A2 reader: snapshot take requires the custody export receipt

[gunbai-bot]

Summary

• dispatch_credential_snapshot_take requires the root-published export receipt (no fallback). Directory authority is established first (publisher-owned, no group/other write). The receipt is lstat'd as a regular file, then opened once; owner, mode and bytes come from that descriptor (extdeps.posix.sh_invocation posix_sh_receipt_object_command / posix_sh_receipt_object_body_program: wrapper exec < "$0", body stat -L of /dev/stdin then cat). Residual: after the directory is admitted, only the publisher can swap the path between lstat and open.
• Version join admits declared.secret.project == fleet_secrets_project_id first (SnapshotReceiptSecretProjectMismatch), then resolve_returned_version against fleet_secrets_project_number unchanged: only SecretRefVersionResolvedExact admits.
• Metadata remains a coproduct (SnapshotReceiptObservedNotRegular | SnapshotReceiptObservedRegular { … }). Claude guard yields the declaration. Custody leaf is data only.
• Pairing: the claim runs the production export planner and the receipt-publication steps, then the real take. It creates the fixture custody file directly and supplies placement_settled: true. It is not a full remote-converge test.
• Claude OAuth ref is pinned to version 1, same shape as Cursor. Last srv1 custody run (2026-10-10, run 38086667921 / job 114315569214) resolved projects/582015116396/secrets/claude-code-oauth-harness/versions/1. admit_enrollment_secret_version already refuses latest. IAM grant is per secret (fleet_secret_accessor_roster), not per version. The operator confirms the intended exact version. Custody's receipt must agree with it. If the observed version differs, landing remains blocked until the intended version is explicitly selected and the declaration and custody are brought into agreement.

Landing gates

Claude/srv1 receipt and exact-head CI are satisfied. Cursor/srv2 receipt remains a mandatory C1 activation precondition; until it exists, Cursor snapshot acquisition refuses typed with no fallback.

Cursor activation chain: operator IAM bootstrap → approved gcp-iam-converge → srv2 Cursor custody converge → export receipt readback → C1 live entitlement trip. A missing or mismatched receipt must keep C1 from starting the provider.

• Claude / srv1 read back. Run 38488382866 (job 115610565363), dispatched from main c6b72a3ead: export=PUBLISHED path=/etc/gunbc-claude-code/oauth-token-harness.gunbc-export-receipt sm_version=projects/582015116396/secrets/claude-code-oauth-harness/versions/1 digest=01062ea8d5e193fa4b0ddf78c74b9a922dbe5cb113a9b2a5676c4dd1f7946028, with custody=HELD, content=identical-to-sm-version, dir=owner=root:briansrls mode=0750. The version agrees with the pinned 1.
• Cursor / srv2. C1 precondition, not a merge gate (side chat ruling: LAND at c38fd21aa8d by squash onto current main).

Test plan

• One remote build-and-run on this head (https://app.buildbuddy.io/invocation/714776e2-1cfd-4cea-861a-86a3bfe3ccc0), all PASS: test.claim.dispatch_credential_snapshot_wet_witness (33, the replacement / FIFO / /dev/null / timeout / directory-order / project REDs among them), pairing the_real_take_accepts_the_production_export_publication, snapshot_receipt_metadata_witness (8), src/v2/test/claim/bash_command_fold.dag (63).
• Heal on c38fd21aa8d: passed.
• Required witnesses on c38fd21aa8d: SUCCESS, https://github.com/gunb-ai/gunbc/actions/runs/38466782474/job/115573267445 (attempt 2, srv4; earlier attempts were cancelled at the 90-minute job cap on srv3).

Prior receipts on earlier heads remain in the conversation (coproduct, version join, rebase onto std.live_tree).

Mutation table (this head, same remote dispatch)

Mutant	Discriminating claim	What the mutant observed
(a) Body stats "$0" instead of /dev/stdin	a_replaced_receipt_does_not_authenticate_held_writable_bytes	object run exits 0; join returns SnapshotReceiptJoined over the held bytes, so the RED fails because the take accepted
(b) Directory decision moved after the custody read	a_group_writable_directory_refuses_before_the_custody_read	refuses SnapshotCustodyUnreadable; RED fails
(c) Open-file kind check dropped	a_character_device_on_held_stdin_is_not_a_regular_receipt	/dev/null is not refused; RED fails
(d) lstat pre-check dropped	a_fifo_at_the_receipt_path_refuses_without_waiting	refuses SnapshotReceiptReadTimedOut after about 5s; RED fails, no hang
(e) Fleet-project admission dropped	a_foreign_declared_project_refuses_a_fleet_number_receipt / a_declared_foreign_project_refuses_a_fleet_number_receipt	inverse RED fails

Side chat: source APPROVE at c38fd21aa8d; then LAND by squash onto current main, with no branch update or CI rerun.

Composition at merge (main dfa83f4baf): independent. Since the merge base, three PR files also changed on main (extdeps.exec.command, v2.extdeps.languages.bash, gunbc.roadmap.roadmap_dispatch_actuator), in disjoint regions; no added line uses the symbols #13882 moved. #13803 (v2 parser) changes no PR file. Its next-line [ rule applies only after an operand, and the PR's two line-leading list literals follow join(. Its lambda-body sealing only widens what parses. git merge-tree is clean.

Head: c38fd21aa8d4b00ec81d35c8f13b8274800a47d5

[gunbai-bot]

Addressed review 79272 (dashboard-only REQUEST_CHANGES):

• join_snapshot_receipt_fields now compares receipt.host to SnapshotCustodyDeclaration.host (same HostIdentity). Wet control a_receipt_for_another_host_refuses_the_host is green: https://app.buildbuddy.io/invocation/7ca39fef-8752-4e16-adee-fbafab2089d5
• Receipt directory must be owned by the declared publisher (SnapshotReceiptDirectoryWrongOwner) before the group/other-writable check. A reader-owned 0755 directory no longer passes.
• Residual unchanged: attempt.instance.host_identity is still NonEmptyStr and is not string-compared to HostIdentity.

Do not merge: landing still waits on srv1/srv2 receipt read-back.

[gunbai-bot]

review 79272 (on eccf863) is addressed on the current head cf33201.

1. Host: join_snapshot_receipt_fields now refuses SnapshotReceiptHostMismatch when receipt.host is not declared.host (same HostIdentity). Wet: a_receipt_for_another_host_refuses_the_host — https://app.buildbuddy.io/invocation/7ca39fef-8752-4e16-adee-fbafab2089d5
   Residual kept: attempt.instance.host_identity is NonEmptyStr and is still not compared to HostIdentity.

2. Directory: observe_snapshot_receipt_directory now stats the directory owner and refuses SnapshotReceiptDirectoryWrongOwner unless it is the declared publisher, then still refuses group/other write as SnapshotReceiptDirectoryReaderWritable. A reader-owned 0755 directory cannot pass.

— sent from clever-hawk-741

[gunbai-bot]

review 79277 asked for the SecretRef join to go through resolve_returned_version and for a foreign-project wet RED. That is on head c9a4d05dc62.

snapshot_receipt_version_agrees (id-segment split) is gone. snapshot_receipt_version_join calls resolve_returned_version(returned: receipt.sm_version, ref: declared.secret, project_number: fleet_secrets_project_number):

• SecretRefVersionResolvedExact admits
• SecretRefVersionResolvedAlias is SnapshotReceiptSecretRefNotPinned (declared ref is not pinned)
• SecretRefVersionResolutionRefused is SnapshotReceiptVersionMismatch

The foreign-project wet RED is a_receipt_naming_the_secret_in_another_project_refuses_the_version: same secret id and version 1 under projects/999999999999/... must be SnapshotReceiptVersionMismatch. Executed wet on https://app.buildbuddy.io/invocation/3bab4aaa-31f9-4e66-ba72-8b2f2bf9803e

— sent from clever-hawk-741

[gunbai-bot]

review 79347: both findings are on head db42cb352cf.

1. SnapshotReceiptObservedMetadata is now a coproduct: SnapshotReceiptObservedNotRegular | SnapshotReceiptObservedRegular { file_owner, file_mode, dir_owner, dir_mode }. The kind tag, snapshot_receipt_zero_mode, and snapshot_receipt_not_regular_observation (empty owners) are gone. Symlink and other non-regular stat arms return SnapshotReceiptNotRegularFile directly, so a later edit cannot match “regular” fields on a not-regular observation.

2. SnapshotReceiptDirectoryReaderWritable is SnapshotReceiptDirectoryGroupOrOtherWritable. The refusal text is “writable by group or other”, matching snapshot_mode_group_or_other_writable_bits (group or other write), not “writable by the declared reader”.

Hermetic metadata claims: https://app.buildbuddy.io/invocation/62c8a69e-3ef8-4ea2-ab24-f2a0572ac060 (4 PASS).

Do not merge: landing still waits on srv1/srv2 receipt read-back.

— sent from clever-hawk-741

[gunbai-bot]

Addressed review 79442 (dashboard artifact /api/reviews/79442/artifacts/stdout.log).

1. Path parent: deleted snapshot_path_dirname (quadratic concat walk). The take uses std.filesystem.path_parent_directory (linear reverse/list_tail). gunbc.live_deploy.emit path_parent_dir now calls that same function.

2. Stdin redirect: posix_sh_receipt_object_program is emitted through the bash grammar. Added bash_build_with_redir_from_file / ^bash_production_fold_redir_from_file (same shape as the existing to-file redirect). Golden: bash_fold_with_redir_from_file_var_holds. The replacement fixture still uses the body program only; production opens via exec redirected from $0.

— sent from clever-hawk-741

[gunbai-bot]

review 79454

The unused-helper claim was stale on this head: posix_sh_receipt_object_body_program is called from a_replaced_receipt_does_not_authenticate_held_writable_bytes and a_character_device_on_held_stdin_is_not_a_regular_receipt (the wrapper/body split). Those REDs have to emit the body without exec < "$0".

The duplication of the stat && cat statement was real. posix_sh_receipt_object_body_stmt is now the single Node; both emit functions use it (6e9f9bf3360).

[gunbai-bot]

review 79460

Body program. On this head posix_sh_receipt_object_body_program is called from the replacement RED and the character-device RED (dispatch_credential_snapshot_wet_witness). Production cannot call that string emit as a statement; both emit functions now share posix_sh_receipt_object_body_stmt (6e9f9bf3360). A grep of only sh_invocation.dag will still miss the consumers.

path_parent_dir. Deleted. The three emit sites and the live_deploy emit witness call std.filesystem path_parent_directory (440b424b18f).

/foo remainder / not "". Intended. path_parent_directory_drops_the_last_segment pins path_parent_directory("/receipt") == "/". Belt and frontend walks still return "" for a relative basename (README.md); that is a different remainder, and their cutover trigger is those consumers admitting the root — recorded on path_parent_directory, not as a silent alias.