extdeps.systemd.systemd_run: typed options, one projection, ArgvCommand everywhere

dag/extdeps/exec/command.dag

@@ -137,7 +137,7 @@ fn argv_command(program: ProgramIdentity, arguments: List<String>) -> ArgvComman
     decl_ref(module_path: "extdeps.iproute2.ip_show", decl_name: "ip_route_show_command"),
     decl_ref(module_path: "extdeps.tools.uname", decl_name: "uname_release_command"),
     decl_ref(module_path: "extdeps.tools.make", decl_name: "make_command"),
-    decl_ref(module_path: "extdeps.systemd.systemd_run", decl_name: "systemd_run_user_scope_command"),
+    decl_ref(module_path: "extdeps.systemd.systemd_run", decl_name: "systemd_run_command_of"),
     decl_ref(module_path: "extdeps.package_managers.pip", decl_name: "pip_install_pinned_command"),
     decl_ref(module_path: "extdeps.package_managers.conda_forge", decl_name: "micromamba_create_command"),
     decl_ref(module_path: "extdeps.printing.orca_slicer", decl_name: "orca_slice_to_project_command"),

dag/extdeps/systemd/systemd.dag

@@ -89,6 +89,13 @@ type SystemdUnitProperty
   | WantsProperty
   | InvocationIDProperty
   | FragmentPathProperty
+  | StandardOutputProperty
+  | StandardErrorProperty
+  | ProtectSystemProperty
+  | ProtectHomeProperty
+  | PrivateTmpProperty
+  | ReadWritePathsProperty
+  | RemainAfterExitProperty
   | JobProperty
 
 // THE WIRE SPELLING AS A SEALED WORD, SO THE CLOSED TYPE SURVIVES ALL THE WAY TO THE ARGV.
@@ -158,6 +165,13 @@ fn systemd_unit_property_wire(property: SystemdUnitProperty) -> NonEmptyStr {
     WantsProperty => "Wants" as NonEmptyStr
     InvocationIDProperty => "InvocationID" as NonEmptyStr
     FragmentPathProperty => "FragmentPath" as NonEmptyStr
+    StandardOutputProperty => "StandardOutput" as NonEmptyStr
+    StandardErrorProperty => "StandardError" as NonEmptyStr
+    ProtectSystemProperty => "ProtectSystem" as NonEmptyStr
+    ProtectHomeProperty => "ProtectHome" as NonEmptyStr
+    PrivateTmpProperty => "PrivateTmp" as NonEmptyStr
+    ReadWritePathsProperty => "ReadWritePaths" as NonEmptyStr
+    RemainAfterExitProperty => "RemainAfterExit" as NonEmptyStr
     JobProperty => "Job" as NonEmptyStr
   }
 }

dag/gunbc/auth/approval_device_enrolment_code_issue.dag

@@ -6,7 +6,12 @@ import std.process { ProcessExit, ExitSuccess, ExitFailure, exit_failure }
 import std.resources { Network }
 import gunbc.cli_wire { CliWireResponse, CliWirePrintable, CliWireUnprintable }
 import extdeps.sudo.elevation { sudo_elevate }
-import extdeps.systemd.systemd_run { SystemdRunProperty, systemd_run_system_scope_argv }
+import extdeps.systemd.systemd_run {
+  SystemdRunProperty, SystemdRunCommandReading, SystemdRunCommandReady, SystemdRunCommandRefused,
+  systemd_run_system_scope_command,
+  systemd_run_option_words_refused_cause_detail,
+}
+import extdeps.exec.command { ArgvCommand, argv_words }
 import extdeps.tools.util_linux_setpriv { setpriv_reuid_regid_argv }
 import extdeps.systemd { MemoryMax, MemoryHigh }
 import std.measure { byte_size_count }
@@ -79,7 +84,7 @@ fn enrolment_code_issue_ssh_target() -> SshTarget {
 // typed-module cache cap is derived from the cgroup's memory.high/memory.max, and with neither bound
 // it refuses HostBudgetUnreadable rather than guessing (fleet-converge run 36556990543). An SSH
 // session binds no such limit. The scope is a system-manager transient scope (extdeps.systemd.systemd_run
-// systemd_run_system_scope_argv) around the account drop below. A user
+// systemd_run_system_scope_command) around the account drop below. A user
 // scope would need that account's session bus, which the elevated command lacks. The bounds are the
 // broker's own slice rows (gunbc.live_deploy.slice_bounds approval_broker_slice_memory_max and _high).
 // The verb resolves the broker's routes closure, the same program the broker boots, so the same
@@ -97,7 +102,7 @@ fn enrolment_code_issue_scope_properties() -> List<SystemdRunProperty> {
 // supplementary groups; systemd-run's own --uid/--gid did not, and every code was minted and then
 // refused delivery (fleet-converge run 37098981121). The drop sits inside the scope so the bound
 // still covers the whole verb.
-fn enrolment_code_issue_remote_argv(revision: ReleaseRevisionBinding) -> List<String> {
+fn enrolment_code_issue_remote_command(revision: ReleaseRevisionBinding) -> SystemdRunCommandReading {
   let root = srv1_gunbc_approval_broker_root as String
   let release_dir = approval_broker_release_dir(root: root, revision: revision)
   let account = fleet_posix_operator_user.name
@@ -113,30 +118,46 @@ fn enrolment_code_issue_remote_argv(revision: ReleaseRevisionBinding) -> List<St
     "--arg", "revision=" + release_revision_execstart_text(binding: revision),
   ])
   let as_account = setpriv_reuid_regid_argv(user: account, group: account, init_groups: true, command_argv: verb)
-  let inv = sudo_elevate(command: systemd_run_system_scope_argv(properties: enrolment_code_issue_scope_properties(), command_argv: as_account))
-  concat([inv.bin_path], inv.args)
+  systemd_run_system_scope_command(properties: enrolment_code_issue_scope_properties(), command_argv: as_account)
 }
 
 fn enrolment_code_issue_refuses_off_srv1(host: String) -> ProcessExit {
   if host == (operator_host_srv1 as String) { ExitSuccess }
   else { exit_failure(reason: "approval device enrolment code: refuses host '" + host + "': the store lives on the machine that serves /approve, which is " + (operator_host_srv1 as String)) }
 }
 
+// The projection refuses a word the wire cannot carry, and the invocation the transport would have
+// run is never minted: the caller sees the refusal's reason, not a command that failed to run --
+// because it IS one.
 fn enrolment_code_issue_remote(revision: ReleaseRevisionBinding) -> CliWireResponse
   uses net: Network
 {
   match prepare_fleet_ssh_agent_context(attempt_raw: approval_device_enrolment_code_issue_attempt_raw) {
     FleetSshContextRefused { cause: c } => CliWireUnprintable { cause: ("approval device enrolment code: " + c) as NonEmptyStr }
     FleetSshContextReady { context: context, receipt: _ } =>
-      match typed_argv_exec_over_fleet_ssh(target: enrolment_code_issue_ssh_target(), context: context, argv: enrolment_code_issue_remote_argv(revision: revision)) {
-        TypedArgvExecRefused { reason: why } => CliWireUnprintable { cause: ("approval device enrolment code: remote invocation refused: " + why) as NonEmptyStr }
-        TypedArgvExecConverged { result: r } =>
-          if r.success { CliWirePrintable { bytes: r.stdout, exit: ExitSuccess } }
-          else { CliWireUnprintable { cause: ("approval device enrolment code: remote exit=" + to_string(r.exit_code) + " " + trim(s: r.stderr)) as NonEmptyStr } }
+      match enrolment_code_issue_remote_command(revision: revision) {
+        SystemdRunCommandRefused { cause: why } =>
+          CliWireUnprintable { cause: ("approval device enrolment code: remote invocation refused: " + systemd_run_option_words_refused_cause_detail(cause: why)) as NonEmptyStr }
+        SystemdRunCommandReady { command: command } =>
+          match typed_argv_exec_over_fleet_ssh(
+            target: enrolment_code_issue_ssh_target(),
+            context: context,
+            argv: sudo_elevate_words(command: command),
+          ) {
+            TypedArgvExecRefused { reason: why } => CliWireUnprintable { cause: ("approval device enrolment code: remote invocation refused: " + why) as NonEmptyStr }
+            TypedArgvExecConverged { result: r } =>
+              if r.success { CliWirePrintable { bytes: r.stdout, exit: ExitSuccess } }
+              else { CliWireUnprintable { cause: ("approval device enrolment code: remote exit=" + to_string(r.exit_code) + " " + trim(s: r.stderr)) as NonEmptyStr } }
+          }
       }
   }
 }
 
+fn sudo_elevate_words(command: ArgvCommand) -> List<String> {
+  let inv = sudo_elevate(command: argv_words(command: command))
+  concat([inv.bin_path], inv.args)
+}
+
 // THE STEP ENTRY: one host per run, named by the dispatch and required to be srv1; one release,
 // named by the dispatch.
 fn approval_device_enrolment_code_issue_wet() -> CliWireResponse

dag/gunbc/compute/unit_bounds.dag

@@ -1,9 +1,11 @@
 module gunbc.compute.unit_bounds
 
-import std.types { String, List }
+import std.types { String, List, NonEmptyStr }
 import std.nat { Nat }
 import std.measure { Kibibyte, kibibyte_to_byte_size, byte_size_count, Millicore, millicore_count }
-import extdeps.systemd.systemd_run { systemd_run_property }
+import extdeps.systemd { SystemdUnitProperty, MemoryMax, WorkingDirectoryProperty, KillModeProperty, CPUQuota, TasksMax }
+import extdeps.systemd.systemd_run { SystemdRunProperty }
+import extdeps.systemd.unit_file { KillModeControlGroup, systemd_kill_mode_wire }
 
 // THE ONE FOLD FROM A CAPACITY GRANT TO THE PROPERTIES OF THE UNIT THAT HOLDS IT. It used to live in
 // gunbc.compute.work_provider_local as compute_unit_properties, and it moved here rather than being
@@ -22,8 +24,7 @@ import extdeps.systemd.systemd_run { systemd_run_property }
 // declaration -- a drop-in or a future default could change it, and a provider would keep treating
 // a completed wait as an empty cgroup (side-chat review at 773825cf). Binding it makes the policy a
 // fact of the invocation, and an agent session releases its seat on the same reading.
-data compute_kill_mode_property: String = "KillMode"
-data compute_kill_mode_value: String = "control-group"
+data compute_kill_mode_property: SystemdUnitProperty = KillModeProperty
 
 // WHAT A GRANT DOES NOT CARRY, NAMED RATHER THAN INVENTED. product.capacity.pool grants MEMORY: the
 // lease is an encumbrance over a Memory pool and nothing else, so a CPU quota or a task ceiling is
@@ -44,19 +45,27 @@ fn unit_cpu_quota_percent(m: Millicore) -> Nat {
   millicore_count(m: m) / 10
 }
 
-fn compute_grant_unit_properties(granted: Kibibyte, working_directory: String, process_bounds: UnitProcessBounds?) -> List<String> {
+fn compute_grant_unit_properties(granted: Kibibyte, working_directory: String, process_bounds: UnitProcessBounds?) -> List<SystemdRunProperty> {
   concat(
     [
-      systemd_run_property(name: "MemoryMax", value: to_string(value: byte_size_count(b: kibibyte_to_byte_size(k: granted)))),
-      systemd_run_property(name: compute_kill_mode_property, value: compute_kill_mode_value),
-      systemd_run_property(name: "WorkingDirectory", value: working_directory),
+      SystemdRunProperty { property: MemoryMax, value: to_string(value: byte_size_count(b: kibibyte_to_byte_size(k: granted))) as NonEmptyStr },
+      SystemdRunProperty { property: compute_kill_mode_property, value: compute_kill_mode_value() },
+      SystemdRunProperty { property: WorkingDirectoryProperty, value: working_directory as NonEmptyStr },
     ],
     match process_bounds {
       Absent => []
       Present { value: b } => [
-        systemd_run_property(name: "CPUQuota", value: join([to_string(value: unit_cpu_quota_percent(m: b.cpu_quota)), "%"], "")),
-        systemd_run_property(name: "TasksMax", value: to_string(value: b.tasks_max)),
+        SystemdRunProperty { property: CPUQuota, value: join([to_string(value: unit_cpu_quota_percent(m: b.cpu_quota)), "%"], "") as NonEmptyStr },
+        SystemdRunProperty { property: TasksMax, value: to_string(value: b.tasks_max) as NonEmptyStr },
       ]
     },
   )
 }
+
+// THE kill mode the release decision relies on is the closed systemd fact KillModeControlGroup;
+// its wire spelling is owned by systemd_kill_mode_wire. This layer projects, it does not store a
+// second copy of the spelling (review 76958: the stored "control-group" was a parallel wire for a
+// closed upstream fact).
+fn compute_kill_mode_value() -> NonEmptyStr {
+  systemd_kill_mode_wire(mode: KillModeControlGroup) as NonEmptyStr
+}