMEASURED and not red (hermetic "no arm for Dir/Run: operation declares no mock_response"): generated_artifact_merge_driver_real_execution (8), long/fleet_release_bins_key (29), mtcollins1_kvm_observer_protocol_wet (6).

• Pre-existing, identical at merge-base 0360849 (binary d53493fb…):

  Witness	Failing at both base and head
  ci_floor_on_success_materialization_receipt_hand_rust	scaffold_names_bounded_deferral_receipt
  gcp_iam_converge_witness_test	resolve refusal: ambiguous attempt_identity_of between gunbc.auth.gcp_iam_converge_run and gunbc.auth.approval_run_identity
  approval_broker_helper_grant_test	the_helper_argv_is_pinned_word_for_word
  shell_dag_ci_deploy_invoke_prelude	2 claims
  shell_dag_ci_fmt_gate_line	1 claim
  shell_dag_ci_heal_regen_invoke	2 claims
  witness_floor_workflow_consolidation	w_the_required_workflow_carries_both_lanes

• Not run: mtcollins1_census_image_local_wet_test (wet only); test/probe/unit_hold_proof_forged_probe is a probe source, executed through mtcollins1_unit_hold_forged_probe_witness.

Required CI at efc4b37: floor, emit-build, generated (the generated-artifact drift lane), witnesses, all success. fleet-converge.yml is unchanged: no workflow authority input changed, and the drift lane is green.

(2) Same-path REDs: see the section above.

(3) Corpus sweep at head: git grep over dag, src, docs, .github, artifacts

Searched for: MtCollins1BootSubject, mtcollins1_boot_subject*, MtCollins1BootMedium, MtCollins1BootStart, mtcollins1_cdrom_selection, mtcollins1_boot_export_dir, the 5 deleted module names and paths, mtcollins1_drive_handoff, mtcollins1_admission_probe, mtcollins1_fetch_boot_image. No code hit remains. Remaining hits, by disposition:

Hits	Disposition
artifacts/bmc/mtcollins1-{diskless-boot,host-pxe-client,virtual-media-boot}.json	receipt (captured evidence; content hashes bind the path)
docs/plans/{managed-host-untangle,power-on-sequence-model,uses-occurrence-census}.md, docs/probes/mtcollins1_memory_census_and_boot_delivery_2026-09-11.md, docs/rung-drops/required_lanes_do_not_resolve_product_layer_modules_2026-09-20.txt	residue / receipt (dated)
gunbc.recurring_failure_mode rows a_derivation_key_that_does_not_pin_bytes_across_build_hosts and else_less_if_statement_has_no_lowered_form	receipt (dated specimens naming where the class was found)
mtcollins1_netboot_client_observation comment	residue (history of an entry deleted by #12101)
src/v2/compiler/reference_conservation_census reference_conservation_stratified_sample_paths (mtcollins1_handoff_probe.dag)	receipt: a sample pinned to revision 8fcd8e7 and re-derived at that revision. A path the tree no longer holds is reported SamplePathMissing by design, and editing the list would break its pin.

Entry-path rows:

• gunbc.non_fold_residue, gunbc.ci_spec, v2.workflow.floor_unimported_bare_provider_debt_roster: no row named a moved or deleted file. ci_spec's two rows name _boot_run and _boot_admission, which keep their paths.
• src/v2/workflow/local_repo_wet_terminal names mtcollins1_boot_phase_timing_witness_test.dag, which keeps its path.
• Citations repointed: gunbc.machine_intake_oob_boot_handoff admit_callers, gunbc.auth.privileged_effect_census mtcollins1_hold_owning_roots (boot_drive_handoff), and the prose citations in host_reset_return, host_reset_return_run, bmc_fan_observation, mtcollins1_fan_observe, mtcollins1_memory_census_observation, mtcollins1_bmc_secure_observation, mtcollins1_census_member_readback, mtcollins1_media_attach and runner_throughput_qualification_route (the runner leg's lands_with now names the BootMedium row seam).

(4) No aliases

• No module re-exports a deleted root.
• No mtcollins1_* function wraps a generic one.
• mtcollins1_boot_medium and mtcollins1_census_boot_medium are rows of the generic carrier, owned by the census module.
• The deleted mtcollins1_bmc_username is replaced by direct calls to the unit observation mtcollins1_secured_account().

🤖 Generated with Claude Code

[briansrls]

REQUEST_CHANGES at exact head cad3011782b1452da2c4704e1db5b308626a38f3, against DESIGN.md §3 (one authority, faithful consumption, and the executing pairing obligation) and the cut-4a refusal-preservation requirement. One medium/export binding blocker remains; this is not a request to complete cuts 4b or 4d.

Accepted

The deleted unit subject/authorization/handoff roots are replaced rather than retained as parallel authorities. AdmittedBootSubject carries the admitted managed-host binding, the medium, the operation's own boot selection and the execution revision. boot_drive_handoff consumes that selection and binding rather than accepting a reset selection or a second controller/account. Its caller confinement and the exact Bool fixture callers remain sound.

The cut-3 adaptation derives the attachment's image name and recorded digest from subject.medium, and checks the held host against the subject before the first chassis request. The phase-timing move preserves its arms, and the unit topology/workload expectations remain unit-owned rather than being promoted to universal platform facts.

Specifically checked mtcollins1_boot_under_live_unit_hold: admit_boot_attempt still runs immediately after UnitHeld, before baseline capture or actuation; BootAttemptRefused retains its configuration refusal, releases the hold and takes the no-controller-read/no-write path. I am not retaining the separately reported approval-broker argv-pin failure as a blocker for this cut.

Blocker: the new medium can name an exporter that its readback silently ignores

gunbc.machine_intake_mtcollins1_census_image::mtcollins1_census_medium_digest says it recognizes exactly the census medium for its own digest. It compares the terminal label, image name and export directory, but does not compare medium.export.target at all.

That omission matters now that the old census arm has become an ordinary BootMedium value. A caller can construct a medium with the genuine census name, digest, directory and terminal label but a different export.target (endpoint or principal). This is not a forged AdmittedBootSubject: ordinary boot_subject_admission_for can legitimately admit that supplied medium, because its admission is about host binding and boot policy.

The public readback routes then answer for the wrong export:

• mtcollins1_census_medium_readback(medium) passes the incomplete census classifier, but mtcollins1_census_readback_target() returns the global bmc_boot_image_export.target. Both the record read and the image measurement go to that global target. Healthy bytes there can produce CensusMediumReadbackAgreed even though the medium named another exporter whose bytes were never read.
• census_member_readback(medium) similarly obtains its target from census_member_readback_target() and uses the same incomplete census qualification in census_pin_gate. It can validate the old export's image members rather than the supplied export's.

The attachment's host-equality guard does not establish this relation: it compares the managed machine being booted, not the server exporting its image. The separately passed NFS share also does not bind the medium's SSH export target. The current factory row uses the expected exporter, so this is a source-derived alternate-input counterexample, not a claim that the current configured boot has been observed mounting the wrong image. Nevertheless the new accepted input space is wider than these retained readers implement.

The bounded fix for 4a is to make census qualification establish the complete supported BootImageExport, including the SSH target, and refuse an unsupported exporter instead of treating it as census readback evidence. Honoring arbitrary exporters throughout the readers and binding the controller share to the same export is another solution, but that larger generalization is not required here. Keep the known limitation at the admission boundary rather than silently substituting the global.

Add a discriminator with the genuine name/digest/directory/label and only the export target changed, plus the unchanged-export positive. A different endpoint, and a different principal at the same endpoint, must not yield a successful census readback from the unchanged global exporter. Exercise the production census-qualification/readback composition with the existing Hermetic fixtures; no hardware boot or new wet lane is requested. The existing forged-subject control cannot detect this because the medium itself is intentionally authorable.

Scope and evidence

The remaining unit-specific SOL/KVM/IPMI bindings belong to the explicitly deferred cut 4d; their mere presence is not an additional finding. The existing root supplies the same global medium that its pre-attach readback currently reads, so I am not alleging an independently demonstrated image/digest mismatch on that configured path.

Reviewed the 45-file diff, exact-head DESIGN and untangle plan, subject/mint and handoff paths, the cut-3 attach adaptation, census qualification/readback consumers, and the adapted controls. Verified GitHub run 37263834273: floor, generated, emit-build and the aggregate witnesses job all succeeded on this exact SHA. The Hermetic 29/29 and direct-roster 892/1 results remain author-reported; I did not run claims or mutants myself. The requested head was unchanged immediately before submission. #13247's later runner-medium/reading work is not part of this review.

[gunbai-bot]

Addressed review 76309 at 458978d:

• Shared CD-ROM selection: fixed. gunbc.machine_intake_mtcollins1_access_observation mtcollins1_virtual_media_boot_selection is now the one unit row (an aarch64 UEFI one-shot from the CD-ROM device, which is how this unit's MegaRAC presents an attached image). gunbc.managed_host_boot boot_selection and gunbc.host_reset_boot_selection reset_boot_selection both read it. They remain two separate admissions, and neither accepts the other's value. Production code spells the device once.
• Netboot observation citation: reworded. It now names the deleted entry (mtcollins1_boot: WIF-trusted recurring effect via auth pattern selection, with an operator maintenance hold #12101) and says where the unit actuation module went.
• reference_conservation_stratified_sample_paths: not changed, on purpose. I checked the code at head. A listed path the tree no longer holds is classified SamplePathMissing from its parent directory's listing (sample_path_observation_of, the FilesystemFileAbsent arm) and reported per path as missing <path>. The census neither refuses nor quietly samples fewer modules; the gap is visible in its output. The list is also pinned to revision 8fcd8e7. reference_conservation_sample_by_rule_at_pin_exit re-derives the list at that revision and refuses if the two differ, so removing or substituting the entry here would break that pairing. A repin, re-run against its pin, is the place to change the list.
• Remaining citations of deleted modules are the dated specimen and receipt text in gunbc.recurring_failure_mode rows (else_less_if_statement_has_no_lowered_form, a_derivation_key_that_does_not_pin_bytes_across_build_hosts). Each records where a class was found on a given date, and rewriting it would falsify the receipt. They are classified as receipts in the PR's corpus sweep.

— sent from valiant-badger-295

[briansrls]

REQUEST_CHANGES at exact head 458978d487a419236950edb4bcfc9ea4be38471e, against DESIGN.md §3 (single authority and faithful consumption) and §5 (no unchecked bypass). The original exporter comparison and the checked entry paths are repaired. One newly extracted member-reader helper still permits the same exporter-binding class.

Accepted

boot_image_export_eq now compares the export directory and both fields of the SSH target: endpoint and principal. mtcollins1_census_medium_qualification distinguishes a non-census medium from an unsupported exporter and returns the supplied export only after complete equality.

mtcollins1_census_medium_readback qualifies before preparing its SSH context, uses the returned export.target for both record and image reads, and preserves record-before-image ordering. census_member_readback also qualifies before entering its read body. The global-target helpers are deleted; the mapped-attributes path likewise qualifies and uses the returned target. The fixed supported-export limitation is an honest bounded repair, not a demand to complete arbitrary-exporter support.

The new production-entry negatives genuinely call the two checked entries. The pure-composition negatives reject healthy answers for a medium naming another endpoint or principal, and the supported-export positives remain. The reported directory-only mutation discriminates the original missing-comparison defect; I am not rejecting those controls.

The dashboard follow-ups are accepted: deleting the unconsumed boot_medium_readback_refusal renderer leaves the actual digest-difference verdict and its control intact. mtcollins1_virtual_media_boot_selection is now one unit row consumed by both policies, while each policy retains its host-specific admission. The previously accepted subject/handoff, cut-3 adaptation and boot-attempt refusal preservation are unchanged by this four-commit increment.

Blocker: census_member_readback_on can bypass the qualified export binding

In gunbc.machine_intake_mtcollins1_census_member_readback, the newly added function is unrestricted:

fn census_member_readback_on(medium: BootMedium, export: BootImageExport)
  -> CensusMemberReadbackAttempt

It has no admit_callers confinement and accepts two independently authorable inputs. It prepares the SSH context, takes target = export.target, and reads both ISOs there. Only afterward does census_pin_gate(medium: medium, ...) qualify the medium. That gate checks medium.export; it never compares it with this helper's separate export argument.

An outside caller can therefore pass a genuine supported medium naming exporter A beside an export targeting B. If B is reachable and supplies the pinned images, the gate accepts A's medium and the helper can return a holding member-readback attempt from B's bytes, without reading A. Conversely, an unsupported medium beside the supported export reaches the supported export's reads before the later pin gate refuses, violating the promised refusal before any read.

These are source-derived counterexamples, not executed claims or reports of a live misread. This helper performs the real SSH/extraction path; it is not one of the intentionally open pure classifiers over supplied answers. The normal caller passes the correct pair, but that does not confine other callers.

The current negatives do not cover this route: the_member_readback_refuses_another_exporter_before_any_leg calls census_member_readback, and the pin-gate control supplies only a medium. Neither invokes the independently rebindable helper or proves an outside call is refused.

Bounded correction

Prefer deleting the helper and placing its body directly inside census_member_readback's CensusMediumQualified arm, as the medium reader already does. Alternatively, confine census_member_readback_on with admit_callers to that checked entry alone, with no unrestricted forwarding helper. There is no need to introduce another authority carrier or generalize the exporters.

Keep the existing endpoint/principal/healthy-answer controls. Add an outside-call compiler RED for the bypass (with a matching allowed-entry control); if the helper is retained under a seal, removing that seal must fail the RED. This closes the new entry route without another hardware boot, live SSH read, matrix redesign, or cut-4b/4d migration.

Evidence and scope

Reviewed the four-commit, eleven-file delta from cad3011782b1452da2c4704e1db5b308626a38f3, exact-head DESIGN, the updated reader/gate code and witness bodies, and the PR discussion. Verified exact-head GitHub run 37274837873: floor, generated, emit-build and aggregate witnesses all succeeded. The Hermetic matrix 29/29, roster 898 PASS / 1 pre-existing FAIL, and mutation results remain author-reported; I did not execute claims, mutants or hardware operations. The requested head was reconfirmed immediately before submission. This review does not reopen #13247's already reviewed runner-reading work.

[briansrls]

APPROVE at exact head efc4b37d6abfe5b648c58561fd846154d5dd9be5, against DESIGN.md §3 (single authority and executing pairing), §4b (preserved discriminators) and §5 (no unchecked bypass). The remaining member-readback exporter-binding blocker in review 5411582489 is closed.

The split-input route is removed

gunbc.machine_intake_mtcollins1_census_member_readback::census_member_readback_on is deleted, not renamed or replaced by another forwarding entry. Its execution body now lives inside census_member_readback's CensusMediumQualified arm. The target used by both ISO measurements, workspace creation, member extraction and cleanup is the qualified arm's export.target; there is no separately supplied export alongside the medium.

The non-census and unsupported-exporter arms return before SSH-context preparation or any remote leg. The move preserves the existing ISO-pin gate before workspace acquisition/extraction and retains the readback and workspace-cleanup outcomes. The endpoint, same-endpoint/different-principal, healthy-answer and supported-export controls are unchanged from the previously reviewed head and still call the production entry or its actual pin/classification boundary. Deleting the bypass is the bounded correction offered in the previous review; no new carrier or replacement helper is needed.

The inspected remaining host/target-taking routines (answer_on, remote, remote_leg, read_member_on, census_member_readings_on, and census_mapped_attributes_on) are transport/read routines without a BootMedium parameter. They return answers, member readings or report text, not a live assertion that an independently supplied medium was qualified. The mapped-attributes entry also qualifies its medium before invoking its reader. I am not treating the intentionally open pure classifiers over supplied readings as live admission mints or requiring a blanket seal on transport primitives.

Additional fetch confinement

gunbc.managed_host_boot_image_fetch::fetch_boot_medium now admits exactly fetch_stock_installer_boot_medium, fetch_stock_installer_wrong_pin_control, and fetch_stock_installer_unowned_export_control. All three are parameterless: they use the fixed stock row/upstream URL, with only the two existing controls' fixed digest/directory substitutions. None forwards a caller-selected medium, exporter or URL through the restricted call.

test.claim.managed_host_forged_probe_witness::a_boot_medium_fetch_from_outside_its_entries_is_refused compiles an actual outside invocation and requires the blocking ConstructorCallAdmissionRefused diagnosis specifically for fetch_boot_medium. A non-running census cannot satisfy it, and the existing clean harness control remains. The reported seal-removal mutation failing exactly this new claim is consistent with the inspected producer and discriminator; I did not execute that mutation myself.

This is confinement of the general parameterized local-fetch entry, not an implementation of remote export targeting or a new proof of arbitrary-host execution placement. The fixed entries retain their existing placement contract.

Preservation and evidence

The complete increment from 458978d487a419236950edb4bcfc9ea4be38471e is one commit over three files: the member-reader deletion/inlining, fetch admission list, and added compile probe/claim. The previously accepted complete exporter comparison, medium reader, subject/handoff refactoring, cut-3 attachment binding, shared unit boot-selection row and BootAttemptRefused handling are not changed by this increment.

Verified exact-head GitHub workflow run 37281526937: floor, generated, emit-build and aggregate witnesses all succeeded. The Hermetic matrix 29/29, medium readback 17/17, member readback 19/19, direct roster 899 PASS / 1 pre-existing FAIL, and seal mutation remain author-reported measurements. I ran no local claims, mutants, SSH reads or hardware operations.

The requested SHA was reconfirmed before submission, and GitHub's final snapshot reports the PR mergeable. No source blocker remains for cut 4a. This approval covers this SHA only; preserve it through the landing checks, with #13247 following as planned. No cut-4b/4d migration or additional hardware run is required for this correction.