Repository navigation
ROADMAP §1: CI-humming operations plan (single CI authority) - #5682
Merged
Merged
Conversation
… the modeled budget) Single CI-operations authority for the ▸ NOW host-operation-on-.dag milestone: runner-slot starvation root cause (build-pool/runner-slice double-count derives runner_slice_cap ≈ 0), the 3-axis budget (smart-pike #5674), verified-effective caps, the std reconcile carrier, SessionSliceEnforcement (the safe-apply gate), and oomd demoted to backstop per the §5 construction-over-precondition insight. Linked from ROADMAP §1 (orphan-doc lens). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
briansrls
force-pushed
the
roadmap/ci-humming-plan
branch
from
June 23, 2026 22:01
9530eb6 to
5e5c8aa
Compare
briansrls
added a commit
that referenced
this pull request
Jun 23, 2026
…ession_worstcase−headroom; count = min(mem, build_tokens, cpu) (#5680) * tesgen analysis (#5664) * WIP: tesgen analysis * WIP: tesgen analysis * Wiring-liveness oracle + compile-time lens: plan carrier + roadmap §4 (carrier-modeled) --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> * Slice C: Host metrics extdeps shapes (#5636) * WIP: Slice C: Host metrics extdeps shapes * Slice C: Host metrics extdeps shapes (§3 single-authority shape modeling) Model host metrics data structures in extdeps/os following DESIGN.md §3 de-fusion (shape/transport/policy separation): - proc_meminfo.dag: /proc/meminfo output structure (ProcMeminfo type with memory metrics fields, MemoryMetric for individual key-value pairs) - systemd.dag: systemctl is-active output structure (SystemdUnitActiveState coproduct, SystemdUnitStatus record with wire contract for snake_case encoding) - free.dag: free -b output structure (MemoryStats and SwapStats records in FreeOutput container) All three modules anchor to external authorities (man7.org) per extdeps convention. Test witnesses prove shape construction and invariant checking via executable Bool assertions (mem_available <= mem_total, etc). Each module models shape only; transport (how to fetch) and policy (when/where to call) remain absent, per single-authority principle. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Add NonEmptyStr casting in witness tests (as NonEmptyStr for name fields) * WIP: Slice C: Host metrics extdeps shapes * Fix: resolve unit type violations in host metrics extdeps shapes Replace bare Int fields with proper Measure types in host metrics modules: - proc_meminfo.dag: all memory fields now use Kibibyte (Measure<Memory, Kibi, Nat>) - free.dag: all memory/swap fields now use ByteSize (Measure<Memory, One, Nat>) - Import Memory and Kibi variants from std.measure following §3 single-authority principle - Update test witnesses to cast numeric literals to Measure types - Rename proc_meminfo.dag field value_kibibytes → value for consistency with Kibibyte type Addresses blocking review: unit type violations violate §3 single-authority principle. Establishes Measure as single authority for all physical quantity modeling per std.measure.dag. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * FIX: systemd.dag wire contract with execution + inert carrier roster * Fix fmt: normalize roster comment alignment Cargo fmt --all normalized spacing on SecretValue roster entry. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice C: Host metrics extdeps shapes * Address PR feedback: consolidate Kibibyte alias, remove trivial assertions, mark systemd parallel-representation 1. Move Kibibyte alias from proc_meminfo.dag to std/measure.dag (canonical location per §3 single authority) 2. Update proc_meminfo.dag and witness test imports to consume Kibibyte from std.measure 3. Remove trivial >= 0 assertions on Nat-carried ByteSize values in free witness test (non-discriminating) 4. Add dissolve-on markers to systemd parse/label functions pending contract-driven derivation (§3 parallel-representation scaffold) Addresses: claude/claude-opus-4-7 REQUEST_CHANGES feedback on #5636 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice C: Host metrics extdeps shapes * FIX: Add missing List import to systemd.dag systemd_parse_label_derivation_debt data declaration uses List<NonEmptyStr> but the file lacked the corresponding std.list import. Adding it resolves the compilation error. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * FIX: Remove stale inert carrier roster entries Remove 5 entries that now have external consumers: - Kibibyte (imported by witness tests) - MemoryMetric (imported by witness tests) - MemoryStats (imported by witness tests) - SwapStats (imported by witness tests) - SystemdUnitActiveState (imported by witness tests) Keep FreeOutput, ProcMeminfo, SystemdUnitStatus which still meet inert criteria. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "FIX: Remove stale inert carrier roster entries" This reverts commit 8c06981. * WIP: Slice C: Host metrics extdeps shapes * FIX: Correct witness test syntax for .dag language Three test files had unsupported syntax: 1. os_systemd_witness_test.dag: Bool literals must be lowercase (true/false, not True/False). Changed lines 16, 17, 23, 24 to use correct .dag syntax. 2. os_proc_meminfo_witness_test.dag: Cannot cast Int to Kibibyte with 'as' operator. Changed all Kibibyte casts to record literal syntax: Kibibyte { count: N }. 3. os_free_witness_test.dag: Cannot cast Int to ByteSize with 'as' operator. Changed all ByteSize casts to byte_size(count: N) constructor calls. Added byte_size import to std.measure imports. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Trigger CI run * Retrigger CI (previous run stuck in queue) * FIX: Remove 5 stale inert carrier roster entries Removed entries that gained consumers when host metrics types (Kibibyte, MemoryMetric, MemoryStats, SwapStats, SystemdUnitActiveState) were integrated into extdeps modules: - Kibibyte: moved to std/measure.dag, now imported by proc_meminfo.dag - MemoryMetric, MemoryStats, SwapStats: now consumed by proc_meminfo.dag / free.dag - SystemdUnitActiveState: now consumed by systemd.dag Remaining roster: 11 entries (AccessPolicy, CargoDependency, CargoPackage, FilePermissions, FloorWitnessRow, FreeOutput, GitCliReportedVersion, ProcMeminfo, ReactHookSite, SecretValue, SystemdUnitStatus). * WIP: Slice C: Host metrics extdeps shapes * Revert "WIP: Slice C: Host metrics extdeps shapes" This reverts commit 6bc985a. * Retrigger CI --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Slice B: Docker container stats extdeps shapes (#5635) * WIP: Slice B: Docker container stats extdeps shapes * Fix: correct imports for Nat type in docker shapes Move Nat import to std.nat module where it is defined. Remove unused BlkioStats from witness test imports. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix: Docker shapes de-fuse, duration carriers, wire contract consumption Address four review findings from claude/opus-4-7 and bold-ant-53: 1. **Duration semantics** — CPU times require std.measure carriers, not bare Nat. Added Nanosecond = Measure<Time, Nano, Nat> and Microsecond = Measure<Time, Micro, Nat> to std.measure.dag. Updated container_stats.dag and container_inspect.dag to type: - cpu_usage fields (total, kernel, user, system) as Nanosecond - cpu_period and cpu_quota as Microsecond 2. **Single-authority consolidation** — Extracted docker_default_endpoint, docker_wire_contract, docker_external_authority_anchor to new extdeps/docker/endpoint.dag. Both container_stats.dag and container_inspect.dag now import from endpoint. 3. **Networks fidelity** — Changed from hardcoded eth0 field to Networks.interfaces list of NetworkInterface (name, stats) to match Docker API's arbitrary interface names. 4. **Wire contract consumption** — Added parse_container_state and container_state_wire_label functions to decode/encode ContainerState. Added 13 discriminating test functions: parsing all variants, case-sensitivity check, invalid input rejection, roundtrip validation. Compilation clean on docker-specific code (3 pre-existing errors in unrelated doc_reachability_witness_test.dag). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Refine: Remove inert docker_wire_contract, add memory_stats working-set gap marker 1. **Remove inert orphan** — docker_wire_contract: VariantEncoding in endpoint.dag was imported but never used. Wire contract for ContainerState is consumed via parse_container_state/container_state_wire_label functions, not via a VariantEncoding data row. Removed from endpoint.dag and dropped unused VariantEncoding imports from container_stats.dag. 2. **Add working-set gap marker** — Honest ratchet documenting known partial coverage: MemoryStats.usage includes page cache (inactive_file), true working-set = usage - stats.inactive_file from Docker stats sub-map. Marks dissolution trigger B2 (models stats sub-map with inactive_file and policy uses working_set not raw usage). Compilation clean. Ready for sign-off. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Add tracked-debt markers for three dissolve-on patterns 1. **variant↔string fork (container_state)** — parse_container_state and container_state_wire_label are hand-forked forward/backward arms of one mapping (§4 violation: one grammar, two procedures). Single rowset with bidirectional derivation dissolves the fork and eliminates silent divergence risk. Trigger: B3 models ContainerState wire facts as single authority. 2. **BlkioValue.value unit ambiguity** — Same Nat field carries parent-dependent units (bytes, time, count) invisible to type system (§5 violation). Docker wire format constraint. Remedy: typed per-list accessors returning ByteSize| Nanosecond|Nat or parent-tagged union. Trigger: B3 models BlkioValue with discriminated unit type. 3. **docker_default_endpoint String vs Uri** — Typed as bare String but module imports Uri; anemic-leaf (§2/§5). Same file uses Uri for authority anchor. Ground endpoint as Uri variant carrying socket/http/https/fd schemes. Trigger: B3 grounds docker endpoint with Uri type. All three tracked per §6 framework: honest ratchet markers with named dissolution triggers and layer they belong to (B3 modeling layer). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix: Add dissolve-on markers for anemic-leaf and error-response scaffolds Address REQUEST_CHANGES review findings by adding honest ratchet markers for remaining scaffolds per §6 pattern: 1. **HostConfig/ContainerConfig anemic leaves** (container_inspect.dag:76-78) - cap_add/cap_drop, exposed_ports, port_bindings, volumes, volumes_from, device_requests (HostConfig); env, cmd, entrypoint, labels, volumes, exposed_ports (ContainerConfig) are structured concepts flattened to bare List<String>? (§2 violation: anemic leaves) - Trigger B3: ground each as typed coproduct (PortBinding record, EnvVar record) or decomposed with named axes 2. **NetworkSettings bare-string fields** (container_inspect.dag:104-108) - gateway, ip_address, mac_address should be typed network carriers (IpAddress, MacAddress) not bare String? - Lower stakes since std/network primitives don't exist yet, but marks structured-validation gap (§5 fail-closed) - Trigger B3: introduces network address carriers in std/ or extdeps 3. **Error responses as opaque strings** (both files) - 404/500 => String collapses two distinct error shapes, violates §5 - Docker returns structured JSON error objects with reason/message - Trigger B3: model as ErrorDetail coproduct (NotFound | ServerError variants with typed failure details) All markers follow §6 self-flagged scaffold pattern with closure/, root cause, and B3 dissolution trigger. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Ground ContainerStateDetail.error with ErrorMessage type ContainerStateDetail.error was typed as bare String?, violating bare-primitive-nicknames-concept modeling coherence. Error messages are a semantic concept that must be grounded in a type. Added type ErrorMessage = String to carry the semantic meaning, replacing bare String usage. This grounds the concept per §3 (single authority) and §2 (minimize anemic leaves). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Remove unused import of VariantEncoding/StringVariant/VariantNaming/AsAuthored Dead remnants from the old wire-contract approach. These imports are not used anywhere in the file and violate §3 (minimize redundancy). Removing them eliminates potential compile errors and cleans up the module's actual dependencies. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Address review findings: add cpu_percent ratio tracking + fix Optional matcher consistency - Add dissolve_on_cpu_percent_ratio_carrier to container_stats.dag documenting bare Float? unit modeling gap (§5); triggers B3 grounding with Ratio/PercentagePoint type alias - Fix container_inspect.dag optional accessors to use consistent Present/Absent pattern instead of null matching (all three: memory_limit, cpu_quota, cpu_period) Both findings valid from claude/claude-opus-4-7 review #5635. Dissolve-on marker ensures tracking discipline; pattern consistency prevents silent wildcard-fallthrough risk. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Add dissolve markers for ContainerStateDetail redundancy + container_state_is_running symmetry - Add dissolve_on_container_state_detail_redundant_bools documenting parallel status coproduct + redundant bool fields allowing illegal states; marks for B3 resolution via bool predicates derived from status only - Add dissolve_on_container_state_predicate_family for symmetry with parse/wire-label pair (both marker-tracked); documents handrolled predicate helper discipline gap and marks for B3 consolidation Both findings from claude/claude-opus-4-7 review #5635 (non-blocking nits, but valuable tracking discipline). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Add dissolve marker for HostConfig.memory_swap -1 unlimited convention loss HostConfig.memory_swap: ByteSize? loses Docker wire convention where -1 encodes 'unlimited'; Nat-backed ByteSize cannot represent -1, causing fidelity gap at extdeps boundary. Added dissolve_on_memory_swap_unlimited_convention marker documenting the gap and B3 trigger (coproduct variant or tagged union to preserve wire semantics). Finding from claude/claude-opus-4-7 review #5635 (APPROVE, non-blocking). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Remove unescaped braces in dissolve_on_hostconfig_containerconfig_anemic_leaves string Unescaped { and } in the example text caused .dag parser to treat them as template interpolation markers, failing on colon in field names. Rephrase example without braces. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix: Test all container state roundtrips instead of unused list binding Remove unused `states` binding and expand roundtrip test to verify all 5 ContainerState variants (Running, Paused, Exited, Dead, Restarting) roundtrip correctly through parse/wire-label functions per review feedback. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix REQUEST_CHANGES architectural violations per parent guidance Three fixes applied per Section-8 guidance: Fix 1 — Remove container_state_is_running predicate (§2/§3) - Delete function and dissolve_on marker (lines 163-168) - Callers now inline: match state { Running => ... _ => ... } - Update test file imports and remove predicate-only tests - Keep predicate-using test (sample_inspect_has_running_state) via direct equality Fix 2 — Ground parse/wire-label fork via CoproductWireContract (§4) - Add container_state_wire_contract data item - Import CoproductWireContract, StringVariant, SnakeCase from std.serialization - Rename dissolve_on_variant_wire_fork_container_state to structural_coverage_gap_container_state_codec_hand_rolled - Update marker text to reference contract and remove B3 reference Fix 3 — Rewrite all B3 references with concrete triggers - container_inspect.dag (5 markers): wire-deserialization, Unlimited variant, typed carriers, network addresses, typed errors - container_stats.dag (3 markers): Ratio/PercentagePoint, typed errors, typed/tagged union Verification: gunbc compile --source-root dsl → 0 docker diagnostics Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com> * BMC onboarding: complete srv3 lifecycle orchestration (.dag) + GCP store §3 fix (#5661) * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * BMC onboarding lifecycle: 4-phase model + Redfish write seam + read-only validation Models the onboarding of the operator's new Altra server (BMC 192.168.1.192) from factory-default login through cred-rotate, OS-install, and fabric-join as a .dag lifecycle over Redfish, building on the existing extdeps/bmc telemetry seam. - extdeps/bmc/types.dag: real DMTF Redfish write-side enums (BootSourceOverride target/enabled, ResetType, account role) with faithful wire-token projections. - extdeps/bmc/http.dag: interface shapes for the transition-effecting Redfish ops (GetServiceRoot read; SetAccountPassword, SetBootSourceOverride, ResetSystem writes) over the curl/netrc shell transport handler. Secrets ride a runtime request_body_file, never argv or the repo. - gunbc/bmc_onboarding.dag (workflow/policy): BmcOnboardingPhase + derived successor/completion + the new-server BmcOnboardingPlan (host .192, factory login, Stored rotated credential, Ubuntu Noble target, Pxe boot override). - gunbc/tools/bmc_onboard.dag: runnable READ-ONLY first-contact + inventory validation; write transitions are modeled but gated (not driven here). - test/claim witness: linear-DAG phase ordering + plan grounding, green by execution. Grounded against the live BMC at 192.168.1.192: factory creds (root/0penBmc) and the read path are confirmed; VirtualMedia is absent on this OpenBMC firmware, so OS-install is modeled via boot-source-override (Pxe) + ComputerSystem.Reset. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review #5563: drop redundant phase_order roster (§3 single authority) bmc_onboarding_next_phase is now the sole authority for the linear successor relation; the standalone bmc_onboarding_phase_order list duplicated it. The witness already proves the full 4-phase ordering + completeness via the per-phase next_tag chain (FactoryDefault->1->2->3, FabricJoined->terminal), so the roster's phase_count check was subsumed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review #5563: rename bmc_onboard -> bmc_onboard_validate (honest tool name, §5) The tool only performs the read-only FactoryDefault validation (GetServiceRoot + GetSystem); it does not drive cred-rotate/OS-install/fabric-join. Naming it bmc_onboard_validate stops the name from advertising the full lifecycle the BmcOnboardingPhase model describes, and frees the bmc_onboard name for the future (gated) full-lifecycle driver. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * review #5563: delete bmc_onboarding_is_complete (single-caller predicate) The predicate had one caller (the witness) and the witness's next_tag chain already proves completion (FabricJoined -> -1 = terminal; others -> 1/2/3). Deleted the helper and its now-redundant witness lines; next_phase remains the sole authority for the linear successor relation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * bmc_onboard: rotate+reauth leg of the onboarding orchestration (compile-verified, live-gated) Assemble the credential-rotation leg of orchestration C over new_altra_onboarding_plan, now that Lane B (#5634) landed the Redfish auth-as-Secret seam on main: materialize the netrc + PATCH body via Filesystem.Write (executable file effect), SetAccountPassword (Redfish write), then reauth with the new credential to VERIFY the rotation took — fail-closed if rejected. The minted Secret is declassified to String exactly once, explicitly (the Secret type forbids accidental exposure). Verified by execution: gunbc compile --source-root dsl => 464 modules, 471 files, 0 diagnostics — the legs typecheck and compose. LIVE execution is operator-fenced (first destructive write); live-correctness of account_id/body shape is confirmed only by the gated run against .192, not this typecheck. Not a *_test.dag, so it does NOT auto-enroll as a floor witness (no false CI-coverage claim). §5 debt (named): the netrc + body files transiently hold the credential on disk at default umask with no post-run unlink; dissolution = mode-0600 file write + unlink leg. gen+store leg (entropy mint #5633 -> base64 -> GCP store) wires in once #5633 lands; os-install leg pends Lane E (#5638). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * bmc_onboard: complete srv3 onboarding orchestration (acquire→gen+store→rotate→reauth→os-install) Assemble the full lifecycle as one .dag workflow over new_altra_onboarding_plan + srv3_os_install_plan, now that all four lanes (entropy #5633, auth-Secret #5634, OS-install #5638) landed on main: acquire — GetServiceRoot + factory-login GetSystem (read; proven live earlier) gen — mint a credential from OS entropy (extdeps.entropy Urandom), FAIL-CLOSED on the Optional (never a fabricated/empty credential — dissolves the witness scaffold's empty-string arm per cool-lynx's dissolution trigger) store — base64 of the same octets -> GCP AddVersion (durability) under the plan's secret id; token via gcloud rotate+reauth — Filesystem.Write netrc + PATCH body, SetAccountPassword, reauth with the NEW credential to verify the rotation took (fail-closed) os-install — re-materialize netrc with the NEW credential (factory netrc is now stale), SetBootSourceOverride(Pxe,Once) + ResetSystem(ForceRestart) via the Lane-E wire fns to boot srv3 into the PXE/autoinstall path Legs chain on ProcessExit so any failure short-circuits. The minted Secret is declassified to String exactly once, explicitly (the type forbids accidental leak). Verified by execution: gunbc compile --source-root dsl => 480 modules, 488 files, 0 diagnostics. The pure wire-shape builders (netrc line, Redfish PATCH/POST JSON bodies, GCP secret name) have by-execution witnesses — all 5 green via --claim-run. The live Redfish/GCP/entropy legs are OPERATOR-FENCED (destructive); their live correctness is confirmed only by the gated run against .192, not this typecheck. §5 debt (named): netrc/body files transiently hold the credential on disk at default umask with no unlink; dissolution = mode-0600 file write + unlink leg. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * review #5661: mark bmc_credential_bytes + JSON-concat scaffolds; add cred-only entry point Address review #32107: - bmc_credential_bytes: Int gets a 🟡 marker riding extdeps.entropy's entropy_count_bytes_unit_debt (same bytesize-argv-interpolation dissolution) — no longer an unmarked *_bytes-on-Int. - the concat-built Redfish PATCH/POST bodies get a 🟡 dissolve-on marker (safe for the current base64url-credential + enum-wire call sites, which the body-shape witnesses pin; dissolution = a structured JSON-object encoder authority). Also adds bmc_assimilate_srv3_credential — a credential-only entry point (acquire -> gen -> store(read-back gated) -> rotate -> reauth, STOPPING before os-install) so the live BMC credential assimilation can run while no PXE/install server exists yet (running the full bmc_onboard_srv3 would reset srv3 into a dead PXE boot). Refactors the shared store+rotate into bmc_store_and_rotate (no duplication). Compile clean (488 files, 0 diagnostics); body-shape witnesses green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * fmt: collapse resolve_auth call site to one line (cargo fmt --check) The auth_input fix's call-site edit split the let-binding across two lines; rustfmt wants it on one (fits in width). cargo fmt --all --check now clean — this was the rust_tests CI failure on 311ff38 (fmt gate), not a logic issue. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * bmc_onboard: dissolve the entropy decode→encode identity round-trip (§2, review #32137) mint_credential_octets base64_decode'd Urandom.octets_b64 to List<UInt8>, then credential_from_octets base64_encode'd it straight back — base64_encode∘base64_decode is identity, so the octets intermediate (and the Optional failure mode that could only trip on a base64_decode bug, never on real Urandom output) bought nothing. Collapse to one fn: mint_bmc_credential() = Urandom.ReadBytes(count).octets_b64 as Secret. The credential IS the base64 entropy string directly — same string set on the BMC, stored as the GCP payload, and compared in the read-back gate (identity preserved; the BMC password is byte-for-byte what it was). Drops the std.encoding + std.integer{UInt8} imports and the unused ExitFailure. Fail-closed now lives at the Urandom service call (nonzero exit raises). Compile 488/0, body witnesses green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Wire runner-slot count to derived budget model: enforce flag, fail-close * WIP: Wire runner-slot count to derived budget model: enforce flag, fail-close * Fix main-red regression: lens-test v2_source_roots missing dsl root after 5647 disposition import, plus regen 2 github pipeline snapshots after 5644 restructure (#5672) * WIP: Fix main-red regression: lens-test v2_source_roots missing dsl root afte * Resolve merge conflicts: take main's v2_layer_roots() and typed-field assertions #5668 landed equivalent fixes using the single-authority helper; resolve all four conflicted files to main's version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * ROADMAP §1: CI-humming operations plan (un-throttle runner slots from the modeled budget) (#5682) Single CI-operations authority for the ▸ NOW host-operation-on-.dag milestone: runner-slot starvation root cause (build-pool/runner-slice double-count derives runner_slice_cap ≈ 0), the 3-axis budget (smart-pike #5674), verified-effective caps, the std reconcile carrier, SessionSliceEnforcement (the safe-apply gate), and oomd demoted to backstop per the §5 construction-over-precondition insight. Linked from ROADMAP §1 (orphan-doc lens). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com> Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
briansrls
added a commit
that referenced
this pull request
Jun 23, 2026
…osed fallback, CPU-core term unified with spawn_width, sccache named reservation, emit consumable per-host count (#5674) * WIP: Wire runner-slot count to derived budget model: enforce flag, fail-close * WIP: Wire runner-slot count to derived budget model: enforce flag, fail-close * STAGE-2 PR-2: wire runner-slot count to the derived fleet-resource budget model Consume #5663's conserving fleet_host_budget.runner_slice_cap as the single authority for the GHA runner-slot count, dissolving the §3 fork where the runner slice had two homes (ci_runner_placement.host_runner_slice = host-overhead- session_slice vs fleet_host_budget.runner_slice_cap = host-overhead-baselines- sccache_build_pool-headroom). - CPU-core term unified with spawn_width: new std.realization_width.cpu_cores_available (nproc - margin) is the ONE CPU-core authority. ctrl jobserver cpu_bound now reads it (token count byte-identical), fleet_host_budget exposes effective_runner_cpu_cap from it, and the runner count = int_min(memory_fit, cpu_cores_available) -- the spawn_width min-over-cores shape, minus the >=1 floor (a runner count of 0 is valid -> fail closed). - enforce flag (§5 live-enforcement gate): RunnerSlotEnforcement committed Unenforced because the runner-slice MemoryMax drop-in is inert (effective MemoryMax=INFINITY); a derived count would assume a cap the host does not enforce. Model-sound but live-unenforced still fails closed. - fail-closed fallback: budget-model Unsound OR enforcement Unenforced -> PlanUnsound; no silent legacy-slice fallback (kills the old conservative-fallback fail-open). - sccache named reservation: budget child build_pool -> sccache_build_pool. - consumable per-host emit: runner-deploy lines carry runner_count + per_slot_memory_max_bytes + build_tokens, one line per host, or the typed Unsound reason gracefully (no partial line). Committed manifest correctly emits UNSOUND (preconditions left as-is per §5 guardrail). - operating curve reframed to SESSION-side coverage only (runner count is now independent of the session operating point). Witnessed by execution (claim_batch) -- dual direction: (a) live/committed -> Unsound manifest with typed reason, no host lines; (b) OomdEnforced+HeadroomSet+Enforced spliced test-locally -> real per-host count+cap+tokens. fleet_model_holds, runner_placement_holds, realization_width_witnesses, ci_budget_tree_holds all green. ci_budget_tree.runner_pool_bytes_at left as a named follow-up (separate consumer). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * T0: fix runner-slice double-subtract — runner_slice = host−overhead−session_worstcase−headroom; count = min(mem, build_tokens, cpu) (#5680) * tesgen analysis (#5664) * WIP: tesgen analysis * WIP: tesgen analysis * Wiring-liveness oracle + compile-time lens: plan carrier + roadmap §4 (carrier-modeled) --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> * Slice C: Host metrics extdeps shapes (#5636) * WIP: Slice C: Host metrics extdeps shapes * Slice C: Host metrics extdeps shapes (§3 single-authority shape modeling) Model host metrics data structures in extdeps/os following DESIGN.md §3 de-fusion (shape/transport/policy separation): - proc_meminfo.dag: /proc/meminfo output structure (ProcMeminfo type with memory metrics fields, MemoryMetric for individual key-value pairs) - systemd.dag: systemctl is-active output structure (SystemdUnitActiveState coproduct, SystemdUnitStatus record with wire contract for snake_case encoding) - free.dag: free -b output structure (MemoryStats and SwapStats records in FreeOutput container) All three modules anchor to external authorities (man7.org) per extdeps convention. Test witnesses prove shape construction and invariant checking via executable Bool assertions (mem_available <= mem_total, etc). Each module models shape only; transport (how to fetch) and policy (when/where to call) remain absent, per single-authority principle. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Add NonEmptyStr casting in witness tests (as NonEmptyStr for name fields) * WIP: Slice C: Host metrics extdeps shapes * Fix: resolve unit type violations in host metrics extdeps shapes Replace bare Int fields with proper Measure types in host metrics modules: - proc_meminfo.dag: all memory fields now use Kibibyte (Measure<Memory, Kibi, Nat>) - free.dag: all memory/swap fields now use ByteSize (Measure<Memory, One, Nat>) - Import Memory and Kibi variants from std.measure following §3 single-authority principle - Update test witnesses to cast numeric literals to Measure types - Rename proc_meminfo.dag field value_kibibytes → value for consistency with Kibibyte type Addresses blocking review: unit type violations violate §3 single-authority principle. Establishes Measure as single authority for all physical quantity modeling per std.measure.dag. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * FIX: systemd.dag wire contract with execution + inert carrier roster * Fix fmt: normalize roster comment alignment Cargo fmt --all normalized spacing on SecretValue roster entry. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice C: Host metrics extdeps shapes * Address PR feedback: consolidate Kibibyte alias, remove trivial assertions, mark systemd parallel-representation 1. Move Kibibyte alias from proc_meminfo.dag to std/measure.dag (canonical location per §3 single authority) 2. Update proc_meminfo.dag and witness test imports to consume Kibibyte from std.measure 3. Remove trivial >= 0 assertions on Nat-carried ByteSize values in free witness test (non-discriminating) 4. Add dissolve-on markers to systemd parse/label functions pending contract-driven derivation (§3 parallel-representation scaffold) Addresses: claude/claude-opus-4-7 REQUEST_CHANGES feedback on #5636 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice C: Host metrics extdeps shapes * FIX: Add missing List import to systemd.dag systemd_parse_label_derivation_debt data declaration uses List<NonEmptyStr> but the file lacked the corresponding std.list import. Adding it resolves the compilation error. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * FIX: Remove stale inert carrier roster entries Remove 5 entries that now have external consumers: - Kibibyte (imported by witness tests) - MemoryMetric (imported by witness tests) - MemoryStats (imported by witness tests) - SwapStats (imported by witness tests) - SystemdUnitActiveState (imported by witness tests) Keep FreeOutput, ProcMeminfo, SystemdUnitStatus which still meet inert criteria. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "FIX: Remove stale inert carrier roster entries" This reverts commit 8c06981. * WIP: Slice C: Host metrics extdeps shapes * FIX: Correct witness test syntax for .dag language Three test files had unsupported syntax: 1. os_systemd_witness_test.dag: Bool literals must be lowercase (true/false, not True/False). Changed lines 16, 17, 23, 24 to use correct .dag syntax. 2. os_proc_meminfo_witness_test.dag: Cannot cast Int to Kibibyte with 'as' operator. Changed all Kibibyte casts to record literal syntax: Kibibyte { count: N }. 3. os_free_witness_test.dag: Cannot cast Int to ByteSize with 'as' operator. Changed all ByteSize casts to byte_size(count: N) constructor calls. Added byte_size import to std.measure imports. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Trigger CI run * Retrigger CI (previous run stuck in queue) * FIX: Remove 5 stale inert carrier roster entries Removed entries that gained consumers when host metrics types (Kibibyte, MemoryMetric, MemoryStats, SwapStats, SystemdUnitActiveState) were integrated into extdeps modules: - Kibibyte: moved to std/measure.dag, now imported by proc_meminfo.dag - MemoryMetric, MemoryStats, SwapStats: now consumed by proc_meminfo.dag / free.dag - SystemdUnitActiveState: now consumed by systemd.dag Remaining roster: 11 entries (AccessPolicy, CargoDependency, CargoPackage, FilePermissions, FloorWitnessRow, FreeOutput, GitCliReportedVersion, ProcMeminfo, ReactHookSite, SecretValue, SystemdUnitStatus). * WIP: Slice C: Host metrics extdeps shapes * Revert "WIP: Slice C: Host metrics extdeps shapes" This reverts commit 6bc985a. * Retrigger CI --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Slice B: Docker container stats extdeps shapes (#5635) * WIP: Slice B: Docker container stats extdeps shapes * Fix: correct imports for Nat type in docker shapes Move Nat import to std.nat module where it is defined. Remove unused BlkioStats from witness test imports. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix: Docker shapes de-fuse, duration carriers, wire contract consumption Address four review findings from claude/opus-4-7 and bold-ant-53: 1. **Duration semantics** — CPU times require std.measure carriers, not bare Nat. Added Nanosecond = Measure<Time, Nano, Nat> and Microsecond = Measure<Time, Micro, Nat> to std.measure.dag. Updated container_stats.dag and container_inspect.dag to type: - cpu_usage fields (total, kernel, user, system) as Nanosecond - cpu_period and cpu_quota as Microsecond 2. **Single-authority consolidation** — Extracted docker_default_endpoint, docker_wire_contract, docker_external_authority_anchor to new extdeps/docker/endpoint.dag. Both container_stats.dag and container_inspect.dag now import from endpoint. 3. **Networks fidelity** — Changed from hardcoded eth0 field to Networks.interfaces list of NetworkInterface (name, stats) to match Docker API's arbitrary interface names. 4. **Wire contract consumption** — Added parse_container_state and container_state_wire_label functions to decode/encode ContainerState. Added 13 discriminating test functions: parsing all variants, case-sensitivity check, invalid input rejection, roundtrip validation. Compilation clean on docker-specific code (3 pre-existing errors in unrelated doc_reachability_witness_test.dag). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Refine: Remove inert docker_wire_contract, add memory_stats working-set gap marker 1. **Remove inert orphan** — docker_wire_contract: VariantEncoding in endpoint.dag was imported but never used. Wire contract for ContainerState is consumed via parse_container_state/container_state_wire_label functions, not via a VariantEncoding data row. Removed from endpoint.dag and dropped unused VariantEncoding imports from container_stats.dag. 2. **Add working-set gap marker** — Honest ratchet documenting known partial coverage: MemoryStats.usage includes page cache (inactive_file), true working-set = usage - stats.inactive_file from Docker stats sub-map. Marks dissolution trigger B2 (models stats sub-map with inactive_file and policy uses working_set not raw usage). Compilation clean. Ready for sign-off. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Add tracked-debt markers for three dissolve-on patterns 1. **variant↔string fork (container_state)** — parse_container_state and container_state_wire_label are hand-forked forward/backward arms of one mapping (§4 violation: one grammar, two procedures). Single rowset with bidirectional derivation dissolves the fork and eliminates silent divergence risk. Trigger: B3 models ContainerState wire facts as single authority. 2. **BlkioValue.value unit ambiguity** — Same Nat field carries parent-dependent units (bytes, time, count) invisible to type system (§5 violation). Docker wire format constraint. Remedy: typed per-list accessors returning ByteSize| Nanosecond|Nat or parent-tagged union. Trigger: B3 models BlkioValue with discriminated unit type. 3. **docker_default_endpoint String vs Uri** — Typed as bare String but module imports Uri; anemic-leaf (§2/§5). Same file uses Uri for authority anchor. Ground endpoint as Uri variant carrying socket/http/https/fd schemes. Trigger: B3 grounds docker endpoint with Uri type. All three tracked per §6 framework: honest ratchet markers with named dissolution triggers and layer they belong to (B3 modeling layer). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix: Add dissolve-on markers for anemic-leaf and error-response scaffolds Address REQUEST_CHANGES review findings by adding honest ratchet markers for remaining scaffolds per §6 pattern: 1. **HostConfig/ContainerConfig anemic leaves** (container_inspect.dag:76-78) - cap_add/cap_drop, exposed_ports, port_bindings, volumes, volumes_from, device_requests (HostConfig); env, cmd, entrypoint, labels, volumes, exposed_ports (ContainerConfig) are structured concepts flattened to bare List<String>? (§2 violation: anemic leaves) - Trigger B3: ground each as typed coproduct (PortBinding record, EnvVar record) or decomposed with named axes 2. **NetworkSettings bare-string fields** (container_inspect.dag:104-108) - gateway, ip_address, mac_address should be typed network carriers (IpAddress, MacAddress) not bare String? - Lower stakes since std/network primitives don't exist yet, but marks structured-validation gap (§5 fail-closed) - Trigger B3: introduces network address carriers in std/ or extdeps 3. **Error responses as opaque strings** (both files) - 404/500 => String collapses two distinct error shapes, violates §5 - Docker returns structured JSON error objects with reason/message - Trigger B3: model as ErrorDetail coproduct (NotFound | ServerError variants with typed failure details) All markers follow §6 self-flagged scaffold pattern with closure/, root cause, and B3 dissolution trigger. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Ground ContainerStateDetail.error with ErrorMessage type ContainerStateDetail.error was typed as bare String?, violating bare-primitive-nicknames-concept modeling coherence. Error messages are a semantic concept that must be grounded in a type. Added type ErrorMessage = String to carry the semantic meaning, replacing bare String usage. This grounds the concept per §3 (single authority) and §2 (minimize anemic leaves). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Remove unused import of VariantEncoding/StringVariant/VariantNaming/AsAuthored Dead remnants from the old wire-contract approach. These imports are not used anywhere in the file and violate §3 (minimize redundancy). Removing them eliminates potential compile errors and cleans up the module's actual dependencies. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Address review findings: add cpu_percent ratio tracking + fix Optional matcher consistency - Add dissolve_on_cpu_percent_ratio_carrier to container_stats.dag documenting bare Float? unit modeling gap (§5); triggers B3 grounding with Ratio/PercentagePoint type alias - Fix container_inspect.dag optional accessors to use consistent Present/Absent pattern instead of null matching (all three: memory_limit, cpu_quota, cpu_period) Both findings valid from claude/claude-opus-4-7 review #5635. Dissolve-on marker ensures tracking discipline; pattern consistency prevents silent wildcard-fallthrough risk. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Add dissolve markers for ContainerStateDetail redundancy + container_state_is_running symmetry - Add dissolve_on_container_state_detail_redundant_bools documenting parallel status coproduct + redundant bool fields allowing illegal states; marks for B3 resolution via bool predicates derived from status only - Add dissolve_on_container_state_predicate_family for symmetry with parse/wire-label pair (both marker-tracked); documents handrolled predicate helper discipline gap and marks for B3 consolidation Both findings from claude/claude-opus-4-7 review #5635 (non-blocking nits, but valuable tracking discipline). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Add dissolve marker for HostConfig.memory_swap -1 unlimited convention loss HostConfig.memory_swap: ByteSize? loses Docker wire convention where -1 encodes 'unlimited'; Nat-backed ByteSize cannot represent -1, causing fidelity gap at extdeps boundary. Added dissolve_on_memory_swap_unlimited_convention marker documenting the gap and B3 trigger (coproduct variant or tagged union to preserve wire semantics). Finding from claude/claude-opus-4-7 review #5635 (APPROVE, non-blocking). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Fix: Remove unescaped braces in dissolve_on_hostconfig_containerconfig_anemic_leaves string Unescaped { and } in the example text caused .dag parser to treat them as template interpolation markers, failing on colon in field names. Rephrase example without braces. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix: Test all container state roundtrips instead of unused list binding Remove unused `states` binding and expand roundtrip test to verify all 5 ContainerState variants (Running, Paused, Exited, Dead, Restarting) roundtrip correctly through parse/wire-label functions per review feedback. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * WIP: Slice B: Docker container stats extdeps shapes * Fix REQUEST_CHANGES architectural violations per parent guidance Three fixes applied per Section-8 guidance: Fix 1 — Remove container_state_is_running predicate (§2/§3) - Delete function and dissolve_on marker (lines 163-168) - Callers now inline: match state { Running => ... _ => ... } - Update test file imports and remove predicate-only tests - Keep predicate-using test (sample_inspect_has_running_state) via direct equality Fix 2 — Ground parse/wire-label fork via CoproductWireContract (§4) - Add container_state_wire_contract data item - Import CoproductWireContract, StringVariant, SnakeCase from std.serialization - Rename dissolve_on_variant_wire_fork_container_state to structural_coverage_gap_container_state_codec_hand_rolled - Update marker text to reference contract and remove B3 reference Fix 3 — Rewrite all B3 references with concrete triggers - container_inspect.dag (5 markers): wire-deserialization, Unlimited variant, typed carriers, network addresses, typed errors - container_stats.dag (3 markers): Ratio/PercentagePoint, typed errors, typed/tagged union Verification: gunbc compile --source-root dsl → 0 docker diagnostics Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Brian Searls <11205878+briansrls@users.noreply.github.com> * BMC onboarding: complete srv3 lifecycle orchestration (.dag) + GCP store §3 fix (#5661) * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * BMC onboarding lifecycle: 4-phase model + Redfish write seam + read-only validation Models the onboarding of the operator's new Altra server (BMC 192.168.1.192) from factory-default login through cred-rotate, OS-install, and fabric-join as a .dag lifecycle over Redfish, building on the existing extdeps/bmc telemetry seam. - extdeps/bmc/types.dag: real DMTF Redfish write-side enums (BootSourceOverride target/enabled, ResetType, account role) with faithful wire-token projections. - extdeps/bmc/http.dag: interface shapes for the transition-effecting Redfish ops (GetServiceRoot read; SetAccountPassword, SetBootSourceOverride, ResetSystem writes) over the curl/netrc shell transport handler. Secrets ride a runtime request_body_file, never argv or the repo. - gunbc/bmc_onboarding.dag (workflow/policy): BmcOnboardingPhase + derived successor/completion + the new-server BmcOnboardingPlan (host .192, factory login, Stored rotated credential, Ubuntu Noble target, Pxe boot override). - gunbc/tools/bmc_onboard.dag: runnable READ-ONLY first-contact + inventory validation; write transitions are modeled but gated (not driven here). - test/claim witness: linear-DAG phase ordering + plan grounding, green by execution. Grounded against the live BMC at 192.168.1.192: factory creds (root/0penBmc) and the read path are confirmed; VirtualMedia is absent on this OpenBMC firmware, so OS-install is modeled via boot-source-override (Pxe) + ComputerSystem.Reset. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review #5563: drop redundant phase_order roster (§3 single authority) bmc_onboarding_next_phase is now the sole authority for the linear successor relation; the standalone bmc_onboarding_phase_order list duplicated it. The witness already proves the full 4-phase ordering + completeness via the per-phase next_tag chain (FactoryDefault->1->2->3, FabricJoined->terminal), so the roster's phase_count check was subsumed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review #5563: rename bmc_onboard -> bmc_onboard_validate (honest tool name, §5) The tool only performs the read-only FactoryDefault validation (GetServiceRoot + GetSystem); it does not drive cred-rotate/OS-install/fabric-join. Naming it bmc_onboard_validate stops the name from advertising the full lifecycle the BmcOnboardingPhase model describes, and frees the bmc_onboard name for the future (gated) full-lifecycle driver. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * review #5563: delete bmc_onboarding_is_complete (single-caller predicate) The predicate had one caller (the witness) and the witness's next_tag chain already proves completion (FabricJoined -> -1 = terminal; others -> 1/2/3). Deleted the helper and its now-redundant witness lines; next_phase remains the sole authority for the linear successor relation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * bmc_onboard: rotate+reauth leg of the onboarding orchestration (compile-verified, live-gated) Assemble the credential-rotation leg of orchestration C over new_altra_onboarding_plan, now that Lane B (#5634) landed the Redfish auth-as-Secret seam on main: materialize the netrc + PATCH body via Filesystem.Write (executable file effect), SetAccountPassword (Redfish write), then reauth with the new credential to VERIFY the rotation took — fail-closed if rejected. The minted Secret is declassified to String exactly once, explicitly (the Secret type forbids accidental exposure). Verified by execution: gunbc compile --source-root dsl => 464 modules, 471 files, 0 diagnostics — the legs typecheck and compose. LIVE execution is operator-fenced (first destructive write); live-correctness of account_id/body shape is confirmed only by the gated run against .192, not this typecheck. Not a *_test.dag, so it does NOT auto-enroll as a floor witness (no false CI-coverage claim). §5 debt (named): the netrc + body files transiently hold the credential on disk at default umask with no post-run unlink; dissolution = mode-0600 file write + unlink leg. gen+store leg (entropy mint #5633 -> base64 -> GCP store) wires in once #5633 lands; os-install leg pends Lane E (#5638). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * bmc_onboard: complete srv3 onboarding orchestration (acquire→gen+store→rotate→reauth→os-install) Assemble the full lifecycle as one .dag workflow over new_altra_onboarding_plan + srv3_os_install_plan, now that all four lanes (entropy #5633, auth-Secret #5634, OS-install #5638) landed on main: acquire — GetServiceRoot + factory-login GetSystem (read; proven live earlier) gen — mint a credential from OS entropy (extdeps.entropy Urandom), FAIL-CLOSED on the Optional (never a fabricated/empty credential — dissolves the witness scaffold's empty-string arm per cool-lynx's dissolution trigger) store — base64 of the same octets -> GCP AddVersion (durability) under the plan's secret id; token via gcloud rotate+reauth — Filesystem.Write netrc + PATCH body, SetAccountPassword, reauth with the NEW credential to verify the rotation took (fail-closed) os-install — re-materialize netrc with the NEW credential (factory netrc is now stale), SetBootSourceOverride(Pxe,Once) + ResetSystem(ForceRestart) via the Lane-E wire fns to boot srv3 into the PXE/autoinstall path Legs chain on ProcessExit so any failure short-circuits. The minted Secret is declassified to String exactly once, explicitly (the type forbids accidental leak). Verified by execution: gunbc compile --source-root dsl => 480 modules, 488 files, 0 diagnostics. The pure wire-shape builders (netrc line, Redfish PATCH/POST JSON bodies, GCP secret name) have by-execution witnesses — all 5 green via --claim-run. The live Redfish/GCP/entropy legs are OPERATOR-FENCED (destructive); their live correctness is confirmed only by the gated run against .192, not this typecheck. §5 debt (named): netrc/body files transiently hold the credential on disk at default umask with no unlink; dissolution = mode-0600 file write + unlink leg. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * review #5661: mark bmc_credential_bytes + JSON-concat scaffolds; add cred-only entry point Address review #32107: - bmc_credential_bytes: Int gets a 🟡 marker riding extdeps.entropy's entropy_count_bytes_unit_debt (same bytesize-argv-interpolation dissolution) — no longer an unmarked *_bytes-on-Int. - the concat-built Redfish PATCH/POST bodies get a 🟡 dissolve-on marker (safe for the current base64url-credential + enum-wire call sites, which the body-shape witnesses pin; dissolution = a structured JSON-object encoder authority). Also adds bmc_assimilate_srv3_credential — a credential-only entry point (acquire -> gen -> store(read-back gated) -> rotate -> reauth, STOPPING before os-install) so the live BMC credential assimilation can run while no PXE/install server exists yet (running the full bmc_onboard_srv3 would reset srv3 into a dead PXE boot). Refactors the shared store+rotate into bmc_store_and_rotate (no duplication). Compile clean (488 files, 0 diagnostics); body-shape witnesses green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * fmt: collapse resolve_auth call site to one line (cargo fmt --check) The auth_input fix's call-site edit split the let-binding across two lines; rustfmt wants it on one (fits in width). cargo fmt --all --check now clean — this was the rust_tests CI failure on 311ff38 (fmt gate), not a logic issue. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: BMC onboarding lifecycle for new Altra server (BMC 192.168.1.192): model * bmc_onboard: dissolve the entropy decode→encode identity round-trip (§2, review #32137) mint_credential_octets base64_decode'd Urandom.octets_b64 to List<UInt8>, then credential_from_octets base64_encode'd it straight back — base64_encode∘base64_decode is identity, so the octets intermediate (and the Optional failure mode that could only trip on a base64_decode bug, never on real Urandom output) bought nothing. Collapse to one fn: mint_bmc_credential() = Urandom.ReadBytes(count).octets_b64 as Secret. The credential IS the base64 entropy string directly — same string set on the BMC, stored as the GCP payload, and compared in the read-back gate (identity preserved; the BMC password is byte-for-byte what it was). Drops the std.encoding + std.integer{UInt8} imports and the unused ExitFailure. Fail-closed now lives at the Urandom service call (nonzero exit raises). Compile 488/0, body witnesses green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * WIP: Wire runner-slot count to derived budget model: enforce flag, fail-close * WIP: Wire runner-slot count to derived budget model: enforce flag, fail-close * Fix main-red regression: lens-test v2_source_roots missing dsl root after 5647 disposition import, plus regen 2 github pipeline snapshots after 5644 restructure (#5672) * WIP: Fix main-red regression: lens-test v2_source_roots missing dsl root afte * Resolve merge conflicts: take main's v2_layer_roots() and typed-field assertions #5668 landed equivalent fixes using the single-authority helper; resolve all four conflicted files to main's version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * ROADMAP §1: CI-humming operations plan (un-throttle runner slots from the modeled budget) (#5682) Single CI-operations authority for the ▸ NOW host-operation-on-.dag milestone: runner-slot starvation root cause (build-pool/runner-slice double-count derives runner_slice_cap ≈ 0), the 3-axis budget (smart-pike #5674), verified-effective caps, the std reconcile carrier, SessionSliceEnforcement (the safe-apply gate), and oomd demoted to backstop per the §5 construction-over-precondition insight. Linked from ROADMAP §1 (orphan-doc lens). Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com> Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Resolve merge: keep counted-once runner_slice_cap (4-arg, no build_pool subtract) + import RunnerSliceCapEffectiveness from ci_floor_measurement single-authority home (drop #5687 5-arg double-subtract form per bright-stag §2/§3 2026-06-23 ruling) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansearls1@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com>
This was referenced Jun 24, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
docs/plans/ci-humming.md— the single CI-operations authority for ROADMAP §1's ▸ NOW host-operation-on-.dagmilestone, and a §1 pointer to it (orphan-doc lens).Why
CI is throttled to ~3 runner slots/host on idle 128c/125GiB boxes — PRs queue while cores loaf. Root cause: the budget model derives
runner_slice_cap ≈ 0because build memory is double-counted (subtracted asbuild_poolAND re-charged in the per-job peak divisor). This plan is the single authority that ties together the in-flight fixes so we stop dropping pieces:Doc-only; no code or gate changes.
🤖 Generated with Claude Code