BMC onboarding: complete srv3 lifecycle orchestration (.dag) + GCP store §3 fix

[gunbai-bot]

Completes the BMC onboarding lifecycle as a single executable .dag workflow for the new Altra server (BMC 192.168.1.192), now that the four supporting lanes landed on main (entropy mint #5633, Redfish auth-as-Secret #5634, OS-install path #5638).

What's here

dsl/gunbc/tools/bmc_onboard.dag — full lifecycle over new_altra_onboarding_plan + srv3_os_install_plan:

• acquire — GetServiceRoot + factory-login GetSystem (read; proven live earlier via bmc_onboard_validate)
• gen — mint a credential from OS entropy (extdeps.entropy Urandom), fail-closed on the Optional (never a fabricated/empty credential — dissolves the entropy witness's empty-string scaffold per the dissolution trigger left for this lane)
• store — base64 of the same octets → GCP AddVersion for durability
• rotate+reauth — Filesystem.Write netrc + PATCH body, SetAccountPassword, reauth with the new credential to verify the rotation took (fail-closed)
• os-install — re-materialize netrc with the new credential (factory netrc is now stale), SetBootSourceOverride(Pxe,Once) + ResetSystem(ForceRestart) via the Lane-E wire fns to boot srv3 into the PXE/autoinstall path

Legs chain on ProcessExit so any failure short-circuits. The minted Secret is declassified to String exactly once, explicitly (the type forbids accidental leak).

dsl/extdeps/cloud/gcp/secret_manager.dag — completes the live-validated CreateSecret/AddVersion/AccessVersion transports on the established auth_input: access_token §3 model (reverts a probe-time auth_source: EnvVar fusion that broke both consumers).

dsl/test/claim/bmc_onboard_body_witness_test.dag — by-execution witnesses for the pure wire-shape builders (netrc line, Redfish PATCH/POST JSON bodies, GCP secret name).

Verification

• gunbc compile --source-root dsl → 480 modules, 488 files, 0 diagnostics
• 5 body-shape witnesses green by execution (--claim-run)
• The live Redfish/GCP/entropy legs are operator-fenced (destructive SetAccountPassword); their live correctness is confirmed only by the gated run against .192, not this typecheck. bmc_onboard.dag is a tool (no test fn), so it does not auto-enroll as a floor witness — no false CI-coverage claim.

Named debt

• §5 secret-on-disk: netrc/body files transiently hold the credential at default umask with no unlink; dissolution = mode-0600 file write + unlink leg.

🤖 Generated with Claude Code

[gunbai-bot]

Thanks — addressing the one non-blocking note (the AccessVersion payload: Bytes + data_b64: String from "payload/data" dual carrier).

Verified against current code: this is a single-authority dual-projection, not a forked authority (as the review itself notes — "shared read of one fact"). One source field (payload/data), two typed views serving two genuinely distinct consumers:

• payload: Bytes → utf8_secret_from_access_payload in auth/credentials.dag + auth/patterns.dag (decode the bytes to the usable Secret).
• data_b64: String → the bmc_onboard read-back gate, which compares against the base64 it stored (readback.data_b64 != payload_b64) — a string compare that avoids a decode round-trip on the hot durability check.

So §3 is satisfied today (one cited source, two projections; neither re-derives the other). The collapse you suggest is real and clean: the canonical carrier is Bytes, and the gate could instead compare readback.payload against the stored octets directly (more direct — compares the actual secret bytes, no base64 hop), letting data_b64 drop. I am deferring that to a follow-up rather than folding it in here, because switching the gate off the live-proven data_b64 path warrants a fresh by-execution re-verification against real GCP, which is currently gated behind a separate v1-resolver closure bug (the service_ops registration drops Filesystem at large closure scale — routed to the resolver lane). Tracking it as the canonical-carrier collapse for that follow-up.

— sent from neat-boar-71

[gunbai-bot]

Addressing review #32125 (it ran on 23708f51, the pre-split head).

Primary finding (REQUEST_CHANGES) — bmc_assimilate_srv3_credential near-duplicate of bmc_onboard_srv3: RESOLVED on the current head (6d2cef65). The split commit removed bmc_onboard_srv3 and bmc_onboard_store_rotate_install entirely — the OS-install orchestration is deferred (it is not live-runnable: no PXE/install infra yet, and its larger import closure trips a separate v1-resolver service_ops registration bug now routed to the resolver lane). So the byte-identical-prelude twin the review flagged is gone; bmc_assimilate_srv3_credential is now the single entry point (one GetServiceRoot prelude in the file). It is an operator-invoked tool entry (run via gunbc run --function), not dead code — it has no in-corpus caller by design, same as any bmc_* entry point. The §2 horizontal-redundancy concern (a credential-mint change having to be made twice and drifting) no longer applies — there is one site.

Secondary finding (non-blocking) — dissolve-on triggers need grounding, not a bare feature: tag. Fair. Disposition:

• bmc_credential_bytes_unit_debt is grounded: it shares a single authority with extdeps.entropy’s entropy_count_bytes_unit_debt (same feature:bytesize-argv-interpolation gate; both migrate to ByteSize together). That is a real, existing corpus debt, not an invented tag.
• bmc_redfish_json_concat_debt / bmc_onboard_secret_on_disk_debt are honest capability deferrals whose triggers are concrete substrate gaps (a structured std to_json Redfish-body encoder; a mode-0600 file-write effect + unlink leg). They are grounded in CAPABILITY terms per §6 ("named dissolution trigger") rather than a ROADMAP row — there is no such capability today, so the trigger is the capability landing, which is the honest condition. If the lane wants these as tracked ROADMAP rows I can add them, but I would not invent an owner where the trigger is a substrate feature.

CI is re-running on 6d2cef65; a fresh review on this head should clear the duplication finding.

— sent from neat-boar-71

[gunbai-bot]

Both findings from review #32129 are addressed via fix commits on 311ff38a:

1. v1_interpreter.rs Bearer-from-Display — fixed. The token is now extracted explicitly: if let Some(Value::Str(tok)) = param_env.lookup(ctx.sym(&field)) { … tok.clone() } instead of format!("{}", v). A non-Str value now falls through to auth_source rather than producing a malformed Bearer <debug> header. (Behaviorally identical for the proven case — Value::Str Display is the raw string — but no longer relies on Display.) Build clean. The live read-only AccessVersion proof stands from before the operator token expired; re-verification is inspection-grade here since the change is a behavior-preserving refactor for the Str path.

2. boot_override_body/reset_body forward-staged — noted in the debt marker (bmc_redfish_json_concat_debt): they model the Redfish boot/reset wire shapes for the os-install leg deferred to the PXE/install-infra lane, kept because they are pinned by by-execution witnesses (the proven shapes that leg will emit).

Review #32132 (APPROVE) on 311ff38a independently confirms both — "explicit Value::Str extraction (no Display fallback) is the right §3/§5 shape" and the forward-staged builders "acceptable."

— sent from neat-boar-71

[gunbai-bot]

Dissolved the §2 round-trip from review #32137 in c1176bdc2.

You were exactly right — base64_encode ∘ base64_decode is identity, so mint_credential_octets → credential_from_octets was decoding Urandom.octets_b64 to List<UInt8> only to re-encode it straight back. Collapsed to one fn: mint_bmc_credential() = Urandom.ReadBytes(count).octets_b64 as Secret. The credential IS the base64 entropy string directly — the same string set on the BMC, stored as the GCP payload, and compared in the read-back gate, so the BMC password is byte-for-byte unchanged (identity preserved). Dropped the now-dead std.encoding + std.integer{UInt8} imports, the spurious Optional (its only failure mode was a base64_decode bug, never real Urandom output — fail-closed now lives at the Urandom service call, which raises on nonzero exit), and an unused ExitFailure. Compile 488/0, body witnesses green by execution.

— sent from neat-boar-71