Managed-host cut 3: boot-critical MegaRAC leaves over ManagedHost

[gunbai-bot]

Cut 3 of the managed-host untangle: the boot-critical MegaRAC leaves stop being mtcollins1-named and take a ManagedHost. Each is admitted only for a controller observed as AMI MegaRAC, on a baseboard and build where the operation is grounded by committed evidence.

Head 04115c70a7b (main merged). Stacked on #13273 (eager-gull-22's run-37102391062 receipts): this branch merged its commits, so land #13273 first. Shares the media-attach seam with cut 4a (#13248), which is held behind this PR.

What changed

Admission: gunbc.megarac_managed_host.

• AdmittedMegaRacHost (sole_constructor) is the only carrier a MegaRAC effect takes. It is minted from one managed host's binding (endpoint, account, firmware) for one operation:
  • MegaRacVirtualMediaAttach
  • MegaRacKvmCanvasStill
  • MegaRacSdrSocketNaming
• Typed refusals:
  • not managed;
  • not bound (unobserved, not secured, endpoint mismatch);
  • not MegaRAC;
  • operation not grounded at this baseboard + firmware;
  • observation not current;
  • current build unobserved.
• One mint. megarac_grounded_admission is the only function that constructs the carrier. It decides from the sealed evidence under a typed MegaRacGroundingRequirement, with no supplied verdict. It is admitted only to the two admissions, so a caller holding a real binding cannot step around the family, grounding or current-build checks (review item 1, 2026-10-05).
• Two admissions:
  • admit_megarac_host (production, FROZEN under a declared rung drop). It grounds the operation at the build the binding's access observation read.
  • admit_megarac_host_at_current_build (SHADOW, staging ruling C). It admits only when the observation is the controller's current build, and only on an executed grounding at that build.

Executed-operation profile: gunbc.megarac_operation_standing, rows in gunbc.machine_intake_megarac_operation_evidence.

• An operation is grounded at an observed baseboard + firmware (BmcObservedIdentity), not family + raw version, following O1a's BmcRotationRouteStanding.
• Sealed carriers: MegaRacBuildReading, MegaRacOperationReceipt, MegaRacFirmwareTransition, MegaRacOperationServedArtifactRecovery, MegaRacOperationStanding.
• The population is sealed too (review item 2, 2026-10-05). MegaRacOperationEvidence is sole_constructor, and its mint megarac_operation_evidence_of is admitted only to the committed rows and named witness fixtures. Genuine evidence therefore cannot be rebuilt without its known 2026-10-02 transition to make 0.32 read as current.
• A run receipt names its run, not its build. It joins a build reading only when no recorded firmware transition, and no reading of another build, lies between the execution and the reading.
• mtcollins1 rows:

Row	Evidence	Grounds
Build reading 0.32	intake observation 2026-09-05 (mtcollins1_evidence_manifest_digest)	—
Media attach receipt	artifacts/bmc/mtcollins1-diskless-boot.json (sha 76340421…), 2026-09-06	media at Mt. Collins 0.32 (executed)
SDR naming receipt	artifacts/bmc/mtcollins1-32dimm/06-sdr.txt (sha dd13ac14…), 2026-09-11	SDR naming at 0.32 (executed)
KVM still	recovered from a served artifact (below)	KVM at 0.32 (recovered, not executed)
Reflash 0.32→0.45.3	typed transition, window 2026-10-02 (record: gunbc.fleet.mtcollins_firmware_converge credential_effect_of)	—
Run 37102391062 media / KVM / SDR receipts	artifacts/bmc/mtcollins1-boot-run-37102391062/ diagnostics (sha d76d8743…), kvm/journal (sha 357c2410…)	nothing: no 0.45.3 build reading is committed and the reflash lies between them and the only reading

• Served-artifact arm (OperationRecoveredFromServedArtifact). This is not O1a's cited-source arm, which cites an upstream publication.
  • Source: https://192.168.1.228/source.min.js, the web UI bundle mtcollins1's BMC 0.32 serves to a browser, read 2026-09-27. It is an observation of what the device serves, the same standing as gunbc.machine_intake_megarac_served_ui_catalog_observation. It is not a disassembly and not a proprietary-notice document.
  • Bytes not committed: only its sha256 5029fae278f7fc8f4dd4ad5eb8e4457e49fa25d4d0158d4bf9fbab09f57d4bf3 is recorded, and the row types this as ServedArtifactDigestOnly.
  • Notices: the committed served capture, artifacts/bmc/mtcollins1-megarac-api-surface.txt (sha 4fc53fea…, 255 API paths), carries no proprietary notice, and neither do artifacts: mtcollins1 boot run 37102391062 evidence (executed MegaRAC media/KVM/SOL/boot after the 0.45.3 reflash) #13273's files.
  • What it does not establish: that the operation was executed. megarac_operation_executed_at and the current-build gate refuse this arm.
• SDR naming at 0.45.3. The run 37102391062 capture was read host-off. Every CPU0_/CPU1_ record answered "No Reading", but the record names are present, which is what socket naming reads. So naming is evidenced, and it still grounds nothing at 0.45.3 until the build probe is committed.

Declared rung drop: gunbc.rung_drop.megarac_operations_admitted_through_a_superseded_build_observation.

• Previous rung: StructurallyGuaranteed (the shadow gate). Temporary rung: Mitigatable (the operations' own wire refusals).
• Population: mtcollins1's three MegaRAC operations and the boot that depends on them.
• Restoration trigger: each operation admitted through the current-build gate from a committed current-build reading plus an executed receipt at that build, so production switches in one transition. The probe slots in as one reading row.
• docs/design-rung-drops.md is regenerated.

Leaves cut over and their mtcollins1 roots deleted:

• gunbc.machine_intake_mtcollins1_kvm_still → gunbc.machine_intake_megarac_kvm_still.
  • megarac_kvm_observer_start(host: AdmittedMegaRacHost, …) refuses a carrier admitted for another operation.
  • kvm_observer_launch / kvm_observer_launch_in are sealed. The protocol witnesses use the test-only kvm_observer_protocol_launch, admitted to those two witness functions.
• gunbc.machine_intake_mtcollins1_media_attach → gunbc.machine_intake_megarac_boot_media_attach. Every entry admits the unit-hold proof's own host, so endpoint, account and firmware come from one binding.
• gunbc.machine_intake_mtcollins1_bmc_sensor_observation → gunbc.machine_intake_megarac_sensor_observation. The CPU<n>_ prefix is read only through a sealed MegaRacSdrSocketNamingRule, minted for an admitted host. The boot's SDR read admits before it reads.
• Secured-account projection. mtcollins1_secured_account and the interim managed_host_bound_account are deleted.
  • gunbc.managed_host managed_host_binding_for(host) returns the whole ManagedHostBindingStanding.
  • managed_host_account_driving(lookup, endpoint) releases the account only to a caller driving the controller the binding observed.
  • Consumers: actuate (4a), fan / UI-bundle observe (cut 5).
• Raw-parameter sweep. One other open effect took a raw account, mtcollins1_ui_bundle_observe_with (cut 5). It is now sealed to its own _wet.

Cut-4d modules change only at their call sites, plus moved byte-identical rows:

• mtcollins1_kvm_observer_dir moved to the boot bundle.
• mtcollins1_media_share and mtcollins1_boot_ipmi_read_bound moved to the boot run.
• The SDR read carries its naming carrier.

Credential frontier (unchanged)

mtcollins1_managed_secret_fetch_frontier is left exactly as it was. Materializing the password needs an access token in the boot job, which is a workflow change, and the plan assigns removing the caller-supplied password path to cut O2.

Fleet-converge surface

No mode, job, input, step id or env var changed. The generated .github/workflows/fleet-converge.yml regenerates byte-identical at 04115c70a7b.

Terminal receipt (all at 04115c70a7b)

Binary: gunbc / claim_batch built by cargo build --release on BuildBuddy from a checkout asserted at the pin. Runs are serial, inside a 20 GiB memory cgroup.

Boot acceptance matrix: claim_batch --claim-run --hermetic --functions <all 28>, 28/28, RC 0. fleet-converge.yml and docs/design-rung-drops.md both regenerate byte-identical at this head.

(1) Consumer roster (plan census method; gunbc run --claim-run, as pass/fail):

witness	result
test.claim.megarac_operation_standing_witness (new)	4/0
test.claim.megarac_managed_host_witness (new)	11/0
test.claim.megarac_managed_host_forged_probe_witness (new)	7/0
megarac_sensor_observation_witness_test	11/0
megarac_kvm_still_witness_test	21/0
megarac_stale_power_off_witness_test	13/0
megarac_media_convergence_witness_test	80/0
megarac_session_release_witness_test	13/0
mtcollins1_boot_diagnostic_bundle_witness_test	71/0
mtcollins1_boot_run_witness_test	35/0
mtcollins1_kvm_observer_observe_witness_test	11/0
mtcollins1_bmc_secure_standing_witness_test	4/0
mtcollins1_unit_hold_forged_probe_witness_test	5/0
mtcollins1_ui_bundle_observe_witness_test	10/0
mtcollins1_power_on_account_witness_test	28/0
kernel_module_decompression_observation_witness_test	13/0
managed_host_witness	5/0
managed_host_unit_hold_witness	17/0
managed_host_unit_hold_forged_probe_witness	4/0
managed_host_boot_federation_witness	6/0
mtcollins_firmware_converge_witness	69/0
authorization_pattern_selection_witness	24/0
non_fold_residue_frontier_test	5/0
runner_browser_toolchain_witness	23/0
v2 floor_unimported_bare_provider_debt_test	17/1, identical at merge-base 0360849c51b: standing_refuses_stale_debt_and_an_unrostered_pair, a pure fixture claim this PR does not reach; FAIL text carries no cause, so it is recorded as pre-existing, not diagnosed
mtcollins1_kvm_observer_protocol_wet_witness	5/7, identical at merge-base (same seven browser-driving claims); cause not read, so these are unmeasured, not green. It resolves through kvm_observer_protocol_launch
sol_hold_stdin_wet_witness	not run (instrument rule: SIGKILLs pid 1)

(2) Same-path REDs. Throwaway ref cut3-red-probe at ce5fd381ae1 = this head plus one mutation commit (never to merge). The other 39 claims stayed green.

refusal removed	claim(s) that went red
family arm admits OpenBMC	w_a_controller_observed_as_openbmc_is_refused_for_every_megarac_operation
grounding ignored (baseboard + build)	w_a_megarac_build_no_operation_was_executed_on_is_refused…, w_another_baseboard_at_the_same_megarac_build_is_refused…
current-build gate admits a known-unread build	w_a_historical_observation_beside_a_known_later_build_mints_no_carrier, w_the_committed_mtcollins1_evidence_is_refused_by_the_shadow_gate_as_not_current
transition join removed	w_a_receipt_across_a_reflash_grounds_no_build, w_the_committed_rows_ground_0_32_by_route_and_nothing_at_0_45_3
executed-only ignored	w_a_route_recovered_from_a_served_artifact_is_grounded_but_not_executed
sole_constructor off AdmittedMegaRacHost	each_forged_megarac_carrier_is_refused_at_its_literal
KVM operation check	a_carrier_admitted_for_virtual_media_does_not_start_the_viewer
SDR operation check	a_host_admitted_for_virtual_media_mints_no_socket_naming
account released for any endpoint	w_an_account_is_released_only_with_the_controller_it_was_bound_to
admit_callers off megarac_grounded_admission	the_carrier_mint_helper_refuses_an_outside_caller
sole_constructor and the mint seal off MegaRacOperationEvidence	a_population_rebuilt_without_its_known_transition_is_refused

(w_a_current_read_build_with_executed_evidence_is_admitted_by_the_shadow_gate also reddens: the grounding mutation admits KVM, which its control requires to refuse.)

Compile walls: the forged probe refuses literals of AdmittedMegaRacHost, MegaRacSdrSocketNamingRule, MegaRacOperationStanding, MegaRacBuildReading, MegaRacOperationReceipt and MegaRacOperationEvidence. The last of these covers genuine evidence rebuilt with transitions: []. It also refuses outside calls to:

• megarac_grounded_admission, with a real binding and the committed evidence;
• megarac_operation_evidence_of;
• the media entries and their chassis effects;
• all three KVM launchers.

(3) Corpus sweep. git grep over dag, src, .github and artifacts finds no hits for:

• the deleted modules: mtcollins1_kvm_still, mtcollins1_media_attach, mtcollins1_bmc_sensor_observation;
• mtcollins1_secured_account, managed_host_bound_account, mtcollins1_bmc_firmware;
• the moved procedure names.

Remaining hits:

• mtcollins1_media_attach_observed_at is a separate memory-census receipt.
• The dated plan docs are residue.
• artifacts/bmc/mtcollins1-* are receipts.

Entry-path rows:

• gunbc.non_fold_residue: re-keyed to the moved paths, merged against closed matches are total: drain 82 mint-era roster rows, total 22 unseen wildcard sites #12990's totality drain.
• v2.workflow.floor_unimported_bare_provider_debt_roster: the roster is append-only. The deleted sensor file's row is carried with cause FileDeleted, as the floor requires, and the moved module imports filter explicitly and carries no debt.
• gunbc.ci_spec: no moved path, import only.

(4) No aliases. No re-export, wrapper or one-line forward through a deleted root. Unit-named rows left in 4a/4d/5 modules are unit facts passed as parameters.

Declared frontiers

• MtCollins1MediaAttachRecord stays in the cut-4d bundle.
• BmcAnomaly types are imported from mtcollins1_power_on_account (type-only).
• The KVM callers in managed_host_unit_hold admit_callers stay for cut 5.
• Production MegaRAC admission is frozen under the declared drop above, until the 0.45.3 build probe is committed.

Not authorized to merge; reporting to warm-crane-577.

🤖 Generated with Claude Code

[briansrls]

Reviewed the current exact head 586806e2b921c03b951bfdf2178dbb2ba55a6dd1. The requested a97a2acbed3 advanced through the main heal (194f1b3) and the append-only debt-roster correction (586806e).

The replacement shape is largely right: the media path derives its controller from the held host; AdmittedMegaRacHost is sealed and operation-tagged; media/chassis effects are caller-confined; SDR naming is a sealed, build-keyed carrier; and the moved production call sites consume binding endpoint/account rather than the deleted unit-local username projection. Four load-bearing gaps remain.

1. The “build gate” consumes a historical observation, not the controller’s current build

admit_megarac_host takes b.observation.identity.firmware from ManagedHostBinding and treats it as the build the live effect is about. Production managed_hosts() still uses mtcollins1_access_standing, whose observation was taken on 2026-09-05 and explicitly reports BMC 0.32. The same physical endpoint was reflashed on 2026-10-02 to 0.45.3.

Nothing in this admission checks observation currency, joins to the post-reflash firmware readback, or invalidates the old access observation after the subject changed. Consequently the live endpoint can still mint an AdmittedMegaRacHost as firmware 0.32 and execute media/KVM/SDR operations against the actual 0.45.3 controller. The supplied 2.11 fixture proves only that an authored 2.11 observation refuses; it does not prove that the observation used in production describes the controller now being driven.

The effect admission needs a current controller-build standing bound to this run/current firmware subject, or it must refuse once a later firmware-set transition is known. Required RED:

historical access observation: 0.32
known current controller after reflash: 0.45.3
→ no MegaRAC operation carrier
→ no request

Until 0.45.3 is qualified, the honest result is build-unverified/refused, not an admitted 0.32 operation on the same network endpoint.

2. Family + raw version is not the executed-build identity the comments claim

The evidence named here is for the Foxconn Mt. Collins MegaRAC implementation at 0.32. But megarac_operation_executed_on compares only BmcFirmwareReleaseIdentity, and that equality is family + raw version. It does not include BmcObservedIdentity.baseboard, product line, or an executed operation/profile receipt.

Any other managed MegaRAC appliance reporting raw version 0.32 would therefore be admitted for the Mt. Collins media wire, KVM bundle behavior, and CPU<n>_ SDR naming, even though none was executed on that product. Refusing mtjade1 at 2.11 does not discriminate this collision.

Key the operation standing to at least the observed baseboard/product plus release, or better to a construction-confined executed-operation profile. Required RED:

non-Mt-Collins baseboard
+ AmiMegaRac
+ raw version 0.32
→ refuse every Mt. Collins-derived operation

3. The KVM effect still has a public raw-parameter bypass around the carrier

megarac_kvm_observer_start checks AdmittedMegaRacHost.operation, but the same module still exports unrestricted effectful helpers:

kvm_observer_launch(dir, base_url, host, username, password_file, ...)
kvm_observer_launch_in(...)

They create the directory and launch the browser/login route from caller-supplied endpoint/account values. Any module can call them without AdmittedMegaRacHost, bypassing the family, build and operation admissions entirely. The forged-carrier probe does not exercise this route, so its claim that endpoint/account/firmware reach a MegaRAC effect only through admit_megarac_host is not true yet.

Confine the production raw launcher to megarac_kvm_observer_start. Protocol tests can use a separately named test-only façade admitted only to their functions. Add a compile RED proving an outside caller cannot reach either effectful launcher with raw host/account values.

4. managed_host_bound_account erases the endpoint/account join it says it preserves

The new general helper returns only NonEmptyStr?. Once the bare account leaves ManagedHostBinding, a caller can pair host A’s account with controller B’s endpoint; the type carries no subject or endpoint with which to refuse that cross-wire. The changed mtcollins1 callers happen to use the mtcollins1 endpoint, but the public helper does not establish the stronger comment that the account is “never paired with another row’s controller.”

Replace this with a label lookup returning ManagedHostBindingStanding, or a sealed carrier that retains host + endpoint + account and is consumed as a unit. Required RED: obtain A’s account standing and attempt to drive B’s endpoint; the effect must refuse before transport.

The unchanged password-materialization frontier is acceptable in this cut, and I found no blocker in leaving the unit-named media record for cut 4d. Exact-head CI is currently queued; the findings above are semantic and independent of it.

[briansrls]

REQUEST_CHANGES at exact head fbaaca2e2b2001546decf820a1aa0be9875b5ba3, against DESIGN.md §§3, 4b and 5. The baseboard+firmware operation standing and executed-versus-served-recovery distinction are substantially improved. I am not re-blocking the explicitly staged current-build cutover merely because the current-build probe remains owed. Two construction paths still defeat the claimed admission wall.

1. gunbc.megarac_managed_host::megarac_grounded_admission is an unrestricted constructor proxy. It accepts independently supplied binding, operation, identity and grounded: Bool; when grounded is true it directly constructs AdmittedMegaRacHost. It never uses its evidence parameter. An outside caller can obtain a real ManagedHostBinding, call this helper with grounded: true, and receive the production effect carrier without the family, product/build grounding or current-build checks. Sealing the record literal does not close this function. Confine the mint to the actual admission functions (and ensure no admitted wrapper re-exports that authority), or have it derive its decision from bound evidence rather than accepting the authoritative Boolean. Add an outside-caller compiler RED through this helper, not only a forged record literal.

2. The shadow admission receives a caller-editable evidence population. MegaRacOperationEvidence is an open record of lists, and admit_megarac_host_at_current_build is unrestricted. Starting with mtcollins1_megarac_operation_evidence(), an outside caller can retain the genuine 0.32 reading and media/SDR receipts, replace transitions with [], and submit the reconstructed evidence. megarac_current_build then sees 0.32 as current and the executed join admits it. The individual readings/receipts can all remain sealed: it is omission of the known transition that forges the conclusion. This can mint the same carrier the live effects consume. Production admission needs the canonical complete evidence population, or a sealed population whose producer establishes that completeness. Supplied-population controls can terminate at a pure classifier or be caller-confined so they cannot export a production carrier. Add a RED for dropping the known 2026-10-02 transition from otherwise genuine evidence.

These are source-level authority bypasses independent of the reported green CI and of the declared temporary use of the historical production admission. No live test or controller action was performed by this reviewer.

[briansrls]

APPROVE at exact head 04115c70a7b7385086ee57213f689c9b17615dc4, against DESIGN.md §§3, 3c, 4b and 5. Both construction bypasses from review 5408700404 are closed.

1. megarac_grounded_admission is now the sole constructor of AdmittedMegaRacHost. It computes grounding from MegaRacOperationEvidence under MegaRacGroundingRequirement; it no longer accepts an authoritative Bool. Its admitted callers are exactly admit_megarac_host_observed_in and admit_megarac_host_at_current_build. Both perform the binding/family checks before calling it, and the shadow entry additionally establishes the current reading and requires executed grounding. The outside-helper compiler probe covers the previously missed path even with a real binding and committed evidence available.

2. MegaRacOperationEvidence is sealed, and megarac_operation_evidence_of admits only the fixed committed producer and four exact witness functions. I checked those functions: each returns Bool and consumes its supplied population internally; none exposes a carrier-returning fixture facade. The committed producer retains the known reflash and takes no caller-supplied population. The new probe attempts both a literal rebuild with transitions: [] and the same omission through the mint, requiring the corresponding blocking diagnostic at each exact subject. The clean-source control uses the real admission entry and requires neither wall class; CensusNotRunnable cannot satisfy it.

The original host/build/operation distinctions remain: a different baseboard/build refuses; the current-build gate refuses the committed historical 0.32 observation beside the known 0.45.3 transition; and served-artifact recovery is not executed-operation evidence. The declared production exception remains open, and the regenerated rung-drop projection retains the full restoration capability for all three operations. This approval does not qualify 0.45.3, retire that drop, switch production to the shadow gate, or authorize a live hardware action.

Reviewed the exact-head admission, evidence producer and mints, all admitted evidence fixtures, compiler probes, the prior review, and the rung-drop declaration/projection. The PR's exact-head Hermetic 28/28 matrix, 24 passing consumer modules, forged 7/7, regeneration checks and mutation results are author-reported execution receipts; I did not run tests, regenerate artifacts or contact a controller. The reported merge-base debt and KVM-wet failures remain explicit unresolved baseline findings, not passing qualification.

GitHub reports exact-head witnesses run 37247390521 completed successfully. No semantic blocker remains on this cut; preserve normal required merge checks and review any subsequently changed head separately.