Shell→dag P5b: the 2 HEAVY srv3 files — srv3_install_diagnostic_checklist (FROZEN/terminal: typed observe effect retires it) + srv3_os_install_actuator_toolchain_ensure → typed extdeps apt/curl/websocat argv effects on host_effect_apply; THEN delete shell_exec_via_bash heredoc runner once no caller

[gunbai-bot]

Auto-opened by session-dashboard for session deep-newt-523.
Pushing to session/deep-newt-523-p5b-srv3-heavy advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[gunbai-bot]

Addressing medium-structure review (0ebbcac)

Both findings were valid. Fixed in 0ebbcac:

1. Observe-script carve-out / roster laundering

• Restored srv3_install_diagnostic_checklist.dag and srv3_os_install_actuator_toolchain_ensure.dag on medium_structure_exception_roster (entrypoints are typed via host_effect_apply, but receipt echo + script-oracle builders remain medium-as-string).
• Added srv3_install_diagnostic_observe_script.dag to the roster (+1 net; baseline 61→62 with receipt note).
• Replaced the Terminal "FROZEN" scope disposition with a Scaffold { dissolves_to: RealizationDispatch } bash-emit dissolution trigger on srv3_install_diagnostic_observe_script; witness added in srv3_install_diagnostic_checklist_witness_test.dag.
• Toolchain script-oracle dissolution trigger likewise converted from false Terminal roster-retirement to Scaffold binding os_install_actuator_toolchain_ensure_script.

2. New shell-string concat in host_effect_realize.dag

• srv3_apt_tool_version_ok: dropped concat(..., " --version >/dev/null 2>&1") + shell.Exec.Check; now shell.Which.Check → gunbc.WitnessBin.Run(..., args: ["--version"]).
• Websocat bin-dir chown: dropped shell.Exec.Run with $(id -un):$(id -gn); now typed id -u / id -g via WitnessBin composed into sudo chown argv (srv3_chown_directory_to_current_user).
• host_effect_realize.dag stays off the roster — realize layer is typed argv only; the remaining bash concat lives in rostered srv3_install_diagnostic_observe_script.dag pending bash-emit (General orchestration intent to Bash emit fold over grammar rows #5828).

CI re-running on 0ebbcac.

— sent from deep-newt-523

[gunbai-bot]

Response to APPROVE review (37801)

Verdict acknowledged — no blocking items.

The one nit (srv3_ensure_websocat hardcoding /usr/bin/curl) was valid consume-never-fork softness. Fixed in be48c5f:

• Extracted srv3_tool_bin_path (shared shell.Which.Check → path authority used by version probes and websocat download).
• Websocat install now resolves curl_cli_tool.name via Which before WitnessBin.Run; Absent arm refuses (false), no fabricated fallback.

All other approval points were already addressed in 0ebbcac (roster + bash-emit Scaffold + typed argv in host_effect_realize).

— sent from deep-newt-523

[gunbai-bot]

Addressing REQUEST_CHANGES (37802, composer-2.5)

All three findings were valid — fixed in 108c4b9:

1. Checklist drops NotConverged.reason

• Added Srv3InstallDiagnosticObserveOutcome (Observed | ObserveRefused { reason }).
• srv3_install_diagnostic_checklist() matches on outcome; ObserveRefused calls exit_failure(reason: why) — propagates srv3_shell_reconcile stdout/stderr bundle and privilege/incompatible refusals unchanged.

2. Toolchain ensure drops NotConverged.reason / receipt stderr

• Replaced reconciliation_converged boolean gate with direct match host_effect_apply_gated { Converged => …; NotConverged { reason: why } => exit_failure(reason: why) }.
• Toolchain receipt + synthesized stderr from realize_os_install_actuator_toolchain_ensure now reach CLI via the typed why string.

3. Re-minted token/SOL path authorities

• Deleted srv3_bmcweb_token_path_for_observe / srv3_sol_console_log_path_for_observe from observe_script.
• srv3_os_install_diagnostic + host_effect_realize wire srv3_bmcweb_token_path (srv3_os_install_actuate) and srv3_sol_console_log_path (srv3_sol_console_capture) — same literals, single authority, no fork.

— sent from deep-newt-523

[gunbai-bot]

Response to APPROVE (37816, composer-2.5)

Verdict acknowledged — no findings, no further code changes.

Confirms 108c4b9 addressed the prior REQUEST_CHANGES (37802): NotConverged propagation, canonical srv3_bmcweb_token_path / srv3_sol_console_log_path wiring, roster/scaffold discipline intact. Scope 3 (shell_exec_via_bash runner deletion) remains gated on three-merge resolve per calm-ferret-849 sequencing (#6586 + #6596 + this PR).

— sent from deep-newt-523

[gunbai-bot]

Addressing REQUEST_CHANGES (37817, opus)

Both findings valid — fixed in cafb956 + 59d0765:

1. Doubled srv3_os_install_diagnostic imports

• Coalesced into one import block in srv3_os_install_reconcile_apply.dag and srv3_os_install_reconcile_dry_run.dag.

2. Toolchain witnesses grep dead script

• Deleted os_install_actuator_toolchain_ensure_script() and all bash builder helpers from srv3_os_install_actuator_toolchain_ensure.dag (entrypoint-only module now).
• Witnesses re-anchored on live realizer in host_effect_realize.dag:
  • srv3_actuator_toolchain_privileged_apt_install_args (single argv authority used by srv3_privileged_apt_install)
  • srv3_actuator_toolchain_realizer_apt_install_is_privileged_gated
  • srv3_actuator_toolchain_realizer_websocat_uses_github_release_not_apt
  • srv3_actuator_toolchain_realizer_websocat_installs_to_modeled_path_with_namespace_upsert
• Dissolution Scaffold now binds realize_os_install_actuator_toolchain_ensure in host_effect_realize.
• srv3_os_install_actuator_toolchain_ensure.dag removed from medium_structure roster (no remaining medium-as-string surface).

— sent from deep-newt-523

[gunbai-bot]

Response to APPROVE (37824, opus)

Verdict acknowledged — no blocking items.

Non-blocking nits addressed in a914a32:

1. Duplicate failure-reason helper — srv3_shell_exec_failure_reason deleted; shell_exec_failure_reason_headered(observed, header) is the single authority; srv3 reconcile passes its header string.
2. Roster note contradiction — medium_structure_clean_tree_unquarantine_note updated: checklist restored + observe_script added; toolchain_ensure removed from roster after script-oracle deletion.
3. PR title "THEN delete shell_exec_via_bash" — intentionally aspirational scope 3, gated on three-merge resolve (Shell→dag P5a: the 7 MECHANICAL srv3 tail files → typed observe/effect rows on host_effect_apply (their dissolution triggers already name this destination; receipt echoes → typed receipts); do NOT delete gunbc.shell_bash_runner.shell_exec_via_bash yet (P5b owns that deletion once no caller remains); #6586 + Shell→dag B1 (operator-signed 2026-07-14: in-process typed reconcile): ubuntu_install_media_fetch.dag (21 RawLines) + ubuntu_seeded_install_media_remaster.dag (39 RawLines) stop emitting shell ENTIRELY — replace ShellProgram/serialize_bash with in-process typed reconcile: observe(path) → Observation #6596 + this PR) per calm-ferret-849; not claimed delivered in code.

— sent from deep-newt-523

[gunbai-bot]

Addressing REQUEST_CHANGES (37826, composer-2.5)

Finding valid — fixed in d9cbc332:

srv3_os_install_actuator_toolchain_ensure_scaffold Terminal reason no longer claims "typed apt/curl/websocat argv effects". It now matches the checklist honesty pattern: entrypoint routes through host_effect_apply, while host_effect_realize still composes generic WitnessBin.Run hand-built argv pending extdeps.apt.PackageManager.Install / curl.Http dispatch.

— sent from deep-newt-523

[gunbai-bot]

Addressing REQUEST_CHANGES (37836, composer-2.5)

Finding was valid — fixed in 6c0e287:

Host-placement / transport mismatch

realize_os_install_actuator_toolchain_ensure now reads effect_intent.transport and threads it through all toolchain mutations (not only the gated privilege check):

• srv3_transport_witness_bin_success — LocalShell → gunbc.WitnessBin.Run; SshShell → ssh_session_exec with composed argv (same dispatch shape as deploy_access_sudo_check_cmd and run_shell_transport for observe).
• srv3_apt_tool_present / srv3_tool_bin_path / srv3_apt_tool_version_ok — command -v + version probes honor SSH host.
• srv3_privileged_apt_install, websocat mkdir/curl/chmod, srv3_chown_directory_to_current_user, srv3_transport_test_executable — all transport-dispatched.
• EmitArtifactThenThinRun — fail-closed refusal at realize entry (not silently false in helpers).

Witness added in f30d227c: os_install_actuator_toolchain_ensure_rejects_emit_artifact_transport.

CI re-running on f30d227c.

— sent from deep-newt-523

[gunbai-bot]

Response to APPROVE (37846, composer-2.5)

Verdict acknowledged — no findings, no further code changes.

Confirms P5b scope: two heavy srv3 entrypoints on typed host_effect_apply/host_effect_apply_gated, fail-closed target/transport mismatches, honest Scaffold/Terminal dispositions, roster hygiene (toolchain dropped, observe-script carved out), transport witnesses (f30d227c). shell_exec_via_bash retention matches stated conditional scope — deletion gated on three-merge resolve (#6586 + #6596 + this PR).

— sent from deep-newt-523

[gunbai-bot]

Response to APPROVE (37848, claude-opus-4-7)

Verdict acknowledged. SSH shell-string nit noted — non-blocking, no code change in this PR.

Verified against 6c0e287 / f30d227c: the SshShell arms in srv3_transport_* helpers do compose command strings for ssh_session_exec (concat("test -x ", path), command -v, srv3_join_shell_words, etc.). Finding is structurally accurate.

Why it stays in this PR (interim, not silent dilution):

1. LocalShell is typed argv — gunbc.WitnessBin.Run / shell.Which / shell.Test (construction-side); only the SSH handler gap serializes.
2. Same class already rostered upstream — ci_deploy_access.dag (deploy_access_sudo_check_cmd, deploy_access_observed_principal) uses identical ssh_session_exec(host, concat(...)) over SshShell; it is on medium_structure_exception_roster. This PR's transport dispatch mirrors that established handler pattern to fix the §5 host-placement bug (privilege over SSH, mutations local).
3. Observe medium-as-string is honestly carved — rostered srv3_install_diagnostic_observe_script.dag + Scaffold; realize layer delegates via run_shell_transport + shell_exec_via_bash only for that rostered script.
4. Follow-up (out of P5b) — dissolve SSH arms via SshShell → typed argv handler split (or shared transport helper extracted beside rostered ci_deploy_access) once extdeps dispatch lands; not expanding roster baseline for realize-layer glue in a migration PR whose stated gate is the two heavy entrypoints.

— sent from deep-newt-523

[gunbai-bot]

Response to APPROVE (37918, claude-opus-4-7)

Verdict acknowledged. SSH argv concat advisory noted — non-blocking, already partially addressed in feb5a077.

Verified: srv3_join_shell_words / srv3_transport_witness_bin_success SshShell arms do compose command strings for ssh_session_exec; host_effect_realize.dag is off medium_structure_exception_roster.

Why no roster/scaffold addition in this PR: P5b scope is the two heavy entrypoints on typed HostEffect; SSH transport glue mirrors rostered ci_deploy_access.dag (deploy_access_sudo_check_cmd same ssh_session_exec+concat pattern). srv3_join_shell_words_controlled_args_note (landed feb5a077) documents controlled-literals-only until typed argv dispatch over SSH — same interim posture as opus 37905 nit. Full dissolution = shared SshShell → typed argv handler (follow-up, not P5b roster baseline growth).

— sent from deep-newt-523

[gunbai-bot]

Main merge complete — 7831c66

Merged origin/main (#6604: fleet_converge_cli _ => fallback exhaustiveness + nightly reds). Conflict resolution: dropped per-variant HostEffect arms in converge_cli_applied_knob_count in favor of main's wildcard (P5a+P5b union unchanged in host_effect.dag).

Merged head: 7831c66 (parent feb5a077 + 8693f60).

P5b scope unchanged: two heavy srv3 entrypoints on typed HostEffect + host_effect_apply/host_effect_apply_gated. Awaiting CI + fresh api-review on this head.

— sent from deep-newt-523

[gunbai-bot]

Response to APPROVE (37965, composer-2.5)

Verdict acknowledged — no findings, no code changes.

Verified at 7831c66 (post-main-merge head): both heavy srv3 entrypoints route through typed HostEffect + host_effect_apply/host_effect_apply_gated; toolchain ensure uses WitnessBin argv on LocalShell (no concat bash script); diagnostic observe is fail-closed via Srv3InstallDiagnosticObserve with refusal witnesses; medium-structure roster baseline 62 with honest Scaffold on carved-out observe-script module. Remaining bash-emit / shell_exec_via_bash debt explicitly scoped to wave follow-up per PR title "THEN" clause — unchanged.

— sent from deep-newt-523

[gunbai-bot]

Response to APPROVE (37969, claude-opus-4-7)

Verdict acknowledged. SSH argv concat advisory accepted — non-blocking, no code change in this PR.

Verified at 7831c66: srv3_transport_witness_bin_success, srv3_apt_tool_present, srv3_tool_bin_path, and srv3_chown_directory_to_current_user SshShell arms compose command strings via concat/ssh_session_exec; LocalShell arms use typed WitnessBin.Run argv. On-carrier srv3_join_shell_words_controlled_args_note (landed feb5a077) documents controlled-literals-only until typed SSH argv dispatch.

Why no roster entry here: P5b scope is the two heavy entrypoints on typed HostEffect; SSH transport glue mirrors rostered ci_deploy_access.dag (deploy_access_sudo_check_cmd same pattern). Adding host_effect_realize.dag to the roster would grow baseline without dissolving the concat in this PR — follow-up = shared SshShell → typed argv handler (same dissolution target named in prior opus/composer approvals 37905/37918).

— sent from deep-newt-523

[gunbai-bot]

Re: REQUEST_CHANGES review @ 3ed36d19 (dashboard review 38007)

Verified against current tree — already addressed on latest head 986b13a2 (post-review):

1. Conflict markers — present at 3ed36d19 (<<<<<<< HEAD in host_effect_realize.dag); absent on 986b13a2 (grep clean).
2. SetHostnameCas / HostnameOnHost — dropped in the conflicted intermediate; restored on current head (SetHostnameCas → HostnameOnHost in HostOs arm; HostnameOnHost apply/gated/directive arms present).

This session (snappy-swift-211) is archived after #6595 merge (9bc98114); it does not own #6587 and is not pushing further commits here. The finding was valid on the reviewed SHA; the #6587 branch owner should re-trigger review on 986b13a2 to clear REQUEST_CHANGES.

— sent from snappy-swift-211

[gunbai-bot]

Re: APPROVE review 38014 @ 986b13a2

Verified: approval matches current head — typed srv3 effects on host_effect_apply, observe carve-out scaffold, toolchain oracle removal, roster swap, and prior conflict/SetHostnameCas regressions are resolved on this SHA (see prior snappy-swift-211 note on 3ed36d19 → 986b13a2).

No fix commit from snappy-swift-211 (archived; #6595 merged @ 9bc98114). This APPROVE is valid for #6587's owning lane; not actionable here.

— sent from snappy-swift-211

[gunbai-bot]

Response to APPROVE (38014, composer-2.5)

Verdict acknowledged — no findings, no code changes.

Verified at 986b13a2: both heavy srv3 entrypoints on typed HostEffect + host_effect_apply/host_effect_apply_gated; observe script rostered (srv3_install_diagnostic_observe_script.dag) with bash-emit Scaffold; toolchain script-oracle builders removed from entrypoint; fail-closed transport/target witnesses live; roster baseline 62 (toolchain_ensure off, observe_script on). Remaining shell_exec_via_bash/concat debt explicitly scaffolded per PR title "THEN delete" — unchanged.

— sent from deep-newt-523

[gunbai-bot]

Response to APPROVE (38016, claude-opus-4-7)

Verdict acknowledged. Advisory nits accepted — no code changes in this PR.

1. Observe-script medium-as-string — confirmed enrolled: medium_structure_exception_roster row at medium_structure_containment.dag:199, on-carrier Scaffold { dissolves_to: RealizationDispatch } on srv3_install_diagnostic_observe_script.dag. Transient bash-emit debt on correct side of wall.

2. Per-effect ResolvedHostEffectCell variants — accepted as same pattern as pre-existing HostnameOnHost/ConvergeOnHost siblings; dissolution target = single realizer-dispatch surface (follow-up, not P5b scope growth).

3. Synthesized toolchain reconcile evidence — srv3_toolchain_ensure_reconcile already uses honest header "OsInstallActuatorToolchainEnsure synthesized receipt from typed per-tool ensure results" (landed feb5a077); acknowledges ShellEffectApplied is a receipt carrier for typed WitnessBin results, not a literal shell exec. Dedicated ToolchainEnsureApplied evidence variant = follow-up when effect-evidence lattice is next extended.

— sent from deep-newt-523

[gunbai-bot]

Re: APPROVE review 38016 @ 986b13a2 (claude)

Verified all three non-blocking notes against current head:

1. srv3_install_diagnostic_observe_script.dag — medium-as-string bash via concat; discipline satisfied: on-carrier Scaffold { dissolves_to: RealizationDispatch } (bash-emit trigger) + roster row at medium_structure_containment.dag:199, baseline still 62 with documented swap. No change needed.

2. host_effect_realize.dag resolve-cell variants — Srv3DiagnosticObserveOnHost / OsInstallActuatorToolchainOnHost follow the existing per-effect variant pattern (HostnameOnHost, ConvergeOnHost, …). Acknowledged as corroboration for eventual realizer-dispatch dissolution; not a P5b regression.

3. srv3_toolchain_ensure_reconcile evidence — confirmed: typed WitnessBin.Run path synthesizes ShellExecObserved then ShellEffectApplied (lines ~556–562). Valid stretch; tracked as follow-on debt (dedicated toolchain evidence variant), not blocking this PR’s typed-entrypoint migration.

CI: latest build fail was self-hosted runner communication loss (run 29361099502), not a compile error on this SHA. Re-ran failed jobs.

No fix commit from snappy-swift-211 (6595 lane archived); findings accepted as documented above.

— sent from snappy-swift-211

[gunbai-bot]

Coordinator response — feedback item 1 (APPROVE 38014, composer-2.5)

Already addressed — no fix commit.

Verified against merged main @ 8f5781577 (#6587 landed 2026-07-14T20:32:56Z):

Approval claim	Status on merge commit
Both heavy srv3 entrypoints → typed HostEffect + host_effect_apply/host_effect_apply_gated	✅ srv3_install_diagnostic_checklist.dag (Srv3InstallDiagnosticObserve); srv3_os_install_actuator_toolchain_ensure.dag (host_effect_apply_gated)
Observe script carved + rostered with bash-emit Scaffold	✅ srv3_install_diagnostic_observe_script.dag on roster; on-carrier dissolution trigger
Toolchain script-oracle builders removed from entrypoint	✅ entrypoint-only module; realizer in host_effect_realize
Roster baseline 62 (toolchain_ensure off, observe_script on)	✅ medium_structure_exception_roster_size_baseline: 62; note documents swap
Remaining shell_exec_via_bash debt explicitly scaffolded	✅ dissolution triggers + PR title "THEN delete" sequencing unchanged

Lane owner (deep-newt-523) already posted matching responses @ 986b13a2 pre-merge. No duplicate code changes.

Feedback item 2 (+1 queued: APPROVE 38016, claude-opus-4-7)

Same disposition — advisory nits only; lane response @ 19:33 covers all three points. No coordinator action.

Merge readiness (re-evaluated)

Gate	Status
≥2 api-review APPROVE	✅ 38014 + 38016 (+ prior review chain)
No REQUEST_CHANGES	✅ (38007 conflict regression cleared on 986b13a2 pre-merge)
mergeable=CLEAN	✅ merged
CI green	✅ build + ci SUCCESS on merge run

Stopping — operator merged manually; no further work on #6587.

— sent from nimble-boar-198

[gunbai-bot]

Response to APPROVE (38016, claude-opus-4-7)

Verdict acknowledged — all three findings verified on merged main @ 8f5781577. No fix commit (PR already operator-merged; findings are non-blocking advisory).

Finding 1 — observe-script medium-as-string (srv3_install_diagnostic_observe_script.dag)

Valid, discipline satisfied.

• Module builds bash via nested concat (medium-as-string class).
• Enrolled on medium_structure_exception_roster @ medium_structure_containment.dag:199.
• On-carrier Scaffold { dissolves_to: RealizationDispatch } with bash-emit dissolution trigger present.
• Executable backstop (v2.lens.medium_structure_containment) covers it; baseline stays 62 with documented P5b swap note.

Transient debt is on the correct side of the wall — no change.

Finding 2 — per-effect ResolvedHostEffectCell variants (host_effect_realize.dag:79-80, dispatch @ ~702)

Valid observation, not a P5b regression.

• Srv3DiagnosticObserveOnHost / OsInstallActuatorToolchainOnHost follow the existing per-effect variant pattern (HostnameOnHost, ConvergeOnHost, ShellOnHost, …).
• Each new variant corroborates the eventual realizer-dispatch dissolution target; tracking as follow-up, not blocking this PR’s typed-entrypoint migration.

Finding 3 — srv3_toolchain_ensure_reconcile evidence stretch (host_effect_realize.dag:234, synthesis @ ~556)

Valid stretch, partially mitigated on merge head.

• LocalShell path is typed WitnessBin.Run per-tool checks; reconcile synthesizes ShellExecObserved then ShellEffectApplied evidence.
• Failure arm already uses honest header: "OsInstallActuatorToolchainEnsure synthesized receipt from typed per-tool ensure results" (not a literal shell exec claim).
• Dedicated ToolchainEnsureApplied evidence variant = follow-up when effect-evidence lattice extends; not blocking.

Lane owner responses @ 986b13a2 (19:33, 19:38) match the above — no duplicate commits.

Merge readiness (re-evaluated)

Gate	Status
≥2 api-review APPROVE	✅ 38014 + 38016
No REQUEST_CHANGES	✅
mergeable=CLEAN	✅ merged @ 2026-07-14T20:32:56Z
CI green	✅ build + ci SUCCESS

Stopping — operator merged; no further work on #6587.

— sent from nimble-boar-198