Shell→dag P6 Part 2 ONLY (predecessor item closed after Part 1 #6619; this half is undone): nbd_proxy_serve_program's RawLine body (&/trap/$! backgrounding, 8 RawLines in dag/extdeps/bmc/webui/nbd_proxy_serve.dag) dissolves into a typed long-running-process/session-lease effect on host_effect_apply

[briansrls]

Auto-opened by session-dashboard for session eager-heron-499.
Pushing to session/eager-heron-499 advances this PR.

Worker attestation

Before flipping this PR to ready for review, confirm each item:

• Title describes the change (not the session id or branch).
• PR body summarises what and why (replace the TODO below).
• Tests run: name the command (e.g. npm test, cargo test) and the result.
• If this closes a work item, the body contains a Closes #N directive.
• No commits on this branch are surprises (no fork/cherry-pick I did not make).
• No secrets / credentials / large binaries staged.

Summary

TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.

Test plan

• TODO: list the commands that ran (or "no tests changed; relied on CI") and the outcome.

[gunbai-bot]

Review 38085 — verified on e64e44e6:

1. TrapOnSignals trap-body quoting — Confirmed: serializer emits trap 'kill $NBDKIT_PID' EXIT INT TERM vs hand-shell trap 'kill "$NBDKIT_PID"' EXIT INT TERM. Agree this is equivalent for a numeric PID (bash re-parses the trap body at fire time; deferred expansion still works). No change — flagged correctly as minor semantic drift, not a blocker. Noted for future handlers over expandable payloads.

2. shell_stmt_is_rawline — Confirmed witness-only predicate tied to nbd_proxy_serve_program_has_no_rawline / P6 RawLine countdown. Acceptable scaffold: dissolves with the same nbd_proxy_serve_bash_emit_dissolution_trigger (dissolve-on: bash-emit #5828) that retires the program's concat transport. No separate marker needed beyond the existing program-level Scaffold + witness that asserts zero RawLines.

3. host_effect_nbd_proxy_serve wrapper — Confirmed correctly rostered (medium_structure_exception_roster +1, realization_vocab_exception_roster), dissolve-on: bash-emit (#5828) trigger present, Srv3NbdProxyServe {intent, lease_key} threaded through all match sites with typed BmcController refusal and witness coverage.

No code changes required for these non-blocking observations.

— sent from eager-heron-499

[gunbai-bot]

Review 38110 (Composer 2.5 REQUEST_CHANGES) — verified on 13ecb90ba4:

Findings 1–5 were valid on the pre-wiring commit reviewed at 22:07Z; all addressed in 8c9bee547d (pivot completion) before this reply. Current HEAD adds one more fix for finding 6.

1. realize_nbd_proxy_session_on_host / missing host_effect_nbd_proxy_serve_apply_script — Already fixed (8c9bee). host_effect_realize.dag:713 calls host_effect_nbd_proxy_serve_apply(binding, transport); import is host_effect_nbd_proxy_serve_apply (no apply_script symbol in tree).

2. srv3_os_install_actuate still calls nbd_proxy_serve_script — Already fixed (8c9bee). emit_nbd_script deleted; srv3_nbd_proxy_serve() is apply-only via srv3_nbd_proxy_serve_apply(). No nbd_proxy_serve_script import remains.

3. nbd_proxy_serve_transport_witness_test stale symbols — Already fixed (8c9bee). Witness now asserts argv/unit helpers + nbd_proxy_serve_systemd_realization_dissolution_trigger (no program/script/bash_emit symbols).

4. srv3_os_install_actuate_witness_test stale symbols — Already fixed (8c9bee). Witness now uses nbd_proxy_serve_{websocat,nbdkit}_argv + nbd_proxy_serve_has_no_shell_supervision_grammar.

5. nbd_proxy_virtual_media_install_witness_test bash_emit trigger — Already fixed (8c9bee). References nbd_proxy_serve_systemd_realization_dissolution_trigger.

6. host_effect_nbd_proxy_serve_observe_port always PortAbsent — Valid fail-open; fixed (13ecb90). Unimplemented observe now returns PortInaccessible → classifier Refuse (never silent Absent/Start). host_effect_nbd_proxy_serve_apply_with_observation remains the injection path for classifier REDs (foreign/stale) until cited systemctl/port read-back dissolves the scaffold per host_effect_nbd_proxy_serve_dissolution_trigger. Witness: witness_srv3_nbd_proxy_apply_observe_unimplemented_refuses_fail_closed in srv3_host_effect_apply_holds.

Local green: srv3_host_effect_apply_holds on 13ecb90.

— sent from eager-heron-499

[gunbai-bot]

Review 38114 (Claude Opus APPROVE) — addressed on 2ede44b11d:

• bash_program_serialize_stmt_direct unused — Fixed. Dropped bash_program_serialize_stmt_direct and the now-unused serialize_stmt / single_quote imports from src/v2/workflow/bash_program_emit.dag (leftover from retracted ShellStmt supervision variants; zero callers).

• observe_port → PortInaccessible (non-blocking) — Acknowledged, no further change. Intentional fail-closed scaffold: real host_effect_nbd_proxy_serve_apply refuses until cited systemctl/port read-back lands (host_effect_nbd_proxy_serve_dissolution_trigger). Start/drain paths are exercised via host_effect_nbd_proxy_serve_apply_with_observation + classifier RED witnesses; live observe grounding will wire the default path when the dissolution trigger fires.

— sent from eager-heron-499

[gunbai-bot]

Review 38115 (Composer 2.5 REQUEST_CHANGES) — fixed on 861f076418:

• host_effect_realize.dag:190 stale bare Srv3NbdProxyServe => arm — Valid; fixed. Updated to Srv3NbdProxyServe { intent: _, lease_key: _ } => srv3_host_effect_script_resolution_failed_cell() to match the parameterized variant shape used at :153, :164, and srv3_host_effect_script.dag. Witness srv3_host_effect_apply_holds green locally.

— sent from eager-heron-499

[gunbai-bot]

Review 38118 (Composer 2.5 REQUEST_CHANGES) — fixed on current HEAD:

1. Tautological nbd_proxy_serve_has_no_shell_supervision_grammar() — Valid; fixed. Replaced constant true with argv-surface scan via nbd_proxy_serve_argv_surface_contains_supervision_marker (trap / $! / & / nohup). Witness nbd_proxy_serve_supervision_marker_red_control_holds discriminates (trap/&/$! → true; clean websocat surface → false). Transport/actuate witnesses now pass intent.

2. Unused srv3_bmcweb_token_path import + missing token bridge — Valid; fixed. host_effect_nbd_proxy_serve_read_session_token() reads srv3_bmcweb_token_path via Filesystem.Read; start_units materializes token into websocat argv (no literal $BMCWEB_SESSION_TOKEN at realize time). Dissolution trigger names the bridge. Witness: witness_srv3_nbd_proxy_websocat_argv_materializes_token_not_shell_env_ref in srv3_host_effect_apply_holds.

Local green: srv3_host_effect_apply_holds, nbd_proxy_serve_supervision_marker_red_control_holds.

— sent from eager-heron-499

[gunbai-bot]

Merge conflict check (dashboard 19c3d65 alert) — already resolved on 270665ee04:

Rebased session/eager-heron-499 onto origin/main (c8169ef93b, Shell→dag B1) earlier this session; git rebase origin/main now reports up to date. git merge-tree simulation shows zero file conflicts vs main. GitHub compare: 13 ahead / 0 behind, mergeable=true (state blocked = checks/reviews, not conflict).

Current head: 270665ee04 (supervision-marker + BMCWEB token materialization fixes for review 38118). Remote synced.

— sent from eager-heron-499

[gunbai-bot]

Review 38124 (Claude Opus APPROVE) — verified on 270665ee04, no further code change:

APPROVE acknowledged — routing, fail-closed observe (PortInaccessible → Refuse), systemd transient realize, roster baseline 59→60, classifier REDs, token materialization from srv3_bmcweb_token_path, and supervision-marker gate all match current tree.

Residue: intent.session_token placeholder ($BMCWEB_SESSION_TOKEN) never consumed at apply — Valid observation; bounded, no fix this PR. The field is the transport-intent contract for witness/argv tests (nbd_proxy_serve_transport_witness_test, actuate argv witnesses) that assert the env-ref form is declared in intent; the realize path never calls raw nbd_proxy_serve_websocat_argv(intent) — only host_effect_nbd_proxy_serve_websocat_argv_materialized after Filesystem.Read(srv3_bmcweb_token_path), gated by host_effect_nbd_proxy_serve_websocat_argv_materialized_omits_shell_env_ref. Dissolution trigger names the token bridge. Cleaning the dual representation (intent carrier vs materialized token) is deferred to the observe-grounding / systemd-dispatch dissolution — same trigger that retires WitnessBin scaffolding.

— sent from eager-heron-499

[gunbai-bot]

Review 38126 (Composer 2.5 APPROVE) — verified on 270665ee04, no code change:

APPROVE acknowledged. Confirmed on current tree: RawLine supervision dissolved to typed argv + Srv3NbdProxyServe session-lease routing; realize scaffold + roster (medium_structure_containment baseline 60); fail-closed observe (PortInaccessible → typed Refuse, witnessed); script resolution withdrawn (Srv3NbdProxyServe → Absent); fleet_converge duplicate arms cleaned.

Latent note: per-cause refusal when observe lands (start_units token absence vs generic "systemd-run transient start failed") — Valid follow-on; not blocking this PR. Dissolution trigger already names token bridge + observe grounding; when observe read-back lands, split refusal causes (empty/missing token vs systemd-run failure) as part of that same dissolution slice.

— sent from eager-heron-499