design: fleet self-converge enforcement — host-local timers, CI observer

[gunbai-bot]

Summary

Adds docs/plans/fleet-self-converge-enforcement-design.md — the enforcement topology for homogeneous srvN: per-host ctrl-fleet-converge.timer running gunbc converge --host self, CI demoted to read-only observer (emit drift + receipt collection + fleet-green assert), HostManagementProfile for reachability, and retirement of the 21-line star script.

Incorporates post-review corrections: srv3 HandStoodUp reality (live OS, interim LAN path, Phase 2 timer priority), decoy-slice false-green as a fleet-green blocker (kernel cgroup read-back required), systemd timer spec fix (Persistent= only with OnCalendar), receipt grammar append-only migration, and explicit non-goals (fleet-green ≠ melt-proof).

Doc-only; no runtime or .dag changes. Implementation phases 0–4 are scoped in the doc for follow-on work.

Worker attestation

• Title describes the change (not the session id or branch).
• PR body summarises what and why.
• Tests run: doc-only — no code changes; no cargo test required.
• Closes work item: none (design sign-off PR).
• No surprise commits on this branch.
• No secrets / credentials / large binaries.

Test plan

• Doc-only PR — verified references against main (host_converge.dag, fleet_converge_cli.dag, live-deploy-srv1-apply.sh, roadmap_authority.dag, live fleet review 2026-07-21).
• CI: emit drift / compile gates expected green (no .dag edits).

[gunbai-bot]

Addressed all three findings from review 40846 in 5de0d908a6:

1. Phase 1 vs Phase 3/4 sequencing — Renamed section to "Phase 1 decision (gates Phase 3 observer)". The unsatisfiability claim now explicitly targets Phase 3 (CI fleet-green observer), with the path signed in Phase 1. Removed the misleading "Phase 4 blocker" heading.

2. Fail-closed fleet-green predicate — fleet_green now quantifies over every fleet_intent_known_hosts member. A host without timer_installed and without an explicit EnforcementExempt row refuses with TimerNotInstalled { host } — it cannot pass as a silent frontier. Today all three live hosts are in the enforcement set (no exemptions).

3. Phase 2 vs Phase 3 accept split — Phase 2 accept now covers timer active + receipt parsing + receipt-level cap correction only. Kernel cgroup-fs read-back is explicitly Phase 3 deliverable/accept; the doc adds a "Phase split" note under the predicate.

— sent from deep-swift-443

[gunbai-bot]

Verified review 40854 (claude APPROVE on 5de0d908a6) against the tree:

• Doc-only diff: docs/plans/fleet-self-converge-enforcement-design.md + fleet_self_converge_enforcement_plan_doc_provenance bind row at host_effect_orchestration.dag:98 (same pattern as effect_namespace_grants_doc_provenance).
• Design claims check out on current text: decoy-slice §5 blocker before fleet-green, TimerNotInstalled/EnforcementExempt fail-closed enrollment, line-grammar-only receipts, Phase 1 collection decision gating Phase 3 observer.

No further doc edits from this approval. Awaiting second approval + CI green on 29850404046.

— sent from deep-swift-443

[gunbai-bot]

Addressed review 40857 in fc81815b0b:

• Prerequisite §183: Phase 4 → Phase 3 for kernel-grounded read-back hard gate (matches fleet-green definition, phased plan, and review disposition table).
• Prerequisite header: split Phase 0 (slice fix + artifact migration) vs Phase 3 (kernel read-back); removed misleading "Phase 1 deliverable" label.

— sent from deep-swift-443

[gunbai-bot]

Verified review 40870 (cursor APPROVE on fc81815b0b) against the tree:

• Doc-only diff: 487-line fleet-self-converge-enforcement-design.md + fleet_self_converge_enforcement_plan_doc_provenance bind at host_effect_orchestration.dag:98.
• Phase E operationalization, fail-closed semantics (TimerNotInstalled, EnforcementExempt, decoy-slice refusal), Phase 3 kernel-read-back gate, and disposition table all match current text.
• No hand-Rust/shell/substrate changes in the diff.

No further edits from this approval. Also noted review 40872 (claude APPROVE on same SHA). Awaiting CI green on run 29851422389.

— sent from deep-swift-443

[gunbai-bot]

Verified review 40872 (claude APPROVE on fc81815b0b) against the tree:

• Doc-only: design note + fleet_self_converge_enforcement_plan_doc_provenance bind at host_effect_orchestration.dag:98, same pattern as effect_namespace_grants_doc_provenance at :96.
• §5/§3 claims hold: typed TimerNotInstalled/UnknownHost refusals, Phase 3 kernel read-back decoy-slice gate, HostManagementProfile re-parents ssh authority, dissolution trigger named.
• No .dag types, hand-Rust, or hand-shell in the diff.

No further edits from this approval. Awaiting CI green on run 29851422389.

— sent from deep-swift-443

[gunbai-bot]

Investigated CI failure on fc81815 (run 29851422389):

• Failed gate: extdeps_external_authority_gate_passes (batch 4), not doc-reachability or generated-artifact drift (both passed).
• Root cause: infra flake — corpus_live_clean_tree_holds() returned false in CI after ~48m under heavy swap/memory pressure ([floor-memory] swap=17GB, sccache zero-byte probe_bin fail-closed earlier in the same floor). Witness is green locally on fc81815 (gunbc run … corpus_live_clean_tree_holds → true).
• Fix: empty retrigger commit 1a83229443 (no doc/model delta). Avoided merging main — that would have pulled in okabe_ito_authority/solarized_authority naming bugs from Color palette catalogue: cited extdeps palettes, island-pastel SwatchSet, register binding #6991 that genuinely fail the anchor gate.

— sent from deep-swift-443

[gunbai-bot]

Verified review 41053 (claude APPROVE) against db48f8341c:

• docs/plans/fleet-self-converge-enforcement-design.md — Phase-E design doc only; no substrate/code-path changes.
• dag/gunbc/plans/host_effect_orchestration.dag — fleet_self_converge_enforcement_plan_doc_provenance bind row follows the existing effect_namespace_grants_doc_provenance sibling pattern in the same module.
• dag/tools/self_host_curated_probe_cargo.dag — separate CI fix (emitter_residual_site_map_doc_provenance bind for docs/probes/emitter_residual_site_map_2026-07-21.md orphan from main merge); same bind-row pattern, orthogonal to the design doc.

No further edits from this approval. Awaiting ci on run for current HEAD.

— sent from deep-swift-443

[gunbai-bot]

Verified review 41056 (cursor APPROVE) against db48f8341c:

• Doc-only scope: docs/plans/fleet-self-converge-enforcement-design.md is Phase E companion design (on-host timers, CI observer-only fleet-green, HostManagementProfile reachability, decoy-slice/kernel read-back gates, srv3 interim path) — aligns with host-effect-orchestration.md §2 Phase E and operator intent. No substrate, hand-Rust, or shell in the diff.
• Two bind: provenance rows: fleet_self_converge_enforcement_plan_doc_provenance in host_effect_orchestration.dag (design doc) and emitter_residual_site_map_doc_provenance in self_host_curated_probe_cargo.dag (existing probe doc from main merge; same sibling pattern as curated_probe_report_doc_provenance).

No further edits from this approval. Awaiting ci floor on run 29872638538.

— sent from deep-swift-443

[gunbai-bot]

Verified review 41121 (claude APPROVE) against 7ced3cf961:

• Doc-only diff vs main (2 files): docs/plans/fleet-self-converge-enforcement-design.md + fleet_self_converge_enforcement_plan_doc_provenance bind in host_effect_orchestration.dag.
• Provenance row mirrors the neighboring effect_namespace_grants_doc_provenance staging-carrier pattern (explicit dissolution context in the bind string).
• No substrate edits, no unit-modeling triggers, no hand-Rust/shell. Emitter probe bind is on main via MAIN-RED-PENDING fix: root #7023's orphan probe doc in the doc graph (bind: provenance row) #7035 — not in this PR's diff.

No further edits from this approval. ci in progress on run 29875677077 (build ✅).

— sent from deep-swift-443