Shell→dag: wire the gunbc converge CLI receiver — stage0 Subcommand gains converge --host <h>, dispatching to the landed converge_apply/ConvergePlan in-process interpreter (#6572) with typed receipts on the byte-locked receipt grammar; green by EXECUTION on a fixture host + discriminating RED (unkno

[briansrls]

Auto-opened by session-dashboard for session deep-crane-705.
Pushing to session/deep-crane-705 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[gunbai-bot]

Addressed the review findings (commit 07cae42):

1. Verdict state-space conflation (blocking) — confirmed valid. ConvergeVerdict.Absent is singly-authored for "no observation of effective state" (host_converge.dag:123-125); the CLI receipt reused it for four unrelated causes. Fix: minted ConvergeCliRefusalCause = PolicyUnsound{reason} | UnknownHost{host} | KnobFrontier{reason} as the typed internal/stderr representation, with converge_cli_refusal_message rendering the final string. The wire receipt line itself is unchanged (still the byte-locked host/applied/drifted/verdict grammar from fleet_converge_emit.dag's shell reference, which is itself 3-valued on verdict — that's the locked authority, not something this PR can widen); the typed split lives one layer up, in the cause carried alongside it. Witness test now asserts on the discriminated typed cause instead of substring-matching free text.

2. Fabricated applied count — confirmed valid, though the "divergence" was not actually reachable today (the same host_converge value flows unmodified into intent.effect via host_effect_apply's pass-through). Still a real single-authority violation per DESIGN §5 (reconstructing a fact instead of reading it from the actual evidence). Fixed: converge_cli_applied_knob_count now derives the count from the reconciled HostEffectIntent.effect's ConvergePlan.policy.knobs, falling back to the input only for the two HostEffect variants this call site never constructs.

3. Duplicated find-by-identity fold — confirmed valid. Extracted find_by_identity<T> in gunbc.host_converge and repointed both fleet_compute_host_for_identity (fleet_converge_apply.dag) and host_converge_for_identity (fleet_converge_cli.dag) onto it.

4. Hand-Rust receipt — added a Terminal disposition (gunbc_converge_cli_stage0_receiver_disposition in fleet_converge_cli.dag) documenting handle_converge as the permanent CLI transport handler (DESIGN §3 transport-is-a-handler) rather than scaffold pending dissolution — it carries no converge logic, only argv parse → in-process interpreter call → stdout/exit-code projection, so there's no dissolution target to name honestly. Cited from a Rust doc comment on handle_converge itself.

Re-verified whole-tree compile-clean (0 diagnostics) and live execution: gunbc converge --host srv1 (knob-frontier refusal) and --host no-such-fleet-host (unknown-host refusal) both still produce the unchanged byte-locked receipt line, now with typed, discriminated causes underneath.

— sent from deep-crane-705

[gunbai-bot]

Addressed the review-37851 finding: the Absent arm in converge_cli_receipt_for_host (apply-layer lookup miss against fleet_intent_known_hosts) was reusing UnknownHost, which is genuinely a different cause than the CLI-level policy-resolution Absent arm in converge_cli_run. Split it into a distinct ComputeInventoryAbsent { host } cause on ConvergeCliRefusalCause, with its own message text, and added a witness (witness_converge_cli_unknown_host_and_compute_inventory_absent_are_distinct_causes) directly discriminating the two causes and their rendered messages (this arm isn't reachable via current fixture data — the three fixture hosts fully overlap between the deployment-plan and compute-inventory lists — so the witness constructs both causes directly rather than through a live converge_cli_run path).

Verified green by execution via claim_batch (remote): PASS fleet_converge_cli_witness_holds (now 6 ANDed witnesses), plus unchanged live CLI receipts for srv1/no-such-fleet-host. Commit c7eda9fac.

— sent from deep-crane-705