machine intake: MachineOperatingEnvironment -> MachineQualificationPolicy { admits: DeploymentRiskClass }

[gunbai-bot]

Deployment-risk conformance deliverable 1b (docs/plans/deployment-risk-conformance.md).

Reading this diff: this PR targets main and includes a merge of main after #13221 landed. That merge's only conflicts were this PR's new names against main's old text, in bmc_secure.dag and machine_intake_bmc_secure_state_witness_test.dag, and this PR's side was kept hunk by hunk. The evidence below was taken at head e9bd547d.

What changes

gunbc.machine_intake_phase MachineOperatingEnvironment = DevelopmentAndTest | Production is deleted. In one motion, with no parallel vocabulary:

before	after
MachineOperatingEnvironment	gunbc.deployment_risk DeploymentRiskClass (consumed, not re-coined)
IntakeQualificationPolicy { environment }	MachineQualificationPolicy { admits }
intake_qualification_policy(environment:)	machine_qualification_policy(admits:)
production_qualification_policy()	prod_risk_admitting_qualification_policy()
intake_qualification_policy_digest	machine_qualification_policy_digest
environment_of_qualification_digest	admitted_class_of_qualification_digest
FleetAdmissionReceipt.environment	.admits
PublishedCredentialRetainedNotAdmittedForProduction	PublishedCredentialRetainedNotAdmittedByProdRiskPolicy

A machine only ADMITS a class. It is never itself ProdRisk and never confers the prod role.

Preserved exactly

• published_account_requires_published_closed is untouched.
• The retained-credential decision in adjudicate_published_census is the same match with renamed arms: TestRisk admission retains a break-glass credential, ProdRisk admission refuses it.
• mtcollins1_bmc_secure_observation (frozen under Managed-host cut O1b: BmcSecure as a desired state (shadow), observer clock, secret-order carriers, sealed phase receipt #13221's rung drop): import and one constructor argument renamed, nothing else.

Digest preimage: CHANGED

"intake-qualification-policy:development-and-test" / ":production" become "machine-qualification-policy:admits-test-risk" / ":admits-prod-risk". The old preimages are gone, so no old digest is accepted anywhere. No witness carries a digest literal (every one is computed through machine_qualification_policy_digest), so no literal needed updating. Nothing outside the tree persists the digest.

The four policy_bar_mismatch_cause refusal strings also change wording; the two witness literals that assert them are updated here.

Controls, one positive and one RED per arm

arm	rotation path (machine_intake_bmc_secure_witness_test)	goal path (machine_intake_bmc_secure_state_witness_test)
TestRisk retains: positive	break_glass_retention_secures_under_test_risk_admission	a_retained_credential_must_be_the_goal_bound_generation
ProdRisk requires closed: RED	retained_credential_refuses_under_prod_risk_admission	new a_goal_bound_retention_refuses_a_prod_risk_admitting_goal_and_a_closed_account_satisfies_it
ProdRisk requires closed: positive	new closed_published_credential_secures_under_prod_risk_admission	same new witness

The ProdRisk arm had a RED but no positive control before this PR, on either path.

Not changed, flagged

derive_fleet_admission still requires the ledger digest to EQUAL the bar's, so a ledger derived under a ProdRisk-admitting policy refuses a TestRisk-admitting bar (prod_risk_ledger_under_test_risk_bar_names_the_bar_not_bmc_secure). The ruling says a prod-admitting machine may host a TestRisk deployment; whether that should make a ProdRisk-qualified ledger satisfy a TestRisk bar is a behaviour change and an operator choice, so it is left as it was.

Evidence

Run at head e9bd547d (the script refuses any other head), one ctrl-build --remote dispatch on an EstimatedMemory=24GB runner, with the process bound to a 20 GiB memory cgroup and an explicit --functions roster generated from every test fn in the five files.

Baseline: 168 PASS, 0 FAIL, exit 0. Rosters: bmc_secure 45, bmc_secure_state 15, disposition 35, mtcollins1 standing 4, mtcollins_firmware_converge 69.

Mutant: the two arms of match admits in adjudicate_published_census swapped (TestRisk refuses, ProdRisk retains). Rerun of the two BMC witness files: 52 PASS, 8 FAIL, exit 1. The eight:

• break_glass_retention_secures_under_test_risk_admission
• retained_credential_refuses_under_prod_risk_admission
• published_factory_retention_secures_under_test_risk_admission_only_when_explicit
• published_factory_retention_refuses_under_prod_risk_admission
• factory_retention_test_risk_ledger_is_not_fleet_admissible_under_prod_risk_bar
• factory_retention_without_acceptance_is_not_retained
• a_retained_credential_must_be_the_goal_bound_generation
• a_goal_bound_retention_refuses_a_prod_risk_admitting_goal_and_a_closed_account_satisfies_it

Both arms go red on both paths. closed_published_credential_secures_under_prod_risk_admission stays green under the mutant, as it should: a closed credential never reaches the retention match.

Zero remaining at e9bd547d: git grep -E 'MachineOperatingEnvironment|DevelopmentAndTest|IntakeQualificationPolicy|production_qualification_policy|intake_qualification_policy' -- dag src returns nothing.

🤖 Generated with Claude Code