Shell->dag Slice 3 precondition: freeze live_deploy emitted script as a committed golden; kill the #6023 self-referential .contains gate

.githooks/pre-push

@@ -55,6 +55,8 @@ fresh_artifact_path() {
     .github/fleet-converge.sh*) return 0 ;;
     dag/gunbc/stage0_crate_layout_generated.dag*) return 0 ;;
     src/v1/stage0/src/bootstrap_stage0_crate_layout_generated.rs*) return 0 ;;
+    .github/live-deploy-srv1-apply.sh*) return 0 ;;
+    .github/live-deploy-srv1-retract.sh*) return 0 ;;
     docs/plans/idea-machine.md*) return 0 ;;
     docs/plans/algebraic-rewrite-optimization.md*) return 0 ;;
     docs/plans/dag-v2-defork-audit.md*) return 0 ;;

.github/live-deploy-srv1-retract.sh

@@ -0,0 +1,10 @@
+set -euo pipefail
+# GENERATED RETRACT by dag/gunbc/live_deploy/emit.dag host=srv1
+# owned-artifacts only — ensured deps (tailscale, nodejs) intentionally NOT purged
+# Runs UNPRIVILEGED; privileged ops via sudo -n <command> (tailscale, systemctl, rm).
+sudo -n tailscale serve reset || true
+sudo -n systemctl disable --now gunbc-roadmap.service 2>/dev/null || true
+sudo -n rm -f /etc/systemd/system/gunbc-roadmap.service
+sudo -n systemctl daemon-reload
+sudo -n rm -f /opt/gunbc/server.js
+echo live-deploy-receipt host=srv1 fold=retract verdict=converged

dag/gunbc/generated_artifact.dag

@@ -17,14 +17,16 @@ type GeneratedArtifact
   | FleetConvergeArtifact
   | Stage0CrateLayoutGeneratedDagArtifact
   | Stage0CrateLayoutGeneratedRsArtifact
+  | LiveDeployApplyScriptArtifact
+  | LiveDeployRetractScriptArtifact
   | AutoinstallUserDataArtifact { spec: HostAutoinstall }
   | ProxyDhcpDnsmasqArtifact { spec: InstallServerSpec }
   | PlanArtifact { plan: Plan }
 
 data generated_artifact_registry: List<GeneratedArtifact> = concat(
   concat(
     concat(
-      [CiYamlArtifact, FalsifierYamlArtifact, GitignoreArtifact, RoadmapArtifact, DesignArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, RunnerDeployArtifact, FleetConvergeArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact],
+      [CiYamlArtifact, FalsifierYamlArtifact, GitignoreArtifact, RoadmapArtifact, DesignArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, RunnerDeployArtifact, FleetConvergeArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, LiveDeployApplyScriptArtifact, LiveDeployRetractScriptArtifact],
       map(fleet_autoinstall_specs, s => AutoinstallUserDataArtifact { spec: s })
     ),
     map(fleet_install_server_specs, s => ProxyDhcpDnsmasqArtifact { spec: s })
@@ -55,6 +57,8 @@ fn artifact_path(a: GeneratedArtifact) -> String {
     FleetConvergeArtifact => ".github/fleet-converge.sh"
     Stage0CrateLayoutGeneratedDagArtifact => "dag/gunbc/stage0_crate_layout_generated.dag"
     Stage0CrateLayoutGeneratedRsArtifact => "src/v1/stage0/src/bootstrap_stage0_crate_layout_generated.rs"
+    LiveDeployApplyScriptArtifact => ".github/live-deploy-srv1-apply.sh"
+    LiveDeployRetractScriptArtifact => ".github/live-deploy-srv1-retract.sh"
     AutoinstallUserDataArtifact { spec } => concat(concat("provisioning/", spec.host), "/user-data")
     ProxyDhcpDnsmasqArtifact { spec } => concat(concat("provisioning/", spec.host), "/dnsmasq.conf")
     PlanArtifact { plan } => plan_path(p: plan)
@@ -75,6 +79,8 @@ fn artifact_commit_policy(a: GeneratedArtifact) -> CommitPolicy {
     FleetConvergeArtifact => CommitRequired { consumer: HostReconciler }
     Stage0CrateLayoutGeneratedDagArtifact => CommitRequired { consumer: GitProtocol }
     Stage0CrateLayoutGeneratedRsArtifact => CommitRequired { consumer: GitProtocol }
+    LiveDeployApplyScriptArtifact => CommitRequired { consumer: HostReconciler }
+    LiveDeployRetractScriptArtifact => CommitRequired { consumer: HostReconciler }
     AutoinstallUserDataArtifact { spec: _ } => NotCommitted
     ProxyDhcpDnsmasqArtifact { spec: _ } => NotCommitted
   }
@@ -104,6 +110,8 @@ fn artifact_eq(a: GeneratedArtifact, b: GeneratedArtifact) -> Bool {
     FleetConvergeArtifact => match b { FleetConvergeArtifact => true  _ => false }
     Stage0CrateLayoutGeneratedDagArtifact => match b { Stage0CrateLayoutGeneratedDagArtifact => true  _ => false }
     Stage0CrateLayoutGeneratedRsArtifact => match b { Stage0CrateLayoutGeneratedRsArtifact => true  _ => false }
+    LiveDeployApplyScriptArtifact => match b { LiveDeployApplyScriptArtifact => true  _ => false }
+    LiveDeployRetractScriptArtifact => match b { LiveDeployRetractScriptArtifact => true  _ => false }
     AutoinstallUserDataArtifact { spec } => match b { AutoinstallUserDataArtifact { spec: spec2 } => spec.host == spec2.host  _ => false }
     ProxyDhcpDnsmasqArtifact { spec } => match b { ProxyDhcpDnsmasqArtifact { spec: spec2 } => spec.host == spec2.host  _ => false }
     PlanArtifact { plan } => match b { PlanArtifact { plan: plan2 } => plan.slug == plan2.slug  _ => false }

dag/gunbc/generated_artifact_emit.dag

@@ -7,6 +7,7 @@ import gunbc.generated_artifact {
   RunnerDeployArtifact, FleetConvergeArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact,
   AutoinstallUserDataArtifact, ProxyDhcpDnsmasqArtifact, PlanArtifact,
   Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact,
+  LiveDeployApplyScriptArtifact, LiveDeployRetractScriptArtifact,
   artifact_path
 }
 import gunbc.ci_yaml_emit { expected_ci_yml }
@@ -26,6 +27,10 @@ import gunbc.stage0_crate_layout_emit {
   expected_stage0_crate_layout_generated_dag,
   expected_stage0_crate_layout_generated_rs
 }
+import gunbc.live_deploy.emit {
+  expected_live_deploy_apply_script,
+  expected_live_deploy_retract_script
+}
 
 fn artifact_generate(a: GeneratedArtifact) -> String {
   match a {
@@ -40,6 +45,8 @@ fn artifact_generate(a: GeneratedArtifact) -> String {
     FleetConvergeArtifact => expected_fleet_converge_sh()
     Stage0CrateLayoutGeneratedDagArtifact => expected_stage0_crate_layout_generated_dag()
     Stage0CrateLayoutGeneratedRsArtifact => expected_stage0_crate_layout_generated_rs()
+    LiveDeployApplyScriptArtifact => expected_live_deploy_apply_script()
+    LiveDeployRetractScriptArtifact => expected_live_deploy_retract_script()
     AutoinstallUserDataArtifact { spec } => autoinstall_user_data(payload: spec.payload)
     ProxyDhcpDnsmasqArtifact { spec } => install_server_dnsmasq_conf(spec: spec)
     PlanArtifact { plan } => expected_plan_md(p: plan)
@@ -59,6 +66,8 @@ fn artifact_extra_valid(a: GeneratedArtifact) -> Bool {
     FleetConvergeArtifact => true
     Stage0CrateLayoutGeneratedDagArtifact => true
     Stage0CrateLayoutGeneratedRsArtifact => true
+    LiveDeployApplyScriptArtifact => true
+    LiveDeployRetractScriptArtifact => true
     AutoinstallUserDataArtifact { spec: _ } => true
     ProxyDhcpDnsmasqArtifact { spec: _ } => true
     PlanArtifact { plan: _ } => true

dag/gunbc/live_deploy/emit.dag

@@ -146,14 +146,6 @@ fn expected_live_deploy_retract_script() -> String {
   live_deploy_retract_script_for(spec: deployment_spec_srv1())
 }
 
-fn live_deploy_apply_script_drifted(committed: String) -> Bool {
-  !(committed == expected_live_deploy_apply_script())
-}
-
-fn live_deploy_retract_script_drifted(committed: String) -> Bool {
-  !(committed == expected_live_deploy_retract_script())
-}
-
 fn live_deploy_systemd_unit_for(spec: DeploymentSpec) -> String {
   render(doc: emit_systemd_unit_doc(spec: spec), proto: live_deploy_protocol)
 }
@@ -176,3 +168,14 @@ data live_deploy_emit_shell_dissolution_trigger: Disposition = Scaffold {
     field: WholeDeclaration
   }
 }
+
+data live_deploy_retract_emit_shell_dissolution_trigger: Disposition = Scaffold {
+  dissolves_to: RealizationDispatch,
+  bind: DeclarationRef {
+    module_path: "gunbc.live_deploy.emit",
+    decl_name: "live_deploy_retract_script_for",
+    field: WholeDeclaration
+  }
+}
+
+data live_deploy_golden_freeze_note: String = "The apply/retract scripts rendered here are frozen as committed golden artifacts (gunbc.generated_artifact LiveDeployApplyScriptArtifact / LiveDeployRetractScriptArtifact, gated byte-for-byte in test.claim.live_deploy.emit) so live_deploy's current shell-emission behavior is provable (green by execution + a discriminating RED), killing the #6023-class self-referential drift check that compared expected_live_deploy_apply_script() to itself. This is a SCAFFOLD, not the end-state: live_deploy is RUNTIME-PRESENT (docs/plans/shell-emission-model.md Slice 3) and dissolves when heredoc file bodies become typed Filesystem.Write effects and apt/systemctl/tailscale become typed argv invocations — see live_deploy_emit_shell_dissolution_trigger / live_deploy_retract_emit_shell_dissolution_trigger."

dag/test/claim/generated_artifact_drift_test.dag

@@ -2,7 +2,7 @@
 module test.claim.generated_artifact_drift
 
 import gunbc.generated_artifact {
-  GeneratedArtifact, CiYamlArtifact, FalsifierYamlArtifact, GitignoreArtifact, RoadmapArtifact, DesignArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, RunnerDeployArtifact, FleetConvergeArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, AutoinstallUserDataArtifact, ProxyDhcpDnsmasqArtifact, PlanArtifact,
+  GeneratedArtifact, CiYamlArtifact, FalsifierYamlArtifact, GitignoreArtifact, RoadmapArtifact, DesignArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, RunnerDeployArtifact, FleetConvergeArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, LiveDeployApplyScriptArtifact, LiveDeployRetractScriptArtifact, AutoinstallUserDataArtifact, ProxyDhcpDnsmasqArtifact, PlanArtifact,
   RepoConsumer, GitProtocol, GithubActionsWorkflow, ProjectDocumentation, HostReconciler,
   CommitPolicy, CommitRequired, NotCommitted,
   generated_artifact_registry,
@@ -54,6 +54,8 @@ fn witness_all_known_committed() -> Bool {
     && !path_is_ignored(path: "dag/gunbc/stage0_crate_layout_generated.dag")
     && !path_is_ignored(path: "src/v1/stage0/src/bootstrap_stage0_crate_layout_generated.rs")
     && !path_is_ignored(path: "docs/plans/idea-machine.md")
+    && !path_is_ignored(path: ".github/live-deploy-srv1-apply.sh")
+    && !path_is_ignored(path: ".github/live-deploy-srv1-retract.sh")
 }
 
 fn witness_ignored_paths_excluded() -> Bool {
@@ -67,7 +69,7 @@ fn witness_ignored_paths_excluded() -> Bool {
 }
 
 fn witness_registry_complete() -> Bool {
-  count(generated_artifact_registry) == (11 + count(fleet_autoinstall_specs) + count(fleet_install_server_specs) + count(all_plans))
+  count(generated_artifact_registry) == (13 + count(fleet_autoinstall_specs) + count(fleet_install_server_specs) + count(all_plans))
     && registry_contains(a: CiYamlArtifact)
     && registry_contains(a: FalsifierYamlArtifact)
     && registry_contains(a: GitignoreArtifact)
@@ -79,6 +81,8 @@ fn witness_registry_complete() -> Bool {
     && registry_contains(a: FleetConvergeArtifact)
     && registry_contains(a: Stage0CrateLayoutGeneratedDagArtifact)
     && registry_contains(a: Stage0CrateLayoutGeneratedRsArtifact)
+    && registry_contains(a: LiveDeployApplyScriptArtifact)
+    && registry_contains(a: LiveDeployRetractScriptArtifact)
     && registry_contains(a: AutoinstallUserDataArtifact { spec: srv3_autoinstall_spec })
     && registry_contains(a: PlanArtifact { plan: idea_machine_plan })
     && fleet_install_server_specs.length() == 0
@@ -93,6 +97,8 @@ fn witness_registry_complete() -> Bool {
     && artifact_is_committed(a: FleetConvergeArtifact)
     && artifact_is_committed(a: Stage0CrateLayoutGeneratedDagArtifact)
     && artifact_is_committed(a: Stage0CrateLayoutGeneratedRsArtifact)
+    && artifact_is_committed(a: LiveDeployApplyScriptArtifact)
+    && artifact_is_committed(a: LiveDeployRetractScriptArtifact)
     && !artifact_is_committed(a: RunnerDeployArtifact)
     && !artifact_is_committed(a: AutoinstallUserDataArtifact { spec: srv3_autoinstall_spec })
     && !artifact_is_committed(a: ProxyDhcpDnsmasqArtifact { spec: srv3_install_server_spec })
@@ -122,6 +128,8 @@ fn witness_commit_policy_reasons() -> Bool {
     && consumer_is(a: FleetConvergeArtifact, expected: HostReconciler)
     && consumer_is(a: Stage0CrateLayoutGeneratedDagArtifact, expected: GitProtocol)
     && consumer_is(a: Stage0CrateLayoutGeneratedRsArtifact, expected: GitProtocol)
+    && consumer_is(a: LiveDeployApplyScriptArtifact, expected: HostReconciler)
+    && consumer_is(a: LiveDeployRetractScriptArtifact, expected: HostReconciler)
     && match artifact_commit_policy(a: RunnerDeployArtifact) { NotCommitted => true  _ => false }
     && match artifact_commit_policy(a: AutoinstallUserDataArtifact { spec: srv3_autoinstall_spec }) { NotCommitted => true  _ => false }
     && match artifact_commit_policy(a: ProxyDhcpDnsmasqArtifact { spec: srv3_install_server_spec }) { NotCommitted => true  _ => false }

dag/test/claim/live_deploy/emit_test.dag

@@ -18,11 +18,15 @@ import gunbc.live_deploy.spec {
 import gunbc.live_deploy.emit {
   expected_live_deploy_apply_script,
   expected_live_deploy_retract_script,
-  live_deploy_apply_script_drifted,
-  live_deploy_retract_script_drifted,
   live_deploy_systemd_unit_for,
   deployment_ensure_dependency_script,
 }
+import gunbc.generated_artifact {
+  LiveDeployApplyScriptArtifact,
+  LiveDeployRetractScriptArtifact,
+  artifact_path,
+}
+import extdeps.filesystem.filesystem_io { Filesystem }
 import gunbc.node_http_server_emit {
   roadmap_dashboard_served_static_route_table,
   roadmap_dashboard_node_http_server_source,
@@ -185,11 +189,18 @@ fn witness_systemd_unit_emitted() -> Bool {
     && string_contains(s: unit, pattern: "Environment=PORT=8080")
 }
 
-fn witness_drift_gates() -> Bool {
-  !live_deploy_apply_script_drifted(committed: expected_live_deploy_apply_script())
-    && live_deploy_apply_script_drifted(committed: concat(expected_live_deploy_apply_script(), "x"))
-    && !live_deploy_retract_script_drifted(committed: expected_live_deploy_retract_script())
-    && live_deploy_retract_script_drifted(committed: concat(expected_live_deploy_retract_script(), "x"))
+fn witness_apply_script_matches_committed_golden() -> Bool {
+  let r = Filesystem.Read(path: artifact_path(a: LiveDeployApplyScriptArtifact))
+  r.success
+    && r.content == expected_live_deploy_apply_script()
+    && !(concat(r.content, "x") == expected_live_deploy_apply_script())
+}
+
+fn witness_retract_script_matches_committed_golden() -> Bool {
+  let r = Filesystem.Read(path: artifact_path(a: LiveDeployRetractScriptArtifact))
+  r.success
+    && r.content == expected_live_deploy_retract_script()
+    && !(concat(r.content, "x") == expected_live_deploy_retract_script())
 }
 
 test fn live_deploy_emit_holds() -> Bool {
@@ -210,5 +221,6 @@ test fn live_deploy_emit_holds() -> Bool {
     && witness_static_site_routes_in_dashboard_route_table()
     && witness_static_site_paths_only_in_retracted_server()
     && witness_systemd_unit_emitted()
-    && witness_drift_gates()
+    && witness_apply_script_matches_committed_golden()
+    && witness_retract_script_matches_committed_golden()
 }