Emit arrival_converge; IAM pair and pinned accessor (msg_f03558d1)

dag/gunbc/actions_run_binding.dag

@@ -98,6 +98,8 @@ data rlm_expected_revision_env_name: String = "RLM_EXPECTED_REVISION"
 
 data fleet_converge_expected_host_env_name: String = "FLEET_CONVERGE_EXPECTED_HOST"
 
+data fleet_converge_arrival_subject_env_name: String = "FLEET_CONVERGE_ARRIVAL_SUBJECT"
+
 type ExpectedRevisionRead
   = ExpectedRevisionPresent { revision: String }
   | ExpectedRevisionAbsent { variable: String, detail: String }

dag/gunbc/auth/authorization_pattern_selection.dag

@@ -111,14 +111,14 @@ type BillingConsequence
 // (gunbc.auth.privileged_effect_census rulings_without_a_rostered_interlock), and the site's
 // realization must take that hold before any write.
 //
-// THREE INTERLOCK STATES, NOT AN OPTIONAL HOLD. InterlockPending is a hold not yet named: it must
+// TWO INTERLOCK STATES, NOT AN OPTIONAL HOLD. InterlockPending is a hold not yet named: it must
 // refuse, never discharge (a bindable irreversible effect under a pending ruling still owes a
-// witness). UnconditionalStanding is an intentional no-hold discharge, with its reason. InterlockedBy
-// is a named hold the census must roster against the site. Only UnconditionalStanding and
-// InterlockedBy discharge the irreversibility ground.
+// witness). InterlockedBy is a named hold the census must roster against the site; only that arm
+// discharges the irreversibility ground. A grant arm that writes BMC credentials must be InterlockedBy
+// the grounded Apply admission (admit_rotation_apply), never pending. Route A overlays that hold per
+// arm (standing_grant_arm_interlock); grant grain may stay InterlockPending for unnamed classes.
 type StandingRulingInterlock
   = InterlockPending { obligation: NonEmptyStr }
-  | UnconditionalStanding { reason: NonEmptyStr }
   | InterlockedBy { hold: DeclarationRef }
 
 type StandingDestructiveAuthorization {
@@ -130,7 +130,6 @@ type StandingDestructiveAuthorization {
 fn standing_ruling_discharges_irreversibility(r: StandingDestructiveAuthorization) -> Bool {
   match r.interlock {
     InterlockPending { obligation: _ } => false
-    UnconditionalStanding { reason: _ } => true
     InterlockedBy { hold: _ } => true
   }
 }
@@ -574,7 +573,6 @@ fn minted_reach_text(m: MintedCredentialReach) -> String {
 fn standing_ruling_interlock_label(r: StandingDestructiveAuthorization) -> String {
   match r.interlock {
     InterlockPending { obligation: o } => join(["InterlockPending: ", o as String], "")
-    UnconditionalStanding { reason: s } => join(["UnconditionalStanding: ", s as String], "")
     InterlockedBy { hold: i } => declaration_ref_display_key(ref: i)
   }
 }

dag/gunbc/auth/gcp_iam_converge.dag

@@ -30,6 +30,7 @@ import gunbc.namecheap.federation_provision { namecheap_dedicated_federation }
 import gunbc.native_product_federation { native_product_federations }
 import gunbc.auth.fleet_convergence_federation { fleet_convergence_federation }
 import gunbc.auth.managed_host_boot_federation_provision { boot_dedicated_federation }
+import gunbc.auth.mtjade1_arrival_federation_provision { mtjade1_arrival_dedicated_federation }
 import gunbc.auth.managed_host_boot_federation { pinned_version_accessor_grant_for, provisioned_boot_federations }
 import gunbc.auth.approval_request_submission { approval_submission_mac_key_secret_ref }
 import gunbc.cloudflare.r2_mint_secret_access { r2_mint_custody_grants }
@@ -219,7 +220,10 @@ data gcp_iam_converge_targets: List<DedicatedFederation> = concat(
     [heal_publisher_dedicated_federation(), private_heal_publisher_dedicated_federation()],
     map(provisioned_boot_federations(), f => boot_dedicated_federation(f: f)),
   ),
-  concat([namecheap_dedicated_federation(), fleet_convergence_federation(), printer_dedicated_federation()], native_product_federations()),
+  concat(
+    concat([namecheap_dedicated_federation(), fleet_convergence_federation(), printer_dedicated_federation()], native_product_federations()),
+    [mtjade1_arrival_dedicated_federation()],
+  ),
 )
 
 fn service_account_resource(email: ServiceAccountEmail) -> String {

dag/gunbc/auth/mtjade1_arrival_federation.dag

@@ -0,0 +1,48 @@
+module gunbc.auth.mtjade1_arrival_federation
+
+import std.types { NonEmptyStr }
+import gunbc.auth.mtjade1_arrival_pair { mtjade1_arrival_principal_member }
+import gunbc.auth.authorization_pattern_selection {
+  PrivilegedEffect, ApiSurface, WorkloadIdentityBindable, WorkloadIdentityStanding,
+  MintsNoCredential, IrreversibleEffect, ReversibleByReapply,
+  NoBillingConsequence, StandingRulingUnderInterlock,
+}
+import std.human_intervention { DeviceOnce }
+import gunbc.auth.standing_operator_grant {
+  mtjade1_live_standing_grant, StandingJadeArrivalArchive, StandingJadeFirmwareQualification,
+  standing_ruling_with_arm_interlock,
+}
+
+fn mtjade1_arrival_bindable_identity() -> WorkloadIdentityStanding {
+  WorkloadIdentityBindable { member: mtjade1_arrival_principal_member() as NonEmptyStr }
+}
+
+fn mtjade1_arrival_archive_effect() -> PrivilegedEffect {
+  PrivilegedEffect {
+    subject: "mtjade1 PriorLifeBoundary archive: content-addressed evidence of BMC carriers, cursor derived from the archive, nothing cleared" as NonEmptyStr,
+    frequency: DeviceOnce,
+    reversibility: ReversibleByReapply,
+    surface: ApiSurface,
+    workload_identity: mtjade1_arrival_bindable_identity(),
+    minted_reach: MintsNoCredential,
+    billing: NoBillingConsequence,
+    witness_discharge: StandingRulingUnderInterlock {
+      ruling: standing_ruling_with_arm_interlock(g: mtjade1_live_standing_grant, e: StandingJadeArrivalArchive),
+    },
+  }
+}
+
+fn mtjade1_arrival_firmware_qualification_effect() -> PrivilegedEffect {
+  PrivilegedEffect {
+    subject: "mtjade1 MegaRAC per-build operation qualification write under the arrival job principal" as NonEmptyStr,
+    frequency: DeviceOnce,
+    reversibility: IrreversibleEffect { what_is_lost: "a controller write at a firmware build is not undone by a reapply of a different build's evidence" as NonEmptyStr },
+    surface: ApiSurface,
+    workload_identity: mtjade1_arrival_bindable_identity(),
+    minted_reach: MintsNoCredential,
+    billing: NoBillingConsequence,
+    witness_discharge: StandingRulingUnderInterlock {
+      ruling: standing_ruling_with_arm_interlock(g: mtjade1_live_standing_grant, e: StandingJadeFirmwareQualification),
+    },
+  }
+}

dag/gunbc/auth/mtjade1_arrival_federation_provision.dag

@@ -0,0 +1,27 @@
+module gunbc.auth.mtjade1_arrival_federation_provision
+
+import gunbc.auth.heal_publisher_provision { DedicatedFederation }
+import gunbc.auth.mtjade1_arrival_pair {
+  mtjade1_arrival_pool_id, mtjade1_arrival_pool_display_name, mtjade1_arrival_provider_id,
+  mtjade1_arrival_wif_attribute_mapping, mtjade1_arrival_claim_pins, mtjade1_arrival_principal_set,
+  mtjade1_arrival_service_account, mtjade1_arrival_service_account_id, mtjade1_arrival_principal_member,
+  mtjade1_arrival_secret_grants,
+}
+import gunbc.auth.oidc_claim_pins { claim_pins_attribute_condition }
+
+fn mtjade1_arrival_dedicated_federation() -> DedicatedFederation {
+  DedicatedFederation {
+    label: "mtjade1 arrival federation",
+    pool_id: mtjade1_arrival_pool_id,
+    pool_display_name: mtjade1_arrival_pool_display_name,
+    provider_id: mtjade1_arrival_provider_id,
+    attribute_mapping: mtjade1_arrival_wif_attribute_mapping,
+    attribute_condition: claim_pins_attribute_condition(pins: mtjade1_arrival_claim_pins()),
+    principal_set: mtjade1_arrival_principal_set(),
+    service_account: mtjade1_arrival_service_account,
+    service_account_id: mtjade1_arrival_service_account_id,
+    service_account_display_name: "Mt. Jade arrival (one job)",
+    service_account_member: mtjade1_arrival_principal_member(),
+    secret_grants: mtjade1_arrival_secret_grants(),
+  }
+}

dag/gunbc/auth/mtjade1_arrival_pair.dag

@@ -0,0 +1,76 @@
+module gunbc.auth.mtjade1_arrival_pair
+
+import std.types { List, Map, NonEmptyStr, String }
+import std.optional { Present }
+import extdeps.cloud.gcp.gcp {
+  ServiceAccountEmail, WifPool, WifProvider, wif_provider_resource, wif_pool_resource,
+}
+import gunbc.auth.github_gcp_federation {
+  fleet_secrets_project_id, fleet_secrets_project_number, github_wif_issuer_uri, federated_service_account_member,
+}
+import gunbc.auth.gcp_secret_access { SecretAccessGrant }
+import gunbc.auth.managed_host_boot_federation { pinned_version_accessor_grant_for }
+import gunbc.auth.oidc_claim_pins { OidcClaimPin, claim_pins_attribute_condition, fleet_converge_job_claim_pins }
+import gunbc.secret_provision { mtjade1_bmc_gunbc_arrival_accessor_ref }
+
+// Names, WIF pair and the one version-pinned accessor. PrivilegedEffect rows live in
+// gunbc.auth.mtjade1_arrival_federation so gcp-iam-converge and fleet-converge.yml do not
+// close over the selection fold.
+
+data mtjade1_arrival_pool_id: NonEmptyStr = "github-mtjade1-arrival"
+data mtjade1_arrival_pool_display_name: NonEmptyStr = "Mt. Jade arrival (one job)"
+data mtjade1_arrival_provider_id: NonEmptyStr = "github-mtjade1-arrival-oidc"
+data mtjade1_arrival_service_account_id: NonEmptyStr = "mtjade1-arrival"
+data mtjade1_arrival_service_account: ServiceAccountEmail = "mtjade1-arrival@gunbai-secrets.iam.gserviceaccount.com"
+data mtjade1_arrival_environment: NonEmptyStr = "mtjade1-arrival"
+
+data mtjade1_arrival_wif_pool: WifPool = WifPool {
+  name: mtjade1_arrival_pool_id
+  project: fleet_secrets_project_id as String
+  display_name: Present { value: mtjade1_arrival_pool_display_name }
+  disabled: false
+}
+
+fn mtjade1_arrival_claim_pins() -> List<OidcClaimPin> {
+  fleet_converge_job_claim_pins(environment: mtjade1_arrival_environment)
+}
+
+data mtjade1_arrival_wif_attribute_mapping: Map<String, String> = {
+  "google.subject": "assertion.sub",
+  "attribute.repository_id": "assertion.repository_id",
+  "attribute.workflow_ref": "assertion.workflow_ref"
+}
+
+fn mtjade1_arrival_wif_provider() -> WifProvider {
+  WifProvider {
+    name: mtjade1_arrival_provider_id
+    pool: mtjade1_arrival_pool_id
+    issuer_uri: github_wif_issuer_uri
+    attribute_mapping: Present { value: mtjade1_arrival_wif_attribute_mapping }
+    attribute_condition: Present { value: claim_pins_attribute_condition(pins: mtjade1_arrival_claim_pins()) }
+  }
+}
+
+fn mtjade1_arrival_provider_resource() -> String {
+  wif_provider_resource(project_number: fleet_secrets_project_number, provider: mtjade1_arrival_wif_provider())
+}
+
+fn mtjade1_arrival_principal_set() -> String {
+  join([
+    "principalSet://iam.googleapis.com/",
+    wif_pool_resource(project_number: fleet_secrets_project_number, pool_id: mtjade1_arrival_pool_id as String),
+    "/*"
+  ], "")
+}
+
+fn mtjade1_arrival_principal_member() -> String {
+  federated_service_account_member(email: mtjade1_arrival_service_account)
+}
+
+fn mtjade1_arrival_secret_grants() -> List<SecretAccessGrant> {
+  [pinned_version_accessor_grant_for(
+    title_prefix: "mtjade1-arrival",
+    description: "gunbc.auth.mtjade1_arrival_pair: the one version the arrival job may read for BmcSecure (signed off msg_f03558d1)",
+    target: mtjade1_bmc_gunbc_arrival_accessor_ref,
+  )]
+}