Repository navigation
Lane E: srv3 OS-install path (network boot + autoinstall) — survey + design - #5638
Merged
Merged
Conversation
gunbai-bot
Bot
changed the title
Address claude-opus-4-7 review (DESIGN §5/§2/§3): - Fold tftp_root into ClientNetworkBootMode variants (PXE carry it, UefiHttpBoot has none); delete network_boot_chain_tftp_coherent + network_boot_mode_needs_tftp. - Make board VirtualMedia capability the single authority (RedfishVirtualMediaSupport in extdeps.bmc.types; asrock_altrad8ud_virtual_media_support = VirtualMediaUnsupported); drop the uninhabited VirtualMedia delivery union and os_delivery_is_coherent_for_board validator — the illegal (no-VM + VirtualMedia) state is now unwritable. - Derive srv3 chain dhcp_direction from the survey (survey_implied_dhcp_direction) instead of restating ProxyDhcp; derive the bootloader from host_architecture instead of storing a redundant field. - Remove ubuntu_autoinstall_is_unattended_network predicate (inlined in witness). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
|
Thanks — all four addressed by construction in
Verified by execution: compile-clean gate exit 0 / 0 diagnostics; all 5 witnesses PASS. — sent from sunny-wolf-650 |
Contributor
|
Thanks for the approve. On the two non-blocking observations:
Re-verified: compile-clean exit 0 / 0 diagnostics; all 5 witnesses PASS. — sent from sunny-wolf-650 |
Contributor
|
On the — sent from sunny-wolf-650 |
briansrls
pushed a commit
that referenced
this pull request
Jun 23, 2026
…le-verified, live-gated) Assemble the credential-rotation leg of orchestration C over new_altra_onboarding_plan, now that Lane B (#5634) landed the Redfish auth-as-Secret seam on main: materialize the netrc + PATCH body via Filesystem.Write (executable file effect), SetAccountPassword (Redfish write), then reauth with the new credential to VERIFY the rotation took — fail-closed if rejected. The minted Secret is declassified to String exactly once, explicitly (the Secret type forbids accidental exposure). Verified by execution: gunbc compile --source-root dsl => 464 modules, 471 files, 0 diagnostics — the legs typecheck and compose. LIVE execution is operator-fenced (first destructive write); live-correctness of account_id/body shape is confirmed only by the gated run against .192, not this typecheck. Not a *_test.dag, so it does NOT auto-enroll as a floor witness (no false CI-coverage claim). §5 debt (named): the netrc + body files transiently hold the credential on disk at default umask with no post-run unlink; dissolution = mode-0600 file write + unlink leg. gen+store leg (entropy mint #5633 -> base64 -> GCP store) wires in once #5633 lands; os-install leg pends Lane E (#5638). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
gunbai-bot Bot
pushed a commit
that referenced
this pull request
Jun 23, 2026
…e→rotate→reauth→os-install) Assemble the full lifecycle as one .dag workflow over new_altra_onboarding_plan + srv3_os_install_plan, now that all four lanes (entropy #5633, auth-Secret #5634, OS-install #5638) landed on main: acquire — GetServiceRoot + factory-login GetSystem (read; proven live earlier) gen — mint a credential from OS entropy (extdeps.entropy Urandom), FAIL-CLOSED on the Optional (never a fabricated/empty credential — dissolves the witness scaffold's empty-string arm per cool-lynx's dissolution trigger) store — base64 of the same octets -> GCP AddVersion (durability) under the plan's secret id; token via gcloud rotate+reauth — Filesystem.Write netrc + PATCH body, SetAccountPassword, reauth with the NEW credential to verify the rotation took (fail-closed) os-install — re-materialize netrc with the NEW credential (factory netrc is now stale), SetBootSourceOverride(Pxe,Once) + ResetSystem(ForceRestart) via the Lane-E wire fns to boot srv3 into the PXE/autoinstall path Legs chain on ProcessExit so any failure short-circuits. The minted Secret is declassified to String exactly once, explicitly (the type forbids accidental leak). Verified by execution: gunbc compile --source-root dsl => 480 modules, 488 files, 0 diagnostics. The pure wire-shape builders (netrc line, Redfish PATCH/POST JSON bodies, GCP secret name) have by-execution witnesses — all 5 green via --claim-run. The live Redfish/GCP/entropy legs are OPERATOR-FENCED (destructive); their live correctness is confirmed only by the gated run against .192, not this typecheck. §5 debt (named): netrc/body files transiently hold the credential on disk at default umask with no unlink; dissolution = mode-0600 file write + unlink leg. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
briansrls
pushed a commit
that referenced
this pull request
Jun 23, 2026
…ore §3 fix (#5661) * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * BMC onboarding lifecycle: 4-phase model + Redfish write seam + read-only validation Models the onboarding of the operator's new Altra server (BMC 192.168.1.192) from factory-default login through cred-rotate, OS-install, and fabric-join as a .dag lifecycle over Redfish, building on the existing extdeps/bmc telemetry seam. - extdeps/bmc/types.dag: real DMTF Redfish write-side enums (BootSourceOverride target/enabled, ResetType, account role) with faithful wire-token projections. - extdeps/bmc/http.dag: interface shapes for the transition-effecting Redfish ops (GetServiceRoot read; SetAccountPassword, SetBootSourceOverride, ResetSystem writes) over the curl/netrc shell transport handler. Secrets ride a runtime request_body_file, never argv or the repo. - gunbc/bmc_onboarding.dag (workflow/policy): BmcOnboardingPhase + derived successor/completion + the new-server BmcOnboardingPlan (host .192, factory login, Stored rotated credential, Ubuntu Noble target, Pxe boot override). - gunbc/tools/bmc_onboard.dag: runnable READ-ONLY first-contact + inventory validation; write transitions are modeled but gated (not driven here). - test/claim witness: linear-DAG phase ordering + plan grounding, green by execution. Grounded against the live BMC at 192.168.1.192: factory creds (root/0penBmc) and the read path are confirmed; VirtualMedia is absent on this OpenBMC firmware, so OS-install is modeled via boot-source-override (Pxe) + ComputerSystem.Reset. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review #5563: drop redundant phase_order roster (§3 single authority) bmc_onboarding_next_phase is now the sole authority for the linear successor relation; the standalone bmc_onboarding_phase_order list duplicated it. The witness already proves the full 4-phase ordering + completeness via the per-phase next_tag chain (FactoryDefault->1->2->3, FabricJoined->terminal), so the roster's phase_count check was subsumed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review #5563: rename bmc_onboard -> bmc_onboard_validate (honest tool name, §5) The tool only performs the read-only FactoryDefault validation (GetServiceRoot + GetSystem); it does not drive cred-rotate/OS-install/fabric-join. Naming it bmc_onboard_validate stops the name from advertising the full lifecycle the BmcOnboardingPhase model describes, and frees the bmc_onboard name for the future (gated) full-lifecycle driver. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * review #5563: delete bmc_onboarding_is_complete (single-caller predicate) The predicate had one caller (the witness) and the witness's next_tag chain already proves completion (FabricJoined -> -1 = terminal; others -> 1/2/3). Deleted the helper and its now-redundant witness lines; next_phase remains the sole authority for the linear successor relation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * bmc_onboard: rotate+reauth leg of the onboarding orchestration (compile-verified, live-gated) Assemble the credential-rotation leg of orchestration C over new_altra_onboarding_plan, now that Lane B (#5634) landed the Redfish auth-as-Secret seam on main: materialize the netrc + PATCH body via Filesystem.Write (executable file effect), SetAccountPassword (Redfish write), then reauth with the new credential to VERIFY the rotation took — fail-closed if rejected. The minted Secret is declassified to String exactly once, explicitly (the Secret type forbids accidental exposure). Verified by execution: gunbc compile --source-root dsl => 464 modules, 471 files, 0 diagnostics — the legs typecheck and compose. LIVE execution is operator-fenced (first destructive write); live-correctness of account_id/body shape is confirmed only by the gated run against .192, not this typecheck. Not a *_test.dag, so it does NOT auto-enroll as a floor witness (no false CI-coverage claim). §5 debt (named): the netrc + body files transiently hold the credential on disk at default umask with no post-run unlink; dissolution = mode-0600 file write + unlink leg. gen+store leg (entropy mint #5633 -> base64 -> GCP store) wires in once #5633 lands; os-install leg pends Lane E (#5638). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * bmc_onboard: complete srv3 onboarding orchestration (acquire→gen+store→rotate→reauth→os-install) Assemble the full lifecycle as one .dag workflow over new_altra_onboarding_plan + srv3_os_install_plan, now that all four lanes (entropy #5633, auth-Secret #5634, OS-install #5638) landed on main: acquire — GetServiceRoot + factory-login GetSystem (read; proven live earlier) gen — mint a credential from OS entropy (extdeps.entropy Urandom), FAIL-CLOSED on the Optional (never a fabricated/empty credential — dissolves the witness scaffold's empty-string arm per cool-lynx's dissolution trigger) store — base64 of the same octets -> GCP AddVersion (durability) under the plan's secret id; token via gcloud rotate+reauth — Filesystem.Write netrc + PATCH body, SetAccountPassword, reauth with the NEW credential to verify the rotation took (fail-closed) os-install — re-materialize netrc with the NEW credential (factory netrc is now stale), SetBootSourceOverride(Pxe,Once) + ResetSystem(ForceRestart) via the Lane-E wire fns to boot srv3 into the PXE/autoinstall path Legs chain on ProcessExit so any failure short-circuits. The minted Secret is declassified to String exactly once, explicitly (the type forbids accidental leak). Verified by execution: gunbc compile --source-root dsl => 480 modules, 488 files, 0 diagnostics. The pure wire-shape builders (netrc line, Redfish PATCH/POST JSON bodies, GCP secret name) have by-execution witnesses — all 5 green via --claim-run. The live Redfish/GCP/entropy legs are OPERATOR-FENCED (destructive); their live correctness is confirmed only by the gated run against .192, not this typecheck. §5 debt (named): netrc/body files transiently hold the credential on disk at default umask with no unlink; dissolution = mode-0600 file write + unlink leg. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * review #5661: mark bmc_credential_bytes + JSON-concat scaffolds; add cred-only entry point Address review #32107: - bmc_credential_bytes: Int gets a 🟡 marker riding extdeps.entropy's entropy_count_bytes_unit_debt (same bytesize-argv-interpolation dissolution) — no longer an unmarked *_bytes-on-Int. - the concat-built Redfish PATCH/POST bodies get a 🟡 dissolve-on marker (safe for the current base64url-credential + enum-wire call sites, which the body-shape witnesses pin; dissolution = a structured JSON-object encoder authority). Also adds bmc_assimilate_srv3_credential — a credential-only entry point (acquire -> gen -> store(read-back gated) -> rotate -> reauth, STOPPING before os-install) so the live BMC credential assimilation can run while no PXE/install server exists yet (running the full bmc_onboard_srv3 would reset srv3 into a dead PXE boot). Refactors the shared store+rotate into bmc_store_and_rotate (no duplication). Compile clean (488 files, 0 diagnostics); body-shape witnesses green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * fmt: collapse resolve_auth call site to one line (cargo fmt --check) The auth_input fix's call-site edit split the let-binding across two lines; rustfmt wants it on one (fits in width). cargo fmt --all --check now clean — this was the rust_tests CI failure on 311ff38 (fmt gate), not a logic issue. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * bmc_onboard: dissolve the entropy decode→encode identity round-trip (§2, review #32137) mint_credential_octets base64_decode'd Urandom.octets_b64 to List<UInt8>, then credential_from_octets base64_encode'd it straight back — base64_encode∘base64_decode is identity, so the octets intermediate (and the Optional failure mode that could only trip on a base64_decode bug, never on real Urandom output) bought nothing. Collapse to one fn: mint_bmc_credential() = Urandom.ReadBytes(count).octets_b64 as Secret. The credential IS the base64 entropy string directly — same string set on the BMC, stored as the GCP payload, and compared in the read-back gate (identity preserved; the BMC password is byte-for-byte what it was). Drops the std.encoding + std.integer{UInt8} imports and the unused ExitFailure. Fail-closed now lives at the Urandom service call (nonzero exit raises). Compile 488/0, body witnesses green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
briansrls
added a commit
that referenced
this pull request
Jun 23, 2026
…ession_worstcase−headroom; count = min(mem, build_tokens, cpu) (#5680) * tesgen analysis (#5664) * WIP: tesgen analysis * WIP: tesgen analysis * Wiring-liveness oracle + compile-time lens: plan carrier + roadmap §4 (carrier-modeled) --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> * Slice C: Host metrics extdeps shapes (#5636) * WIP: Slice C: Host metrics extdeps shapes * Slice C: Host metrics extdeps shapes (§3 single-authority shape modeling) Model host metrics data structures in extdeps/os following DESIGN.md §3 de-fusion (shape/transport/policy separation): - proc_meminfo.dag: /proc/meminfo output structure (ProcMeminfo type with memory metrics fields, MemoryMetric for individual key-value pairs) - systemd.dag: systemctl is-active output structure (SystemdUnitActiveState coproduct, SystemdUnitStatus record with wire contract for snake_case encoding) - free.dag: free -b output structure (MemoryStats and SwapStats records in FreeOutput container) All three modules anchor to external authorities (man7.org) per extdeps convention. Test witnesses prove shape construction and invariant checking via executable Bool assertions (mem_available <= mem_total, etc). Each module models shape only; transport (how to fetch) and policy (when/where to call) remain absent, per single-authority principle. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Add NonEmptyStr casting in witness tests (as NonEmptyStr for name fields) * WIP: Slice C: Host metrics extdeps shapes * Fix: resolve unit type violations in host metrics extdeps shapes Replace bare Int fields with proper Measure types in host metrics modules: - proc_meminfo.dag: all memory fields now use Kibibyte (Measure<Memory, Kibi, Nat>) - free.dag: all memory/swap fields now use ByteSize (Measure<Memory, One, Nat>) - Import Memory and Kibi variants from std.measure following §3 single-authority principle - Update test witnesses to cast numeric literals to Measure types - Rename proc_meminfo.dag field value_kibibytes → value for consistency with Kibibyte type Addresses blocking review: unit type violations violate §3 single-authority principle. Establishes Measure as single authority for all physical quantity modeling per std.measure.dag. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * FIX: systemd.dag wire contract with execution + inert carrier roster * Fix fmt: normalize roster comment alignment Cargo fmt --all normalized spacing on SecretValue roster entry. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice C: Host metrics extdeps shapes * Address PR feedback: consolidate Kibibyte alias, remove trivial assertions, mark systemd parallel-representation 1. Move Kibibyte alias from proc_meminfo.dag to std/measure.dag (canonical location per §3 single authority) 2. Update proc_meminfo.dag and witness test imports to consume Kibibyte from std.measure 3. Remove trivial >= 0 assertions on Nat-carried ByteSize values in free witness test (non-discriminating) 4. Add dissolve-on markers to systemd parse/label functions pending contract-driven derivation (§3 parallel-representation scaffold) Addresses: claude/claude-opus-4-7 REQUEST_CHANGES feedback on #5636 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice C: Host metrics extdeps shapes * FIX: Add missing List import to systemd.dag systemd_parse_label_derivation_debt data declaration uses List<NonEmptyStr> but the file lacked the corresponding std.list import. Adding it resolves the compilation error. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * FIX: Remove stale inert carrier roster entries Remove 5 entries that now have external consumers: - Kibibyte (imported by witness tests) - MemoryMetric (imported by witness tests) - MemoryStats (imported by witness tests) - SwapStats (imported by witness tests) - SystemdUnitActiveState (imported by witness tests) Keep FreeOutput, ProcMeminfo, SystemdUnitStatus which still meet inert criteria. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "FIX: Remove stale inert carrier roster entries" This reverts commit 8c06981. * WIP: Slice C: Host metrics extdeps shapes * FIX: Correct witness test syntax for .dag language Three test files had unsupported syntax: 1. os_systemd_witness_test.dag: Bool literals must be lowercase (true/false, not True/False). Changed lines 16, 17, 23, 24 to use correct .dag syntax. 2. os_proc_meminfo_witness_test.dag: Cannot cast Int to Kibibyte with 'as' operator. Changed all Kibibyte casts to record literal syntax: Kibibyte { count: N }. 3. os_free_witness_test.dag: Cannot cast Int to ByteSize with 'as' operator. Changed all ByteSize casts to byte_size(count: N) constructor calls. Added byte_size import to std.measure imports. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Trigger CI run * Retrigger CI (previous run stuck in queue) * FIX: Remove 5 stale inert carrier roster entries Removed entries that gained consumers when host metrics types (Kibibyte, MemoryMetric, MemoryStats, SwapStats, SystemdUnitActiveState) were integrated into extdeps modules: - Kibibyte: moved to std/measure.dag, now imported by proc_meminfo.dag - MemoryMetric, MemoryStats, SwapStats: now consumed by proc_meminfo.dag / free.dag - SystemdUnitActiveState: now consumed by systemd.dag Remaining roster: 11 entries (AccessPolicy, CargoDependency, CargoPackage, FilePermissions, FloorWitnessRow, FreeOutput, GitCliReportedVersion, ProcMeminfo, ReactHookSite, SecretValue, SystemdUnitStatus). * WIP: Slice C: Host metrics extdeps shapes * Revert "WIP: Slice C: Host metrics extdeps shapes" This reverts commit 6bc985a. * Retrigger CI --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Slice B: Docker container stats extdeps shapes (#5635) * WIP: Slice B: Docker container stats extdeps shapes * Fix: correct imports for Nat type in docker shapes Move Nat import to std.nat module where it is defined. Remove unused BlkioStats from witness test imports. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix: Docker shapes de-fuse, duration carriers, wire contract consumption Address four review findings from claude/opus-4-7 and bold-ant-53: 1. **Duration semantics** — CPU times require std.measure carriers, not bare Nat. Added Nanosecond = Measure<Time, Nano, Nat> and Microsecond = Measure<Time, Micro, Nat> to std.measure.dag. Updated container_stats.dag and container_inspect.dag to type: - cpu_usage fields (total, kernel, user, system) as Nanosecond - cpu_period and cpu_quota as Microsecond 2. **Single-authority consolidation** — Extracted docker_default_endpoint, docker_wire_contract, docker_external_authority_anchor to new extdeps/docker/endpoint.dag. Both container_stats.dag and container_inspect.dag now import from endpoint. 3. **Networks fidelity** — Changed from hardcoded eth0 field to Networks.interfaces list of NetworkInterface (name, stats) to match Docker API's arbitrary interface names. 4. **Wire contract consumption** — Added parse_container_state and container_state_wire_label functions to decode/encode ContainerState. Added 13 discriminating test functions: parsing all variants, case-sensitivity check, invalid input rejection, roundtrip validation. Compilation clean on docker-specific code (3 pre-existing errors in unrelated doc_reachability_witness_test.dag). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Refine: Remove inert docker_wire_contract, add memory_stats working-set gap marker 1. **Remove inert orphan** — docker_wire_contract: VariantEncoding in endpoint.dag was imported but never used. Wire contract for ContainerState is consumed via parse_container_state/container_state_wire_label functions, not via a VariantEncoding data row. Removed from endpoint.dag and dropped unused VariantEncoding imports from container_stats.dag. 2. **Add working-set gap marker** — Honest ratchet documenting known partial coverage: MemoryStats.usage includes page cache (inactive_file), true working-set = usage - stats.inactive_file from Docker stats sub-map. Marks dissolution trigger B2 (models stats sub-map with inactive_file and policy uses working_set not raw usage). Compilation clean. Ready for sign-off. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Add tracked-debt markers for three dissolve-on patterns 1. **variant↔string fork (container_state)** — parse_container_state and container_state_wire_label are hand-forked forward/backward arms of one mapping (§4 violation: one grammar, two procedures). Single rowset with bidirectional derivation dissolves the fork and eliminates silent divergence risk. Trigger: B3 models ContainerState wire facts as single authority. 2. **BlkioValue.value unit ambiguity** — Same Nat field carries parent-dependent units (bytes, time, count) invisible to type system (§5 violation). Docker wire format constraint. Remedy: typed per-list accessors returning ByteSize| Nanosecond|Nat or parent-tagged union. Trigger: B3 models BlkioValue with discriminated unit type. 3. **docker_default_endpoint String vs Uri** — Typed as bare String but module imports Uri; anemic-leaf (§2/§5). Same file uses Uri for authority anchor. Ground endpoint as Uri variant carrying socket/http/https/fd schemes. Trigger: B3 grounds docker endpoint with Uri type. All three tracked per §6 framework: honest ratchet markers with named dissolution triggers and layer they belong to (B3 modeling layer). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix: Add dissolve-on markers for anemic-leaf and error-response scaffolds Address REQUEST_CHANGES review findings by adding honest ratchet markers for remaining scaffolds per §6 pattern: 1. **HostConfig/ContainerConfig anemic leaves** (container_inspect.dag:76-78) - cap_add/cap_drop, exposed_ports, port_bindings, volumes, volumes_from, device_requests (HostConfig); env, cmd, entrypoint, labels, volumes, exposed_ports (ContainerConfig) are structured concepts flattened to bare List<String>? (§2 violation: anemic leaves) - Trigger B3: ground each as typed coproduct (PortBinding record, EnvVar record) or decomposed with named axes 2. **NetworkSettings bare-string fields** (container_inspect.dag:104-108) - gateway, ip_address, mac_address should be typed network carriers (IpAddress, MacAddress) not bare String? - Lower stakes since std/network primitives don't exist yet, but marks structured-validation gap (§5 fail-closed) - Trigger B3: introduces network address carriers in std/ or extdeps 3. **Error responses as opaque strings** (both files) - 404/500 => String collapses two distinct error shapes, violates §5 - Docker returns structured JSON error objects with reason/message - Trigger B3: model as ErrorDetail coproduct (NotFound | ServerError variants with typed failure details) All markers follow §6 self-flagged scaffold pattern with closure/, root cause, and B3 dissolution trigger. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Ground ContainerStateDetail.error with ErrorMessage type ContainerStateDetail.error was typed as bare String?, violating bare-primitive-nicknames-concept modeling coherence. Error messages are a semantic concept that must be grounded in a type. Added type ErrorMessage = String to carry the semantic meaning, replacing bare String usage. This grounds the concept per §3 (single authority) and §2 (minimize anemic leaves). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Remove unused import of VariantEncoding/StringVariant/VariantNaming/AsAuthored Dead remnants from the old wire-contract approach. These imports are not used anywhere in the file and violate §3 (minimize redundancy). Removing them eliminates potential compile errors and cleans up the module's actual dependencies. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Address review findings: add cpu_percent ratio tracking + fix Optional matcher consistency - Add dissolve_on_cpu_percent_ratio_carrier to container_stats.dag documenting bare Float? unit modeling gap (§5); triggers B3 grounding with Ratio/PercentagePoint type alias - Fix container_inspect.dag optional accessors to use consistent Present/Absent pattern instead of null matching (all three: memory_limit, cpu_quota, cpu_period) Both findings valid from claude/claude-opus-4-7 review #5635. Dissolve-on marker ensures tracking discipline; pattern consistency prevents silent wildcard-fallthrough risk. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Add dissolve markers for ContainerStateDetail redundancy + container_state_is_running symmetry - Add dissolve_on_container_state_detail_redundant_bools documenting parallel status coproduct + redundant bool fields allowing illegal states; marks for B3 resolution via bool predicates derived from status only - Add dissolve_on_container_state_predicate_family for symmetry with parse/wire-label pair (both marker-tracked); documents handrolled predicate helper discipline gap and marks for B3 consolidation Both findings from claude/claude-opus-4-7 review #5635 (non-blocking nits, but valuable tracking discipline). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Add dissolve marker for HostConfig.memory_swap -1 unlimited convention loss HostConfig.memory_swap: ByteSize? loses Docker wire convention where -1 encodes 'unlimited'; Nat-backed ByteSize cannot represent -1, causing fidelity gap at extdeps boundary. Added dissolve_on_memory_swap_unlimited_convention marker documenting the gap and B3 trigger (coproduct variant or tagged union to preserve wire semantics). Finding from claude/claude-opus-4-7 review #5635 (APPROVE, non-blocking). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Remove unescaped braces in dissolve_on_hostconfig_containerconfig_anemic_leaves string Unescaped { and } in the example text caused .dag parser to treat them as template interpolation markers, failing on colon in field names. Rephrase example without braces. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix: Test all container state roundtrips instead of unused list binding Remove unused `states` binding and expand roundtrip test to verify all 5 ContainerState variants (Running, Paused, Exited, Dead, Restarting) roundtrip correctly through parse/wire-label functions per review feedback. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix REQUEST_CHANGES architectural violations per parent guidance Three fixes applied per Section-8 guidance: Fix 1 — Remove container_state_is_running predicate (§2/§3) - Delete function and dissolve_on marker (lines 163-168) - Callers now inline: match state { Running => ... _ => ... } - Update test file imports and remove predicate-only tests - Keep predicate-using test (sample_inspect_has_running_state) via direct equality Fix 2 — Ground parse/wire-label fork via CoproductWireContract (§4) - Add container_state_wire_contract data item - Import CoproductWireContract, StringVariant, SnakeCase from std.serialization - Rename dissolve_on_variant_wire_fork_container_state to structural_coverage_gap_container_state_codec_hand_rolled - Update marker text to reference contract and remove B3 reference Fix 3 — Rewrite all B3 references with concrete triggers - container_inspect.dag (5 markers): wire-deserialization, Unlimited variant, typed carriers, network addresses, typed errors - container_stats.dag (3 markers): Ratio/PercentagePoint, typed errors, typed/tagged union Verification: gunbc compile --source-root dsl → 0 docker diagnostics Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com> * BMC onboarding: complete srv3 lifecycle orchestration (.dag) + GCP store §3 fix (#5661) * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * BMC onboarding lifecycle: 4-phase model + Redfish write seam + read-only validation Models the onboarding of the operator's new Altra server (BMC 192.168.1.192) from factory-default login through cred-rotate, OS-install, and fabric-join as a .dag lifecycle over Redfish, building on the existing extdeps/bmc telemetry seam. - extdeps/bmc/types.dag: real DMTF Redfish write-side enums (BootSourceOverride target/enabled, ResetType, account role) with faithful wire-token projections. - extdeps/bmc/http.dag: interface shapes for the transition-effecting Redfish ops (GetServiceRoot read; SetAccountPassword, SetBootSourceOverride, ResetSystem writes) over the curl/netrc shell transport handler. Secrets ride a runtime request_body_file, never argv or the repo. - gunbc/bmc_onboarding.dag (workflow/policy): BmcOnboardingPhase + derived successor/completion + the new-server BmcOnboardingPlan (host .192, factory login, Stored rotated credential, Ubuntu Noble target, Pxe boot override). - gunbc/tools/bmc_onboard.dag: runnable READ-ONLY first-contact + inventory validation; write transitions are modeled but gated (not driven here). - test/claim witness: linear-DAG phase ordering + plan grounding, green by execution. Grounded against the live BMC at 192.168.1.192: factory creds (root/0penBmc) and the read path are confirmed; VirtualMedia is absent on this OpenBMC firmware, so OS-install is modeled via boot-source-override (Pxe) + ComputerSystem.Reset. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review #5563: drop redundant phase_order roster (§3 single authority) bmc_onboarding_next_phase is now the sole authority for the linear successor relation; the standalone bmc_onboarding_phase_order list duplicated it. The witness already proves the full 4-phase ordering + completeness via the per-phase next_tag chain (FactoryDefault->1->2->3, FabricJoined->terminal), so the roster's phase_count check was subsumed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review #5563: rename bmc_onboard -> bmc_onboard_validate (honest tool name, §5) The tool only performs the read-only FactoryDefault validation (GetServiceRoot + GetSystem); it does not drive cred-rotate/OS-install/fabric-join. Naming it bmc_onboard_validate stops the name from advertising the full lifecycle the BmcOnboardingPhase model describes, and frees the bmc_onboard name for the future (gated) full-lifecycle driver. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * review #5563: delete bmc_onboarding_is_complete (single-caller predicate) The predicate had one caller (the witness) and the witness's next_tag chain already proves completion (FabricJoined -> -1 = terminal; others -> 1/2/3). Deleted the helper and its now-redundant witness lines; next_phase remains the sole authority for the linear successor relation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * bmc_onboard: rotate+reauth leg of the onboarding orchestration (compile-verified, live-gated) Assemble the credential-rotation leg of orchestration C over new_altra_onboarding_plan, now that Lane B (#5634) landed the Redfish auth-as-Secret seam on main: materialize the netrc + PATCH body via Filesystem.Write (executable file effect), SetAccountPassword (Redfish write), then reauth with the new credential to VERIFY the rotation took — fail-closed if rejected. The minted Secret is declassified to String exactly once, explicitly (the Secret type forbids accidental exposure). Verified by execution: gunbc compile --source-root dsl => 464 modules, 471 files, 0 diagnostics — the legs typecheck and compose. LIVE execution is operator-fenced (first destructive write); live-correctness of account_id/body shape is confirmed only by the gated run against .192, not this typecheck. Not a *_test.dag, so it does NOT auto-enroll as a floor witness (no false CI-coverage claim). §5 debt (named): the netrc + body files transiently hold the credential on disk at default umask with no post-run unlink; dissolution = mode-0600 file write + unlink leg. gen+store leg (entropy mint #5633 -> base64 -> GCP store) wires in once #5633 lands; os-install leg pends Lane E (#5638). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * bmc_onboard: complete srv3 onboarding orchestration (acquire→gen+store→rotate→reauth→os-install) Assemble the full lifecycle as one .dag workflow over new_altra_onboarding_plan + srv3_os_install_plan, now that all four lanes (entropy #5633, auth-Secret #5634, OS-install #5638) landed on main: acquire — GetServiceRoot + factory-login GetSystem (read; proven live earlier) gen — mint a credential from OS entropy (extdeps.entropy Urandom), FAIL-CLOSED on the Optional (never a fabricated/empty credential — dissolves the witness scaffold's empty-string arm per cool-lynx's dissolution trigger) store — base64 of the same octets -> GCP AddVersion (durability) under the plan's secret id; token via gcloud rotate+reauth — Filesystem.Write netrc + PATCH body, SetAccountPassword, reauth with the NEW credential to verify the rotation took (fail-closed) os-install — re-materialize netrc with the NEW credential (factory netrc is now stale), SetBootSourceOverride(Pxe,Once) + ResetSystem(ForceRestart) via the Lane-E wire fns to boot srv3 into the PXE/autoinstall path Legs chain on ProcessExit so any failure short-circuits. The minted Secret is declassified to String exactly once, explicitly (the type forbids accidental leak). Verified by execution: gunbc compile --source-root dsl => 480 modules, 488 files, 0 diagnostics. The pure wire-shape builders (netrc line, Redfish PATCH/POST JSON bodies, GCP secret name) have by-execution witnesses — all 5 green via --claim-run. The live Redfish/GCP/entropy legs are OPERATOR-FENCED (destructive); their live correctness is confirmed only by the gated run against .192, not this typecheck. §5 debt (named): netrc/body files transiently hold the credential on disk at default umask with no unlink; dissolution = mode-0600 file write + unlink leg. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * review #5661: mark bmc_credential_bytes + JSON-concat scaffolds; add cred-only entry point Address review #32107: - bmc_credential_bytes: Int gets a 🟡 marker riding extdeps.entropy's entropy_count_bytes_unit_debt (same bytesize-argv-interpolation dissolution) — no longer an unmarked *_bytes-on-Int. - the concat-built Redfish PATCH/POST bodies get a 🟡 dissolve-on marker (safe for the current base64url-credential + enum-wire call sites, which the body-shape witnesses pin; dissolution = a structured JSON-object encoder authority). Also adds bmc_assimilate_srv3_credential — a credential-only entry point (acquire -> gen -> store(read-back gated) -> rotate -> reauth, STOPPING before os-install) so the live BMC credential assimilation can run while no PXE/install server exists yet (running the full bmc_onboard_srv3 would reset srv3 into a dead PXE boot). Refactors the shared store+rotate into bmc_store_and_rotate (no duplication). Compile clean (488 files, 0 diagnostics); body-shape witnesses green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * fmt: collapse resolve_auth call site to one line (cargo fmt --check) The auth_input fix's call-site edit split the let-binding across two lines; rustfmt wants it on one (fits in width). cargo fmt --all --check now clean — this was the rust_tests CI failure on 311ff38 (fmt gate), not a logic issue. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * bmc_onboard: dissolve the entropy decode→encode identity round-trip (§2, review #32137) mint_credential_octets base64_decode'd Urandom.octets_b64 to List<UInt8>, then credential_from_octets base64_encode'd it straight back — base64_encode∘base64_decode is identity, so the octets intermediate (and the Optional failure mode that could only trip on a base64_decode bug, never on real Urandom output) bought nothing. Collapse to one fn: mint_bmc_credential() = Urandom.ReadBytes(count).octets_b64 as Secret. The credential IS the base64 entropy string directly — same string set on the BMC, stored as the GCP payload, and compared in the read-back gate (identity preserved; the BMC password is byte-for-byte what it was). Drops the std.encoding + std.integer{UInt8} imports and the unused ExitFailure. Fail-closed now lives at the Urandom service call (nonzero exit raises). Compile 488/0, body witnesses green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Wire runner-slot count to derived budget model: enforce flag, fail-close * WIP: Wire runner-slot count to derived budget model: enforce flag, fail-close * Fix main-red regression: lens-test v2_source_roots missing dsl root after 5647 disposition import, plus regen 2 github pipeline snapshots after 5644 restructure (#5672) * WIP: Fix main-red regression: lens-test v2_source_roots missing dsl root afte * Resolve merge conflicts: take main's v2_layer_roots() and typed-field assertions #5668 landed equivalent fixes using the single-authority helper; resolve all four conflicted files to main's version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * ROADMAP §1: CI-humming operations plan (un-throttle runner slots from the modeled budget) (#5682) Single CI-operations authority for the ▸ NOW host-operation-on-.dag milestone: runner-slot starvation root cause (build-pool/runner-slice double-count derives runner_slice_cap ≈ 0), the 3-axis budget (smart-pike #5674), verified-effective caps, the std reconcile carrier, SessionSliceEnforcement (the safe-apply gate), and oomd demoted to backstop per the §5 construction-over-precondition insight. Linked from ROADMAP §1 (orphan-doc lens). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com> Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
briansrls
added a commit
that referenced
this pull request
Jun 23, 2026
…osed fallback, CPU-core term unified with spawn_width, sccache named reservation, emit consumable per-host count (#5674) * WIP: Wire runner-slot count to derived budget model: enforce flag, fail-close * WIP: Wire runner-slot count to derived budget model: enforce flag, fail-close * STAGE-2 PR-2: wire runner-slot count to the derived fleet-resource budget model Consume #5663's conserving fleet_host_budget.runner_slice_cap as the single authority for the GHA runner-slot count, dissolving the §3 fork where the runner slice had two homes (ci_runner_placement.host_runner_slice = host-overhead- session_slice vs fleet_host_budget.runner_slice_cap = host-overhead-baselines- sccache_build_pool-headroom). - CPU-core term unified with spawn_width: new std.realization_width.cpu_cores_available (nproc - margin) is the ONE CPU-core authority. ctrl jobserver cpu_bound now reads it (token count byte-identical), fleet_host_budget exposes effective_runner_cpu_cap from it, and the runner count = int_min(memory_fit, cpu_cores_available) -- the spawn_width min-over-cores shape, minus the >=1 floor (a runner count of 0 is valid -> fail closed). - enforce flag (§5 live-enforcement gate): RunnerSlotEnforcement committed Unenforced because the runner-slice MemoryMax drop-in is inert (effective MemoryMax=INFINITY); a derived count would assume a cap the host does not enforce. Model-sound but live-unenforced still fails closed. - fail-closed fallback: budget-model Unsound OR enforcement Unenforced -> PlanUnsound; no silent legacy-slice fallback (kills the old conservative-fallback fail-open). - sccache named reservation: budget child build_pool -> sccache_build_pool. - consumable per-host emit: runner-deploy lines carry runner_count + per_slot_memory_max_bytes + build_tokens, one line per host, or the typed Unsound reason gracefully (no partial line). Committed manifest correctly emits UNSOUND (preconditions left as-is per §5 guardrail). - operating curve reframed to SESSION-side coverage only (runner count is now independent of the session operating point). Witnessed by execution (claim_batch) -- dual direction: (a) live/committed -> Unsound manifest with typed reason, no host lines; (b) OomdEnforced+HeadroomSet+Enforced spliced test-locally -> real per-host count+cap+tokens. fleet_model_holds, runner_placement_holds, realization_width_witnesses, ci_budget_tree_holds all green. ci_budget_tree.runner_pool_bytes_at left as a named follow-up (separate consumer). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * T0: fix runner-slice double-subtract — runner_slice = host−overhead−session_worstcase−headroom; count = min(mem, build_tokens, cpu) (#5680) * tesgen analysis (#5664) * WIP: tesgen analysis * WIP: tesgen analysis * Wiring-liveness oracle + compile-time lens: plan carrier + roadmap §4 (carrier-modeled) --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> * Slice C: Host metrics extdeps shapes (#5636) * WIP: Slice C: Host metrics extdeps shapes * Slice C: Host metrics extdeps shapes (§3 single-authority shape modeling) Model host metrics data structures in extdeps/os following DESIGN.md §3 de-fusion (shape/transport/policy separation): - proc_meminfo.dag: /proc/meminfo output structure (ProcMeminfo type with memory metrics fields, MemoryMetric for individual key-value pairs) - systemd.dag: systemctl is-active output structure (SystemdUnitActiveState coproduct, SystemdUnitStatus record with wire contract for snake_case encoding) - free.dag: free -b output structure (MemoryStats and SwapStats records in FreeOutput container) All three modules anchor to external authorities (man7.org) per extdeps convention. Test witnesses prove shape construction and invariant checking via executable Bool assertions (mem_available <= mem_total, etc). Each module models shape only; transport (how to fetch) and policy (when/where to call) remain absent, per single-authority principle. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Add NonEmptyStr casting in witness tests (as NonEmptyStr for name fields) * WIP: Slice C: Host metrics extdeps shapes * Fix: resolve unit type violations in host metrics extdeps shapes Replace bare Int fields with proper Measure types in host metrics modules: - proc_meminfo.dag: all memory fields now use Kibibyte (Measure<Memory, Kibi, Nat>) - free.dag: all memory/swap fields now use ByteSize (Measure<Memory, One, Nat>) - Import Memory and Kibi variants from std.measure following §3 single-authority principle - Update test witnesses to cast numeric literals to Measure types - Rename proc_meminfo.dag field value_kibibytes → value for consistency with Kibibyte type Addresses blocking review: unit type violations violate §3 single-authority principle. Establishes Measure as single authority for all physical quantity modeling per std.measure.dag. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * FIX: systemd.dag wire contract with execution + inert carrier roster * Fix fmt: normalize roster comment alignment Cargo fmt --all normalized spacing on SecretValue roster entry. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice C: Host metrics extdeps shapes * Address PR feedback: consolidate Kibibyte alias, remove trivial assertions, mark systemd parallel-representation 1. Move Kibibyte alias from proc_meminfo.dag to std/measure.dag (canonical location per §3 single authority) 2. Update proc_meminfo.dag and witness test imports to consume Kibibyte from std.measure 3. Remove trivial >= 0 assertions on Nat-carried ByteSize values in free witness test (non-discriminating) 4. Add dissolve-on markers to systemd parse/label functions pending contract-driven derivation (§3 parallel-representation scaffold) Addresses: claude/claude-opus-4-7 REQUEST_CHANGES feedback on #5636 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice C: Host metrics extdeps shapes * FIX: Add missing List import to systemd.dag systemd_parse_label_derivation_debt data declaration uses List<NonEmptyStr> but the file lacked the corresponding std.list import. Adding it resolves the compilation error. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * FIX: Remove stale inert carrier roster entries Remove 5 entries that now have external consumers: - Kibibyte (imported by witness tests) - MemoryMetric (imported by witness tests) - MemoryStats (imported by witness tests) - SwapStats (imported by witness tests) - SystemdUnitActiveState (imported by witness tests) Keep FreeOutput, ProcMeminfo, SystemdUnitStatus which still meet inert criteria. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "FIX: Remove stale inert carrier roster entries" This reverts commit 8c06981. * WIP: Slice C: Host metrics extdeps shapes * FIX: Correct witness test syntax for .dag language Three test files had unsupported syntax: 1. os_systemd_witness_test.dag: Bool literals must be lowercase (true/false, not True/False). Changed lines 16, 17, 23, 24 to use correct .dag syntax. 2. os_proc_meminfo_witness_test.dag: Cannot cast Int to Kibibyte with 'as' operator. Changed all Kibibyte casts to record literal syntax: Kibibyte { count: N }. 3. os_free_witness_test.dag: Cannot cast Int to ByteSize with 'as' operator. Changed all ByteSize casts to byte_size(count: N) constructor calls. Added byte_size import to std.measure imports. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Trigger CI run * Retrigger CI (previous run stuck in queue) * FIX: Remove 5 stale inert carrier roster entries Removed entries that gained consumers when host metrics types (Kibibyte, MemoryMetric, MemoryStats, SwapStats, SystemdUnitActiveState) were integrated into extdeps modules: - Kibibyte: moved to std/measure.dag, now imported by proc_meminfo.dag - MemoryMetric, MemoryStats, SwapStats: now consumed by proc_meminfo.dag / free.dag - SystemdUnitActiveState: now consumed by systemd.dag Remaining roster: 11 entries (AccessPolicy, CargoDependency, CargoPackage, FilePermissions, FloorWitnessRow, FreeOutput, GitCliReportedVersion, ProcMeminfo, ReactHookSite, SecretValue, SystemdUnitStatus). * WIP: Slice C: Host metrics extdeps shapes * Revert "WIP: Slice C: Host metrics extdeps shapes" This reverts commit 6bc985a. * Retrigger CI --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Slice B: Docker container stats extdeps shapes (#5635) * WIP: Slice B: Docker container stats extdeps shapes * Fix: correct imports for Nat type in docker shapes Move Nat import to std.nat module where it is defined. Remove unused BlkioStats from witness test imports. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix: Docker shapes de-fuse, duration carriers, wire contract consumption Address four review findings from claude/opus-4-7 and bold-ant-53: 1. **Duration semantics** — CPU times require std.measure carriers, not bare Nat. Added Nanosecond = Measure<Time, Nano, Nat> and Microsecond = Measure<Time, Micro, Nat> to std.measure.dag. Updated container_stats.dag and container_inspect.dag to type: - cpu_usage fields (total, kernel, user, system) as Nanosecond - cpu_period and cpu_quota as Microsecond 2. **Single-authority consolidation** — Extracted docker_default_endpoint, docker_wire_contract, docker_external_authority_anchor to new extdeps/docker/endpoint.dag. Both container_stats.dag and container_inspect.dag now import from endpoint. 3. **Networks fidelity** — Changed from hardcoded eth0 field to Networks.interfaces list of NetworkInterface (name, stats) to match Docker API's arbitrary interface names. 4. **Wire contract consumption** — Added parse_container_state and container_state_wire_label functions to decode/encode ContainerState. Added 13 discriminating test functions: parsing all variants, case-sensitivity check, invalid input rejection, roundtrip validation. Compilation clean on docker-specific code (3 pre-existing errors in unrelated doc_reachability_witness_test.dag). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Refine: Remove inert docker_wire_contract, add memory_stats working-set gap marker 1. **Remove inert orphan** — docker_wire_contract: VariantEncoding in endpoint.dag was imported but never used. Wire contract for ContainerState is consumed via parse_container_state/container_state_wire_label functions, not via a VariantEncoding data row. Removed from endpoint.dag and dropped unused VariantEncoding imports from container_stats.dag. 2. **Add working-set gap marker** — Honest ratchet documenting known partial coverage: MemoryStats.usage includes page cache (inactive_file), true working-set = usage - stats.inactive_file from Docker stats sub-map. Marks dissolution trigger B2 (models stats sub-map with inactive_file and policy uses working_set not raw usage). Compilation clean. Ready for sign-off. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Add tracked-debt markers for three dissolve-on patterns 1. **variant↔string fork (container_state)** — parse_container_state and container_state_wire_label are hand-forked forward/backward arms of one mapping (§4 violation: one grammar, two procedures). Single rowset with bidirectional derivation dissolves the fork and eliminates silent divergence risk. Trigger: B3 models ContainerState wire facts as single authority. 2. **BlkioValue.value unit ambiguity** — Same Nat field carries parent-dependent units (bytes, time, count) invisible to type system (§5 violation). Docker wire format constraint. Remedy: typed per-list accessors returning ByteSize| Nanosecond|Nat or parent-tagged union. Trigger: B3 models BlkioValue with discriminated unit type. 3. **docker_default_endpoint String vs Uri** — Typed as bare String but module imports Uri; anemic-leaf (§2/§5). Same file uses Uri for authority anchor. Ground endpoint as Uri variant carrying socket/http/https/fd schemes. Trigger: B3 grounds docker endpoint with Uri type. All three tracked per §6 framework: honest ratchet markers with named dissolution triggers and layer they belong to (B3 modeling layer). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix: Add dissolve-on markers for anemic-leaf and error-response scaffolds Address REQUEST_CHANGES review findings by adding honest ratchet markers for remaining scaffolds per §6 pattern: 1. **HostConfig/ContainerConfig anemic leaves** (container_inspect.dag:76-78) - cap_add/cap_drop, exposed_ports, port_bindings, volumes, volumes_from, device_requests (HostConfig); env, cmd, entrypoint, labels, volumes, exposed_ports (ContainerConfig) are structured concepts flattened to bare List<String>? (§2 violation: anemic leaves) - Trigger B3: ground each as typed coproduct (PortBinding record, EnvVar record) or decomposed with named axes 2. **NetworkSettings bare-string fields** (container_inspect.dag:104-108) - gateway, ip_address, mac_address should be typed network carriers (IpAddress, MacAddress) not bare String? - Lower stakes since std/network primitives don't exist yet, but marks structured-validation gap (§5 fail-closed) - Trigger B3: introduces network address carriers in std/ or extdeps 3. **Error responses as opaque strings** (both files) - 404/500 => String collapses two distinct error shapes, violates §5 - Docker returns structured JSON error objects with reason/message - Trigger B3: model as ErrorDetail coproduct (NotFound | ServerError variants with typed failure details) All markers follow §6 self-flagged scaffold pattern with closure/, root cause, and B3 dissolution trigger. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Ground ContainerStateDetail.error with ErrorMessage type ContainerStateDetail.error was typed as bare String?, violating bare-primitive-nicknames-concept modeling coherence. Error messages are a semantic concept that must be grounded in a type. Added type ErrorMessage = String to carry the semantic meaning, replacing bare String usage. This grounds the concept per §3 (single authority) and §2 (minimize anemic leaves). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Remove unused import of VariantEncoding/StringVariant/VariantNaming/AsAuthored Dead remnants from the old wire-contract approach. These imports are not used anywhere in the file and violate §3 (minimize redundancy). Removing them eliminates potential compile errors and cleans up the module's actual dependencies. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Address review findings: add cpu_percent ratio tracking + fix Optional matcher consistency - Add dissolve_on_cpu_percent_ratio_carrier to container_stats.dag documenting bare Float? unit modeling gap (§5); triggers B3 grounding with Ratio/PercentagePoint type alias - Fix container_inspect.dag optional accessors to use consistent Present/Absent pattern instead of null matching (all three: memory_limit, cpu_quota, cpu_period) Both findings valid from claude/claude-opus-4-7 review #5635. Dissolve-on marker ensures tracking discipline; pattern consistency prevents silent wildcard-fallthrough risk. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Add dissolve markers for ContainerStateDetail redundancy + container_state_is_running symmetry - Add dissolve_on_container_state_detail_redundant_bools documenting parallel status coproduct + redundant bool fields allowing illegal states; marks for B3 resolution via bool predicates derived from status only - Add dissolve_on_container_state_predicate_family for symmetry with parse/wire-label pair (both marker-tracked); documents handrolled predicate helper discipline gap and marks for B3 consolidation Both findings from claude/claude-opus-4-7 review #5635 (non-blocking nits, but valuable tracking discipline). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Add dissolve marker for HostConfig.memory_swap -1 unlimited convention loss HostConfig.memory_swap: ByteSize? loses Docker wire convention where -1 encodes 'unlimited'; Nat-backed ByteSize cannot represent -1, causing fidelity gap at extdeps boundary. Added dissolve_on_memory_swap_unlimited_convention marker documenting the gap and B3 trigger (coproduct variant or tagged union to preserve wire semantics). Finding from claude/claude-opus-4-7 review #5635 (APPROVE, non-blocking). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Remove unescaped braces in dissolve_on_hostconfig_containerconfig_anemic_leaves string Unescaped { and } in the example text caused .dag parser to treat them as template interpolation markers, failing on colon in field names. Rephrase example without braces. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix: Test all container state roundtrips instead of unused list binding Remove unused `states` binding and expand roundtrip test to verify all 5 ContainerState variants (Running, Paused, Exited, Dead, Restarting) roundtrip correctly through parse/wire-label functions per review feedback. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix REQUEST_CHANGES architectural violations per parent guidance Three fixes applied per Section-8 guidance: Fix 1 — Remove container_state_is_running predicate (§2/§3) - Delete function and dissolve_on marker (lines 163-168) - Callers now inline: match state { Running => ... _ => ... } - Update test file imports and remove predicate-only tests - Keep predicate-using test (sample_inspect_has_running_state) via direct equality Fix 2 — Ground parse/wire-label fork via CoproductWireContract (§4) - Add container_state_wire_contract data item - Import CoproductWireContract, StringVariant, SnakeCase from std.serialization - Rename dissolve_on_variant_wire_fork_container_state to structural_coverage_gap_container_state_codec_hand_rolled - Update marker text to reference contract and remove B3 reference Fix 3 — Rewrite all B3 references with concrete triggers - container_inspect.dag (5 markers): wire-deserialization, Unlimited variant, typed carriers, network addresses, typed errors - container_stats.dag (3 markers): Ratio/PercentagePoint, typed errors, typed/tagged union Verification: gunbc compile --source-root dsl → 0 docker diagnostics Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com> * BMC onboarding: complete srv3 lifecycle orchestration (.dag) + GCP store §3 fix (#5661) * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * BMC onboarding lifecycle: 4-phase model + Redfish write seam + read-only validation Models the onboarding of the operator's new Altra server (BMC 192.168.1.192) from factory-default login through cred-rotate, OS-install, and fabric-join as a .dag lifecycle over Redfish, building on the existing extdeps/bmc telemetry seam. - extdeps/bmc/types.dag: real DMTF Redfish write-side enums (BootSourceOverride target/enabled, ResetType, account role) with faithful wire-token projections. - extdeps/bmc/http.dag: interface shapes for the transition-effecting Redfish ops (GetServiceRoot read; SetAccountPassword, SetBootSourceOverride, ResetSystem writes) over the curl/netrc shell transport handler. Secrets ride a runtime request_body_file, never argv or the repo. - gunbc/bmc_onboarding.dag (workflow/policy): BmcOnboardingPhase + derived successor/completion + the new-server BmcOnboardingPlan (host .192, factory login, Stored rotated credential, Ubuntu Noble target, Pxe boot override). - gunbc/tools/bmc_onboard.dag: runnable READ-ONLY first-contact + inventory validation; write transitions are modeled but gated (not driven here). - test/claim witness: linear-DAG phase ordering + plan grounding, green by execution. Grounded against the live BMC at 192.168.1.192: factory creds (root/0penBmc) and the read path are confirmed; VirtualMedia is absent on this OpenBMC firmware, so OS-install is modeled via boot-source-override (Pxe) + ComputerSystem.Reset. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review #5563: drop redundant phase_order roster (§3 single authority) bmc_onboarding_next_phase is now the sole authority for the linear successor relation; the standalone bmc_onboarding_phase_order list duplicated it. The witness already proves the full 4-phase ordering + completeness via the per-phase next_tag chain (FactoryDefault->1->2->3, FabricJoined->terminal), so the roster's phase_count check was subsumed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review #5563: rename bmc_onboard -> bmc_onboard_validate (honest tool name, §5) The tool only performs the read-only FactoryDefault validation (GetServiceRoot + GetSystem); it does not drive cred-rotate/OS-install/fabric-join. Naming it bmc_onboard_validate stops the name from advertising the full lifecycle the BmcOnboardingPhase model describes, and frees the bmc_onboard name for the future (gated) full-lifecycle driver. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * review #5563: delete bmc_onboarding_is_complete (single-caller predicate) The predicate had one caller (the witness) and the witness's next_tag chain already proves completion (FabricJoined -> -1 = terminal; others -> 1/2/3). Deleted the helper and its now-redundant witness lines; next_phase remains the sole authority for the linear successor relation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * bmc_onboard: rotate+reauth leg of the onboarding orchestration (compile-verified, live-gated) Assemble the credential-rotation leg of orchestration C over new_altra_onboarding_plan, now that Lane B (#5634) landed the Redfish auth-as-Secret seam on main: materialize the netrc + PATCH body via Filesystem.Write (executable file effect), SetAccountPassword (Redfish write), then reauth with the new credential to VERIFY the rotation took — fail-closed if rejected. The minted Secret is declassified to String exactly once, explicitly (the Secret type forbids accidental exposure). Verified by execution: gunbc compile --source-root dsl => 464 modules, 471 files, 0 diagnostics — the legs typecheck and compose. LIVE execution is operator-fenced (first destructive write); live-correctness of account_id/body shape is confirmed only by the gated run against .192, not this typecheck. Not a *_test.dag, so it does NOT auto-enroll as a floor witness (no false CI-coverage claim). §5 debt (named): the netrc + body files transiently hold the credential on disk at default umask with no post-run unlink; dissolution = mode-0600 file write + unlink leg. gen+store leg (entropy mint #5633 -> base64 -> GCP store) wires in once #5633 lands; os-install leg pends Lane E (#5638). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * bmc_onboard: complete srv3 onboarding orchestration (acquire→gen+store→rotate→reauth→os-install) Assemble the full lifecycle as one .dag workflow over new_altra_onboarding_plan + srv3_os_install_plan, now that all four lanes (entropy #5633, auth-Secret #5634, OS-install #5638) landed on main: acquire — GetServiceRoot + factory-login GetSystem (read; proven live earlier) gen — mint a credential from OS entropy (extdeps.entropy Urandom), FAIL-CLOSED on the Optional (never a fabricated/empty credential — dissolves the witness scaffold's empty-string arm per cool-lynx's dissolution trigger) store — base64 of the same octets -> GCP AddVersion (durability) under the plan's secret id; token via gcloud rotate+reauth — Filesystem.Write netrc + PATCH body, SetAccountPassword, reauth with the NEW credential to verify the rotation took (fail-closed) os-install — re-materialize netrc with the NEW credential (factory netrc is now stale), SetBootSourceOverride(Pxe,Once) + ResetSystem(ForceRestart) via the Lane-E wire fns to boot srv3 into the PXE/autoinstall path Legs chain on ProcessExit so any failure short-circuits. The minted Secret is declassified to String exactly once, explicitly (the type forbids accidental leak). Verified by execution: gunbc compile --source-root dsl => 480 modules, 488 files, 0 diagnostics. The pure wire-shape builders (netrc line, Redfish PATCH/POST JSON bodies, GCP secret name) have by-execution witnesses — all 5 green via --claim-run. The live Redfish/GCP/entropy legs are OPERATOR-FENCED (destructive); their live correctness is confirmed only by the gated run against .192, not this typecheck. §5 debt (named): netrc/body files transiently hold the credential on disk at default umask with no unlink; dissolution = mode-0600 file write + unlink leg. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * review #5661: mark bmc_credential_bytes + JSON-concat scaffolds; add cred-only entry point Address review #32107: - bmc_credential_bytes: Int gets a 🟡 marker riding extdeps.entropy's entropy_count_bytes_unit_debt (same bytesize-argv-interpolation dissolution) — no longer an unmarked *_bytes-on-Int. - the concat-built Redfish PATCH/POST bodies get a 🟡 dissolve-on marker (safe for the current base64url-credential + enum-wire call sites, which the body-shape witnesses pin; dissolution = a structured JSON-object encoder authority). Also adds bmc_assimilate_srv3_credential — a credential-only entry point (acquire -> gen -> store(read-back gated) -> rotate -> reauth, STOPPING before os-install) so the live BMC credential assimilation can run while no PXE/install server exists yet (running the full bmc_onboard_srv3 would reset srv3 into a dead PXE boot). Refactors the shared store+rotate into bmc_store_and_rotate (no duplication). Compile clean (488 files, 0 diagnostics); body-shape witnesses green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * fmt: collapse resolve_auth call site to one line (cargo fmt --check) The auth_input fix's call-site edit split the let-binding across two lines; rustfmt wants it on one (fits in width). cargo fmt --all --check now clean — this was the rust_tests CI failure on 311ff38 (fmt gate), not a logic issue. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * bmc_onboard: dissolve the entropy decode→encode identity round-trip (§2, review #32137) mint_credential_octets base64_decode'd Urandom.octets_b64 to List<UInt8>, then credential_from_octets base64_encode'd it straight back — base64_encode∘base64_decode is identity, so the octets intermediate (and the Optional failure mode that could only trip on a base64_decode bug, never on real Urandom output) bought nothing. Collapse to one fn: mint_bmc_credential() = Urandom.ReadBytes(count).octets_b64 as Secret. The credential IS the base64 entropy string directly — same string set on the BMC, stored as the GCP payload, and compared in the read-back gate (identity preserved; the BMC password is byte-for-byte what it was). Drops the std.encoding + std.integer{UInt8} imports and the unused ExitFailure. Fail-closed now lives at the Urandom service call (nonzero exit raises). Compile 488/0, body witnesses green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Wire runner-slot count to derived budget model: enforce flag, fail-close * WIP: Wire runner-slot count to derived budget model: enforce flag, fail-close * Fix main-red regression: lens-test v2_source_roots missing dsl root after 5647 disposition import, plus regen 2 github pipeline snapshots after 5644 restructure (#5672) * WIP: Fix main-red regression: lens-test v2_source_roots missing dsl root afte * Resolve merge conflicts: take main's v2_layer_roots() and typed-field assertions #5668 landed equivalent fixes using the single-authority helper; resolve all four conflicted files to main's version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * ROADMAP §1: CI-humming operations plan (un-throttle runner slots from the modeled budget) (#5682) Single CI-operations authority for the ▸ NOW host-operation-on-.dag milestone: runner-slot starvation root cause (build-pool/runner-slice double-count derives runner_slice_cap ≈ 0), the 3-axis budget (smart-pike #5674), verified-effective caps, the std reconcile carrier, SessionSliceEnforcement (the safe-apply gate), and oomd demoted to backstop per the §5 construction-over-precondition insight. Linked from ROADMAP §1 (orphan-doc lens). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com> Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Resolve merge: keep counted-once runner_slice_cap (4-arg, no build_pool subtract) + import RunnerSliceCapEffectiveness from ci_floor_measurement single-authority home (drop #5687 5-arg double-subtract form per bright-stag §2/§3 2026-06-23 ruling) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com>
briansrls
pushed a commit
that referenced
this pull request
Jun 24, 2026
…t + SA + IAM + WIF as .dag, proven live) (#5712) * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * BMC onboarding lifecycle: 4-phase model + Redfish write seam + read-only validation Models the onboarding of the operator's new Altra server (BMC 192.168.1.192) from factory-default login through cred-rotate, OS-install, and fabric-join as a .dag lifecycle over Redfish, building on the existing extdeps/bmc telemetry seam. - extdeps/bmc/types.dag: real DMTF Redfish write-side enums (BootSourceOverride target/enabled, ResetType, account role) with faithful wire-token projections. - extdeps/bmc/http.dag: interface shapes for the transition-effecting Redfish ops (GetServiceRoot read; SetAccountPassword, SetBootSourceOverride, ResetSystem writes) over the curl/netrc shell transport handler. Secrets ride a runtime request_body_file, never argv or the repo. - gunbc/bmc_onboarding.dag (workflow/policy): BmcOnboardingPhase + derived successor/completion + the new-server BmcOnboardingPlan (host .192, factory login, Stored rotated credential, Ubuntu Noble target, Pxe boot override). - gunbc/tools/bmc_onboard.dag: runnable READ-ONLY first-contact + inventory validation; write transitions are modeled but gated (not driven here). - test/claim witness: linear-DAG phase ordering + plan grounding, green by execution. Grounded against the live BMC at 192.168.1.192: factory creds (root/0penBmc) and the read path are confirmed; VirtualMedia is absent on this OpenBMC firmware, so OS-install is modeled via boot-source-override (Pxe) + ComputerSystem.Reset. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review #5563: drop redundant phase_order roster (§3 single authority) bmc_onboarding_next_phase is now the sole authority for the linear successor relation; the standalone bmc_onboarding_phase_order list duplicated it. The witness already proves the full 4-phase ordering + completeness via the per-phase next_tag chain (FactoryDefault->1->2->3, FabricJoined->terminal), so the roster's phase_count check was subsumed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review #5563: rename bmc_onboard -> bmc_onboard_validate (honest tool name, §5) The tool only performs the read-only FactoryDefault validation (GetServiceRoot + GetSystem); it does not drive cred-rotate/OS-install/fabric-join. Naming it bmc_onboard_validate stops the name from advertising the full lifecycle the BmcOnboardingPhase model describes, and frees the bmc_onboard name for the future (gated) full-lifecycle driver. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * review #5563: delete bmc_onboarding_is_complete (single-caller predicate) The predicate had one caller (the witness) and the witness's next_tag chain already proves completion (FabricJoined -> -1 = terminal; others -> 1/2/3). Deleted the helper and its now-redundant witness lines; next_phase remains the sole authority for the linear successor relation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * bmc_onboard: rotate+reauth leg of the onboarding orchestration (compile-verified, live-gated) Assemble the credential-rotation leg of orchestration C over new_altra_onboarding_plan, now that Lane B (#5634) landed the Redfish auth-as-Secret seam on main: materialize the netrc + PATCH body via Filesystem.Write (executable file effect), SetAccountPassword (Redfish write), then reauth with the new credential to VERIFY the rotation took — fail-closed if rejected. The minted Secret is declassified to String exactly once, explicitly (the Secret type forbids accidental exposure). Verified by execution: gunbc compile --source-root dsl => 464 modules, 471 files, 0 diagnostics — the legs typecheck and compose. LIVE execution is operator-fenced (first destructive write); live-correctness of account_id/body shape is confirmed only by the gated run against .192, not this typecheck. Not a *_test.dag, so it does NOT auto-enroll as a floor witness (no false CI-coverage claim). §5 debt (named): the netrc + body files transiently hold the credential on disk at default umask with no post-run unlink; dissolution = mode-0600 file write + unlink leg. gen+store leg (entropy mint #5633 -> base64 -> GCP store) wires in once #5633 lands; os-install leg pends Lane E (#5638). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * bmc_onboard: complete srv3 onboarding orchestration (acquire→gen+store→rotate→reauth→os-install) Assemble the full lifecycle as one .dag workflow over new_altra_onboarding_plan + srv3_os_install_plan, now that all four lanes (entropy #5633, auth-Secret #5634, OS-install #5638) landed on main: acquire — GetServiceRoot + factory-login GetSystem (read; proven live earlier) gen — mint a credential from OS entropy (extdeps.entropy Urandom), FAIL-CLOSED on the Optional (never a fabricated/empty credential — dissolves the witness scaffold's empty-string arm per cool-lynx's dissolution trigger) store — base64 of the same octets -> GCP AddVersion (durability) under the plan's secret id; token via gcloud rotate+reauth — Filesystem.Write netrc + PATCH body, SetAccountPassword, reauth with the NEW credential to verify the rotation took (fail-closed) os-install — re-materialize netrc with the NEW credential (factory netrc is now stale), SetBootSourceOverride(Pxe,Once) + ResetSystem(ForceRestart) via the Lane-E wire fns to boot srv3 into the PXE/autoinstall path Legs chain on ProcessExit so any failure short-circuits. The minted Secret is declassified to String exactly once, explicitly (the type forbids accidental leak). Verified by execution: gunbc compile --source-root dsl => 480 modules, 488 files, 0 diagnostics. The pure wire-shape builders (netrc line, Redfish PATCH/POST JSON bodies, GCP secret name) have by-execution witnesses — all 5 green via --claim-run. The live Redfish/GCP/entropy legs are OPERATOR-FENCED (destructive); their live correctness is confirmed only by the gated run against .192, not this typecheck. §5 debt (named): netrc/body files transiently hold the credential on disk at default umask with no unlink; dissolution = mode-0600 file write + unlink leg. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * review #5661: mark bmc_credential_bytes + JSON-concat scaffolds; add cred-only entry point Address review #32107: - bmc_credential_bytes: Int gets a 🟡 marker riding extdeps.entropy's entropy_count_bytes_unit_debt (same bytesize-argv-interpolation dissolution) — no longer an unmarked *_bytes-on-Int. - the concat-built Redfish PATCH/POST bodies get a 🟡 dissolve-on marker (safe for the current base64url-credential + enum-wire call sites, which the body-shape witnesses pin; dissolution = a structured JSON-object encoder authority). Also adds bmc_assimilate_srv3_credential — a credential-only entry point (acquire -> gen -> store(read-back gated) -> rotate -> reauth, STOPPING before os-install) so the live BMC credential assimilation can run while no PXE/install server exists yet (running the full bmc_onboard_srv3 would reset srv3 into a dead PXE boot). Refactors the shared store+rotate into bmc_store_and_rotate (no duplication). Compile clean (488 files, 0 diagnostics); body-shape witnesses green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * fmt: collapse resolve_auth call site to one line (cargo fmt --check) The auth_input fix's call-site edit split the let-binding across two lines; rustfmt wants it on one (fits in width). cargo fmt --all --check now clean — this was the rust_tests CI failure on 311ff38 (fmt gate), not a logic issue. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * bmc_onboard: dissolve the entropy decode→encode identity round-trip (§2, review #32137) mint_credential_octets base64_decode'd Urandom.octets_b64 to List<UInt8>, then credential_from_octets base64_encode'd it straight back — base64_encode∘base64_decode is identity, so the octets intermediate (and the Optional failure mode that could only trip on a base64_decode bug, never on real Urandom output) bought nothing. Collapse to one fn: mint_bmc_credential() = Urandom.ReadBytes(count).octets_b64 as Secret. The credential IS the base64 entropy string directly — same string set on the BMC, stored as the GCP payload, and compared in the read-back gate (identity preserved; the BMC password is byte-for-byte what it was). Drops the std.encoding + std.integer{UInt8} imports and the unused ExitFailure. Fail-closed now lives at the Urandom service call (nonzero exit raises). Compile 488/0, body witnesses green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * GCP one-token bootstrap of the keyless BMC assimilator: API-enablement + SA + IAM + WIF modeled as .dag, proven live Collapses the entire operator-fenced WIF runbook (every manual `gcloud` block) into a single admin-token .dag orchestration over the proven v1 REST executor. The only manual input is the initial admin access token, acquired via the operator's existing gcloud login (shell.GCloud.AuthPrintAccessToken). No host/.rs changes — the REST executor already serializes list/map/record JSON bodies. New surfaces (all extdeps interface shapes + one workflow orchestration): - extdeps/cloud/gcp/serviceusage.dag — ServiceUsage.BatchEnableServices - extdeps/cloud/gcp/iam_admin.dag — IamAdmin.{CreateServiceAccount,CreateWorkloadIdentityPool,CreateWorkloadIdentityPoolProvider} - extdeps/cloud/gcp/secret_manager.dag — SecretManager.SetSecretIamPolicy (resource-level least-priv) - gcp.dag — shared GcpOperation + GcpService.{GcpIamCredentials,GcpServiceUsage} + gcp_service_api_id - gunbc/assimilate/bmc_bootstrap_provision.dag — enable -> SA -> bind -> pool -> provider API enablement is a DEPENDENCY OF USAGE, not a hand-typed list: bmc_required_gcp_apis is derived from bmc_assimilate_service_deps (the GcpService set the path uses) via gcp_service_api_id, single-authority on the GcpService enum. PROVEN LIVE 2026-06-24 against gunbai-secrets: all 5 ops dispatched; SA minted, both least-priv roles bound on bmc-srv3-admin only, WIF provider ACTIVE. Witness bmc_bootstrap_provision_witness_test.dag green by execution (least-priv + closed-API-set + derivation, with discriminating negatives). §3 single authority preserved (federation facts). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lane E — srv3 OS-install path: survey + design
The ASRock ALTRAD8UD (Ampere Altra, aarch64) running OpenBMC at
192.168.1.192has no Redfish VirtualMedia (confirmed live), so the only OS-install path is a BMC-driven network boot + unattended autoinstall.LAN survey (2026-06-23, live from the subnet)
Probed
192.168.1.0/24for install infrastructure:192.168.1.1= a Verizon Fios consumer router — it cannot serve PXE boot options (66/67 / HTTPClient) or run proxyDHCP..192(BMC),.151(HP printer,debut/1.30),.183/.184/.186/.187(IoT). None install-related.Conclusion: install infra must be stood up from scratch, and because the existing DHCP is not configurable the chain must use proxyDHCP (e.g. dnsmasq) alongside it. This observation is modeled as data so the design decisions are derived from the survey, not asserted bare.
Design (modeled
.dag, model-before-implement)extdeps/provisioning/network_boot.dag— the cited network-boot mechanism:ClientNetworkBootMode(legacy PXE / UEFI PXE / UEFI HTTP Boot),DhcpBootDirection(native options vs proxyDHCP), per-architecture signed GRUB bootloader (aarch64 → grubnetaa64.efi, fail-closedAbsentfor un-grounded arches), and aNetworkBootChainwith a TFTP-coherence predicate (HTTP Boot needs no TFTP).extdeps/os/ubuntu_autoinstall.dag— Ubuntu Subiquity autoinstall payload (NoCloudNet seed over HTTP,version: 1, fully-automated), cited to the Canonical autoinstall reference.gunbc/os_install.dag— the srv3 plan: Ubuntu 24.04 / aarch64 / UEFI HTTP Boot + proxyDHCP + autoinstall, driven by a one-shot RedfishPxeboot override + reset. A fail-closed coherence predicate makes a VirtualMedia delivery on a VirtualMedia-absent board unrepresentable as coherent (§5), andsurvey_implied_dhcp_directionderives proxyDHCP from the survey.test/claim/srv3_os_install_witness_test.dag— 5 by-execution witnesses with discriminating teeth (arch→bootloader perturbation incl. an unsupported-archAbsent; VirtualMedia-absent forces NetworkBoot; survey forces proxyDHCP vs a configurable-DHCP control; boot target wiresPxe/Once).Reuses single authorities —
Architecture(extdeps.toolchain.types),Uri,OperatingSystemProduct/UbuntuDistribution, and the existingRedfishBootSourceOverride*already wired inbmc_onboarding.dag(os_install_boot_target: BootTargetPxe).Verification (by execution)
gunbc compile --source-root dsl --source-root src/v2 --target rust→ exit 0, 0 diagnostics, 473 files emitted.claim_batch(corpus resolves: 16 modules, 261 items).Follow-on (out of scope, parent-tracked): the install server itself (proxyDHCP+HTTP) is described by the model but must still be provisioned on the LAN; the BMC action sequence (set override → reset → poll) is the lifecycle lane's to drive.