srv4 fleet subsumption + BMC virtual-media install path + modeling cleanup

[briansrls]

Subsumes srv4 into the fleet and onto GitHub Actions runners, driving it through the modeled .dag workflow, plus the supporting install-path modeling and several dissolved shell/§3 forks found along the way.

Outcome

srv4 is enrolled and serving: 5 GitHub runners live (org gunb-ai), rootless Docker + sccache 0.15.0 — runner-layer parity with srv1/srv2. Subsumption is not claimed complete: host-convergence still carries interim hand-values and every step that was performed by hand is typed, with an acceptance bar and dissolution trigger, in the registered plan gunbc.plans.fleet_subsumption_manual_gaps (srv4's memory row likewise carries a declared observation deferral, the srv1/srv2 pre-observation shape). The plan retires when srv5 subsumes with zero hand-run shell.

Fleet membership (Layer 1)

• srv4_host + samsung_970_evo_500gb_catalog (its actual drive, cited), LAN endpoint 192.168.1.196, srv4_offer, deployed_intent_v1_srv4. Placement solver now allocates srv4 slots (fleet_concurrent_runs 30→40).

Runner deploy (the width-INCREASE gap, now modeled)

• runner_host_deploy.dag: RunnerHostDeploy intent citing the ctrl installer (install-actions-runner.sh) as the bound realization handler (§3 cite-upstream, not re-coined). Renders the CTRL_RUNNER_* invocation, the App-key SecretRef, and the actions-runner@srv4-NN enables. srv4: user briansrls, 5 slots (disk-cap note for the 500GB NVMe vs 2TB fleet).

Execution-surface honesty + toolchain provisioning (§5 model-reality gap)

• fleet_intent_execution_surface no longer lies: container_runtime: Present{Docker} + toolchains: [sccache] instead of none/[].
• extdeps/cache/sccache.dag: SccacheBinaryRelease (pinned v0.15.0 + per-arch sha256, cited to mozilla/sccache/releases) + install script.
• extdeps/container/docker_ce.dag: DockerCeAptRepo + packages + rootless-docker apt prereq install, cited to docs.docker.com.

BMC virtual-media install path (used to install srv4 end-to-end)

• extdeps/storage/nbd.dag, extdeps/linux/usb_gadget.dag (typed ConfigfsOp list, not scattered concats), gunbc/bmc_virtual_media.dag: nbd-server → nbd-client → configfs mass_storage USB gadget. Unified under extdeps/bmc/virtual_media.dag VirtualMediaIntent with the existing nbd-proxy-websocat path (§3 fork dissolved).
• extdeps/firmware/uefi_shell.dag + gunbc/bmc_netboot_shell_boot.dag: shell-native tftp/execute boot modeling.

Install bugfixes (root-caused live, captured in the model + witnesses)

• grub.dag: quote kernel cmdline args containing ; (grub command separator) — ds=nocloud;s=... was truncated at ;, dropping the seedfrom, so autoinstall fell to interactive on every attempt. grub_cmdline_arg_render + the seeded-media builders quote it.
• ubuntu_seeded_install_media_remaster.dag: xorriso -boot_image any replay (was mkisofs, which destroyed the arm64 El Torito/ESP boot structure); instance-id derived from hostname (was hardcoded srv3).

All new modeling lands with green witnesses and dissolution markers on the shell-as-string leaves.

Operational (out of tree)

• srv4 provisioned via the modeled scripts; App-key in Secret Manager reconciled to the live key (revoked version disabled); temp credentials shredded.

🤖 Generated with Claude Code

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[gunbai-bot]

Addressed (review 41809) — the gunbai-secrets project-ID fork is consolidated onto the single existing authority gunbc.assimilate.bmc_token_federation.bmc_secrets_project_id, on head 75ef068747:

• bmc_onboard.dag: deleted its bmc_secrets_gcp_project decl, imports bmc_secrets_project_id, all three consumers repointed.
• fleet_ssh_access.dag: deleted its fleet_ssh_secrets_project decl (the one this PR introduced), consumes bmc_secrets_project_id.
• runner_host_deploy.dag: it imported the fleet_ssh_access fork transitively — repointed to the authority too, so there's exactly one source for the literal.
• Now-unused GcpProjectId imports dropped from both files.

git grep bmc_secrets_gcp_project / fleet_ssh_secrets_project is now empty; no import cycle (bmc_token_federation imports none of these). Zero hard diagnostics on the gate-equivalent compile, base advisory count unchanged, and all affected witnesses PASS (bmc_onboard_body, bmc_token_federation, runner_host_deploy, tailscale_acl_phase2).

— sent from valiant-crab-81

[gunbai-bot]

Thanks (review 41822). On the || true observation in the generated fleet-converge.sh bootstrap: agreed it's the softer §5 bar — the swallowed nonzero exits aren't counted, though as you note they sit in the declared pre-runtime bootstrap window and are followed by a loud gunbc converge that reds on a bad pin, so nothing fabricates green. I'm treating the "render each bootstrap step as a typed refusal incrementing host_failed" change as a follow-up in a separate PR rather than landing it here: it means editing the fleet_converge_emit.dag template and regenerating the artifact (re-touching the drift gate), which is orthogonal to this PR's srv4-subsumption scope and better isolated. Per the repo's merge policy (substantive follow-ups land in a new PR), I'd rather not widen this one further.

For the CI failures this PR hit on the prior head (all stale assertions the srv4 enrollment invalidated, not logic bugs): endpoint count 9→10 (srv4 adds a LAN + BMC endpoint), offers 3→4 (srv4_offer), and the srv3 grub-cmdline witness updated to the now-quoted autoinstall "ds=nocloud — the quoting is this PR's own fix for grub truncating the seedfrom at the unquoted ;. All three affected suites pass; head is now 0438ae743d.

— sent from valiant-crab-81

[gunbai-bot]

Follow-up on review 41809 (the gunbai-secrets project-id consolidation): my first pass pointed the three config modules at gunbc.assimilate.bmc_token_federation.bmc_secrets_project_id, which turned out to break the compile-clean gate — surfaced on the merged head 752a9441. Root cause, proven by execution:

bmc_token_federation imports v2.* compiler-orchestration modules (emit_orchestration, bash_orchestration_emit, std.orchestration/collection/diagnostic) for its GHA token-smoke workflow emission. The compile-clean gate compiles the affected .dag closures against a dag-only pool (--target dag), where those v2.* modules don't resolve. Importing bmc_token_federation dragged them into the config modules' dag-scoped closure: gunbc compile --entry dag/gunbc/tools/bmc_onboard.dag --source-root dag (dag-only) → v2.compiler.emit_orchestration not found; adding --source-root src/v2 resolves it. That's why the full-tree compile and the witnesses were green but the scoped gate went red.

Revised fix (head e329b68f): extracted the shared authority into a new lightweight, dependency-free module gunbc.fleet_secrets_config (fleet_secrets_gcp_project) and pointed bmc_onboard, fleet_ssh_access, and runner_host_deploy there. The three config modules now consume one shared authority — no re-minted literal — without coupling to bmc_token_federation's v2 imports. Verified: all three consumer closures compile clean under the dag-only pool, full gate compile has zero hard diagnostics, base advisory count unchanged, witnesses pass.

One honest residual: bmc_token_federation keeps its own bmc_secrets_project_id decl. It can't consume the shared authority in this PR, because editing it (or importing it from a dag-scoped module) puts its own un-resolvable v2.* imports into the gate's dag-only closure. Decoupling bmc_token_federation from the v2.* compiler internals is a pre-existing cross-boundary issue and a better fit for a focused follow-up. Net effect here: the three config-module forks the srv4 work introduced/carried collapse to one lightweight authority.

— sent from valiant-crab-81

[gunbai-bot]

Thanks — all three findings from review 41895 are addressed on the current head (8636a93):

1. .github/fleet-converge.sh re-add — correct catch, and now removed. The file was transiently re-added when the WIP auto-committer resolved the modify/delete merge conflict by keeping HEAD's side. Commit 12f87ca accepts main's #7121 deletion; git cat-file -e HEAD:.github/fleet-converge.sh is now empty and FleetConvergeArtifact is absent from the registry, so srv4 enrollment flows through the typed converge_apply path, not the paper transport.

2. uefi_interface_has_link predicate dissolution — agreed. It was a total 2→2 relabel of UefiMediaState. Deleted; iface_dhcp_rank now matches iface.media directly, with the no-link case as the MediaDisconnected => 0 arm, and the witness matches the coproduct inline.

3. boot_install_is_refused predicate dissolution — agreed; it was witness-only. Deleted; the two witnesses now branch on BootInstallAction's RefuseNoSource variant directly.

Both affected witness suites are green by execution (uefi_boot_install_decision, uefi_shell_environment).

— sent from valiant-crab-81

[gunbai-bot]

On review 41905's bmc_staged_file_basename fold-as-last note (dag/gunbc/bmc_netboot_serve.dag:153): agreed the accumulator is inert and it reads as a disguised last. Worth flagging that this exact idiom is already the established one in-tree — gunbc.gitignore_emit.path_basename (dag/gunbc/gitignore_emit.dag:239) is byte-for-byte the same fold(split(...), init: "", f: (_, seg) => seg). So the clean fix per DESIGN §2/§3 is not a local rewrite of this one site but consolidating both onto a single last-element / basename accessor (no such accessor exists in std today). I've deliberately scoped that consolidation out of this srv4 subsumption PR: it's a cross-module refactor touching gitignore_emit, and every extra push here re-runs the full floor against main's currently-active emitter/stage0-partition churn (this PR has already had to chase three emitter/partition merges to keep the generated-artifact drift gate green). Filing it as the honest follow-up rather than destabilizing a green head. No behavior change either way — both are correct last-of-split.

— sent from valiant-crab-81