Connect srv1 workspace VM lifecycle and kernel prerequisites

dag/extdeps/bootloader/grub.dag

@@ -81,6 +81,19 @@ fn grub_config_render(cfg: GrubConfig) -> String {
   join([header, body], "\n")
 }
 
+// The first linux/initrd command's literal operand in a generated configuration.
+// This is a narrow read, not an interpreter for arbitrary GRUB scripts: computed
+// or quoted operands remain different from the literal path a caller expects.
+fn grub_first_command_operand(config: String, command: String) -> String? {
+  let rows = map(split(s: config, delimiter: "\n"), line =>
+    filter(flat_map(split(s: trim(s: line), delimiter: "\t"), part => split(s: part, delimiter: " ")), word => word != ""))
+  let commands = filter(rows, words => match words.first() { Present { value: word } => word == command Absent => false })
+  match commands.first() {
+    Absent => none
+    Present { value: words } => words.skip(n: 1).first()
+  }
+}
+
 data grub_console_banner_prefix: NonEmptyStr = "GNU GRUB  version "
 data grub_failed_default_and_fallback: NonEmptyStr = "Failed to boot both default and fallback entries."
 data grub_error_prefix: NonEmptyStr = "error: "

dag/extdeps/cadquery/cadquery.dag

@@ -1,6 +1,6 @@
 module extdeps.cadquery.cadquery
 
-import extdeps.exec.program { ProgramIdentity, uncataloged_program }
+import extdeps.python { python_program }
 
 import std.types { Bool, String, NonEmptyStr, List }
 import std.measure { Micrometer, micrometer_count }
@@ -41,7 +41,6 @@ data cadquery_ocp_distribution: OcpDistribution = OcpWithVtk
 
 // PATH-resolved, for the reason extdeps.exec.command program_spelling_is_an_observation_claim
 // records: an absolute path is a claim about a filesystem this repository has not observed.
-fn python_program() -> ProgramIdentity = uncataloged_program(invocation: "python3")
 
 // RUN ONE EMITTED PROGRAM. The script path is the caller's -- this module has no authority to
 // enumerate the programs a consumer might run, exactly as extdeps.tools.make refuses to enumerate

dag/extdeps/ethtool/ethtool.dag

@@ -98,92 +98,3 @@ fn ethtool_module_info_raw_command(device: NonEmptyStr) -> NonEmptyStr {
     " ", ethtool_module_info_raw_on as String,
   ], "") as NonEmptyStr
 }
-
-// ================= THE CHANNEL READ =================
-//
-// `-l` (long form `--show-channels`) reports the device's channel counts: ethtool issues
-// ETHTOOL_MSG_CHANNELS_GET over netlink, or ETHTOOL_GCHANNELS where netlink is unavailable. Both
-// answer the same `struct ethtool_channels` (include/uapi/linux/ethtool.h). The rendering cited here
-// is netlink/channels.c in ethtool 6.7, the version measured on spark-a3ee (see
-// ethtool_binary_directory): a header line `Channel parameters for <dev>:`, then a `Pre-set
-// maximums:` block and a `Current hardware settings:` block, each holding `RX:`, `TX:`, `Other:` and
-// `Combined:` lines. A count the driver does not report is printed as `n/a`, not as 0.
-//
-// THE CURRENT COMBINED COUNT IS THE ONLY FIELD READ, because it is the one any consumer here needs:
-// struct ethtool_channels.combined_count, the field the earlier inline ioctl probe read as
-// channels[8]. Every other outcome is a refusal and never a count. That covers a nonzero exit (the
-// driver has no get_channels, or the device is gone), a missing header, a missing current block, a
-// missing `Combined:` line in that block, and `n/a` or any other non-decimal value. A refusal that
-// fell back to 0 would make an unreadable count look like an idle device.
-data ethtool_show_channels_flag: NonEmptyStr = "--show-channels" as NonEmptyStr
-
-service ethtool.Ethtool {
-  operation ShowChannels {
-    input { device: NonEmptyStr }
-    output { value: String from "stdout", success: Bool from "exit_success" }
-    readonly
-    transport shell { argv: ["/usr/sbin/ethtool", "--show-channels", "{device}"] }
-    exit { 0 => Unit nonzero => String "ethtool channel read failed" }
-    mock_response { 1 => { value: "", success: false } "no fabricated channel parameters" }
-  }
-}
-
-type EthtoolCombinedChannels
-  = EthtoolCombinedChannelsCurrent { count: Int }
-  | EthtoolCombinedChannelsUnreadable { cause: NonEmptyStr }
-
-fn ethtool_decimal_value(text: String) -> Int? {
-  let cps = text |> chars
-  if length(cps) == 0 || length(cps) > 10 || !all(cps, cp => cp >= 48 && cp <= 57) { none }
-  else { parse_int(s: text) }
-}
-
-fn ethtool_channel_line_value(line: String, label: String) -> String? {
-  if starts_with(s: line, prefix: label) {
-    Present { value: trim(s: substring(s: line, start: string_length(s: label), end: string_length(s: line))) }
-  } else { none }
-}
-
-// The current `Combined:` line is the first one AFTER the `Current hardware settings:` line, so the
-// pre-set maximum, which carries the same label, can never be read in its place.
-fn ethtool_current_combined_from(lines: List<String>) -> EthtoolCombinedChannels {
-  let after = fold(lines, init: EthtoolChannelScanBefore {}, f: (acc, line) => match acc {
-    EthtoolChannelScanBefore {} =>
-      if trim(s: line) == "Current hardware settings:" { EthtoolChannelScanCurrent {} } else { acc }
-    EthtoolChannelScanCurrent {} => match ethtool_channel_line_value(line: line, label: "Combined:") {
-      Present { value: v } => EthtoolChannelScanFound { value: v }
-      Absent => acc
-    }
-    EthtoolChannelScanFound { value: _ } => acc
-  })
-  match after {
-    EthtoolChannelScanBefore {} => EthtoolCombinedChannelsUnreadable { cause: "no current hardware settings block" as NonEmptyStr }
-    EthtoolChannelScanCurrent {} => EthtoolCombinedChannelsUnreadable { cause: "no current Combined count" as NonEmptyStr }
-    EthtoolChannelScanFound { value: v } => match ethtool_decimal_value(text: v) {
-      Present { value: n } => EthtoolCombinedChannelsCurrent { count: n }
-      Absent => EthtoolCombinedChannelsUnreadable { cause: "current Combined count is not a decimal count" as NonEmptyStr }
-    }
-  }
-}
-
-type EthtoolChannelScan
-  = EthtoolChannelScanBefore {}
-  | EthtoolChannelScanCurrent {}
-  | EthtoolChannelScanFound { value: String }
-
-fn ethtool_combined_channels(device: NonEmptyStr, success: Bool, value: String) -> EthtoolCombinedChannels {
-  let lines = split(s: value, delimiter: "\n")
-  if !success { EthtoolCombinedChannelsUnreadable { cause: "ethtool --show-channels exited nonzero" as NonEmptyStr } }
-  else { match lines |> first {
-    Absent => EthtoolCombinedChannelsUnreadable { cause: "empty channel report" as NonEmptyStr }
-    Present { value: header } =>
-      if trim(s: header) != join(["Channel parameters for ", device as String, ":"], "") {
-        EthtoolCombinedChannelsUnreadable { cause: "channel report names a different device or no device" as NonEmptyStr }
-      } else { ethtool_current_combined_from(lines: lines) }
-  } }
-}
-
-fn ethtool_observe_combined_channels(device: NonEmptyStr) -> EthtoolCombinedChannels {
-  let read = ethtool.Ethtool.ShowChannels(device: device)
-  ethtool_combined_channels(device: device, success: read.success, value: read.value)
-}

dag/extdeps/exec/command.dag

@@ -142,6 +142,7 @@ fn argv_command(program: ProgramIdentity, arguments: List<String>) -> ArgvComman
     decl_ref(module_path: "extdeps.iproute2.ip_show", decl_name: "ip_route_show_command"),
     decl_ref(module_path: "extdeps.tools.uname", decl_name: "uname_release_command"),
     decl_ref(module_path: "extdeps.tools.uname", decl_name: "uname_machine_command"),
+    decl_ref(module_path: "extdeps.linux.ethtool_ioctl", decl_name: "linux_ethtool_channels_command"),
     decl_ref(module_path: "extdeps.tools.make", decl_name: "make_command"),
     decl_ref(module_path: "extdeps.systemd.systemd_run", decl_name: "systemd_run_command_of"),
     decl_ref(module_path: "extdeps.package_managers.pip", decl_name: "pip_install_pinned_command"),

dag/extdeps/exec/program.dag

@@ -168,7 +168,7 @@ fn uncataloged_program(invocation: NonEmptyStr) -> ProgramIdentity
     decl_ref(module_path: "extdeps.storage.nbd", decl_name: "nbd_server_program"),
     decl_ref(module_path: "extdeps.package_managers.pip", decl_name: "pip_program"),
     decl_ref(module_path: "extdeps.posix.sh_invocation", decl_name: "posix_sh_program"),
-    decl_ref(module_path: "extdeps.cadquery.cadquery", decl_name: "python_program"),
+    decl_ref(module_path: "extdeps.python", decl_name: "python_program"),
     decl_ref(module_path: "extdeps.dpkg", decl_name: "dpkg_query_status_command"),
     decl_ref(module_path: "extdeps.ssh.openssh_client_commands", decl_name: "scp_program"),
     decl_ref(module_path: "extdeps.ssh.openssh_client_commands", decl_name: "ssh_add_program"),

dag/extdeps/github/actions.dag

@@ -411,3 +411,7 @@ data max_matrix_combinations: Int = 256
 // repository's own live ruleset row (GET /repos/gunb-ai/gunbc/rulesets, integration_id 15368,
 // 2026-08-27) and consistent with the documented app id for GitHub Actions.
 data github_actions_app_integration_id: Int = 15368
+
+// https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#onworkflow_dispatchinputs
+// GitHub increased the top-level workflow_dispatch input limit from 10 to 25 on 2025-12-04.
+data workflow_dispatch_max_inputs: Int = 25

dag/extdeps/linux/ethtool_ioctl.dag

@@ -0,0 +1,90 @@
+module extdeps.linux.ethtool_ioctl
+
+import std.types { String, NonEmptyStr, Int, List, Bool }
+import std.algebra { trim }
+import extdeps.external_authority { ExternalAuthority }
+import extdeps.uri { Uri, Https }
+import extdeps.python { PythonProgramText, python_run_program_argv, python_program }
+import extdeps.exec.command { ArgvCommand, argv_command, LocalExec }
+import gunbc.command_runner { run_shell_command_observe_outcome }
+import extdeps.shell.exec { ProcessRan, ProcessNotSpawned }
+
+data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
+  uri: Uri { scheme: Https, locator: "github.com/torvalds/linux/blob/v6.9/include/uapi/linux/ethtool.h" }
+}
+
+// Linux's ETHTOOL_GCHANNELS/SIOCETHTOOL ABI, not ethtool's diagnostic prose. The Python
+// realization only marshals the native ABI and returns the syscall's errno or all nine u32s.
+// No package selection or repair policy lives in it. PythonProgramText carries the same
+// declared second-medium boundary as extdeps.nvidia.cuda_driver. This realization admits
+// Linux's 64-bit ifreq layout (16-byte name, 24-byte union); other ABIs fail before ioctl.
+// include/uapi/linux/{ethtool.h,sockios.h,if.h}; include/uapi/asm-generic/errno.h.
+data linux_siocethtool: Int = 35142
+data linux_ethtool_gchannels: Int = 60
+data linux_eopnotsupp: Int = 95
+
+type LinuxEthtoolChannels
+  = LinuxEthtoolChannelsRead { combined: Int }
+  | LinuxEthtoolChannelsUnsupported
+  | LinuxEthtoolChannelsUnreadable { cause: NonEmptyStr }
+
+fn linux_ethtool_channels_program() -> PythonProgramText {
+  join([
+    "import array, fcntl, socket, struct, sys",
+    "name = sys.argv[1]",
+    "assert struct.calcsize('P') == 8 and array.array('I').itemsize == 4",
+    "encoded = name.encode('ascii')",
+    "assert 0 < len(encoded) < 16 and chr(0) not in name",
+    concat("channels = array.array('I', [", concat(to_string(linux_ethtool_gchannels), "] + [0] * 8)")),
+    "with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:",
+    "    request = struct.pack('16sP', encoded, channels.buffer_info()[0]).ljust(40, bytes([0]))",
+    "    try:",
+    concat("        fcntl.ioctl(sock.fileno(), ", concat(to_string(linux_siocethtool), ", request)")),
+    "    except OSError as error:",
+    "        print('errno:' + name + ':' + str(error.errno))",
+    "    else:",
+    "        print('channels:' + name + ':' + ':'.join(str(x) for x in channels))",
+  ], "\n") as PythonProgramText
+}
+
+fn linux_ethtool_channels_command(device: NonEmptyStr) -> ArgvCommand {
+  let words = python_run_program_argv(program: linux_ethtool_channels_program())
+  argv_command(program: python_program(), arguments: words.skip(n: 1) + [device as String])
+}
+
+// Eliminate first() by a match, following optional_equality_answers_by_representation:
+// the seed's raw optional carrier cannot be compared with a Present literal.
+fn linux_ethtool_channels_decode(device: NonEmptyStr, text: String) -> LinuxEthtoolChannels {
+  let fields = split(s: trim(s: text), delimiter: ":")
+  let prefix = concat("channels:", concat(device as String, ":"))
+  if trim(s: text) == concat("errno:", concat(device as String, concat(":", to_string(linux_eopnotsupp)))) {
+    LinuxEthtoolChannelsUnsupported
+  } else if fields.count() == 11 && starts_with(s: trim(s: text), prefix: prefix) {
+    let numbers = fields.skip(n: 2)
+    let valid = all(numbers, word => string_length(s: word) > 0 && string_length(s: word) <= 10
+      && all(chars(word), cp => cp >= 48 && cp <= 57)
+      && (match parse_int(s: word) { Present { value: n } => n >= 0 && n <= 4294967295 Absent => false }))
+    let command_matches = match numbers.first() {
+      Present { value: command } => command == to_string(linux_ethtool_gchannels)
+      Absent => false
+    }
+    if !valid || !command_matches {
+      LinuxEthtoolChannelsUnreadable { cause: "ETHTOOL_GCHANNELS returned malformed fields or another command" as NonEmptyStr }
+    } else { match numbers.last() {
+      Present { value: last } => match parse_int(s: last) {
+        Present { value: count } => LinuxEthtoolChannelsRead { combined: count }
+        Absent => LinuxEthtoolChannelsUnreadable { cause: "ETHTOOL_GCHANNELS combined count is malformed" as NonEmptyStr }
+      }
+      Absent => LinuxEthtoolChannelsUnreadable { cause: "ETHTOOL_GCHANNELS combined count is missing" as NonEmptyStr }
+    } }
+  } else { LinuxEthtoolChannelsUnreadable { cause: concat("ETHTOOL_GCHANNELS read refused: ", trim(s: text)) as NonEmptyStr } }
+}
+
+fn linux_ethtool_channels_observe(device: NonEmptyStr) -> LinuxEthtoolChannels {
+  match run_shell_command_observe_outcome(command: linux_ethtool_channels_command(device: device), transport: LocalExec) {
+    ProcessRan { observation } => if observation.exit_code == 0 {
+      linux_ethtool_channels_decode(device: device, text: observation.stdout)
+    } else { LinuxEthtoolChannelsUnreadable { cause: "ETHTOOL_GCHANNELS reader could not execute successfully" as NonEmptyStr } }
+    ProcessNotSpawned { program: _, cause } => LinuxEthtoolChannelsUnreadable { cause: cause }
+  }
+}