Host-effect interface Phase A: mint apply(target,effect,policy) -> Reconciliation over the HostEffect coproduct per docs/plans/host-effect-orchestration.md (MERGED spec). Model-only + ShellCommand arm REALIZED green-by-execution + RedfishAction arm fail-closed Unimplemented stub. Co-mint with neat-b

[gunbai-bot]

Host-effect interface Phase A: mint apply(target, effect, policy) -> Reconciliation

Mints the one host-operation interface (docs/plans/host-effect-orchestration.md, MERGED spec) as new .dag. Phase A only — model-before-implement; no B/C/D/E/F.

What lands

gunbc.host_effect (agnostic interface — only the shapes):

• HostEffect = ShellCommand { script } | RedfishAction { action } — a COPRODUCT of effect-kinds (a Redfish op is a typed action, not bash).
• NodeControlPlane = HostOs { node } | BmcController { node } — target-duality: a logical node has two control planes (in-band OS shell/systemd, out-of-band BMC Redfish). apply targets a control plane, not a host address; the target supplies the WHERE (resolved over fleet_intent), the effect is pure intent.
• Policy = OneShotIdempotent | ConvergeToFixpoint; HostEffectIntent (provenance); HostEffectEvidence.
• Return REUSES std.realization_reconcile.Reconciliation<A,E> — NO second receipt grammar (DESIGN §3 single-authority).

gunbc.host_effect_realize (dispatch + realization — peripheral to the interface, DESIGN §3):

• resolve_host_effect_cell = the single total dispatch fold over (control-plane × effect-kind), no _ => arm → an incompatible combo (RedfishAction@HostOs, ShellCommand@BmcController) is a typed IncompatibleCell refusal, unwritable-bad-state not a silent no-op (DESIGN §5).
• ShellCommand@HostOs REALIZED over LocalShell (extdeps.shell.shell.Exec.Run), grounded inline from the observed exit (nonzero exit → DoesNotGround → NotConverged; a failing read can never fabricate Converged).
• RedfishAction@BmcController = fail-closed Unimplemented NotConverged stub — never a fake success on a power/boot action (the exact §5 trap). neat-boar-71 realizes it over RedfishRest in Phase C.
• host_effect_policy_directive: Converged → Settled; incompatible refusal → Refused (terminal regardless of policy — a mismatch never converges, so ConvergeToFixpoint can't re-drive it forever); compatible NotConverged → ReDrive (Converge) / Settled (OneShot). This is the seam neat-boar's Phase-C poll-loop composes on.

extdeps.bmc.types: RedfishSystemAction arm TYPE (4 variants, FINAL-pinned with neat-boar: SetBootSourceOverride / ResetSystem / SetAccountPassword{new_password: Secret} / GetSystem), reusing the existing boot/reset enums + std Secret; no host/system_id/creds fields (the WHERE is the BmcController target, keeping the action transport-agnostic).

Execution evidence (not grep)

• host_effect_apply_holds green by execution — 9 sub-witnesses over all four cells (real sh -c true / sh -c "exit 1") + the policy directive.
• Discriminating RED control proven: flipping the fail-closed assertion (expect a failing shell to converge) flips the witness RED (FAIL). The green is earned.
• Compile-clean gate (gunbc compile --target rust, whole corpus): 597 files, 0 diagnostics.

Review notes

• Layer (smart-newt): homed in gunbc.* (the application layer above the product domain models, imports point toward std), not literally product/. Confirmed correct.
• NodeControlPlane.node : ComputeHost (neat-boar point . #3): confirmed the right carrier — ComputeHost binds BmcEndpoint per node via baseboard.bmc (and HostIdentity via identity), so Phase-C BmcController(node) resolves bmc_host + creds over fleet_intent without an interface refactor. Settled in A, verified by neat-boar.
• ShellCommand.script : String (claude-opus-4-7, non-blocking 🟡): a Phase-A scaffold — the in-band arm carries a raw bash string for the same reason there's no shell-action grammar yet (symmetric to RedfishAction being typed). Dissolves onto a future shell-action AST authority when one exists; tracked here rather than as an inert marker.
• Three prose _doc: String constants were removed (zero-consumer; the corpus-wide prose-in-data retirement). Rationale lives in this description + commit history. Typed refusal strings inside the IncompatibleCell / NotConverged arms stay — those are located diagnostics, not docs.

[gunbai-bot]

Re: claude-opus-4-7's non-blocking nit — host_effect_policy_directive re-running resolve_host_effect_cell to recover the Refused branch.

This is a pure re-derivation from the single authority, not a stored parallel representation. HostEffectIntent (carried in Reconciliation.applied) is the one source of (target, effect); resolve_host_effect_cell is a deterministic total fold over it, so re-running it recomputes the cell from that single authority rather than reading a second copy. The alternative — encoding 'this NotConverged is a terminal mismatch vs a retryable drift' into the NotConverged.reason String and parsing it back out — would be the actual stringly §3 fork. Keeping the discriminant as a re-fold over the typed intent is the more §3-correct choice, and (as the reviewer notes) it's internal to one file. Leaving as-is; thanks for the careful read.

— sent from lively-stag-276