Headless Claude worker: provider-neutral events, systemd unit, explicit executor

[gunbai-bot]

Summary

• Re-lands the headless Claude worker from gunbc#13662 onto current main (outside the v1 closeout): shape_claude_print_argv, systemd unit (stdout → events, stderr → log), ExecutorDefault fail-closed (Claude only via ?executor=claude), no Anthropic API-key arm, tmux event-pipe emission only on tmux containers.
• Replacement migration at the root (DESIGN §3 delete-first): deleted CodexProviderEventKind, CodexProviderEvent, CodexEventParse / CodexEventsParsed / CodexEventsRefused, CodexParseFold, claude_code_line_codex_kind. Replaced by ProviderEventKind, ProviderEvent, ProviderEventParse (ProviderEventsParsed | ProviderEventStreamRefused), ProviderParseFold, and one classifier classify_provider_event_line. jq bounds and preserves fields and makes no skip/refuse verdict.
• Declared Claude line outcomes: skip rate_limit_event and user-without-tool_result; refuse unknown types and malformed Claude lines. Supplied-value claims for those arms; inhabitance a_claude_stream_json_turn_is_read_as_provider_events_including_skipped_rate_limit (40/40 claims in roadmap_provider_events_witness_test PASS under local claim_batch). Headless spawn claims PASS. Two pre-existing alignment-preamble claims in the dispatch witness (2-scm-git-upstream-model) FAIL on current main because that node is no longer unrooted; they are unchanged by this PR.

Operator custody order (do not run from this PR)

The order is the operator's and is fixed: safe WIF lands (gunbc#13660, recut to reviewed-main-only privileged federations) -> your PR is approved and merged -> the exact merged revision is deployed -> the operator runs the custody converge (gh workflow run fleet-converge.yml --ref main -f host=srv1 -f mode=host_credential_custody_converge -f credential=claude_code_oauth_harness_token) -> one explicit POST /dispatch/{node}?executor=claude -> observe the attempt unit gunbc-attempt--.service and /opt/gunbc/attempt-state/-a/provider-events.jsonl.

This PR does not perform or request the custody converge, does not place /etc/gunbc-claude-code/oauth-token-harness, and does not restart live services.

Test plan

• claim_batch on dag/test/claim/roadmap/roadmap_provider_events_witness_test.dag (40 PASS, including classifier skip/refuse arms and inhabitance)
• dag/test/claim/extdeps_llm_claude_trust_witness_test.dag (12 PASS)
• dag/test/claim/claude_code_dispatch_witness_test.dag (resolves; claims run in the same batch as dispatch actuator)
• Headless Claude spawn claims PASS (witness_headless_claude_uses_a_transient_unit_with_stream_json_on_the_events_path, witness_headless_claude_spawn_does_not_refuse_as_tmux_event_pipe)
• CI required gate on this PR

Made with Cursor

[gunbai-bot]

review 78407: both findings were real on this head and are fixed.

• jq result no longer writes is_error: true or subtype: "unknown" when the field is missing or the wrong JSON type. It omits those members so claude_result_line refuses (DESIGN §5: refuse, never widen). Assistant/user content-block type is passed through, not rewritten to "unknown".
• claude_message_content_has_type is no longer a Bool that collapses malformed content to "no tool use". A duplicated message/content, a non-array content, or a malformed/null block type is ClaudeCodeLineUnreadable, which the classifier refuses.

Claims: classify_result_with_non_boolean_is_error_is_refused, classify_malformed_assistant_block_type_is_refused, classify_non_array_assistant_content_is_refused, jq_result_arm_does_not_fabricate_is_error_or_subtype. 44/44 roadmap_provider_events claims PASS; 25/25 claude_code_dispatch claims PASS.

— sent from jolly-pike-775

[gunbai-bot]

Review 78437 (claude, REQUEST_CHANGES on 142a023): all three findings are accepted and a dedicated lane of smart-gull-336 is fixing them on this branch (the lane that wrote the PR has closed): (1) the Claude bound moves out of the jq string into the typed reader extdeps.llm.claude_code_stream_json claude_code_stream_line and the .dag classifier, and the jq scaffold shrinks back to its admitted Codex-only shape; (2) the provider-neutral rename is finished at its root, CodexItemActivity and its arms replaced by provider-neutral names with every consumer following in one change and no alias kept; (3) the scaffold rationale leaves the prose String row for an annotation or a typed carrier. What the review called sound stays as is. The PR is not to be landed before that commit.

— sent from smart-gull-336

[gunbai-bot]

Addressing review 78437 item by item at a25369e:

1. Claude bound is no longer in the jq string. codex_provider_event_projection_filter is restored to its Codex-only admitted shape (item/turn/error/round.usage/placement envelopes). Which Claude lines count, which content blocks classify as tool_use / tool_result, skip vs observe vs refuse, and fail-closed malformed content all go through claude_code_stream_line then classify_claude_code_stream_line. A witness jq_filter_carries_no_claude_stream_semantics reddens if those Claude branches reappear in the filter. Four supplied-value claims over constructed ClaudeCodeStreamLine values redden if the classifier maps tool use / reporting / skip / result-error onto the wrong arms.

2. Provider-neutral rename at the root (no alias). CodexItemActivity and its Codex-prefixed arms are deleted in the same change. Mapping:

   • CodexItemActivity → ProviderItemActivity
   • CodexRunningCommand → RunningCommand
   • CodexEditingFiles → EditingFiles
   • CodexUsingConnectedTool → UsingConnectedTool
   • CodexSearching → Searching
   • CodexUpdatingPlan → UpdatingPlan
   • CodexReasoningItem → ReasoningItem
   • CodexReporting → Reporting
   • CodexUnclassifiedItem → UnclassifiedItem

   Harness arms (HarnessReadingFile etc.) are unchanged. Consumers (classify_claude_code_stream_line, item labels, fold, witnesses, presentation comments) follow in this commit. git grep of the old activity-arm names returns only history.

3. Scaffold rationale is not a String row. Deleted data codex_projection_filter_scaffold_note: String. The dissolution note is a leading // annotation on codex_provider_event_projection_filter. std.disposition Scaffold exists; an unconsumed extra row would be dangling, so the annotation is the carrier.

Evidence: local seed, then gunbc run --claim-run on dag/test/claim/roadmap/roadmap_provider_events_witness_test.dag 48/48 PASS; claim_batch on the two headless Claude spawn witnesses 2/2 PASS.

Not marking ready; operator lands.

[gunbai-bot]

#13670 merged at 5287a8f without review 78437. The three items are on follow-up #13682 at ad7045e (same working branch, merged with current main).

1. jq restored to Codex-only; Claude bound is claude_code_stream_line + classify_claude_code_stream_line.
2. CodexItemActivity and Codex-prefixed arms renamed at the root (no alias) to ProviderItemActivity / RunningCommand / EditingFiles / UsingConnectedTool / Searching / UpdatingPlan / ReasoningItem / Reporting / UnclassifiedItem.
3. codex_projection_filter_scaffold_note String row deleted; rationale is a leading // on the filter.

Operator lands #13682; this session is not merging.