Board identity: bound host's FRU board reaches its per-board authority (delete closed BaseboardModel)

[gunbai-bot]

Replacement migration at the root: the closed BaseboardModel enum in extdeps.boards.types is deleted (no alias). A bound host's observed board is its own FRU (manufacturer/product/part), bound by a consumer-layer table to a per-board authority subject, so adding a board is a per-board module plus one row.

Design: extdeps.board_authority (shapes + one total fold) · gunbc.board_authority_binding (rows, committed-FRU receipts, digest-checked FRU text decode) · extdeps.ampere.mt_collins_board (new thin Collins subject) · extdeps.ocp.mt_jade.subject mt_jade_board_authority.

• mtjade1: BoundByNameOnly (+ discriminator obligation) → identity-grade uses only; board FACTS (figure, profile routes) refuse. Nothing is nicknamed as GigabyteMp72Hb0.
• mtcollins1: BoundByObservedEvidence citing the 32-DIMM bring-up and physical-orientation receipts; verdicts unchanged.
• Unbound / ambiguous / not-read FRU refuse with typed causes, never a default.

Consumers (by name): extdeps.bmc.access_profile (new AccessProfileBoardNotFactsBound), gunbc.megarac_managed_host, gunbc.megarac_operation_standing, gunbc.machine_intake_access, gunbc.machine_intake_mtcollins1_access_observation, gunbc.boot_artifact_delivery, gunbc.os_install_mechanism, gunbc.baseboard_dimm_figure, gunbc.machine_intake_dimm_physical_orientation, plus the mechanically migrated boards/cooling/firmware/host modules. docs/plans/managed-host-untangle.md still names the old enum (historical).

Witnesses run locally (claim_batch --wet, remote runner), all PASS in the visible output: new board_authority_binding_witness (11: collins evidence-bound, jade name-only, unknown/another-product refuse, ambiguous, not-read, hard-coding mutant, real committed-FRU inhabitance), megarac_managed_host, megarac_operation_standing, boot_artifact_delivery, dimm_physical_orientation, its forged-probe, mtcollins1_physical_orientation, build_fulfillment, memory_change_evaluation. Output was tail-truncated for the larger files, so exact-head CI is the authoritative result. Not yet done: trial-merge of main, megarac_managed_host_forged_probe verdict re-read.

🤖 Generated with Claude Code

[gunbai-bot]

Addressing review 77249 (pushed in the head after 8ef49ab):

1. Two homes for the Mt. Jade FRU receipt — fixed. mtjade1_fru_capture_path / mtjade1_fru_capture_sha256 in gunbc.machine_intake_mtjade1_access_observation are now derived from gunbc.board_authority_binding mtjade1_fru_receipt (the only place the path and digest are spelled).
2. Receipt-checked read has no production consumer — partly fixed, partly a declared frontier.
   • mtcollins1_identity is a pure data row and cannot read a file, so its typed BoardFruRead stays. It is no longer an unchecked literal: w_the_committed_fru_captures_decode_to_the_fixtures_and_bind now asserts the digest-checked read of the committed capture equals mtcollins1_identity.board, so the row cannot drift from its capture.
   • For mtjade1 there is no BmcObservedIdentity row yet; the consumer of read_board_fru_observation(mtjade1_fru_receipt) is the J3 MegaRacBuildReading mint in the mtjade1 wet worker's lane (gentle-carp-328), which is exactly what this cut unblocks. Trigger: that lane's first mtjade1 identity row. I did not add an unconsumed production wrapper in the meantime.

— sent from sleek-carp-686

[gunbai-bot]

Addressing review 77255: valid, fixed. BoardFruReceipt.sha256 is now a Sha256Digest (the receipt is always a file SHA-256), so receipt_sha256_hex is a plain field read with no default arm; ContentHash and the empty-string fallback are gone, and mtjade1_fru_capture_sha256 / board_fru_observation_of_capture can no longer see an invented digest.

— sent from sleek-carp-686

[gunbai-bot]

review 77362: agreed and fixed in 1668f4e. gunbc.ipmitool_fru_text now has two grains: FruFieldGapKind (Absent | Repeated | Empty), which is all fru_field can return, and FruCaptureGap, which wraps it as FruFieldGapped beside the capture-level arms (unreadable, digest mismatch, link unobserved, bound to another link). board_fru_observation_of_text matches the field arms directly and fru_gap_is_absent is deleted. Re-run on BuildBuddy: board_authority_binding 11/11, mtjade1_access 2/2, mtjade1_recorded_manager_capture 2/2, mtjade1_coverage_frontier 2/2, machine_intake_arrival_converge 20/20, bmc_intake_first_contact 8/8, all rc=0. — sent from sleek-carp-686

[briansrls]

APPROVE at exact head a32a233859.

The replacement is cut at the right root. BaseboardModel is deleted rather than aliased; the generic extdeps.board_authority module carries only FRU/authority/binding shapes plus the single total fold and enumerates no products. Concrete product joins live in gunbc.board_authority_binding, so adding another board is a subject + binding-row operation rather than widening a generic enum.

The standing split satisfies the typed-bet/refusal requirements. Mt. Collins is BoundByObservedEvidence; Mt. Jade is BoundByNameOnly with an explicit discriminator obligation. Identity-grade consumers (megarac_operation_standing) accept either bound grade but require both observations to reach the same authority. Facts consumers do not: baseboard_dimm_figure calls board_facts_authority, and extdeps.bmc.access_profile returns AccessProfileBoardNotFactsBound when the observed board is not evidence-bound. Unread, unbound and ambiguous observations never fall back to a board.

The DIMM path is correctly sealed through the managed host's own observation: host_dimm_orientation obtains observed_board_authority(binding.observation.identity.board), then asks baseboard_dimm_figure; a name-only Mt. Jade therefore refuses before any Collins figure/anchor logic can run. The profile path has the same property.

The §3 pairing claim is a real route claim. w_the_committed_fru_captures_decode_to_the_fixtures_and_bind calls read_board_fru_observation for both committed receipts; production performs Filesystem.Read, digest admission, FRU field decode, and only then the authority fold. The claim additionally asserts decoded observation equality with the supplied fixture (and Collins with mtcollins1_identity.board) before asserting Collins evidence-bound / Jade identity-bound. The wrong-digest control refuses at the capture layer. This is stronger than a table-only lookup claim.

The migration surface is broad and consistent with the deleted type: the PR changes the enum definition plus all source consumers exposed in the diff (BMC converge/projection, firmware/cooling, memory qualification/configuration, DIMM figure/orientation, access/boot/install paths and witnesses). Exact-head required CI also compiles the composed source successfully, so I found no surviving executable consumer of the deleted enum. The unchanged megarac_managed_host_forged_probe does not itself name the old enum, so the PR body's 'not yet re-read' note is not a blocker.

Exact-head workflow 37819497320 is on a32a233859354f4c7b7b4d129837d0dc17b57cde; seed, emit-build, generated, floor, and witnesses all succeeded, while rust-unit-tests was skipped.

Two non-blocking cleanup items remain. docs/plans/managed-host-untangle.md still names the deleted enum, which is acceptable only as historical text as the body says. More importantly, host_memory_qualification.dag now contains stale prose saying BoardAuthorityRef currently has exactly one variant; BoardAuthorityRef is a reference struct and this head already has multiple board authority values. Please delete/correct that note in ordinary cleanup, but it does not affect the model or verdict.

No blocking defect found.

[gunbai-bot]

Superseded by #13641 (v1 closeout): this head is an ancestor of integration/v1-closeout.