CD deploy: require srv1 target-host proof before LocalShell apply by gunbai-bot[bot] · Pull Request #6115 · gunb-ai/gunbc

gunbai-bot · 2026-07-01T22:43:56Z

Summary

Fixes the CD transport premise (#6093 follow-on): deploy_dashboard_srv1 is a srv1 effect, but job placement alone is not a host proof. This PR:

Pins the deploy job to [self-hosted, linux, arm64, srv1] instead of Ubicloud
Adds DeployTargetHostProof (RunnerIdentityOnHost | SshExplicitHost) in dsl/gunbc/ci_deploy_target_host.dag
Extends deploy preflight to fail-closed unless hostname or RUNNER_NAME proves srv1 (non-srv1 / Ubicloud runners refuse)
Models SshShell-over-tailnet as an alternate structural proof path (ssh_host must match target host identity)

Test plan

claim_batch --source-root dsl --entry dsl/test/claim/ci_deploy_target_host_witness_test.dag --function ci_deploy_target_host_witnesses --claim-run → PASS
claim_batch --source-root dsl --entry dsl/test/claim/ci_deploy_witness_test.dag --function ci_deploy_witnesses --claim-run → PASS
Full CI floor (known inherited reds on main until Fix main-red: de-fork extdeps.shell + loud module-collision wall + nbd_proxy_serve anchor #6112 merges; not blocking this change)

…dashboar

…flight. LocalShell deploy_dashboard_srv1 now requires runner identity to prove host=srv1 (hostname or RUNNER_NAME), pins the deploy job to [self-hosted, linux, arm64, srv1], and models SshShell-over-tailnet as an alternate structural proof path. Co-authored-by: Cursor <cursoragent@cursor.com>

…in). Retriggers CI on the parse-fix commit; picks up #6112 extdeps.shell de-fork. Co-authored-by: Cursor <cursoragent@cursor.com>

Add deploy_target_host_preflight_shell_dissolution_trigger on the shell-emit carrier and enroll dsl/gunbc/ci_deploy_target_host.dag plus its witness test on medium_structure_exception_roster (HAND-SHELL gate parity with ci_deploy_access). Co-authored-by: Cursor <cursoragent@cursor.com>

gunbai-bot · 2026-07-01T23:12:00Z

Addressed all three medium-structure findings in 9758e68:

ci_deploy_target_host.dag — enrolled on medium_structure_exception_roster (alongside ci_deploy_access.dag).
deploy_target_host_preflight_shell_dissolution_trigger — on-carrier 🟡 dissolve-on marker added to the shell-emit module (same dissolution path as deploy_access_preflight_shell).
ci_deploy_target_host_witness_test.dag — enrolled on roster (check-side string_contains over expected_ci_yml(), same pattern as ci_deploy_witness_test.dag).

Merge conflict with main was already resolved in 710951a (deploy job keeps [self-hosted, linux, arm64, srv1]; ci/rust_tests stay fleet self-hosted post-#6111).

— sent from fierce-wren-456

…dashboar

gunbai-bot · 2026-07-01T23:21:22Z

Addressed both non-blocking nits from the Opus APPROVE review:

pinned_label redundancy — collapsed RunnerIdentityOnHost to { host: HostIdentity } only; the srv1 pin lives in gunbc_ci_deploy_srv1_runner_spec() (job placement), runtime proof reads host alone.
grep quoting — switched grep -q '…' to grep -Fq "…" so a future HostIdentity containing ' cannot corrupt the shell block. Full structural shell-safe embed belongs in the host_effect emit dissolution (General orchestration intent to Bash emit fold over grammar rows #5828), same as the rest of this preflight debt.

— sent from fierce-wren-456

gunbai-bot · 2026-07-01T23:25:53Z

Verified the Composer APPROVE review against d9d7a0d: no findings, no code changes required. The approval matches current HEAD (srv1-pinned runner, collapsed RunnerIdentityOnHost, grep -Fq preflight, roster + dissolution marker).

Merge blockers remaining: CI in progress on d9d7a0d; Claude approval is on prior SHA 9758e686 (stale pending re-review on nit-fix commit).

— sent from fierce-wren-456

@host

Model layer uses @host- / @host. / @host suffix patterns; preflight uses grep -Eq '@host(-|\\.|$)' so RUNNER_NAME cannot satisfy proof via prefix overlap. Co-authored-by: Cursor <cursoragent@cursor.com>

gunbai-bot · 2026-07-01T23:36:56Z

Fixed the anchored-runner-name nit from the Opus APPROVE on d9d7a0d:

Model: runner_name_proves_host_identity now accepts exact hostname, @srv1-, @srv1., or @srv1 suffix — not bare substring (srv12 no longer matches srv1).
Preflight: grep -Fq → grep -Eq '@srv1(-|\\.|$)' (same anchor in emitted bash).
Witness: added witness_srv12_runner_name_refused_for_srv1_deploy.

— sent from fierce-wren-456

gunbai-bot · 2026-07-01T23:45:56Z

Verified Opus APPROVE review #34502 on 5fbb108: no findings, no code changes required. Review confirms current HEAD (anchored runner-name proof including srv12 negative witness, roster + dissolution marker, srv1-pinned deploy job).

Merge readiness on 5fbb108: 2/2 dashboard approvals (claude + cursor), no REQUEST_CHANGES, MERGEABLE — awaiting ci floor job (rust_tests green).

— sent from fierce-wren-456

gunbai-bot · 2026-07-01T23:46:14Z

Verified Composer APPROVE review #34503 on 5fbb108: no findings, no code changes required. Confirms prior Opus approval — target-host proof, srv1 runner pin, fail-closed preflight, roster/dissolution marker, and witness coverage are all in place on current HEAD.

Merge blockers: only ci floor job still pending (rust_tests green, 2/2 approvals, MERGEABLE).

— sent from fierce-wren-456

Export deploy_target_host_preflight_script; live_deploy runs target-host host_effect_apply before deploy_access_preflight_script so privilege PR (#6114) can replace the latter without dropping runtime host proof. Co-authored-by: Cursor <cursoragent@cursor.com>

Rebase onto fierce-wren-456: decision_meet preserves left denial reason; preflight and live_deploy_fold meet deploy_access_check_observed with deploy_target_host_check_observed before host_effect_apply; Cartesian witness in deploy_mutation_gate_witness_test.dag. Co-authored-by: Cursor <cursoragent@cursor.com>

Export deploy_target_host_preflight_script; decouple privilege script. live_deploy_access_preflight: target-host host_effect_apply then typed deploy_access_check_observed. Mutation path unchanged: decision_meet(host, access) via deploy_mutation_gate before host_effect_apply_gated. Co-authored-by: Cursor <cursoragent@cursor.com>

Keep privilege model (#6114) on top of main's target-host composition surface: typed deploy_mutation_gate, deploy_access_check_observed preflight step, and modeled host observation helpers. Co-authored-by: Cursor <cursoragent@cursor.com>

…des done The three verification-target PRs merged without self-marking their nodes; central-marker flips 2-cd-transport, 2-live-read-runner-memory, and 2-compile-clean-shard-a to done: true (render 'awaiting sign-off' — operator sign-off stays separate). Drift gate, roadmap witnesses, doc-graph all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

@host

* WIP: 2-privilege-model: privilege model for host mutation — extend DeployAcce * WIP: 2-cd-transport: CD deploy target-host proof — LocalShell deploy_dashboar * WIP: 2-privilege-model: privilege model for host mutation — extend DeployAcce * Fix privilege model compile errors and green witness execution. Resolve NonEmptyStr? branch typing in deploy_access_observed_principal and correct NodeControlPlane return type in the privilege witness test. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: 2-cd-transport: CD deploy target-host proof — LocalShell deploy_dashboar * Add CD deploy target-host proof: srv1-pinned runner + fail-closed preflight. LocalShell deploy_dashboard_srv1 now requires runner identity to prove host=srv1 (hostname or RUNNER_NAME), pins the deploy job to [self-hosted, linux, arm64, srv1], and models SshShell-over-tailnet as an alternate structural proof path. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: 2-privilege-model: privilege model for host mutation — extend DeployAcce * Consolidate deploy access verdict onto std.access.AccessDecision. Extend Deny with an optional located reason so privilege refusal uses the single std authority instead of a parallel DeployAccessVerdict coproduct. Widen the on-carrier dissolve trigger to name deploy_access_sudo_check_cmd. Co-authored-by: Cursor <cursoragent@cursor.com> * Address medium-structure review: roster ci_deploy_target_host + witness. Add deploy_target_host_preflight_shell_dissolution_trigger on the shell-emit carrier and enroll dsl/gunbc/ci_deploy_target_host.dag plus its witness test on medium_structure_exception_roster (HAND-SHELL gate parity with ci_deploy_access). Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: 2-cd-transport: CD deploy target-host proof — LocalShell deploy_dashboar * Address review nits: std.access import + sudoers denial hint. Import AccessDecision from std.access in host_effect_realize (not via ci_deploy_access re-export). Restore actionable sudoers line in modeled sudo-miss refusal; witness the fixture path. Co-authored-by: Cursor <cursoragent@cursor.com> * Anchor runner-name host proof: reject srv12-for-srv1 substring match. Model layer uses @host- / @host. / @host suffix patterns; preflight uses grep -Eq '@host(-|\\.|$)' so RUNNER_NAME cannot satisfy proof via prefix overlap. Co-authored-by: Cursor <cursoragent@cursor.com> * WIP: 2-privilege-model: privilege model for host mutation — extend DeployAcce * WIP: 2-privilege-model: privilege model for host mutation — extend DeployAcce * Address cursor review: drop dead predicate, inline privilege match. Delete unused deploy_access_decision_is_permit; inline privilege_denial match in host_effect_policy_directive (remove helper predicate). Import AccessDecision from std.access in live_deploy/apply. Co-authored-by: Cursor <cursoragent@cursor.com> * Align preflight with #6115 composition surface (host gate first). Export deploy_target_host_preflight_script; decouple privilege script. live_deploy_access_preflight: target-host host_effect_apply then typed deploy_access_check_observed. Mutation path unchanged: decision_meet(host, access) via deploy_mutation_gate before host_effect_apply_gated. Co-authored-by: Cursor <cursoragent@cursor.com> * Close merge gaps: both-deny witness + hermetic shell.Exec.Run mock. Pin wrong-host×unprivileged both-deny left-reason precedence (host reason survives; access reason not surfaced). Add mock_response on shell.Exec.Run and shell.Exec.Check so deploy_mutation_gate may-apply passes --dry-run --claim-run. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Cursor <cursoragent@cursor.com>

* WIP: fable * WIP: fable * WIP: fable * WIP: fable * Roadmap: fold in operator directives + 2026-07-01 live findings - §2 posture: required CI back on the fleet (#6111 revert; Ubicloud detour bought no wall-clock — serial compile-clean wall dominates); milestones updated; fleet-return group becomes fleet-hardening (the return happened ungated, the gates are now owed). - New: 2-compile-clean-serial (the ~47min width-immune dominant cost + its three levers), 2-runner-shape (operator 1:3 core:GiB + swap slot contract), cap-deconflation corrected (width=9 was live by construction; the deferred item was only the concept rename), CD-transport reframed post-revert, G4 gains the dup-run + lingering in_progress evidence. - §3 audit: 3-audit-artifact-freshness (operator freshness-gate ask; the .gitignore landed-drift incident as the RED receipt, closes via the merge-admission freshness block) and 3-audit-gate-disagreement (compile-clean green while discovery red on the same tree — the extdeps.shell collision; one tree, one verdict). - §1 5-defork gains the live evidence line (the shell fork kept main red). Witnesses re-targeted in lockstep; verified by execution: main_wet regen, drift gate, roadmap_authority_witnesses, doc-graph orphans+dangling all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: operator review + fabric dispatch design + stateless-frontend MVP Applies the operator's three directives in one lockstep batch: 1. Roadmap-review blockers: - Ubicloud tone: detour was the diagnostic + emergency valve, not a failure; stays the break-glass/burst option. - CD transport reframed as target-host proof (LocalShell valid only when runner identity proves host=srv1), not Ubicloud-specific. - v1-collapse dependency edges now REAL: roadmap_spawner readiness is all-parents (node_dep_done folds every edge, not the first), with a RED/GREEN multi-parent witness; 5-collapse-v1 gains edges from dissolve-patches, test-migration, seed-honesty, defork. - workload-class admission model + cap/admission de-conflation (three facts, one knob today) + sound host admission (Guaranteed vs Burst with Σ-accounting receipts) + live host read seam as first-class nodes; G1 stale "dormant on Ubicloud" conditional fixed (cursor review finding on #6110). - Floor group renamed: throughput — reduce work, then schedule it. - Shelf: privacy/isolation model + structural correctness walls. 2. Fabric dispatch design (operator-signed): core design rule prose (ProviderOffer adapter / RunShape→Allocation→Receipt / strict default / oversubscription earned by receipts), StrictLease Policy 0, CI shape labels (runs-on as a projection; runner availability is backpressure), ProviderOffer rows + dormant-Ubicloud design-break probe, BurstLease Policy 1; TERMINAL reworded to "required CI runs on the compute fabric"; converge re-land gains the narrow srv2 first-acceptance case; ordering prose ①–⑩. 3. Stateless frontend MVP on fabric: first non-CI product-shaped consumer (SiteArtifact/WebServiceShape/DomainRoute/ServiceAllocation, manual DNS, digest-proving receipt, milestones A/B), service allocation receipt under control plane, fabric-hostable rule prose, shelf HTML line scoped. Verified by execution: main_wet regen, drift gate, roadmap_authority witnesses (new fabric pins + updated interleaving neighbor), spawner witnesses (incl. new all-parents RED control), doc-graph orphans + dangling links — all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * WIP: fable * Roadmap dispatch utility + first-receipt splits + converge edge-direction fix Operator ask: a small utility returning the active/needed work items to dispatch from the roadmap (frontend/visualization seam, useful now). - gunbc.roadmap_spawner gains roadmap_dispatch_json (single authority for spawn semantics): {ready (full node rows), upcoming (node + unmet_parents), done}. node_json also emits parent_node_ids (all parents — folds in claude's non-blocking #6110 finding; single parent_node_id kept for bridge back-compat). json_escape now escapes newlines (latent invalid-JSON bug, witnessed). - dsl/tools/roadmap_dispatch.dag: `claim_batch --source-root dsl --entry dsl/tools/roadmap_dispatch.dag --function main --wet` writes target/roadmap-dispatch.json (schema roadmap-dispatch-file/v1, embeds the M0-M3 worker-brief template). - First-receipt splits per operator dispatch review: 1-resolver-pathology → -a (profile receipt only) / -b (fix one confirmed pathology, edge b←a); 2-live-read-runner-memory as the first slice of the read seam (seam gated on it); 2-privilege-model sized with RED/green acceptance. - Edge-direction fix (operator structural concern): 2-converge-reland now DEPENDS ON 2-live-read-seam + 2-privilege-model (was inverted: privilege as converge's child); umbrella g2-runner edge removed so it cannot gate; periodic-actuation ← converge kept. Verified by execution: spawner witnesses (new dispatch-partition + newline-escape RED controls), authority witnesses, main_wet regen, drift gate, doc-graph — PASS; utility run produces valid JSON with 11 ready / 4 gated, gates matching the signed ordering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: dispatch compile-clean shard A (first-receipt split) + mark owned Operator go-ahead post-merge of #6110/#6111/#6112. 2-compile-clean-shard-a (partition boundary + ONE shard + compose proof, no scheduler enrollment) dispatched as adhoc-3e95c046-279 and marked owned; 2-compile-clean-shard-b (floor-plan enrollment + before/after batch-1 wall receipt) gated on A. Verified: regen, drift gate, authority + spawner witnesses PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap: mark 3-audit-gate-inventory done (#6116 merged) #6116 (gate-inventory audit + pilot red-control) merged without flipping its node, unlike #6120 which self-marked. Set done: true to parity with the resolver node — both now render "⏳ awaiting sign-off" (the [x] checkbox is gated on operator sign-off by design, not merge alone). Verified: main_wet regen, drift gate, roadmap_authority_witnesses PASS; dispatch file moves 3-audit-gate-inventory to the done partition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap #6122: drop #6120 duplicate resolver node + heal doc-graph orphan Addresses cursor REQUEST_CHANGES on #6122: - Finding 3 (real): removed 1-resolver-pathology-receipt, a #6120-introduced near-verbatim duplicate of 1-resolver-pathology-a (§2 parallel representation). - Findings 1/2 (drift-heal, not regression): done:true renders "[ ] — ⏳ awaiting sign-off" by design (box = signoff_accepts, not merge); #6120 had committed ROADMAP.md with resolver-A as [x] with no sign-off — that was drift, and the regen heals it to the honest awaiting-sign-off state. - Also heals a pre-existing doc-graph orphan: mechanism-inventory-red-controls.md (#6116) was link-unreachable; attached it to the 3-audit-gate-inventory node via a new with_plan helper (keeps the node sized). Verified: main_wet, drift gate, roadmap_authority_witnesses, doc-graph orphans + dangling links all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap #6122: keep PR scoped — move hostname-converge demo off this branch Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap #6122: sync main (#6113/#6115/#6118) + mark those 3 merged nodes done The three verification-target PRs merged without self-marking their nodes; central-marker flips 2-cd-transport, 2-live-read-runner-memory, and 2-compile-clean-shard-a to done: true (render 'awaiting sign-off' — operator sign-off stays separate). Drift gate, roadmap witnesses, doc-graph all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* WIP: fable * WIP: fable * WIP: fable * WIP: fable * Roadmap: fold in operator directives + 2026-07-01 live findings - §2 posture: required CI back on the fleet (#6111 revert; Ubicloud detour bought no wall-clock — serial compile-clean wall dominates); milestones updated; fleet-return group becomes fleet-hardening (the return happened ungated, the gates are now owed). - New: 2-compile-clean-serial (the ~47min width-immune dominant cost + its three levers), 2-runner-shape (operator 1:3 core:GiB + swap slot contract), cap-deconflation corrected (width=9 was live by construction; the deferred item was only the concept rename), CD-transport reframed post-revert, G4 gains the dup-run + lingering in_progress evidence. - §3 audit: 3-audit-artifact-freshness (operator freshness-gate ask; the .gitignore landed-drift incident as the RED receipt, closes via the merge-admission freshness block) and 3-audit-gate-disagreement (compile-clean green while discovery red on the same tree — the extdeps.shell collision; one tree, one verdict). - §1 5-defork gains the live evidence line (the shell fork kept main red). Witnesses re-targeted in lockstep; verified by execution: main_wet regen, drift gate, roadmap_authority_witnesses, doc-graph orphans+dangling all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: operator review + fabric dispatch design + stateless-frontend MVP Applies the operator's three directives in one lockstep batch: 1. Roadmap-review blockers: - Ubicloud tone: detour was the diagnostic + emergency valve, not a failure; stays the break-glass/burst option. - CD transport reframed as target-host proof (LocalShell valid only when runner identity proves host=srv1), not Ubicloud-specific. - v1-collapse dependency edges now REAL: roadmap_spawner readiness is all-parents (node_dep_done folds every edge, not the first), with a RED/GREEN multi-parent witness; 5-collapse-v1 gains edges from dissolve-patches, test-migration, seed-honesty, defork. - workload-class admission model + cap/admission de-conflation (three facts, one knob today) + sound host admission (Guaranteed vs Burst with Σ-accounting receipts) + live host read seam as first-class nodes; G1 stale "dormant on Ubicloud" conditional fixed (cursor review finding on #6110). - Floor group renamed: throughput — reduce work, then schedule it. - Shelf: privacy/isolation model + structural correctness walls. 2. Fabric dispatch design (operator-signed): core design rule prose (ProviderOffer adapter / RunShape→Allocation→Receipt / strict default / oversubscription earned by receipts), StrictLease Policy 0, CI shape labels (runs-on as a projection; runner availability is backpressure), ProviderOffer rows + dormant-Ubicloud design-break probe, BurstLease Policy 1; TERMINAL reworded to "required CI runs on the compute fabric"; converge re-land gains the narrow srv2 first-acceptance case; ordering prose ①–⑩. 3. Stateless frontend MVP on fabric: first non-CI product-shaped consumer (SiteArtifact/WebServiceShape/DomainRoute/ServiceAllocation, manual DNS, digest-proving receipt, milestones A/B), service allocation receipt under control plane, fabric-hostable rule prose, shelf HTML line scoped. Verified by execution: main_wet regen, drift gate, roadmap_authority witnesses (new fabric pins + updated interleaving neighbor), spawner witnesses (incl. new all-parents RED control), doc-graph orphans + dangling links — all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * WIP: fable * Roadmap dispatch utility + first-receipt splits + converge edge-direction fix Operator ask: a small utility returning the active/needed work items to dispatch from the roadmap (frontend/visualization seam, useful now). - gunbc.roadmap_spawner gains roadmap_dispatch_json (single authority for spawn semantics): {ready (full node rows), upcoming (node + unmet_parents), done}. node_json also emits parent_node_ids (all parents — folds in claude's non-blocking #6110 finding; single parent_node_id kept for bridge back-compat). json_escape now escapes newlines (latent invalid-JSON bug, witnessed). - dsl/tools/roadmap_dispatch.dag: `claim_batch --source-root dsl --entry dsl/tools/roadmap_dispatch.dag --function main --wet` writes target/roadmap-dispatch.json (schema roadmap-dispatch-file/v1, embeds the M0-M3 worker-brief template). - First-receipt splits per operator dispatch review: 1-resolver-pathology → -a (profile receipt only) / -b (fix one confirmed pathology, edge b←a); 2-live-read-runner-memory as the first slice of the read seam (seam gated on it); 2-privilege-model sized with RED/green acceptance. - Edge-direction fix (operator structural concern): 2-converge-reland now DEPENDS ON 2-live-read-seam + 2-privilege-model (was inverted: privilege as converge's child); umbrella g2-runner edge removed so it cannot gate; periodic-actuation ← converge kept. Verified by execution: spawner witnesses (new dispatch-partition + newline-escape RED controls), authority witnesses, main_wet regen, drift gate, doc-graph — PASS; utility run produces valid JSON with 11 ready / 4 gated, gates matching the signed ordering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: dispatch compile-clean shard A (first-receipt split) + mark owned Operator go-ahead post-merge of #6110/#6111/#6112. 2-compile-clean-shard-a (partition boundary + ONE shard + compose proof, no scheduler enrollment) dispatched as adhoc-3e95c046-279 and marked owned; 2-compile-clean-shard-b (floor-plan enrollment + before/after batch-1 wall receipt) gated on A. Verified: regen, drift gate, authority + spawner witnesses PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap: mark 3-audit-gate-inventory done (#6116 merged) #6116 (gate-inventory audit + pilot red-control) merged without flipping its node, unlike #6120 which self-marked. Set done: true to parity with the resolver node — both now render "⏳ awaiting sign-off" (the [x] checkbox is gated on operator sign-off by design, not merge alone). Verified: main_wet regen, drift gate, roadmap_authority_witnesses PASS; dispatch file moves 3-audit-gate-inventory to the done partition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap #6122: drop #6120 duplicate resolver node + heal doc-graph orphan Addresses cursor REQUEST_CHANGES on #6122: - Finding 3 (real): removed 1-resolver-pathology-receipt, a #6120-introduced near-verbatim duplicate of 1-resolver-pathology-a (§2 parallel representation). - Findings 1/2 (drift-heal, not regression): done:true renders "[ ] — ⏳ awaiting sign-off" by design (box = signoff_accepts, not merge); #6120 had committed ROADMAP.md with resolver-A as [x] with no sign-off — that was drift, and the regen heals it to the honest awaiting-sign-off state. - Also heals a pre-existing doc-graph orphan: mechanism-inventory-red-controls.md (#6116) was link-unreachable; attached it to the 3-audit-gate-inventory node via a new with_plan helper (keeps the node sized). Verified: main_wet, drift gate, roadmap_authority_witnesses, doc-graph orphans + dangling links all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap #6122: keep PR scoped — move hostname-converge demo off this branch Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap #6122: sync main (#6113/#6115/#6118) + mark those 3 merged nodes done The three verification-target PRs merged without self-marking their nodes; central-marker flips 2-cd-transport, 2-live-read-runner-memory, and 2-compile-clean-shard-a to done: true (render 'awaiting sign-off' — operator sign-off stays separate). Drift gate, roadmap witnesses, doc-graph all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…emit-partition (#6135) * WIP: fable * WIP: fable * WIP: fable * WIP: fable * Roadmap: fold in operator directives + 2026-07-01 live findings - §2 posture: required CI back on the fleet (#6111 revert; Ubicloud detour bought no wall-clock — serial compile-clean wall dominates); milestones updated; fleet-return group becomes fleet-hardening (the return happened ungated, the gates are now owed). - New: 2-compile-clean-serial (the ~47min width-immune dominant cost + its three levers), 2-runner-shape (operator 1:3 core:GiB + swap slot contract), cap-deconflation corrected (width=9 was live by construction; the deferred item was only the concept rename), CD-transport reframed post-revert, G4 gains the dup-run + lingering in_progress evidence. - §3 audit: 3-audit-artifact-freshness (operator freshness-gate ask; the .gitignore landed-drift incident as the RED receipt, closes via the merge-admission freshness block) and 3-audit-gate-disagreement (compile-clean green while discovery red on the same tree — the extdeps.shell collision; one tree, one verdict). - §1 5-defork gains the live evidence line (the shell fork kept main red). Witnesses re-targeted in lockstep; verified by execution: main_wet regen, drift gate, roadmap_authority_witnesses, doc-graph orphans+dangling all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: operator review + fabric dispatch design + stateless-frontend MVP Applies the operator's three directives in one lockstep batch: 1. Roadmap-review blockers: - Ubicloud tone: detour was the diagnostic + emergency valve, not a failure; stays the break-glass/burst option. - CD transport reframed as target-host proof (LocalShell valid only when runner identity proves host=srv1), not Ubicloud-specific. - v1-collapse dependency edges now REAL: roadmap_spawner readiness is all-parents (node_dep_done folds every edge, not the first), with a RED/GREEN multi-parent witness; 5-collapse-v1 gains edges from dissolve-patches, test-migration, seed-honesty, defork. - workload-class admission model + cap/admission de-conflation (three facts, one knob today) + sound host admission (Guaranteed vs Burst with Σ-accounting receipts) + live host read seam as first-class nodes; G1 stale "dormant on Ubicloud" conditional fixed (cursor review finding on #6110). - Floor group renamed: throughput — reduce work, then schedule it. - Shelf: privacy/isolation model + structural correctness walls. 2. Fabric dispatch design (operator-signed): core design rule prose (ProviderOffer adapter / RunShape→Allocation→Receipt / strict default / oversubscription earned by receipts), StrictLease Policy 0, CI shape labels (runs-on as a projection; runner availability is backpressure), ProviderOffer rows + dormant-Ubicloud design-break probe, BurstLease Policy 1; TERMINAL reworded to "required CI runs on the compute fabric"; converge re-land gains the narrow srv2 first-acceptance case; ordering prose ①–⑩. 3. Stateless frontend MVP on fabric: first non-CI product-shaped consumer (SiteArtifact/WebServiceShape/DomainRoute/ServiceAllocation, manual DNS, digest-proving receipt, milestones A/B), service allocation receipt under control plane, fabric-hostable rule prose, shelf HTML line scoped. Verified by execution: main_wet regen, drift gate, roadmap_authority witnesses (new fabric pins + updated interleaving neighbor), spawner witnesses (incl. new all-parents RED control), doc-graph orphans + dangling links — all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * WIP: fable * Roadmap dispatch utility + first-receipt splits + converge edge-direction fix Operator ask: a small utility returning the active/needed work items to dispatch from the roadmap (frontend/visualization seam, useful now). - gunbc.roadmap_spawner gains roadmap_dispatch_json (single authority for spawn semantics): {ready (full node rows), upcoming (node + unmet_parents), done}. node_json also emits parent_node_ids (all parents — folds in claude's non-blocking #6110 finding; single parent_node_id kept for bridge back-compat). json_escape now escapes newlines (latent invalid-JSON bug, witnessed). - dsl/tools/roadmap_dispatch.dag: `claim_batch --source-root dsl --entry dsl/tools/roadmap_dispatch.dag --function main --wet` writes target/roadmap-dispatch.json (schema roadmap-dispatch-file/v1, embeds the M0-M3 worker-brief template). - First-receipt splits per operator dispatch review: 1-resolver-pathology → -a (profile receipt only) / -b (fix one confirmed pathology, edge b←a); 2-live-read-runner-memory as the first slice of the read seam (seam gated on it); 2-privilege-model sized with RED/green acceptance. - Edge-direction fix (operator structural concern): 2-converge-reland now DEPENDS ON 2-live-read-seam + 2-privilege-model (was inverted: privilege as converge's child); umbrella g2-runner edge removed so it cannot gate; periodic-actuation ← converge kept. Verified by execution: spawner witnesses (new dispatch-partition + newline-escape RED controls), authority witnesses, main_wet regen, drift gate, doc-graph — PASS; utility run produces valid JSON with 11 ready / 4 gated, gates matching the signed ordering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: dispatch compile-clean shard A (first-receipt split) + mark owned Operator go-ahead post-merge of #6110/#6111/#6112. 2-compile-clean-shard-a (partition boundary + ONE shard + compose proof, no scheduler enrollment) dispatched as adhoc-3e95c046-279 and marked owned; 2-compile-clean-shard-b (floor-plan enrollment + before/after batch-1 wall receipt) gated on A. Verified: regen, drift gate, authority + spawner witnesses PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap: mark 3-audit-gate-inventory done (#6116 merged) #6116 (gate-inventory audit + pilot red-control) merged without flipping its node, unlike #6120 which self-marked. Set done: true to parity with the resolver node — both now render "⏳ awaiting sign-off" (the [x] checkbox is gated on operator sign-off by design, not merge alone). Verified: main_wet regen, drift gate, roadmap_authority_witnesses PASS; dispatch file moves 3-audit-gate-inventory to the done partition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap #6122: drop #6120 duplicate resolver node + heal doc-graph orphan Addresses cursor REQUEST_CHANGES on #6122: - Finding 3 (real): removed 1-resolver-pathology-receipt, a #6120-introduced near-verbatim duplicate of 1-resolver-pathology-a (§2 parallel representation). - Findings 1/2 (drift-heal, not regression): done:true renders "[ ] — ⏳ awaiting sign-off" by design (box = signoff_accepts, not merge); #6120 had committed ROADMAP.md with resolver-A as [x] with no sign-off — that was drift, and the regen heals it to the honest awaiting-sign-off state. - Also heals a pre-existing doc-graph orphan: mechanism-inventory-red-controls.md (#6116) was link-unreachable; attached it to the 3-audit-gate-inventory node via a new with_plan helper (keeps the node sized). Verified: main_wet, drift gate, roadmap_authority_witnesses, doc-graph orphans + dangling links all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap #6122: keep PR scoped — move hostname-converge demo off this branch Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap #6122: sync main (#6113/#6115/#6118) + mark those 3 merged nodes done The three verification-target PRs merged without self-marking their nodes; central-marker flips 2-cd-transport, 2-live-read-runner-memory, and 2-compile-clean-shard-a to done: true (render 'awaiting sign-off' — operator sign-off stays separate). Drift gate, roadmap witnesses, doc-graph all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap: derive 2-debash-orchestration (#6106) + 5-dual-rep-lens (#6104) done; flip 2-privilege-model (#6114); mark 2-emit-partition dispatched - authored_merged_prs += 6104, 6106 (operator merged both) - 2-privilege-model done: #6114 merged, live receipts on #6123/#6130 wet runs - 2-emit-partition now un-gated and dispatched (adhoc-2040cdfe-46b) - regen ROADMAP.md via generated_artifact_gate main_wet; drift gate + roadmap witnesses PASS Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…led GitHub default) (#6154) * WIP: fable * WIP: fable * WIP: fable * WIP: fable * Roadmap: fold in operator directives + 2026-07-01 live findings - §2 posture: required CI back on the fleet (#6111 revert; Ubicloud detour bought no wall-clock — serial compile-clean wall dominates); milestones updated; fleet-return group becomes fleet-hardening (the return happened ungated, the gates are now owed). - New: 2-compile-clean-serial (the ~47min width-immune dominant cost + its three levers), 2-runner-shape (operator 1:3 core:GiB + swap slot contract), cap-deconflation corrected (width=9 was live by construction; the deferred item was only the concept rename), CD-transport reframed post-revert, G4 gains the dup-run + lingering in_progress evidence. - §3 audit: 3-audit-artifact-freshness (operator freshness-gate ask; the .gitignore landed-drift incident as the RED receipt, closes via the merge-admission freshness block) and 3-audit-gate-disagreement (compile-clean green while discovery red on the same tree — the extdeps.shell collision; one tree, one verdict). - §1 5-defork gains the live evidence line (the shell fork kept main red). Witnesses re-targeted in lockstep; verified by execution: main_wet regen, drift gate, roadmap_authority_witnesses, doc-graph orphans+dangling all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: operator review + fabric dispatch design + stateless-frontend MVP Applies the operator's three directives in one lockstep batch: 1. Roadmap-review blockers: - Ubicloud tone: detour was the diagnostic + emergency valve, not a failure; stays the break-glass/burst option. - CD transport reframed as target-host proof (LocalShell valid only when runner identity proves host=srv1), not Ubicloud-specific. - v1-collapse dependency edges now REAL: roadmap_spawner readiness is all-parents (node_dep_done folds every edge, not the first), with a RED/GREEN multi-parent witness; 5-collapse-v1 gains edges from dissolve-patches, test-migration, seed-honesty, defork. - workload-class admission model + cap/admission de-conflation (three facts, one knob today) + sound host admission (Guaranteed vs Burst with Σ-accounting receipts) + live host read seam as first-class nodes; G1 stale "dormant on Ubicloud" conditional fixed (cursor review finding on #6110). - Floor group renamed: throughput — reduce work, then schedule it. - Shelf: privacy/isolation model + structural correctness walls. 2. Fabric dispatch design (operator-signed): core design rule prose (ProviderOffer adapter / RunShape→Allocation→Receipt / strict default / oversubscription earned by receipts), StrictLease Policy 0, CI shape labels (runs-on as a projection; runner availability is backpressure), ProviderOffer rows + dormant-Ubicloud design-break probe, BurstLease Policy 1; TERMINAL reworded to "required CI runs on the compute fabric"; converge re-land gains the narrow srv2 first-acceptance case; ordering prose ①–⑩. 3. Stateless frontend MVP on fabric: first non-CI product-shaped consumer (SiteArtifact/WebServiceShape/DomainRoute/ServiceAllocation, manual DNS, digest-proving receipt, milestones A/B), service allocation receipt under control plane, fabric-hostable rule prose, shelf HTML line scoped. Verified by execution: main_wet regen, drift gate, roadmap_authority witnesses (new fabric pins + updated interleaving neighbor), spawner witnesses (incl. new all-parents RED control), doc-graph orphans + dangling links — all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * WIP: fable * Roadmap dispatch utility + first-receipt splits + converge edge-direction fix Operator ask: a small utility returning the active/needed work items to dispatch from the roadmap (frontend/visualization seam, useful now). - gunbc.roadmap_spawner gains roadmap_dispatch_json (single authority for spawn semantics): {ready (full node rows), upcoming (node + unmet_parents), done}. node_json also emits parent_node_ids (all parents — folds in claude's non-blocking #6110 finding; single parent_node_id kept for bridge back-compat). json_escape now escapes newlines (latent invalid-JSON bug, witnessed). - dsl/tools/roadmap_dispatch.dag: `claim_batch --source-root dsl --entry dsl/tools/roadmap_dispatch.dag --function main --wet` writes target/roadmap-dispatch.json (schema roadmap-dispatch-file/v1, embeds the M0-M3 worker-brief template). - First-receipt splits per operator dispatch review: 1-resolver-pathology → -a (profile receipt only) / -b (fix one confirmed pathology, edge b←a); 2-live-read-runner-memory as the first slice of the read seam (seam gated on it); 2-privilege-model sized with RED/green acceptance. - Edge-direction fix (operator structural concern): 2-converge-reland now DEPENDS ON 2-live-read-seam + 2-privilege-model (was inverted: privilege as converge's child); umbrella g2-runner edge removed so it cannot gate; periodic-actuation ← converge kept. Verified by execution: spawner witnesses (new dispatch-partition + newline-escape RED controls), authority witnesses, main_wet regen, drift gate, doc-graph — PASS; utility run produces valid JSON with 11 ready / 4 gated, gates matching the signed ordering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: dispatch compile-clean shard A (first-receipt split) + mark owned Operator go-ahead post-merge of #6110/#6111/#6112. 2-compile-clean-shard-a (partition boundary + ONE shard + compose proof, no scheduler enrollment) dispatched as adhoc-3e95c046-279 and marked owned; 2-compile-clean-shard-b (floor-plan enrollment + before/after batch-1 wall receipt) gated on A. Verified: regen, drift gate, authority + spawner witnesses PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap: mark 3-audit-gate-inventory done (#6116 merged) #6116 (gate-inventory audit + pilot red-control) merged without flipping its node, unlike #6120 which self-marked. Set done: true to parity with the resolver node — both now render "⏳ awaiting sign-off" (the [x] checkbox is gated on operator sign-off by design, not merge alone). Verified: main_wet regen, drift gate, roadmap_authority_witnesses PASS; dispatch file moves 3-audit-gate-inventory to the done partition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap #6122: drop #6120 duplicate resolver node + heal doc-graph orphan Addresses cursor REQUEST_CHANGES on #6122: - Finding 3 (real): removed 1-resolver-pathology-receipt, a #6120-introduced near-verbatim duplicate of 1-resolver-pathology-a (§2 parallel representation). - Findings 1/2 (drift-heal, not regression): done:true renders "[ ] — ⏳ awaiting sign-off" by design (box = signoff_accepts, not merge); #6120 had committed ROADMAP.md with resolver-A as [x] with no sign-off — that was drift, and the regen heals it to the honest awaiting-sign-off state. - Also heals a pre-existing doc-graph orphan: mechanism-inventory-red-controls.md (#6116) was link-unreachable; attached it to the 3-audit-gate-inventory node via a new with_plan helper (keeps the node sized). Verified: main_wet, drift gate, roadmap_authority_witnesses, doc-graph orphans + dangling links all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap #6122: keep PR scoped — move hostname-converge demo off this branch Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap #6122: sync main (#6113/#6115/#6118) + mark those 3 merged nodes done The three verification-target PRs merged without self-marking their nodes; central-marker flips 2-cd-transport, 2-live-read-runner-memory, and 2-compile-clean-shard-a to done: true (render 'awaiting sign-off' — operator sign-off stays separate). Drift gate, roadmap witnesses, doc-graph all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap: derive 2-debash-orchestration (#6106) + 5-dual-rep-lens (#6104) done; flip 2-privilege-model (#6114); mark 2-emit-partition dispatched - authored_merged_prs += 6104, 6106 (operator merged both) - 2-privilege-model done: #6114 merged, live receipts on #6123/#6130 wet runs - 2-emit-partition now un-gated and dispatched (adhoc-2040cdfe-46b) - regen ROADMAP.md via generated_artifact_gate main_wet; drift gate + roadmap witnesses PASS Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Revert throwaway deploy-principal edits (restore live_deploy/apply + ci_deploy_access to main) The manual-deploy investigation surfaced two real bugs (dash/pipefail + principal fiction) but the fix belongs in the modeled grounded-principal lane, not anemic stopgap strings. Restoring these two files to origin/main clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * CI policy: 30-minute job timeout (workflow layer; GitHub 360min default stays modeled) Operator directive 2026-07-02: a healthy floor is ~9min solo — a job past 30min is pathological and must fail fast + release its runner slot instead of squatting toward the platform ceiling (observed: 6h-timeout jobs holding all 25 fleet slots in a self-sustaining queue deadlock, ~9h single-core claim_executor runs). - gunbc_ci_job_timeout_policy_minutes: Int = 30 (+ Terminal disposition carrying the rationale) - extdeps default_job_timeout_minutes = 360 deliberately unchanged (§3: it faithfully models GitHub's real platform default; policy lives in the workflow layer) - ci.yml regenerated via generated_artifact_gate main_wet; drift gate PASS Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * CI emergency: roll back #6127 width-1 compile-clean sharding (30.9x regression) #6127 (merged 15:08 today) sharded compile-clean into ~1,605 per-module gunbc-compile subprocesses, each re-resolving its full import closure (sum-of-closures ~30.9x the monolith CPU), scheduled at WIDTH 1 because the width fold priced each single-module shard against a stale whole-corpus 4.24GiB RSS sample vs the 8GiB cap. Live regression: 8h57m wall / 8h07m CPU per job on an 87%-idle 128-core box. Pre-regression monolith green runs were 28-96min. Sets the modeled rollback valve GUNBC_CI_COMPILE_CLEAN_WHOLE_TREE=1 on the ci job (env), restoring the whole-tree monolith compile-clean. Authority = the matching v2.workflow valve; rationale on ci_compile_clean_rollback_dissolution_trigger; Scaffold disposition bound, dissolves with the v2 authority once the in-process shard resolve pool lands. ci.yml regenerated via generated_artifact_gate main_wet; drift gate PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Back out #6127 rollback valve-flip; keep only the 30min timeout policy The GUNBC_CI_COMPILE_CLEAN_WHOLE_TREE valve does NOT cleanly restore a green monolith floor: under the valve, gunbc_ci_floor_schedule_lens_holds() FAILs and batch-0 carries neither shards nor the monolith gate label (verified by execution with claim_batch --wet under GUNBC_CI_COMPILE_CLEAN_WHOLE_TREE=1). The valve looks like a half-exercised scaffold from #6127. Flipping it and patching witnesses to match an unverified plan path would violate DESIGN §5 (ship only what runs green), so this PR keeps only the sound, approved part: - gunbc_ci_job_timeout_policy_minutes = 30 (workflow-layer; GitHub 360 default stays modeled) - disposition text reconciled: 30min is deliberately BELOW today's 28-96min floor — a fail-fast smoke alarm until the resolver single-thread fix lands (verification local meanwhile) The #6127 regression is better addressed by a clean revert of #6127 or a proper fix to the plan's rollback branch (load-bearing floor-plan work) — surfaced to the operator. ci.yml regenerated (timeout-only, no rollback env); drift gate PASS; both shard-b floor witnesses PASS at origin/main state. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…#6164) * WIP: fable * WIP: fable * WIP: fable * WIP: fable * Roadmap: fold in operator directives + 2026-07-01 live findings - §2 posture: required CI back on the fleet (#6111 revert; Ubicloud detour bought no wall-clock — serial compile-clean wall dominates); milestones updated; fleet-return group becomes fleet-hardening (the return happened ungated, the gates are now owed). - New: 2-compile-clean-serial (the ~47min width-immune dominant cost + its three levers), 2-runner-shape (operator 1:3 core:GiB + swap slot contract), cap-deconflation corrected (width=9 was live by construction; the deferred item was only the concept rename), CD-transport reframed post-revert, G4 gains the dup-run + lingering in_progress evidence. - §3 audit: 3-audit-artifact-freshness (operator freshness-gate ask; the .gitignore landed-drift incident as the RED receipt, closes via the merge-admission freshness block) and 3-audit-gate-disagreement (compile-clean green while discovery red on the same tree — the extdeps.shell collision; one tree, one verdict). - §1 5-defork gains the live evidence line (the shell fork kept main red). Witnesses re-targeted in lockstep; verified by execution: main_wet regen, drift gate, roadmap_authority_witnesses, doc-graph orphans+dangling all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: operator review + fabric dispatch design + stateless-frontend MVP Applies the operator's three directives in one lockstep batch: 1. Roadmap-review blockers: - Ubicloud tone: detour was the diagnostic + emergency valve, not a failure; stays the break-glass/burst option. - CD transport reframed as target-host proof (LocalShell valid only when runner identity proves host=srv1), not Ubicloud-specific. - v1-collapse dependency edges now REAL: roadmap_spawner readiness is all-parents (node_dep_done folds every edge, not the first), with a RED/GREEN multi-parent witness; 5-collapse-v1 gains edges from dissolve-patches, test-migration, seed-honesty, defork. - workload-class admission model + cap/admission de-conflation (three facts, one knob today) + sound host admission (Guaranteed vs Burst with Σ-accounting receipts) + live host read seam as first-class nodes; G1 stale "dormant on Ubicloud" conditional fixed (cursor review finding on #6110). - Floor group renamed: throughput — reduce work, then schedule it. - Shelf: privacy/isolation model + structural correctness walls. 2. Fabric dispatch design (operator-signed): core design rule prose (ProviderOffer adapter / RunShape→Allocation→Receipt / strict default / oversubscription earned by receipts), StrictLease Policy 0, CI shape labels (runs-on as a projection; runner availability is backpressure), ProviderOffer rows + dormant-Ubicloud design-break probe, BurstLease Policy 1; TERMINAL reworded to "required CI runs on the compute fabric"; converge re-land gains the narrow srv2 first-acceptance case; ordering prose ①–⑩. 3. Stateless frontend MVP on fabric: first non-CI product-shaped consumer (SiteArtifact/WebServiceShape/DomainRoute/ServiceAllocation, manual DNS, digest-proving receipt, milestones A/B), service allocation receipt under control plane, fabric-hostable rule prose, shelf HTML line scoped. Verified by execution: main_wet regen, drift gate, roadmap_authority witnesses (new fabric pins + updated interleaving neighbor), spawner witnesses (incl. new all-parents RED control), doc-graph orphans + dangling links — all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * WIP: fable * Roadmap dispatch utility + first-receipt splits + converge edge-direction fix Operator ask: a small utility returning the active/needed work items to dispatch from the roadmap (frontend/visualization seam, useful now). - gunbc.roadmap_spawner gains roadmap_dispatch_json (single authority for spawn semantics): {ready (full node rows), upcoming (node + unmet_parents), done}. node_json also emits parent_node_ids (all parents — folds in claude's non-blocking #6110 finding; single parent_node_id kept for bridge back-compat). json_escape now escapes newlines (latent invalid-JSON bug, witnessed). - dsl/tools/roadmap_dispatch.dag: `claim_batch --source-root dsl --entry dsl/tools/roadmap_dispatch.dag --function main --wet` writes target/roadmap-dispatch.json (schema roadmap-dispatch-file/v1, embeds the M0-M3 worker-brief template). - First-receipt splits per operator dispatch review: 1-resolver-pathology → -a (profile receipt only) / -b (fix one confirmed pathology, edge b←a); 2-live-read-runner-memory as the first slice of the read seam (seam gated on it); 2-privilege-model sized with RED/green acceptance. - Edge-direction fix (operator structural concern): 2-converge-reland now DEPENDS ON 2-live-read-seam + 2-privilege-model (was inverted: privilege as converge's child); umbrella g2-runner edge removed so it cannot gate; periodic-actuation ← converge kept. Verified by execution: spawner witnesses (new dispatch-partition + newline-escape RED controls), authority witnesses, main_wet regen, drift gate, doc-graph — PASS; utility run produces valid JSON with 11 ready / 4 gated, gates matching the signed ordering. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap: dispatch compile-clean shard A (first-receipt split) + mark owned Operator go-ahead post-merge of #6110/#6111/#6112. 2-compile-clean-shard-a (partition boundary + ONE shard + compose proof, no scheduler enrollment) dispatched as adhoc-3e95c046-279 and marked owned; 2-compile-clean-shard-b (floor-plan enrollment + before/after batch-1 wall receipt) gated on A. Verified: regen, drift gate, authority + spawner witnesses PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap: mark 3-audit-gate-inventory done (#6116 merged) #6116 (gate-inventory audit + pilot red-control) merged without flipping its node, unlike #6120 which self-marked. Set done: true to parity with the resolver node — both now render "⏳ awaiting sign-off" (the [x] checkbox is gated on operator sign-off by design, not merge alone). Verified: main_wet regen, drift gate, roadmap_authority_witnesses PASS; dispatch file moves 3-audit-gate-inventory to the done partition. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap #6122: drop #6120 duplicate resolver node + heal doc-graph orphan Addresses cursor REQUEST_CHANGES on #6122: - Finding 3 (real): removed 1-resolver-pathology-receipt, a #6120-introduced near-verbatim duplicate of 1-resolver-pathology-a (§2 parallel representation). - Findings 1/2 (drift-heal, not regression): done:true renders "[ ] — ⏳ awaiting sign-off" by design (box = signoff_accepts, not merge); #6120 had committed ROADMAP.md with resolver-A as [x] with no sign-off — that was drift, and the regen heals it to the honest awaiting-sign-off state. - Also heals a pre-existing doc-graph orphan: mechanism-inventory-red-controls.md (#6116) was link-unreachable; attached it to the 3-audit-gate-inventory node via a new with_plan helper (keeps the node sized). Verified: main_wet, drift gate, roadmap_authority_witnesses, doc-graph orphans + dangling links all PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * WIP: fable * Roadmap #6122: keep PR scoped — move hostname-converge demo off this branch Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roadmap #6122: sync main (#6113/#6115/#6118) + mark those 3 merged nodes done The three verification-target PRs merged without self-marking their nodes; central-marker flips 2-cd-transport, 2-live-read-runner-memory, and 2-compile-clean-shard-a to done: true (render 'awaiting sign-off' — operator sign-off stays separate). Drift gate, roadmap witnesses, doc-graph all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Roadmap: derive 2-debash-orchestration (#6106) + 5-dual-rep-lens (#6104) done; flip 2-privilege-model (#6114); mark 2-emit-partition dispatched - authored_merged_prs += 6104, 6106 (operator merged both) - 2-privilege-model done: #6114 merged, live receipts on #6123/#6130 wet runs - 2-emit-partition now un-gated and dispatched (adhoc-2040cdfe-46b) - regen ROADMAP.md via generated_artifact_gate main_wet; drift gate + roadmap witnesses PASS Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Revert throwaway deploy-principal edits (restore live_deploy/apply + ci_deploy_access to main) The manual-deploy investigation surfaced two real bugs (dash/pipefail + principal fiction) but the fix belongs in the modeled grounded-principal lane, not anemic stopgap strings. Restoring these two files to origin/main clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * CI policy: 30-minute job timeout (workflow layer; GitHub 360min default stays modeled) Operator directive 2026-07-02: a healthy floor is ~9min solo — a job past 30min is pathological and must fail fast + release its runner slot instead of squatting toward the platform ceiling (observed: 6h-timeout jobs holding all 25 fleet slots in a self-sustaining queue deadlock, ~9h single-core claim_executor runs). - gunbc_ci_job_timeout_policy_minutes: Int = 30 (+ Terminal disposition carrying the rationale) - extdeps default_job_timeout_minutes = 360 deliberately unchanged (§3: it faithfully models GitHub's real platform default; policy lives in the workflow layer) - ci.yml regenerated via generated_artifact_gate main_wet; drift gate PASS Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * CI emergency: roll back #6127 width-1 compile-clean sharding (30.9x regression) #6127 (merged 15:08 today) sharded compile-clean into ~1,605 per-module gunbc-compile subprocesses, each re-resolving its full import closure (sum-of-closures ~30.9x the monolith CPU), scheduled at WIDTH 1 because the width fold priced each single-module shard against a stale whole-corpus 4.24GiB RSS sample vs the 8GiB cap. Live regression: 8h57m wall / 8h07m CPU per job on an 87%-idle 128-core box. Pre-regression monolith green runs were 28-96min. Sets the modeled rollback valve GUNBC_CI_COMPILE_CLEAN_WHOLE_TREE=1 on the ci job (env), restoring the whole-tree monolith compile-clean. Authority = the matching v2.workflow valve; rationale on ci_compile_clean_rollback_dissolution_trigger; Scaffold disposition bound, dissolves with the v2 authority once the in-process shard resolve pool lands. ci.yml regenerated via generated_artifact_gate main_wet; drift gate PASS. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * Back out #6127 rollback valve-flip; keep only the 30min timeout policy The GUNBC_CI_COMPILE_CLEAN_WHOLE_TREE valve does NOT cleanly restore a green monolith floor: under the valve, gunbc_ci_floor_schedule_lens_holds() FAILs and batch-0 carries neither shards nor the monolith gate label (verified by execution with claim_batch --wet under GUNBC_CI_COMPILE_CLEAN_WHOLE_TREE=1). The valve looks like a half-exercised scaffold from #6127. Flipping it and patching witnesses to match an unverified plan path would violate DESIGN §5 (ship only what runs green), so this PR keeps only the sound, approved part: - gunbc_ci_job_timeout_policy_minutes = 30 (workflow-layer; GitHub 360 default stays modeled) - disposition text reconciled: 30min is deliberately BELOW today's 28-96min floor — a fail-fast smoke alarm until the resolver single-thread fix lands (verification local meanwhile) The #6127 regression is better addressed by a clean revert of #6127 or a proper fix to the plan's rollback branch (load-bearing floor-plan work) — surfaced to the operator. ci.yml regenerated (timeout-only, no rollback env); drift gate PASS; both shard-b floor witnesses PASS at origin/main state. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * docs: land enforcement-intent governance model (DESIGN thread + ROADMAP §3 node + sketch) Model the operator's recurring standing directives (complexity repo-wide, lenses-must-be-live, self-application, no dual-representation/anemia) as durable StandingIntent rows, gated fail-closed against LensContract + coverage receipts -- "ask once, compile forever". One new authority (StandingIntent); everything else extends existing machinery (LensRegistryEntryV0 -> LensContract; reuse ConstructionJustification / subject_roster; consume intent_linearity / self_applying_lenses for the fractal/self-application layer). Un-shelves the lens-meta-wall lane into ROADMAP §3 with displaced-cost justification (the operator's repeated manual what-is-enforced-by-what-lens-over-what-corpus join). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * docs: enforcement-intent review refinements (consumer/mode/receipt/exemption types + roadmap A-E split) Operator design-review deltas before the model becomes load-bearing: - ConsumerKind / ConsumerRequirement replace the hardwired FloorGate — merge-admission, pre-push, periodic-actuator, deploy-readback are valid consumers (gate leg 4 = consumer_satisfies). - EnforcementMode order (Advisory < AuditOnly < Blocking) modeled with enforcement_mode_satisfies; no overloaded >=. - CoverageReceipt shape added; the gate reads receipts, never self-declared contract claims (a red_control:Present whose receipt is RedControlFailedToFlip still reds). - ScopeSatisfaction / NarrowingReason type the whole-corpus-narrowing path (BootstrapBlocked / TypeReflectionUnavailable / ExternalRuntimeOnly / ExplicitOperatorExemption) — not a stringly hatch. - StandingIntent admission rule (recurring + displaced cost + scoped + mechanism class + receiptable) keeps the carrier from becoming a preference dump. - ROADMAP node split into parent + children A-E with explicit A->B->C-before-object-rules dependency. DESIGN.md entry unchanged (its "mechanism claiming enforcement" wording was already the refinement). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * WIP: fable * docs: fix #6164 review — edit .dag AUTHORITIES not generated artifacts; de-nickname PropertyClass Addresses cursor REQUEST_CHANGES (all three findings valid): - DESIGN.md / ROADMAP.md are EMITTED from gunbc.design_document / gunbc.roadmap_authority. My hand-edits to the generated artifacts were drift (a §3 parallel-representation of the authority, and would fail the generated-artifact drift gate). Moved the enforcement-intent content INTO the authorities (open_threads_blocks li + section_3 node + un-shelve prose) and regenerated (claim_batch main_wet). Drift gate now PASSES: committed == emitted. - Removed the PropertyClass nickname (git-grep empty; a fork of the existing LensIdV0 lens-property coproduct at src/v2/lens/registry.dag:10) — the exact §3 sin this PR argues against. StandingIntent.property now reuses LensIdV0. Fitting that a single-authority PR forked its own authority; caught by review, fixed at the source. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Brian Searls <briansrls@gunb.ai> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

briansrls and others added 3 commits July 1, 2026 22:43

WIP: 2-cd-transport: CD deploy target-host proof — LocalShell deploy_…

71b0d6a

…dashboar

WIP: 2-cd-transport: CD deploy target-host proof — LocalShell deploy_…

cc5fd30

…dashboar

gunbai-bot Bot marked this pull request as ready for review July 1, 2026 23:04

briansrls and others added 2 commits July 1, 2026 23:06

Merge origin/main: resolve ci.yml deploy runner conflict (keep srv1 p…

710951a

…in). Retriggers CI on the parse-fix commit; picks up #6112 extdeps.shell de-fork. Co-authored-by: Cursor <cursoragent@cursor.com>

WIP: 2-cd-transport: CD deploy target-host proof — LocalShell deploy_…

d9d7a0d

…dashboar

Anchor runner-name host proof: reject srv12-for-srv1 substring match.

5fbb108

Model layer uses @host- / @host. / @host suffix patterns; preflight uses grep -Eq '@host(-|\\.|$)' so RUNNER_NAME cannot satisfy proof via prefix overlap. Co-authored-by: Cursor <cursoragent@cursor.com>

briansrls merged commit e7d12dc into main Jul 2, 2026
1 of 2 checks passed

briansrls deleted the session/fierce-wren-456 branch July 2, 2026 01:14

gunbai-bot Bot mentioned this pull request Jul 2, 2026

De-fork the 'Step' nickname: rename internal orchestration Step → PipelineStep #6144

Merged

Navigation Menu

Repository navigation

CD deploy: require srv1 target-host proof before LocalShell apply - #6115

CD deploy: require srv1 target-host proof before LocalShell apply#6115
briansrls merged 8 commits into
mainfrom
session/fierce-wren-456

gunbai-bot Bot commented Jul 1, 2026 •

edited

Loading

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

gunbai-bot Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

gunbai-bot Bot commented Jul 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

gunbai-bot Bot commented Jul 1, 2026 •

edited

Loading