access layer: POSIX accounts + BMC Redfish roles as least-privilege RBAC - #5571

…nly validation

Models the onboarding of the operator's new Altra server (BMC 192.168.1.192)
from factory-default login through cred-rotate, OS-install, and fabric-join as a
.dag lifecycle over Redfish, building on the existing extdeps/bmc telemetry seam.

- extdeps/bmc/types.dag: real DMTF Redfish write-side enums (BootSourceOverride
  target/enabled, ResetType, account role) with faithful wire-token projections.
- extdeps/bmc/http.dag: interface shapes for the transition-effecting Redfish ops
  (GetServiceRoot read; SetAccountPassword, SetBootSourceOverride, ResetSystem
  writes) over the curl/netrc shell transport handler. Secrets ride a runtime
  request_body_file, never argv or the repo.
- gunbc/bmc_onboarding.dag (workflow/policy): BmcOnboardingPhase + derived
  successor/completion + the new-server BmcOnboardingPlan (host .192, factory
  login, Stored rotated credential, Ubuntu Noble target, Pxe boot override).
- gunbc/tools/bmc_onboard.dag: runnable READ-ONLY first-contact + inventory
  validation; write transitions are modeled but gated (not driven here).
- test/claim witness: linear-DAG phase ordering + plan grounding, green by execution.

Grounded against the live BMC at 192.168.1.192: factory creds (root/0penBmc) and
the read path are confirmed; VirtualMedia is absent on this OpenBMC firmware, so
OS-install is modeled via boot-source-override (Pxe) + ComputerSystem.Reset.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bmc_onboarding_next_phase is now the sole authority for the linear successor
relation; the standalone bmc_onboarding_phase_order list duplicated it. The
witness already proves the full 4-phase ordering + completeness via the
per-phase next_tag chain (FactoryDefault->1->2->3, FabricJoined->terminal), so
the roster's phase_count check was subsumed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… name, §5)

The tool only performs the read-only FactoryDefault validation (GetServiceRoot +
GetSystem); it does not drive cred-rotate/OS-install/fabric-join. Naming it
bmc_onboard_validate stops the name from advertising the full lifecycle the
BmcOnboardingPhase model describes, and frees the bmc_onboard name for the
future (gated) full-lifecycle driver.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…): model

…ate)

The predicate had one caller (the witness) and the witness's next_tag chain
already proves completion (FabricJoined -> -1 = terminal; others -> 1/2/3).
Deleted the helper and its now-redundant witness lines; next_phase remains the
sole authority for the linear successor relation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Model the credentialing leaves in the existing access layer (DESIGN.md §2/§3):
- extdeps/access/posix.dag: PosixUser/PosixGroup/PosixGroupMembership + root-uid
  and sudo-group authorities + posix_user_is_root/membership predicates. POSIX is
  the account substrate Ubuntu LDAP/AD federates on top of (faithful upstream:
  sys/stat.h anchor already present).
- extdeps/bmc/access.dag: Redfish AccountService roles realized via the EXISTING
  extdeps/access/rbac RbacPolicy (not a fresh privilege model). role->privilege
  grounded from the live .192 probe (Administrator/Operator/ReadOnly DMTF
  privilege sets). redfish_role_name projects the faithful DMTF role tokens.
- test/claim/access_layer_extension_witness_test.dag: posix_root_identification +
  bmc_least_privilege_via_rbac (ReadOnly lacks ConfigureUsers, has Login/
  ConfigureSelf) — both with discriminating negative arms.

Stacked on #5563 (needs RedfishAccountRole from extdeps/bmc/types).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… enum

Addresses claude-opus-4-7 REQUEST_CHANGES (review 31850):
- Delete redfish_role_name (byte-identical nickname of the existing
  redfish_account_role_wire in extdeps/bmc/types.dag) — §3 single authority.
  access.dag + witness now import and reuse redfish_account_role_wire.
- Ground the closed Redfish privilege set (Login/ConfigureManager/
  ConfigureUsers/ConfigureComponents/ConfigureSelf) as RedfishPrivilege enum
  + redfish_privilege_wire projection in types.dag, exactly as RedfishAccountRole
  does (§4 grounding). Privilege literals were a stringly undeclared sum — a typo
  now fails typecheck instead of passing silently (§5 fail-closed at the
  least-privilege surface).
- Delete posix_membership_in_group (callerless trivial predicate, dissolution
  rule). posix_user_is_root kept (encapsulates posix_root_uid authority).

Witnesses green by execution; whole-tree compile 429/0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…nto session/neat-boar-71-acqcreds