From 3a8adde0bf6bfb38eb48291679ea37512f236cce Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sat, 25 Jul 2026 17:40:08 +0000 Subject: [PATCH 1/4] =?UTF-8?q?WIP:=20srv3=20install/reconcile=20subgraph?= =?UTF-8?q?=20retirement=20(shell=E2=86=92dag=20wave-2,=20operator=20G?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- dag/gunbc/srv3_boot_once_cd.dag | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/dag/gunbc/srv3_boot_once_cd.dag b/dag/gunbc/srv3_boot_once_cd.dag index 3294197b3a2..f3d2a25dcdb 100644 --- a/dag/gunbc/srv3_boot_once_cd.dag +++ b/dag/gunbc/srv3_boot_once_cd.dag @@ -1,5 +1,10 @@ module gunbc.srv3_boot_once_cd +import std.measure { Second, second } + +data srv3_boot_once_approval_grant_path: String = "/var/lib/gunbc/logs/approvals/srv3-boot-once-cd.grant" + +data srv3_boot_once_apply_read_back_sleep: Second = second(count: 45) data srv3_boot_once_cd_secret_debt: Disposition = Scaffold { dissolves_to: RealizationDispatch, From 6695f8ccc2286dee592a5fd1a311453203ae11c3 Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sat, 25 Jul 2026 17:41:00 +0000 Subject: [PATCH 2/4] =?UTF-8?q?WIP:=20srv3=20install/reconcile=20subgraph?= =?UTF-8?q?=20retirement=20(shell=E2=86=92dag=20wave-2,=20operator=20G?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- dag/gunbc/ci_deploy_access_observe.dag | 4 - dag/gunbc/fleet_converge_cli.dag | 4 - dag/gunbc/host_effect.dag | 9 - dag/gunbc/host_effect_realize.dag | 267 +++++++----------- dag/gunbc/nbd_proxy_virtual_media_install.dag | 2 +- dag/gunbc/srv3_host_effect_apply.dag | 25 -- dag/gunbc/srv3_nbd_proxy_serve_intent.dag | 3 +- 7 files changed, 104 insertions(+), 210 deletions(-) diff --git a/dag/gunbc/ci_deploy_access_observe.dag b/dag/gunbc/ci_deploy_access_observe.dag index 404012be39c..a55af8861a8 100644 --- a/dag/gunbc/ci_deploy_access_observe.dag +++ b/dag/gunbc/ci_deploy_access_observe.dag @@ -73,17 +73,13 @@ fn deploy_access_effect_is_typed_probe(effect: HostEffect) -> Bool { ShellCommand { script: _ } => false RedfishAction { action: _ } => false ConvergePlan { policy: _ } => false - Srv3InstallDiagnosticObserve { bmc: _, port: _, iso_path: _, iso_content_hash: _ } => false OsInstallActuatorToolchainEnsure {} => false ProvisionBuildCache { catalog_id: _ } => false SetHostnameCas { hostnamectl_path: _, base: _, desired: _ } => false - Srv3InstallReconcileObserve { include_git_meta: _ } => false - DurableApprovalGrantRecord => false DurableApprovalGrantRead => false Srv3InstallMediaFetch => false Srv3SeededInstallMediaRemaster => false Srv3SeededInstallMediaToolchainEnsure => false - Srv3SolConsoleCapture => false Srv3BmcwebSessionLogin => false Srv3BmcwebTokenExtract => false Srv3NbdProxyServe { intent: _, lease_key: _ } => false diff --git a/dag/gunbc/fleet_converge_cli.dag b/dag/gunbc/fleet_converge_cli.dag index 74873cb0086..871ed6ca851 100644 --- a/dag/gunbc/fleet_converge_cli.dag +++ b/dag/gunbc/fleet_converge_cli.dag @@ -59,16 +59,12 @@ fn converge_cli_applied_knob_count(intent: HostEffectIntent, fallback: Int) -> I SetHostnameCas { hostnamectl_path: _, base: _, desired: _ } => fallback ReadEffectivePosixPrincipal { read: _ } => fallback SudoNopasswdExecuteProbe { probe: _ } => fallback - Srv3InstallDiagnosticObserve { bmc: _, port: _, iso_path: _, iso_content_hash: _ } => fallback OsInstallActuatorToolchainEnsure {} => fallback ProvisionBuildCache { catalog_id: _ } => fallback - Srv3InstallReconcileObserve { include_git_meta: _ } => fallback - DurableApprovalGrantRecord => fallback DurableApprovalGrantRead => fallback Srv3InstallMediaFetch => fallback Srv3SeededInstallMediaRemaster => fallback Srv3SeededInstallMediaToolchainEnsure => fallback - Srv3SolConsoleCapture => fallback Srv3BmcwebSessionLogin => fallback Srv3BmcwebTokenExtract => fallback Srv3NbdProxyServe { intent: _, lease_key: _ } => fallback diff --git a/dag/gunbc/host_effect.dag b/dag/gunbc/host_effect.dag index 8ccf4b2050b..66bd5762bc2 100644 --- a/dag/gunbc/host_effect.dag +++ b/dag/gunbc/host_effect.dag @@ -28,24 +28,15 @@ type HostEffect = ShellCommand { script: String } | RedfishAction { action: RedfishSystemAction } | ConvergePlan { policy: HostConverge } - | Srv3InstallDiagnosticObserve { - bmc: NonEmptyStr, - port: Int, - iso_path: NonEmptyStr, - iso_content_hash: ContentHash, - } | OsInstallActuatorToolchainEnsure {} | ProvisionBuildCache { catalog_id: CacheInterfaceId } | SetHostnameCas { hostnamectl_path: NonEmptyStr, base: DnsLabel, desired: DnsLabel } | ReadEffectivePosixPrincipal { read: EffectivePosixPrincipalRead } | SudoNopasswdExecuteProbe { probe: SudoNopasswdExecuteProbeShape } - | Srv3InstallReconcileObserve { include_git_meta: Bool } - | DurableApprovalGrantRecord | DurableApprovalGrantRead | Srv3InstallMediaFetch | Srv3SeededInstallMediaRemaster | Srv3SeededInstallMediaToolchainEnsure - | Srv3SolConsoleCapture | Srv3BmcwebSessionLogin | Srv3BmcwebTokenExtract | Srv3NbdProxyServe { diff --git a/dag/gunbc/host_effect_realize.dag b/dag/gunbc/host_effect_realize.dag index 8ec6cca3dda..d52dd8018c5 100644 --- a/dag/gunbc/host_effect_realize.dag +++ b/dag/gunbc/host_effect_realize.dag @@ -2,17 +2,14 @@ module gunbc.host_effect_realize import gunbc.host_effect { HostEffect, ShellCommand, RedfishAction, ConvergePlan, - Srv3InstallDiagnosticObserve, OsInstallActuatorToolchainEnsure, ProvisionBuildCache, + OsInstallActuatorToolchainEnsure, ProvisionBuildCache, SetHostnameCas, ReadEffectivePosixPrincipal, SudoNopasswdExecuteProbe, - Srv3InstallReconcileObserve, - DurableApprovalGrantRecord, DurableApprovalGrantRead, Srv3InstallMediaFetch, Srv3SeededInstallMediaRemaster, Srv3SeededInstallMediaToolchainEnsure, - Srv3SolConsoleCapture, Srv3BmcwebSessionLogin, Srv3BmcwebTokenExtract, Srv3NbdProxyServe, @@ -79,15 +76,10 @@ import extdeps.tools.websocat { websocat_github_release_download_url, } import extdeps.bmc.os_install_actuator_toolchain { gunbc_bin_dir } -import gunbc.shell_bash_runner { shell_exec_via_bash } -import gunbc.srv3_install_diagnostic_observe_script { - srv3_install_diagnostic_observe_script, -} import gunbc.srv3_actuate_shell_paths { srv3_bmcweb_login_body_path, srv3_bmcweb_login_response_path, srv3_bmcweb_token_path, - srv3_sol_console_log_path, } import std.access { AccessDecision, Permit, Deny } import gunbc.ci_deploy_access { @@ -101,7 +93,6 @@ import gunbc.ci_deploy_access { deploy_access_read_principal_effect, deploy_access_sudo_probe_effect, } -import gunbc.srv3_host_effect_script { srv3_host_effect_script_for } import gunbc.live_deploy.spec { DeploymentSpec, DeploymentDependencyStep } import gunbc.live_deploy.emit { live_deploy_apply_script_for, @@ -121,7 +112,7 @@ import extdeps.cache.sccache { sccache_release_arch_token, sccache_release_digest, } -import gunbc.srv3_os_install_reconcile_types { +import gunbc.srv3_boot_once_cd { srv3_boot_once_approval_grant_path, srv3_boot_once_apply_read_back_sleep, } @@ -175,7 +166,6 @@ type ResolvedHostEffectCell = | RedfishOnBmc { node: ComputeHost, action: RedfishSystemAction } | ConvergeOnHost { node: ComputeHost, host_converge: HostConverge } | TypedReconcileOnHost { node: ComputeHost, kind: TypedReconcileKind } - | Srv3DiagnosticObserveOnHost { node: ComputeHost, bmc: String, port: String, iso_path: String, intent_content_hash: String } | OsInstallActuatorToolchainOnHost { node: ComputeHost } | ProvisionBuildCacheOnHost { node: ComputeHost, catalog_id: String } | HostnameOnHost { node: ComputeHost, hostnamectl_path: NonEmptyStr, base: DnsLabel, desired: DnsLabel } @@ -209,22 +199,10 @@ fn converge_plan_identity_mismatch_reason(node: ComputeHost, policy: HostConverg ) } -fn srv3_host_effect_script_resolution_failed_cell() -> ResolvedHostEffectCell { - IncompatibleCell { reason: "host_effect: srv3 typed effect script resolution failed; fail-closed" } -} - fn resolve_host_effect_cell(target: NodeControlPlane, effect: HostEffect) -> ResolvedHostEffectCell { match target { HostOs { node: n } => match effect { - Srv3InstallDiagnosticObserve { bmc: b, port: p, iso_path: ip, iso_content_hash: h } => - Srv3DiagnosticObserveOnHost { - node: n, - bmc: b as String, - port: p as String, - iso_path: ip as String, - intent_content_hash: h as String, - } OsInstallActuatorToolchainEnsure {} => OsInstallActuatorToolchainOnHost { node: n } ProvisionBuildCache { catalog_id: id } => @@ -250,75 +228,64 @@ fn resolve_host_effect_cell(target: NodeControlPlane, effect: HostEffect) -> Res LiveDeployDigestReadback { port: p } => LiveDeployDigestReadbackOnHost { node: n, port: p } _ => - match srv3_host_effect_script_for(effect: effect) { - Present { value: script } => ShellOnHost { node: n, script: script } - Absent => - match effect { - ShellCommand { script: s } => - ShellOnHost { - node: n, - script: retained_srvn(body: s, reason: "host_effect ShellCommand raw-script leaf (anemic String terminal, DESIGN section 5)"), - } - RedfishAction { action: _ } => - IncompatibleCell { reason: "host_effect: RedfishAction is out-of-band (Redfish) and cannot target HostOs (in-band shell/systemd); target BmcController instead. Typed mismatch via total fold, DESIGN section 5." } - ConvergePlan { policy: p } => - if n.identity != p.identity { - IncompatibleCell { reason: converge_plan_identity_mismatch_reason(node: n, policy: p) } - } else { - ConvergeOnHost { node: n, host_converge: p } - } - Srv3InstallDiagnosticObserve { bmc: _, port: _, iso_path: _, iso_content_hash: _ } => - srv3_host_effect_script_resolution_failed_cell() - OsInstallActuatorToolchainEnsure {} => - srv3_host_effect_script_resolution_failed_cell() - ProvisionBuildCache { catalog_id: id } => - ProvisionBuildCacheOnHost { node: n, catalog_id: id } - Srv3InstallReconcileObserve { include_git_meta: _ } => srv3_host_effect_script_resolution_failed_cell() - DurableApprovalGrantRecord => srv3_host_effect_script_resolution_failed_cell() - DurableApprovalGrantRead => - IncompatibleCell { reason: "host_effect: DurableApprovalGrantRead is in-band (actuator host typed read) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - Srv3InstallMediaFetch => TypedReconcileOnHost { node: n, kind: TypedReconcileFetch } - Srv3SeededInstallMediaRemaster => TypedReconcileOnHost { node: n, kind: TypedReconcileRemaster } - Srv3SeededInstallMediaToolchainEnsure => - SeededInstallMediaToolchainOnHost { node: n } - Srv3SolConsoleCapture => srv3_host_effect_script_resolution_failed_cell() - Srv3BmcwebSessionLogin => - BmcwebSessionLoginOnHost { node: n } - Srv3BmcwebTokenExtract => - BmcwebTokenExtractOnHost { node: n } - Srv3BootOnceReadBackSleep => - IncompatibleCell { reason: "host_effect: Srv3BootOnceReadBackSleep is in-band (actuator host typed sleep) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - Srv3ReceiptEmit { lines: _ } => - IncompatibleCell { reason: "host_effect: Srv3ReceiptEmit is in-band (actuator host typed receipt) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - SetHostnameCas { hostnamectl_path: p, base: b, desired: d } => - HostnameOnHost { node: n, hostnamectl_path: p, base: b, desired: d } - ReadEffectivePosixPrincipal { read: r } => - EffectivePrincipalReadOnHost { node: n, read: r } - SudoNopasswdExecuteProbe { probe: p } => - SudoNopasswdProbeOnHost { node: n, probe: p } - Srv3NbdProxyServe { intent: i, lease_key: k } => - NbdProxySessionOnHost { node: n, intent: i, lease_key: k } - HostIdentityShortHostnameRead => - HostnameReadOnHost { node: n } - LiveDeployApply { spec: s } => - LiveDeployApplyOnHost { node: n, spec: s } - LiveDeployRetract { spec: s } => - LiveDeployRetractOnHost { node: n, spec: s } - LiveDeployEnsureDependency { dep: d } => - LiveDeployEnsureDependencyOnHost { node: n, dep: d } - LiveDeployDigestReadback { port: p } => - LiveDeployDigestReadbackOnHost { node: n, port: p } - DeployAccessPreflight {} => - IncompatibleCell { - reason: "host_effect: DeployAccessPreflight is intent-only (authorization gate record) and cannot be applied; typed mismatch, DESIGN section 5.", - } + match effect { + ShellCommand { script: s } => + ShellOnHost { + node: n, + script: retained_srvn(body: s, reason: "host_effect ShellCommand raw-script leaf (anemic String terminal, DESIGN section 5)"), + } + RedfishAction { action: _ } => + IncompatibleCell { reason: "host_effect: RedfishAction is out-of-band (Redfish) and cannot target HostOs (in-band shell/systemd); target BmcController instead. Typed mismatch via total fold, DESIGN section 5." } + ConvergePlan { policy: p } => + if n.identity != p.identity { + IncompatibleCell { reason: converge_plan_identity_mismatch_reason(node: n, policy: p) } + } else { + ConvergeOnHost { node: n, host_converge: p } + } + OsInstallActuatorToolchainEnsure {} => + OsInstallActuatorToolchainOnHost { node: n } + ProvisionBuildCache { catalog_id: id } => + ProvisionBuildCacheOnHost { node: n, catalog_id: id } + DurableApprovalGrantRead => + DurableApprovalGrantReadOnHost { node: n } + Srv3InstallMediaFetch => TypedReconcileOnHost { node: n, kind: TypedReconcileFetch } + Srv3SeededInstallMediaRemaster => TypedReconcileOnHost { node: n, kind: TypedReconcileRemaster } + Srv3SeededInstallMediaToolchainEnsure => + SeededInstallMediaToolchainOnHost { node: n } + Srv3BmcwebSessionLogin => + BmcwebSessionLoginOnHost { node: n } + Srv3BmcwebTokenExtract => + BmcwebTokenExtractOnHost { node: n } + Srv3BootOnceReadBackSleep => + BootOnceReadBackSleepOnHost { node: n } + Srv3ReceiptEmit { lines: lines } => + ReceiptEmitOnHost { node: n, lines: lines } + SetHostnameCas { hostnamectl_path: p, base: b, desired: d } => + HostnameOnHost { node: n, hostnamectl_path: p, base: b, desired: d } + ReadEffectivePosixPrincipal { read: r } => + EffectivePrincipalReadOnHost { node: n, read: r } + SudoNopasswdExecuteProbe { probe: p } => + SudoNopasswdProbeOnHost { node: n, probe: p } + Srv3NbdProxyServe { intent: i, lease_key: k } => + NbdProxySessionOnHost { node: n, intent: i, lease_key: k } + HostIdentityShortHostnameRead => + HostnameReadOnHost { node: n } + LiveDeployApply { spec: s } => + LiveDeployApplyOnHost { node: n, spec: s } + LiveDeployRetract { spec: s } => + LiveDeployRetractOnHost { node: n, spec: s } + LiveDeployEnsureDependency { dep: d } => + LiveDeployEnsureDependencyOnHost { node: n, dep: d } + LiveDeployDigestReadback { port: p } => + LiveDeployDigestReadbackOnHost { node: n, port: p } + DeployAccessPreflight {} => + IncompatibleCell { + reason: "host_effect: DeployAccessPreflight is intent-only (authorization gate record) and cannot be applied; typed mismatch, DESIGN section 5.", } } } BmcController { node: n } => match effect { - Srv3InstallDiagnosticObserve { bmc: _, port: _, iso_path: _, iso_content_hash: _ } => - IncompatibleCell { reason: "host_effect: Srv3InstallDiagnosticObserve is in-band (actuator host shell observe) and cannot target BmcController; target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } OsInstallActuatorToolchainEnsure {} => IncompatibleCell { reason: "host_effect: OsInstallActuatorToolchainEnsure is in-band (actuator host toolchain) and cannot target BmcController; target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } ProvisionBuildCache { catalog_id: _ } => @@ -326,61 +293,52 @@ fn resolve_host_effect_cell(target: NodeControlPlane, effect: HostEffect) -> Res Srv3NbdProxyServe { intent: _, lease_key: _ } => IncompatibleCell { reason: "host_effect: Srv3NbdProxyServe is in-band (actuator host long-running session) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } _ => - match srv3_host_effect_script_for(effect: effect) { - Present { value: _ } => - IncompatibleCell { reason: "host_effect: srv3 shell effects are in-band (actuator host LocalShell) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - Absent => - match effect { - ShellCommand { script: _ } => - IncompatibleCell { reason: "host_effect: ShellCommand is in-band (shell/systemd) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - RedfishAction { action: a } => RedfishOnBmc { node: n, action: a } - ConvergePlan { policy: _ } => - IncompatibleCell { reason: "host_effect: ConvergePlan is in-band (host OS converge) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - Srv3InstallDiagnosticObserve { bmc: _, port: _, iso_path: _, iso_content_hash: _ } => - srv3_host_effect_script_resolution_failed_cell() - OsInstallActuatorToolchainEnsure {} => - srv3_host_effect_script_resolution_failed_cell() - ProvisionBuildCache { catalog_id: _ } => - IncompatibleCell { reason: "host_effect: ProvisionBuildCache is in-band (per-host sccache daemon) and cannot target BmcController; target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - Srv3InstallReconcileObserve { include_git_meta: _ } => srv3_host_effect_script_resolution_failed_cell() - DurableApprovalGrantRecord => srv3_host_effect_script_resolution_failed_cell() - DurableApprovalGrantRead => - IncompatibleCell { reason: "host_effect: DurableApprovalGrantRead is in-band (actuator host typed read) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - Srv3InstallMediaFetch => - IncompatibleCell { reason: "host_effect: Srv3InstallMediaFetch is in-band (actuator host typed reconcile) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - Srv3SeededInstallMediaRemaster => - IncompatibleCell { reason: "host_effect: Srv3SeededInstallMediaRemaster is in-band (actuator host typed reconcile) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - Srv3SeededInstallMediaToolchainEnsure => - IncompatibleCell { reason: "host_effect: Srv3SeededInstallMediaToolchainEnsure is in-band (actuator host typed toolchain ensure) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - Srv3SolConsoleCapture => srv3_host_effect_script_resolution_failed_cell() - Srv3BmcwebSessionLogin => - IncompatibleCell { reason: "host_effect: Srv3BmcwebSessionLogin is in-band (actuator host typed curl login) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - Srv3BmcwebTokenExtract => - IncompatibleCell { reason: "host_effect: Srv3BmcwebTokenExtract is in-band (actuator host typed jq extract + write) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - Srv3NbdProxyServe { intent: _, lease_key: _ } => srv3_host_effect_script_resolution_failed_cell() - Srv3BootOnceReadBackSleep => - IncompatibleCell { reason: "host_effect: Srv3BootOnceReadBackSleep is in-band (actuator host typed sleep) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - Srv3ReceiptEmit { lines: _ } => - IncompatibleCell { reason: "host_effect: Srv3ReceiptEmit is in-band (actuator host typed receipt) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - SetHostnameCas { hostnamectl_path: _, base: _, desired: _ } => - IncompatibleCell { reason: "host_effect: SetHostnameCas is in-band (shell hostnamectl) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - ReadEffectivePosixPrincipal { read: _ } => - IncompatibleCell { reason: "host_effect: ReadEffectivePosixPrincipal is in-band (shell whoami) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - SudoNopasswdExecuteProbe { probe: _ } => - IncompatibleCell { reason: "host_effect: SudoNopasswdExecuteProbe is in-band (shell sudo -n probe) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - HostIdentityShortHostnameRead => - IncompatibleCell { reason: "host_effect: HostIdentityShortHostnameRead is in-band (shell hostname -s) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - LiveDeployApply { spec: _ } => - IncompatibleCell { reason: "host_effect: LiveDeployApply is in-band (actuator host shell mutation) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - LiveDeployRetract { spec: _ } => - IncompatibleCell { reason: "host_effect: LiveDeployRetract is in-band (actuator host shell mutation) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - LiveDeployEnsureDependency { dep: _ } => - IncompatibleCell { reason: "host_effect: LiveDeployEnsureDependency is in-band (actuator host shell mutation) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - LiveDeployDigestReadback { port: _ } => - IncompatibleCell { reason: "host_effect: LiveDeployDigestReadback is in-band (actuator host shell readback) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } - DeployAccessPreflight {} => - IncompatibleCell { reason: "host_effect: DeployAccessPreflight is intent-only (authorization gate record) and cannot target BmcController; typed mismatch, DESIGN section 5." } - } + match effect { + ShellCommand { script: _ } => + IncompatibleCell { reason: "host_effect: ShellCommand is in-band (shell/systemd) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + RedfishAction { action: a } => RedfishOnBmc { node: n, action: a } + ConvergePlan { policy: _ } => + IncompatibleCell { reason: "host_effect: ConvergePlan is in-band (host OS converge) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + OsInstallActuatorToolchainEnsure {} => + IncompatibleCell { reason: "host_effect: OsInstallActuatorToolchainEnsure is in-band (actuator host toolchain) and cannot target BmcController; target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + ProvisionBuildCache { catalog_id: _ } => + IncompatibleCell { reason: "host_effect: ProvisionBuildCache is in-band (per-host sccache daemon) and cannot target BmcController; target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + DurableApprovalGrantRead => + IncompatibleCell { reason: "host_effect: DurableApprovalGrantRead is in-band (actuator host typed read) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + Srv3InstallMediaFetch => + IncompatibleCell { reason: "host_effect: Srv3InstallMediaFetch is in-band (actuator host typed reconcile) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + Srv3SeededInstallMediaRemaster => + IncompatibleCell { reason: "host_effect: Srv3SeededInstallMediaRemaster is in-band (actuator host typed reconcile) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + Srv3SeededInstallMediaToolchainEnsure => + IncompatibleCell { reason: "host_effect: Srv3SeededInstallMediaToolchainEnsure is in-band (actuator host typed toolchain ensure) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + Srv3BmcwebSessionLogin => + IncompatibleCell { reason: "host_effect: Srv3BmcwebSessionLogin is in-band (actuator host typed curl login) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + Srv3BmcwebTokenExtract => + IncompatibleCell { reason: "host_effect: Srv3BmcwebTokenExtract is in-band (actuator host typed jq extract + write) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + Srv3NbdProxyServe { intent: _, lease_key: _ } => + IncompatibleCell { reason: "host_effect: Srv3NbdProxyServe is in-band (actuator host long-running session) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + Srv3BootOnceReadBackSleep => + IncompatibleCell { reason: "host_effect: Srv3BootOnceReadBackSleep is in-band (actuator host typed sleep) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + Srv3ReceiptEmit { lines: _ } => + IncompatibleCell { reason: "host_effect: Srv3ReceiptEmit is in-band (actuator host typed receipt) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + SetHostnameCas { hostnamectl_path: _, base: _, desired: _ } => + IncompatibleCell { reason: "host_effect: SetHostnameCas is in-band (shell hostnamectl) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + ReadEffectivePosixPrincipal { read: _ } => + IncompatibleCell { reason: "host_effect: ReadEffectivePosixPrincipal is in-band (shell whoami) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + SudoNopasswdExecuteProbe { probe: _ } => + IncompatibleCell { reason: "host_effect: SudoNopasswdExecuteProbe is in-band (shell sudo -n probe) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + HostIdentityShortHostnameRead => + IncompatibleCell { reason: "host_effect: HostIdentityShortHostnameRead is in-band (shell hostname -s) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + LiveDeployApply { spec: _ } => + IncompatibleCell { reason: "host_effect: LiveDeployApply is in-band (actuator host shell mutation) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + LiveDeployRetract { spec: _ } => + IncompatibleCell { reason: "host_effect: LiveDeployRetract is in-band (actuator host shell mutation) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + LiveDeployEnsureDependency { dep: _ } => + IncompatibleCell { reason: "host_effect: LiveDeployEnsureDependency is in-band (actuator host shell mutation) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + LiveDeployDigestReadback { port: _ } => + IncompatibleCell { reason: "host_effect: LiveDeployDigestReadback is in-band (actuator host shell readback) and cannot target BmcController (out-of-band Redfish only); target HostOs instead. Typed mismatch via total fold, DESIGN section 5." } + DeployAccessPreflight {} => + IncompatibleCell { reason: "host_effect: DeployAccessPreflight is intent-only (authorization gate record) and cannot target BmcController; typed mismatch, DESIGN section 5." } } } } @@ -781,29 +739,6 @@ fn provision_build_cache_reconcile( ) } -fn realize_srv3_install_diagnostic_observe( - bmc: String, - port: String, - iso_path: String, - intent_content_hash: String, - transport: HostEffectTransport, - effect_intent: HostEffectIntent, -) -> Reconciliation { - let script = srv3_install_diagnostic_observe_script( - token_path: srv3_bmcweb_token_path, - bmc: bmc, - port: port, - iso_path: iso_path, - intent_content_hash: intent_content_hash, - sol_log: srv3_sol_console_log_path as String, - ) - let observed = run_shell_transport( - script: retained_srvn(body: shell_exec_via_bash(body: script), reason: "srv3 install diagnostic observe"), - transport: transport, - ) - srv3_shell_reconcile(observed: observed, intent: effect_intent) -} - data srv3_join_shell_words_controlled_args_note: String = "SshShell argv composer for toolchain transport helpers only; callers must pass controlled literals (package names, modeled paths) — no shell-quoting until typed argv dispatch lands." fn srv3_join_shell_words(words: List) -> String { diff --git a/dag/gunbc/nbd_proxy_virtual_media_install.dag b/dag/gunbc/nbd_proxy_virtual_media_install.dag index 8d5b1f3c5b6..e28465ef60a 100644 --- a/dag/gunbc/nbd_proxy_virtual_media_install.dag +++ b/dag/gunbc/nbd_proxy_virtual_media_install.dag @@ -53,7 +53,7 @@ import gunbc.host_effect { HostEffectIntent, LocalShell, } -import gunbc.srv3_os_install_reconcile_types { srv3_nbd_proxy_lease_key } +import gunbc.srv3_nbd_proxy_serve_intent { srv3_nbd_proxy_lease_key } type OsInstallActuatorStep = ActuatorNbdProxyServe { diff --git a/dag/gunbc/srv3_host_effect_apply.dag b/dag/gunbc/srv3_host_effect_apply.dag index fe54543700c..1f7558ff074 100644 --- a/dag/gunbc/srv3_host_effect_apply.dag +++ b/dag/gunbc/srv3_host_effect_apply.dag @@ -32,27 +32,6 @@ fn srv3_host_effect_apply( ) } -fn srv3_host_effect_observe_apply( - include_git_meta: Bool, -) -> Reconciliation { - srv3_host_effect_apply( - effect: Srv3InstallReconcileObserve { include_git_meta: include_git_meta }, - ) -} - -fn srv3_host_effect_observe_read_apply() -> Reconciliation { - host_effect_apply( - target: srv3_actuator_target(), - effect: Srv3InstallReconcileObserve { include_git_meta: true }, - evidence: host_effect_read_evidence, - transport: LocalShell, - ) -} - -fn srv3_durable_approval_grant_record_apply() -> Reconciliation { - srv3_host_effect_apply(effect: DurableApprovalGrantRecord) -} - fn srv3_durable_approval_grant_read_apply() -> Reconciliation { host_effect_apply( target: srv3_actuator_target(), @@ -81,10 +60,6 @@ fn srv3_seeded_install_media_remaster_apply() -> Reconciliation Reconciliation { - srv3_host_effect_apply(effect: Srv3SolConsoleCapture) -} - fn srv3_bmcweb_session_login_apply() -> Reconciliation { srv3_host_effect_apply(effect: Srv3BmcwebSessionLogin) } diff --git a/dag/gunbc/srv3_nbd_proxy_serve_intent.dag b/dag/gunbc/srv3_nbd_proxy_serve_intent.dag index a411945b98e..b55c3e16f39 100644 --- a/dag/gunbc/srv3_nbd_proxy_serve_intent.dag +++ b/dag/gunbc/srv3_nbd_proxy_serve_intent.dag @@ -14,9 +14,10 @@ import extdeps.boards.asrock_rack { } import gunbc.srv3_os_install_actuate_scope { srv3_actuator_virtual_media_iso_install_path } import gunbc.host_effect { HostEffect, Srv3NbdProxyServe } -import gunbc.srv3_os_install_reconcile_types { srv3_nbd_proxy_lease_key } import std.types { NonEmptyStr } +data srv3_nbd_proxy_lease_key: NonEmptyStr = "srv3-nbd-proxy-10809" as NonEmptyStr + fn srv3_nbd_proxy_serve_transport_intent() -> NbdProxyServeTransportIntent { nbd_proxy_serve_transport_intent( bmc_host: asrock_srv3_live_bmc_host, From 20cfee84abc9c33591d432b6916fe81a5a4e020d Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sat, 25 Jul 2026 17:43:17 +0000 Subject: [PATCH 3/4] =?UTF-8?q?WIP:=20srv3=20install/reconcile=20subgraph?= =?UTF-8?q?=20retirement=20(shell=E2=86=92dag=20wave-2,=20operator=20G?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- dag/gunbc/host_effect_realize.dag | 10 - dag/gunbc/non_fold_residue.dag | 35 -- dag/gunbc/srv3_host_effect_script.dag | 160 ------ .../srv3_install_diagnostic_checklist.dag | 179 ------ ...srv3_install_diagnostic_observe_script.dag | 346 ------------ dag/gunbc/srv3_os_install_diagnostic.dag | 26 +- dag/gunbc/srv3_os_install_reconcile.dag | 431 -------------- dag/gunbc/srv3_os_install_reconcile_apply.dag | 162 ------ .../srv3_os_install_reconcile_dry_run.dag | 77 --- .../srv3_os_install_reconcile_receipt.dag | 532 ------------------ ...3_os_install_reconcile_record_approval.dag | 18 - dag/gunbc/srv3_os_install_reconcile_types.dag | 46 -- dag/gunbc/srv3_sol_console_capture.dag | 29 - dag/gunbc/srv3_sol_console_intent.dag | 14 - .../srv3_host_effect_apply_witness_test.dag | 106 +--- .../srv3_host_effect_realize_witness_test.dag | 22 - ...tall_diagnostic_checklist_witness_test.dag | 199 ------- ...srv3_os_install_reconcile_witness_test.dag | 273 --------- .../srv3_sol_console_capture_witness_test.dag | 33 -- src/v2/lens/meta_exec_confinement.dag | 5 - .../corpus/wall_residue_live_test.dag | 6 - 21 files changed, 3 insertions(+), 2706 deletions(-) delete mode 100644 dag/gunbc/srv3_host_effect_script.dag delete mode 100644 dag/gunbc/srv3_install_diagnostic_checklist.dag delete mode 100644 dag/gunbc/srv3_install_diagnostic_observe_script.dag delete mode 100644 dag/gunbc/srv3_os_install_reconcile.dag delete mode 100644 dag/gunbc/srv3_os_install_reconcile_apply.dag delete mode 100644 dag/gunbc/srv3_os_install_reconcile_dry_run.dag delete mode 100644 dag/gunbc/srv3_os_install_reconcile_receipt.dag delete mode 100644 dag/gunbc/srv3_os_install_reconcile_record_approval.dag delete mode 100644 dag/gunbc/srv3_os_install_reconcile_types.dag delete mode 100644 dag/gunbc/srv3_sol_console_capture.dag delete mode 100644 dag/gunbc/srv3_sol_console_intent.dag delete mode 100644 dag/test/claim/srv3_install_diagnostic_checklist_witness_test.dag delete mode 100644 dag/test/claim/srv3_os_install_reconcile_witness_test.dag delete mode 100644 dag/test/claim/srv3_sol_console_capture_witness_test.dag diff --git a/dag/gunbc/host_effect_realize.dag b/dag/gunbc/host_effect_realize.dag index d52dd8018c5..a3392e3b557 100644 --- a/dag/gunbc/host_effect_realize.dag +++ b/dag/gunbc/host_effect_realize.dag @@ -1633,15 +1633,6 @@ fn host_effect_apply(target: NodeControlPlane, effect: HostEffect, evidence: Ide ConvergeOnHost { node: _, host_converge: hc } => realize_converge_on_host(host_converge: hc, transport: transport, intent: intent) TypedReconcileOnHost { node: _, kind: k } => realize_srv3_typed_reconcile(kind: k, transport: transport, intent: intent) - Srv3DiagnosticObserveOnHost { node: _, bmc: b, port: p, iso_path: ip, intent_content_hash: h } => - realize_srv3_install_diagnostic_observe( - bmc: b, - port: p, - iso_path: ip, - intent_content_hash: h, - transport: transport, - effect_intent: intent, - ) OsInstallActuatorToolchainOnHost { node: _ } => realize_os_install_actuator_toolchain_ensure(effect_intent: intent) ProvisionBuildCacheOnHost { node: _, catalog_id: _ } => @@ -1882,7 +1873,6 @@ fn host_effect_drive_directive(r: Reconciliation not_converged_directive(drive: host_effect_drive(intent: intent)) ConvergeOnHost { node: _, host_converge: _ } => not_converged_directive(drive: host_effect_drive(intent: intent)) TypedReconcileOnHost { node: _, kind: _ } => not_converged_directive(drive: host_effect_drive(intent: intent)) - Srv3DiagnosticObserveOnHost { node: _, bmc: _, port: _, iso_path: _, intent_content_hash: _ } => not_converged_directive(drive: host_effect_drive(intent: intent)) OsInstallActuatorToolchainOnHost { node: _ } => not_converged_directive(drive: host_effect_drive(intent: intent)) ProvisionBuildCacheOnHost { node: _, catalog_id: _ } => not_converged_directive(drive: host_effect_drive(intent: intent)) HostnameOnHost { node: _, hostnamectl_path: _, base: _, desired: _ } => not_converged_directive(drive: host_effect_drive(intent: intent)) diff --git a/dag/gunbc/non_fold_residue.dag b/dag/gunbc/non_fold_residue.dag index 7ce92498cd6..7f8aaf87715 100644 --- a/dag/gunbc/non_fold_residue.dag +++ b/dag/gunbc/non_fold_residue.dag @@ -105,41 +105,6 @@ data non_fold_residue_frontier: List = [ reason: nfr_reason_land_red_era, dissolve_on: nfr_dissolve_owning_fold }, - FrontierRow { - unit: "dag/gunbc/srv3_os_install_reconcile.dag::kvm_screen_from_diagnostic", - reason: nfr_reason_land_red_era, - dissolve_on: nfr_dissolve_owning_fold - }, - FrontierRow { - unit: "dag/gunbc/srv3_os_install_reconcile.dag::optional_kvm_attestation_from_observation", - reason: nfr_reason_land_red_era, - dissolve_on: nfr_dissolve_owning_fold - }, - FrontierRow { - unit: "dag/gunbc/srv3_os_install_reconcile.dag::reconcile_pending_step_id", - reason: nfr_reason_land_red_era, - dissolve_on: nfr_dissolve_owning_fold - }, - FrontierRow { - unit: "dag/gunbc/srv3_os_install_reconcile.dag::workflow_approval_from_durable_grant", - reason: nfr_reason_land_red_era, - dissolve_on: nfr_dissolve_owning_fold - }, - FrontierRow { - unit: "dag/gunbc/srv3_os_install_reconcile_apply.dag::process_exit_succeeded", - reason: nfr_reason_land_red_era, - dissolve_on: nfr_dissolve_owning_fold - }, - FrontierRow { - unit: "dag/gunbc/srv3_os_install_reconcile_receipt.dag::durable_grant_is_active", - reason: nfr_reason_land_red_era, - dissolve_on: nfr_dissolve_owning_fold - }, - FrontierRow { - unit: "dag/gunbc/srv3_os_install_reconcile_receipt.dag::reconcile_refusal_reason_wire", - reason: nfr_reason_land_red_era, - dissolve_on: nfr_dissolve_owning_fold - }, FrontierRow { unit: "src/v2/lens/enforcement/cost_coverage.dag::cost_coverage_fn_verdict_is_body_not_located", reason: nfr_reason_land_red_era, diff --git a/dag/gunbc/srv3_host_effect_script.dag b/dag/gunbc/srv3_host_effect_script.dag deleted file mode 100644 index 40e46edbb2a..00000000000 --- a/dag/gunbc/srv3_host_effect_script.dag +++ /dev/null @@ -1,160 +0,0 @@ -module gunbc.srv3_host_effect_script - -import gunbc.retained_shell_script { RetainedShellScript, retained_srvn } -import gunbc.host_effect { - HostEffect, - Srv3InstallDiagnosticObserve, - OsInstallActuatorToolchainEnsure, - ProvisionBuildCache, - Srv3InstallReconcileObserve, - DurableApprovalGrantRecord, - DurableApprovalGrantRead, - Srv3InstallMediaFetch, - Srv3SeededInstallMediaRemaster, - Srv3SeededInstallMediaToolchainEnsure, - Srv3SolConsoleCapture, - Srv3BmcwebSessionLogin, - Srv3BmcwebTokenExtract, - Srv3NbdProxyServe, - Srv3BootOnceReadBackSleep, - Srv3ReceiptEmit, - ShellCommand, - RedfishAction, - ConvergePlan, - LiveDeployApply, - LiveDeployRetract, - LiveDeployEnsureDependency, - LiveDeployDigestReadback, - DeployAccessPreflight, -} -import gunbc.shell_bash_runner { shell_exec_via_bash, shell_printf_line } -import gunbc.srv3_os_install_diagnostic { - srv3_os_install_attempt_intent, - srv3_install_diagnostic_observe_script_for_intent, -} -import gunbc.srv3_os_install_reconcile_receipt { srv3_install_record_boot_once_approval_script } -import extdeps.bmc.serial_console { - sol_console_capture_script, -} -import gunbc.srv3_sol_console_intent { srv3_sol_console_capture_intent } -import extdeps.git { git_observe_meta_shell_fragment } -import std.types { String, NonEmptyStr, List, Bool } -import std.disposition { Disposition, Scaffold, SingleAuthority } -import std.decl_ref { DeclarationRef, WholeDeclaration } - -data srv3_host_effect_script_dissolution_trigger: String = "🟡 dissolve-on: srv3_host_effect_script — concat-built bash bodies for srv3 observe/effect intents (centralized handler staging post-P5a call-site migration); DISSOLVES WHEN bash-emit (#5828 / shell-emission slice0) realizes srv3 observe/effect intents as typed argv invocations / grammar-emitted nodes and srv3_host_effect_script_for retires without concat-built transport strings. Wave 4 residue (shell→dag census §1C category C). NOT gated on shell_exec_via_bash executor deletion (P5b)." - -data srv3_host_effect_script_scaffold: Disposition = Scaffold { - dissolves_to: SingleAuthority, - bind: DeclarationRef { - module_path: "gunbc.srv3_host_effect_script", - decl_name: "srv3_host_effect_script_dissolution_trigger", - field: WholeDeclaration, - } -} - -fn srv3_install_reconcile_observe_meta_script() -> String { - concat( - "printf '%s\\n' \"Srv3InstallObserveReceipt: surface=observed_at=$(date -u +%Y-%m-%dT%H:%M:%SZ)\"\nprintf '%s\\n' \"Srv3InstallObserveReceipt: surface=", concat(git_observe_meta_shell_fragment(), "\"\n"), - ) -} - -fn srv3_install_reconcile_observe_script(include_git_meta: Bool) -> String { - let diagnostic = srv3_install_diagnostic_observe_script_for_intent(intent: srv3_os_install_attempt_intent) - if include_git_meta { - concat(diagnostic, srv3_install_reconcile_observe_meta_script()) - } else { - diagnostic - } -} - -fn srv3_join_adjacent_pairs(parts: List) -> List { - let paired = fold( - parts, - init: JoinPairAcc { pending: Absent, joined: [] }, - f: (acc, part) => match acc.pending { - Absent => JoinPairAcc { pending: Present { value: part }, joined: acc.joined }, - Present { value: left } => - JoinPairAcc { pending: Absent, joined: list_push(acc.joined, concat(left, part)) }, - }, - ) - match paired.pending { - Absent => paired.joined - Present { value: last } => list_push(paired.joined, last) - } -} - -type JoinPairAcc { - pending: String? - joined: List -} - -fn srv3_concat_balanced(parts: List) -> String { - if list_length(items: parts) == 0 { - "" - } else if list_length(items: parts) == 1 { - fold(parts, init: "" as String, f: (acc, part) => concat(acc, part)) - } else { - srv3_concat_balanced(parts: srv3_join_adjacent_pairs(parts: parts)) - } -} - -fn srv3_receipt_emit_script(lines: List) -> String { - srv3_concat_balanced( - parts: map(lines, line => shell_printf_line(line: line)), - ) -} - -fn srv3_host_effect_script_for(effect: HostEffect) -> RetainedShellScript? { - match effect { - Srv3InstallReconcileObserve { include_git_meta: meta } => - Present { - value: retained_srvn( - body: shell_exec_via_bash( - body: srv3_install_reconcile_observe_script(include_git_meta: meta), - ), - reason: "srv3 install reconcile observe (git-meta probe)", - ), - } - DurableApprovalGrantRecord => - Present { - value: retained_srvn( - body: shell_exec_via_bash(body: srv3_install_record_boot_once_approval_script()), - reason: "srv3 boot-once approval grant record", - ), - } - DurableApprovalGrantRead => Absent - Srv3InstallMediaFetch => Absent - Srv3SeededInstallMediaRemaster => Absent - Srv3SeededInstallMediaToolchainEnsure => Absent - Srv3SolConsoleCapture => - Present { - value: retained_srvn( - body: shell_exec_via_bash( - body: sol_console_capture_script(intent: srv3_sol_console_capture_intent), - ), - reason: "srv3 SOL console capture", - ), - } - Srv3BmcwebSessionLogin => Absent - Srv3BmcwebTokenExtract => Absent - Srv3NbdProxyServe { intent: _, lease_key: _ } => Absent - Srv3BootOnceReadBackSleep => Absent - Srv3ReceiptEmit { lines: _ } => Absent - Srv3InstallDiagnosticObserve { bmc: _, port: _, iso_path: _, iso_content_hash: _ } => Absent - OsInstallActuatorToolchainEnsure {} => Absent - ProvisionBuildCache { catalog_id: _ } => Absent - ShellCommand { script: _ } => Absent - RedfishAction { action: _ } => Absent - ConvergePlan { policy: _ } => Absent - SetHostnameCas { hostnamectl_path: _, base: _, desired: _ } => Absent - ReadEffectivePosixPrincipal { read: _ } => Absent - SudoNopasswdExecuteProbe { probe: _ } => Absent - HostIdentityShortHostnameRead => Absent - LiveDeployApply { spec: _ } => Absent - LiveDeployRetract { spec: _ } => Absent - LiveDeployEnsureDependency { dep: _ } => Absent - LiveDeployDigestReadback { port: _ } => Absent - DeployAccessPreflight {} => Absent - } -} diff --git a/dag/gunbc/srv3_install_diagnostic_checklist.dag b/dag/gunbc/srv3_install_diagnostic_checklist.dag deleted file mode 100644 index 2f023bea0ce..00000000000 --- a/dag/gunbc/srv3_install_diagnostic_checklist.dag +++ /dev/null @@ -1,179 +0,0 @@ -module gunbc.srv3_install_diagnostic_checklist - -import extdeps.shell -import gunbc.retained_shell_script { retained_runtime } -import extdeps.filesystem.filesystem_io { Filesystem } -import gunbc.shell_bash_runner { shell_printf_line } -import gunbc.srv3_os_install_diagnostic { - srv3_os_install_attempt_intent, - OsInstallAttemptIntent, - srv3_install_diagnostic_observe_script_for_intent, - Srv3InstallDebugObservation, - Srv3InstallDiagnostic, - NbdServeObservation, - BmcWebsocketObservation, - ServeUnknown, - ServeObserved, - WebsocketUpgradeAccepted, - WebsocketUnavailable, - WebsocketUnknown, - diagnose_srv3_install, - srv3_install_diagnostic_wire, - srv3_install_diagnostic_recommended_action_wire, - parse_srv3_install_debug_observation, -} -import gunbc.host_effect { - Srv3InstallDiagnosticObserve, - HostOs, - host_effect_read_evidence, - LocalShell, - ShellEffectApplied, - ConvergePlanApplied, -} -import gunbc.host_effect_realize { host_effect_apply } -import gunbc.os_install_actuator_selection { srv3_os_install_actuator_host } -import std.realization_reconcile { - Reconciliation, - Converged, - NotConverged, -} -import std.process { ProcessExit, ExitSuccess, exit_failure } -import std.types { String } -import std.disposition { Disposition, Scaffold, RealizationDispatch } -import std.decl_ref { DeclarationRef, WholeDeclaration } - -type Srv3InstallDiagnosticObserveOutcome - = Srv3InstallDiagnosticObserved { stdout: String } - | Srv3InstallDiagnosticObserveRefused { reason: String } - -data srv3_install_diagnostic_checklist_receipt_echo_dissolution_trigger: Disposition = Scaffold { - dissolves_to: RealizationDispatch, - bind: DeclarationRef { - module_path: "gunbc.srv3_install_diagnostic_checklist", - decl_name: "srv3_install_diagnostic_checklist", - field: WholeDeclaration, - } -} - -data srv3_install_diagnostic_checklist_scaffold: Disposition = Scaffold { - dissolves_to: RealizationDispatch, - bind: DeclarationRef { - module_path: "gunbc.srv3_install_diagnostic_checklist", - decl_name: "srv3_install_diagnostic_checklist_receipt_echo_dissolution_trigger", - field: WholeDeclaration, - } -} - -data srv3_install_diagnostic_checklist_shell_runner_dissolution_trigger: String = "dissolved: observe path routes through host_effect_apply Srv3InstallDiagnosticObserve; receipt echo and observe-script oracle remain medium-as-string pending bash-emit (#5828)" - -data srv3_install_diagnostic_observe_script_path: String = "/tmp/srv3_install_diagnostic_observe.sh" - -func srv3_install_diagnostic_emit_observe_script() -> ProcessExit { - let script = srv3_install_diagnostic_observe_script_for_intent(intent: srv3_os_install_attempt_intent) - let write = Filesystem.Write(path: srv3_install_diagnostic_observe_script_path, content: script) - if write.success { - ExitSuccess - } else { - exit_failure(reason: concat("srv3-install-diagnostic-emit: write failed: ", write.error)) - } -} - -fn srv3_install_diagnostic_observe_outcome( - intent: OsInstallAttemptIntent, -) -> Srv3InstallDiagnosticObserveOutcome { - let target = HostOs { node: srv3_os_install_actuator_host } - match host_effect_apply( - target: target, - effect: Srv3InstallDiagnosticObserve { - bmc: intent.bmc_endpoint, - port: intent.serve_port, - iso_path: intent.iso_path, - iso_content_hash: intent.iso_content_hash, - }, - evidence: host_effect_read_evidence, - transport: LocalShell, - ) { - Converged { evidence: ShellEffectApplied { exit_code: _, stdout: out }, applied: _ } => - Srv3InstallDiagnosticObserved { stdout: out } - Converged { evidence: ConvergePlanApplied { exit_code: _, stdout: _ }, applied: _ } => - Srv3InstallDiagnosticObserveRefused { - reason: "srv3-install-diagnostic-observe: unexpected ConvergePlanApplied evidence for Srv3InstallDiagnosticObserve", - } - NotConverged { reason: why, applied: _ } => - Srv3InstallDiagnosticObserveRefused { reason: why } - } -} - -fn srv3_install_diagnostic_observe_stdout( - intent: OsInstallAttemptIntent, -) -> String? { - match srv3_install_diagnostic_observe_outcome(intent: intent) { - Srv3InstallDiagnosticObserved { stdout: out } => Present { value: out } - Srv3InstallDiagnosticObserveRefused { reason: _ } => none - } -} - -func srv3_install_diagnostic_checklist() -> ProcessExit { - let intent = srv3_os_install_attempt_intent - match srv3_install_diagnostic_observe_outcome(intent: intent) { - Srv3InstallDiagnosticObserved { stdout } => { - let observation = parse_srv3_install_debug_observation( - stdout: stdout, - intent: intent, - ) - let verdict = diagnose_srv3_install(intent: intent, observation: observation) - let receipt = srv3_install_diagnostic_receipt_line(verdict: verdict, observation: observation) - let action = srv3_install_diagnostic_recommended_action_wire(verdict: verdict) - let echo_body = concat( - shell_printf_line(line: receipt), - shell_printf_line(line: concat("Srv3InstallDiagnosticAction: ", action)), - ) - let echo_run = shell.Exec.Run(script: retained_runtime(body: echo_body, reason: "srv3_install_diagnostic receipt + recommended-action printf echo")) - if echo_run.success { - ExitSuccess - } else { - exit_failure(reason: concat("srv3-install-diagnostic-receipt: ", echo_run.stderr)) - } - } - Srv3InstallDiagnosticObserveRefused { reason } => - exit_failure(reason: reason) - } -} - -fn srv3_install_diagnostic_receipt_line( - verdict: Srv3InstallDiagnostic, - observation: Srv3InstallDebugObservation, -) -> String { - concat( - concat("Srv3InstallDiagnosticReceipt: verdict=", srv3_install_diagnostic_wire(verdict: verdict)), - concat( - " serve=", - concat( - srv3_install_diagnostic_serve_observation_wire(observation: observation.actuator_serve), - concat( - " bmc_websocket=", - srv3_install_diagnostic_websocket_wire(observation: observation.bmc_websocket), - ), - ), - ), - ) -} - -fn srv3_install_diagnostic_serve_observation_wire(observation: NbdServeObservation) -> String { - match observation { - ServeUnknown => "unknown" - ServeObserved { process: _, port: _, session: _, iso: _ } => "observed" - } -} - -fn srv3_install_diagnostic_websocket_wire(observation: BmcWebsocketObservation) -> String { - match observation { - WebsocketUpgradeAccepted => "upgrade_accepted" - WebsocketUnavailable => "unavailable" - WebsocketUnknown => "unknown" - } -} - -fn srv3_install_diagnostic_checklist_entrypoint_is_declared() -> Bool { - string_contains(s: srv3_install_diagnostic_checklist_shell_runner_dissolution_trigger, pattern: "Srv3InstallDiagnosticObserve") -} diff --git a/dag/gunbc/srv3_install_diagnostic_observe_script.dag b/dag/gunbc/srv3_install_diagnostic_observe_script.dag deleted file mode 100644 index 539ae3fd238..00000000000 --- a/dag/gunbc/srv3_install_diagnostic_observe_script.dag +++ /dev/null @@ -1,346 +0,0 @@ -module gunbc.srv3_install_diagnostic_observe_script - -import std.types { String, NonEmptyStr } -import std.disposition { Disposition, RealizationDispatch, Scaffold } -import std.decl_ref { DeclarationRef, WholeDeclaration } - -data srv3_install_diagnostic_observe_script_bash_emit_dissolution_trigger: Disposition = Scaffold { - dissolves_to: RealizationDispatch, - bind: DeclarationRef { - module_path: "gunbc.srv3_install_diagnostic_observe_script", - decl_name: "srv3_install_diagnostic_observe_script", - field: WholeDeclaration, - } -} - -fn bash_var_ref(name: String) -> String { - concat("$", concat("{", concat(name, "}"))) -} - -fn curl_http_code_writeout() -> String { - concat("%", concat("{", concat("http_code", "}"))) -} - -fn srv3_install_diagnostic_observe_script_curl_tail() -> String { - concat( - "if test -s \"", - concat( - bash_var_ref(name: "TOKEN_PATH"), - concat( - "\"; then\n HTTP_CODE=", - concat( - concat("$", "(curl -sk -o /dev/null -w \""), - concat( - curl_http_code_writeout(), - concat( - "\" -H \"Connection: Upgrade\" -H \"Upgrade: websocket\" -H \"Sec-WebSocket-Version: 13\" -H \"Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\" -H \"Authorization: Token ", - concat( - concat("$", "(cat \""), - concat( - bash_var_ref(name: "TOKEN_PATH"), - concat( - "\")\" \"https://", - concat( - bash_var_ref(name: "BMC"), - concat( - "/vm/0/0\" 2>/dev/null || echo 000)\nelse\n HTTP_CODE=000\nfi\necho \"Srv3InstallObserveReceipt: surface=bmc_websocket http_code=", - concat( - bash_var_ref(name: "HTTP_CODE"), - "\"\nif test -s \"", - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ) -} - -fn srv3_install_diagnostic_observe_script_redfish_tail() -> String { - concat( - bash_var_ref(name: "TOKEN_PATH"), - concat( - "\"; then\n RF=", - concat( - concat("$", "(curl -sk -H \"Authorization: Token "), - concat( - concat("$", "(cat \""), - concat( - bash_var_ref(name: "TOKEN_PATH"), - concat( - "\")\" \"https://", - concat( - bash_var_ref(name: "BMC"), - concat( - "/redfish/v1/Systems/system\")\n POWER=", - concat( - concat("$", "(echo \""), - concat( - bash_var_ref(name: "RF"), - concat( - "\" | jq -r .PowerState)\n BOOT_ENABLED=", - concat( - concat("$", "(echo \""), - concat( - bash_var_ref(name: "RF"), - concat( - "\" | jq -r .Boot.BootSourceOverrideEnabled)\n BOOT_TARGET=", - concat( - concat("$", "(echo \""), - concat( - bash_var_ref(name: "RF"), - concat( - "\" | jq -r .Boot.BootSourceOverrideTarget)\n echo \"Srv3InstallObserveReceipt: surface=redfish power=", - concat( - bash_var_ref(name: "POWER"), - concat( - " boot_enabled=", - concat( - bash_var_ref(name: "BOOT_ENABLED"), - concat( - " boot_target=", - concat( - bash_var_ref(name: "BOOT_TARGET"), - "\"\nelse\n echo \"Srv3InstallObserveReceipt: surface=redfish status=token_missing\"\nfi\nif test -s \"", - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ) -} - -fn srv3_install_diagnostic_observe_script_sol_tail() -> String { - concat( - bash_var_ref(name: "SOL_LOG"), - concat( - "\"; then\n echo \"Srv3InstallObserveReceipt: surface=sol status=present\"\n grep -qi grub \"", - concat( - bash_var_ref(name: "SOL_LOG"), - concat( - "\" && echo \"Srv3InstallObserveReceipt: surface=sol marker=grub\" || true\n grep -qi subiquity \"", - concat( - bash_var_ref(name: "SOL_LOG"), - concat( - "\" && echo \"Srv3InstallObserveReceipt: surface=sol marker=subiquity\" || true\n grep -qi autoinstall \"", - concat( - bash_var_ref(name: "SOL_LOG"), - concat( - "\" && echo \"Srv3InstallObserveReceipt: surface=sol marker=autoinstall\" || true\n grep -qiE 'UEFI|Setup|Firmware|BIOS' \"", - concat( - bash_var_ref(name: "SOL_LOG"), - concat( - "\" && echo \"Srv3InstallObserveReceipt: surface=sol marker=firmware_menu\" || true\n grep -qi -E 'error|fail' \"", - concat( - bash_var_ref(name: "SOL_LOG"), - concat( - "\" && echo \"Srv3InstallObserveReceipt: surface=sol marker=error\" || true\nelse\n echo \"Srv3InstallObserveReceipt: surface=sol status=silent\"\nfi\nNBDKIT_PID=$(pgrep -n -x nbdkit 2>/dev/null || true)\nif [ -n \"", - concat( - bash_var_ref(name: "NBDKIT_PID"), - concat( - "\" ]; then\n ELAPSED_MS=$(( $(ps -o etimes= -p \"", - concat( - bash_var_ref(name: "NBDKIT_PID"), - concat( - "\" 2>/dev/null | tr -d ' ') * 1000 ))\nelse\n ELAPSED_MS=0\nfi\necho \"Srv3InstallObserveReceipt: surface=elapsed boot_once_ms=", - concat( - bash_var_ref(name: "ELAPSED_MS"), - "\"\necho \"Srv3InstallObserveReceipt: surface=router status=operator_required\"\n", - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ) -} - -fn srv3_install_diagnostic_observe_script( - token_path: String, - bmc: String, - port: String, - iso_path: String, - intent_content_hash: String, - sol_log: String, -) -> String { - let serve_body = concat( - concat( - concat( - concat( - "#!/usr/bin/env bash\nset -uo pipefail\nTOKEN_PATH=", - concat( - token_path, - concat( - "\nBMC=", - concat( - bmc, - concat( - "\nPORT=", - concat( - port, - concat( - "\nISO_PATH=", - concat( - iso_path, - concat( - "\nINTENT_CONTENT_HASH=", - concat( - intent_content_hash, - concat("\nSOL_LOG=", sol_log), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - "\nif pgrep -x nbdkit >/dev/null 2>&1; then NBDKIT=present; else NBDKIT=absent; fi\nif pgrep -x websocat >/dev/null 2>&1; then WSOCAT=present; else WSOCAT=absent; fi\nPORT_OWNER=absent\nif ss -ltnp 2>/dev/null | grep -q \":", - ), - concat( - bash_var_ref(name: "PORT"), - " \"; then\n if ss -ltnp 2>/dev/null | grep \":", - ), - ), - concat( - concat( - concat( - concat( - bash_var_ref(name: "PORT"), - "\" | grep -q nbdkit; then\n PORT_OWNER=expected\n else\n PORT_OWNER=foreign\n fi\nfi\nISO_STATE=missing\nISO_FILE_SHA256=none\nCONTENT_HASH_OBSERVED=none\nif test -f \"", - ), - concat( - bash_var_ref(name: "ISO_PATH"), - "\"; then\n ISO_FILE_SHA256=", - ), - ), - concat( - concat("$", "(sha256sum \""), - concat( - bash_var_ref(name: "ISO_PATH"), - concat( - "\" | cut -d' ' -f1)\n SIDE=\"", - concat( - bash_var_ref(name: "ISO_PATH"), - ".gunbc-content-hash\"\n if test -f \"", - ), - ), - ), - ), - ), - concat( - concat( - concat( - concat( - bash_var_ref(name: "SIDE"), - "\"; then\n CONTENT_HASH_OBSERVED=", - ), - concat("$", "(cat \""), - ), - concat( - bash_var_ref(name: "SIDE"), - concat( - "\")\n if [ \"", - concat( - bash_var_ref(name: "CONTENT_HASH_OBSERVED"), - concat( - "\" = \"", - concat( - bash_var_ref(name: "INTENT_CONTENT_HASH"), - "\" ]; then\n ISO_STATE=match\n else\n ISO_STATE=mismatch\n fi\n else\n ISO_STATE=unverified\n fi\nfi\nif test -s \"", - ), - ), - ), - ), - ), - ), - concat( - concat( - concat( - concat( - bash_var_ref(name: "TOKEN_PATH"), - "\"; then TOKEN=present; else TOKEN=absent; fi\necho \"Srv3InstallObserveReceipt: surface=serve nbdkit=", - ), - concat( - concat( - concat( - bash_var_ref(name: "NBDKIT"), - " websocat=", - ), - bash_var_ref(name: "WSOCAT"), - ), - " port_owner=", - ), - ), - bash_var_ref(name: "PORT_OWNER"), - ), - concat( - " token=", - concat( - bash_var_ref(name: "TOKEN"), - concat( - " iso=", - concat( - bash_var_ref(name: "ISO_STATE"), - concat( - " iso_file_sha256=", - concat( - bash_var_ref(name: "ISO_FILE_SHA256"), - concat( - " content_hash_observed=", - concat(bash_var_ref(name: "CONTENT_HASH_OBSERVED"), "\"\n"), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ), - ) - concat( - serve_body, - concat( - srv3_install_diagnostic_observe_script_curl_tail(), - concat( - srv3_install_diagnostic_observe_script_redfish_tail(), - srv3_install_diagnostic_observe_script_sol_tail(), - ), - ), - ) -} diff --git a/dag/gunbc/srv3_os_install_diagnostic.dag b/dag/gunbc/srv3_os_install_diagnostic.dag index f4abc217484..28719a15f75 100644 --- a/dag/gunbc/srv3_os_install_diagnostic.dag +++ b/dag/gunbc/srv3_os_install_diagnostic.dag @@ -42,10 +42,6 @@ import gunbc.srv3_seeded_install_media_artifact { srv3_seeded_install_media_cont import product.placement_supply { HostIdentity } import gunbc.srv3_actuate_shell_paths { srv3_bmcweb_token_path, - srv3_sol_console_log_path, -} -import gunbc.srv3_install_diagnostic_observe_script { - srv3_install_diagnostic_observe_script, } data srv3_nbd_proxy_local_port: Int = 10809 @@ -139,26 +135,6 @@ data srv3_os_install_attempt_intent: OsInstallAttemptIntent = OsInstallAttemptIn serve_port: srv3_nbd_proxy_local_port, } -fn srv3_install_diagnostic_observe_script_for_intent(intent: OsInstallAttemptIntent) -> String { - srv3_install_diagnostic_observe_script( - token_path: srv3_bmcweb_token_path, - bmc: intent.bmc_endpoint as String, - port: intent.serve_port as String, - iso_path: intent.iso_path as String, - intent_content_hash: intent.iso_content_hash as String, - sol_log: srv3_sol_console_log_path as String, - ) -} - -fn srv3_install_diagnostic_observe_script_declares_five_surfaces() -> Bool { - let script = srv3_install_diagnostic_observe_script_for_intent(intent: srv3_os_install_attempt_intent) - string_contains(s: script, pattern: "surface=serve") - && string_contains(s: script, pattern: "surface=bmc_websocket") - && string_contains(s: script, pattern: "surface=redfish") - && string_contains(s: script, pattern: "surface=sol") - && string_contains(s: script, pattern: "surface=router") -} - type NbdServeProcessObservation = NbdkitAbsent | WebsocatAbsent @@ -1407,7 +1383,7 @@ fn srv3_install_diagnostic_recommended_action_wire(verdict: Srv3InstallDiagnosti OsInstalled => "confirm router dynamic lease option-12 srv3; proceed post-install witnesses" KvmUntrusted => "do not use KVM as success oracle; read SOL and router lease" Inconclusive => "collect missing observation surfaces before next actuation" - InconclusiveNeedsServeObservation => "run srv3_install_diagnostic_checklist on srv1 actuator host" + InconclusiveNeedsServeObservation => "collect actuator-host serve observation surfaces before next actuation" } } diff --git a/dag/gunbc/srv3_os_install_reconcile.dag b/dag/gunbc/srv3_os_install_reconcile.dag deleted file mode 100644 index 37305e28edb..00000000000 --- a/dag/gunbc/srv3_os_install_reconcile.dag +++ /dev/null @@ -1,431 +0,0 @@ -module gunbc.srv3_os_install_reconcile - - -data srv3_os_install_reconcile_shell_runner_scaffold: Disposition = std.disposition.Terminal { - reason: "P5a discharged (2026-07-14): dry_run/apply/record_approval call sites migrated to srv3_host_effect_apply typed HostEffect rows — no shell.Exec.Run or shell_exec_via_bash in those modules. Remaining concat transport debt is centralized in gunbc.srv3_host_effect_script (srv3_host_effect_script_dissolution_trigger; bash-emit #5828 Wave 4 residue)." -} - -fn held_lease_observed_from_serve(serve: NbdServeObservation) -> HeldLeaseObservedState { - match serve { - ServeUnknown => LeaseInaccessible - ServeObserved { process: proc, port: port, session: _, iso: _ } => - match proc { - NbdkitAbsent => LeaseAbsent - WebsocatAbsent => LeaseAbsent - ServeProcessesPresent => - match port { - ServePortAbsent => LeaseAbsent - ServePortConflict => LeasePortForeign - ServePortListening { port: _, owner_matches_expected: owner_ok } => - if owner_ok { - LeaseRunningExpected - } else { - LeasePortForeign - } - } - } - } -} - -fn srv3_held_lease_from_serve(serve: NbdServeObservation) -> HeldLease { - HeldLease { - lease_key: srv3_nbd_proxy_lease_key, - resource_fingerprint: srv3_seeded_install_media_content_hash, - owner_fingerprint: "gunbc-nbd-proxy" as ContentHash, - generation: 1, - observed: held_lease_observed_from_serve(serve: serve), - } -} - -fn kvm_screen_from_diagnostic( - diagnostic: Srv3InstallDiagnostic, - observation: Srv3InstallDebugObservation, -) -> KvmObservedScreen { - match diagnostic { - BootOverrideConsumedNoInstallEvidence => - match observation.sol { - Present { value: sol } => - if sol.contains_firmware_menu { - FirmwareSetup - } else { - if sol.contains_grub { - GrubMenu - } else { - UefiBootMenu - } - } - Absent => UefiBootMenu - } - InstallerProbablyRunning => - match observation.sol { - Present { value: sol } => - if sol.contains_subiquity { - SubiquityStorageScreen - } else { - if sol.contains_grub { - GrubMenu - } else { - UefiBootMenu - } - } - Absent => UefiBootMenu - } - _ => UefiBootMenu - } -} - -fn optional_kvm_attestation_from_observation( - diagnostic: Srv3InstallDiagnostic, - observation: Srv3InstallDebugObservation, - observed_at: Timestamp, -) -> KvmOperatorAttestation? { - match diagnostic { - BootOverrideConsumedNoInstallEvidence => Present { - value: KvmOperatorAttestation { - target: operator_host_srv3, - observed_screen: kvm_screen_from_diagnostic( - diagnostic: diagnostic, - observation: observation, - ), - observed_at: observed_at, - attested_by: "reconcile-infer-sol-redfish" as NonEmptyStr, - }, - } - _ => Absent - } -} - -fn deduction_runtime_hint( - preflight: OsInstallPreflightVerdict, - diagnostic: Srv3InstallDiagnostic, - observation: Srv3InstallDebugObservation, - observed_at: Timestamp, -) -> DeductionRuntimeHint { - match optional_kvm_attestation_from_observation( - diagnostic: diagnostic, - observation: observation, - observed_at: observed_at, - ) { - Present { value: att } => DeductionRuntimePresent { - verdict: runtime_verdict_from_kvm_attestation( - attestation: att, - preflight: preflight, - ), - } - Absent => DeductionRuntimeAbsent - } -} - -fn reconcile_pending_step_id(diagnostic: Srv3InstallDiagnostic) -> NonEmptyStr { - match diagnostic { - ReadyToBoot => "boot-once-cd" as NonEmptyStr - ServeDown => "nbd-serve" as NonEmptyStr - BootOverrideNotArmed => "boot-once-cd" as NonEmptyStr - BootOverrideConsumedNoInstallEvidence => "boot-once-cd" as NonEmptyStr - InstallerProbablyRunning => "monitor-install" as NonEmptyStr - OsInstalled => "post-install-verify" as NonEmptyStr - _ => "diagnose" as NonEmptyStr - } -} - -fn reconcile_requires_destructive_approval(step_id: NonEmptyStr) -> Bool { - step_id == srv3_boot_once_cd_step_id -} - -fn plan_boot_once_cd_with_lease(lease: HeldLease, step_id: NonEmptyStr) -> NextStepPlan { - match lease.observed { - LeaseRunningExpected => PlanApply { step_id: step_id } - LeaseAbsent => - PlanRefuse { - step_id: step_id, - reason: "nbd serve lease absent before boot-once-cd", - } - LeasePortForeign => - PlanRefuse { - step_id: step_id, - reason: "foreign lease holder on scoped nbd serve resource", - } - LeaseRunningStale => - PlanRefuse { - step_id: step_id, - reason: "stale nbd serve lease before boot-once-cd", - } - LeaseInaccessible => - PlanRefuse { - step_id: step_id, - reason: "nbd serve lease observation inaccessible", - } - } -} - -fn plan_boot_once_cd_step( - intent: EffectAttemptIntent, - escalation_id: NonEmptyStr, - grant: DurableApprovalGrant, - lease: HeldLease, - prior: PriorStepReceipt, - observed_at: Timestamp, -) -> NextStepPlan { - if !approval_grant_covers_intent( - grant: grant, - intent: intent, - escalation_id: escalation_id, - observed_at: observed_at, - ) { - PlanAwaitApproval { escalation_id: escalation_id } - } else { - match prior { - PriorReceipt { receipt: r } => - if r.step_id == srv3_boot_once_cd_step_id && r.read_back_ok { - PlanNoop { step_id: srv3_boot_once_cd_step_id } - } else { - if r.step_id == srv3_boot_once_cd_step_id && !r.read_back_ok { - PlanRefuse { - step_id: srv3_boot_once_cd_step_id, - reason: "prior boot-once-cd applied without read-back convergence", - } - } else { - plan_boot_once_cd_with_lease(lease: lease, step_id: srv3_boot_once_cd_step_id) - } - } - NoPriorReceipt => - plan_boot_once_cd_with_lease(lease: lease, step_id: srv3_boot_once_cd_step_id) - } - } -} - -fn reconcile_temporal_plan( - pending_step_id: NonEmptyStr, - grant: DurableApprovalGrant, - lease: HeldLease, - prior: PriorStepReceipt, - observed_at: Timestamp, -) -> NextStepPlan { - if pending_step_id == srv3_boot_once_cd_step_id { - plan_boot_once_cd_step( - intent: srv3_install_effect_attempt_intent, - escalation_id: srv3_boot_once_cd_escalation.escalation_id, - grant: grant, - lease: lease, - prior: prior, - observed_at: observed_at, - ) - } else { - plan_next_step_from_prior_receipt_and_lease( - intent: srv3_install_effect_attempt_intent, - pending_step_id: pending_step_id, - requires_destructive_approval: reconcile_requires_destructive_approval(step_id: pending_step_id), - escalation_id: srv3_boot_once_cd_escalation.escalation_id, - grant: grant, - lease: lease, - prior: prior, - observed_at: observed_at, - ) - } -} - -fn workflow_approval_from_durable_grant(grant: DurableApprovalGrant) -> WorkflowApprovalState { - match grant { - GrantActive { escalation_id: eid, intent_hash: _, granted_by: gb, granted_at: _, expires_at: _ } => - gunbc.workflow_escalation.ApprovalGranted { escalation_id: eid, granted_by: gb } - _ => - gunbc.workflow_escalation.PendingApproval { escalation: srv3_boot_once_cd_escalation } - } -} - -fn parse_grant_field_token(tail: String) -> String { - let token = split(s: tail, delimiter: " ").first() - split(s: token, delimiter: "\n").first() -} - -fn parse_grant_field(contents: String, key: String) -> String { - let marker = concat(key, "=") - if !string_contains(s: contents, pattern: marker) { - concat("", "") - } else { - let parts = split(s: contents, delimiter: marker) - if parts.length() <= 1 { - concat("", "") - } else { - let tail = parts.skip(n: 1).first() - parse_grant_field_token(tail: tail) - } - } -} - -fn parse_durable_approval_grant_file(contents: String) -> DurableApprovalGrant { - if !string_contains(s: contents, pattern: "Srv3InstallApprovalGrant:") { - GrantAbsent - } else { - let escalation_id = parse_grant_field(contents: contents, key: "escalation_id") - let intent_hash = parse_grant_field(contents: contents, key: "intent_hash") - let granted_by = parse_grant_field(contents: contents, key: "granted_by") - let granted_at = parse_grant_field(contents: contents, key: "granted_at") - let expires_at = parse_grant_field(contents: contents, key: "expires_at") - if escalation_id == "" - || intent_hash == "" - || granted_by == "" - || granted_at == "" - || expires_at == "" { - GrantAbsent - } else { - if intent_hash == (srv3_install_effect_attempt_intent.intent_hash as String) { - GrantActive { - escalation_id: escalation_id as NonEmptyStr, - intent_hash: intent_hash as ContentHash, - granted_by: granted_by as NonEmptyStr, - granted_at: granted_at, - expires_at: expires_at, - } - } else { - GrantAbsent - } - } - } -} -fn parse_observed_at_from_stdout(stdout: String) -> String? { - let parts = split(s: stdout, delimiter: "surface=observed_at=") - if parts.length() <= 1 { - Absent - } else { - let tail = parts.skip(n: 1).first() - let token = split(s: tail, delimiter: "\n").first() - match token == concat("", "") { - true => Absent - false => Present { value: token } - } - } -} - -fn sol_has_new_installer_markers( - pre: Srv3InstallDebugObservation, - post: Srv3InstallDebugObservation, -) -> Bool { - match post.sol { - Present { value: post_sol } => - match pre.sol { - Present { value: pre_sol } => - (post_sol.contains_grub && !pre_sol.contains_grub) - || (post_sol.contains_subiquity && !pre_sol.contains_subiquity) - || (post_sol.contains_autoinstall && !pre_sol.contains_autoinstall) - Absent => - post_sol.contains_grub - || post_sol.contains_subiquity - || post_sol.contains_autoinstall - } - Absent => false - } -} - -fn redfish_boot_override_is_consumed(obs: RedfishBootObservation) -> Bool { - obs.boot_override_enabled == BootOverrideDisabled - && obs.boot_override_target == BootTargetNone -} - -fn redfish_boot_override_is_armed_for_cd(obs: RedfishBootObservation) -> Bool { - obs.boot_override_enabled == BootOverrideOnce - && obs.boot_override_target == BootTargetCd -} - -fn boot_override_armed_to_consumed_transition( - pre: Srv3InstallDebugObservation, - post: Srv3InstallDebugObservation, -) -> Bool { - redfish_boot_override_is_armed_for_cd(obs: pre.redfish_boot) - && redfish_boot_override_is_consumed(obs: post.redfish_boot) -} - -fn boot_once_elapsed_advanced_after_pre_boot_ready( - pre: Srv3InstallDebugObservation, - post: Srv3InstallDebugObservation, -) -> Bool { - if !srv3_install_pre_boot_ready_to_boot(observation: pre) - || !redfish_boot_override_is_consumed(obs: post.redfish_boot) { - false - } else { - match pre.elapsed_since_boot_once_ms { - Absent => - match post.elapsed_since_boot_once_ms { - Present { value: post_elapsed } => post_elapsed > 0 - Absent => false - } - Present { value: pre_elapsed } => - match post.elapsed_since_boot_once_ms { - Present { value: post_elapsed } => post_elapsed > pre_elapsed - Absent => false - } - } - } -} - -fn boot_once_apply_read_back_ok( - pre: Srv3InstallDebugObservation, - post: Srv3InstallDebugObservation, - apply_succeeded: Bool, -) -> Bool { - if !apply_succeeded || !install_serve_session_active(observation: post) { - false - } else { - sol_has_new_installer_markers(pre: pre, post: post) - } -} - -fn consumed_grant_after_boot_once() -> DurableApprovalGrant { - GrantConsumed { - escalation_id: srv3_boot_once_cd_escalation.escalation_id, - intent_hash: srv3_install_effect_attempt_intent.intent_hash, - consumed_by_step: srv3_boot_once_cd_step_id, - } -} - -fn reconcile_srv3_os_install( - intent: OsInstallAttemptIntent, - observation: Srv3InstallDebugObservation, - disk: TargetDiskState, - observed_at: Timestamp, - grant: DurableApprovalGrant, - prior: PriorStepReceipt, -) -> Srv3InstallReconcileResult { - let preflight = fold_nbd_proxy_os_install_preflight_verdict( - payload: srv3_ubuntu_autoinstall_on_iso, - disk: disk, - ) - let preflight_plan = plan_for_os_install_preflight_verdict(verdict: preflight) - let diagnostic = diagnose_srv3_install(intent: intent, observation: observation) - let deduction_runtime = deduction_runtime_hint( - preflight: preflight, - diagnostic: diagnostic, - observation: observation, - observed_at: observed_at, - ) - let pending_step_id = reconcile_pending_step_id(diagnostic: diagnostic) - let lease = srv3_held_lease_from_serve(serve: observation.actuator_serve) - let temporal_plan = reconcile_temporal_plan( - pending_step_id: pending_step_id, - grant: grant, - lease: lease, - prior: prior, - observed_at: observed_at, - ) - Srv3InstallReconcileResult { - preflight: preflight, - preflight_plan: preflight_plan, - diagnostic: diagnostic, - deduction_runtime: deduction_runtime, - temporal_plan: temporal_plan, - pending_step_id: pending_step_id, - } -} - -fn reconcile_srv3_os_install_dry_run_fixture( - observation: Srv3InstallDebugObservation, -) -> Srv3InstallReconcileResult { - reconcile_srv3_os_install( - intent: srv3_os_install_attempt_intent, - observation: observation, - disk: srv3_install_reconcile_default_disk, - observed_at: srv3_install_reconcile_dry_run_observed_at, - grant: GrantAbsent, - prior: NoPriorReceipt, - ) -} diff --git a/dag/gunbc/srv3_os_install_reconcile_apply.dag b/dag/gunbc/srv3_os_install_reconcile_apply.dag deleted file mode 100644 index ec1dd09c7e2..00000000000 --- a/dag/gunbc/srv3_os_install_reconcile_apply.dag +++ /dev/null @@ -1,162 +0,0 @@ -module gunbc.srv3_os_install_reconcile_apply - - -data srv3_os_install_reconcile_apply_shell_runner_scaffold: Disposition = Scaffold { - dissolves_to: SingleAuthority, - bind: DeclarationRef { - module_path: "gunbc.srv3_host_effect_script", - decl_name: "srv3_host_effect_script_dissolution_trigger", - field: WholeDeclaration, - } -} - - -fn process_exit_succeeded(exit: ProcessExit) -> Bool { - match exit { - ExitSuccess => true - _ => false - } -} - -func srv3_os_install_reconcile_apply() -> ProcessExit - uses net: std.resources.Network -{ - let intent = srv3_os_install_attempt_intent - let grant_r = srv3_durable_approval_grant_read_apply() - let grant_stdout = match srv3_shell_stdout_from_apply(r: grant_r) { - Present { value: out } => out - Absent => - return match srv3_reconciliation_failure_reason(r: grant_r) { - Present { value: why } => exit_failure(reason: concat("srv3-install-reconcile-apply: read grant: ", why)) - Absent => exit_failure(reason: "srv3-install-reconcile-apply: read grant: host_effect_apply failed") - } - } - let grant = parse_durable_approval_grant_file(contents: grant_stdout) - if !durable_grant_is_active(grant: grant) { - return exit_failure(reason: "srv3-install-reconcile-apply: durable approval grant missing or invalid") - } - - let pre_observe_r = srv3_host_effect_observe_read_apply() - let pre_observe_stdout = match srv3_shell_stdout_from_apply(r: pre_observe_r) { - Present { value: out } => out - Absent => - return match srv3_reconciliation_failure_reason(r: pre_observe_r) { - Present { value: why } => exit_failure(reason: concat("srv3-install-reconcile-apply: pre-observe: ", why)) - Absent => exit_failure(reason: "srv3-install-reconcile-apply: pre-observe: host_effect_apply failed") - } - } - let pre_observed_at = match parse_observed_at_from_stdout(stdout: pre_observe_stdout) { - Present { value: t } => t as Timestamp - Absent => - return exit_failure(reason: "srv3-install-reconcile-apply: pre-observe missing surface=observed_at=") - } - let pre_observation = parse_srv3_install_debug_observation( - stdout: pre_observe_stdout, - intent: intent, - ) - let pre_result = reconcile_srv3_os_install( - intent: intent, - observation: pre_observation, - disk: srv3_install_reconcile_default_disk, - observed_at: pre_observed_at, - grant: grant, - prior: NoPriorReceipt, - ) - - match pre_result.temporal_plan { - PlanApply { step_id: _ } => {} - PlanAwaitApproval { escalation_id: _ } => - return exit_failure(reason: "srv3-install-reconcile-apply: plan awaits approval despite grant file present") - PlanRefuse { step_id: _, reason: r } => - return exit_failure(reason: concat("srv3-install-reconcile-apply: plan refused: ", r)) - PlanNoop { step_id: _ } => - return exit_failure(reason: "srv3-install-reconcile-apply: plan noop; boot-once already converged") - _ => - return exit_failure(reason: "srv3-install-reconcile-apply: unexpected temporal plan for boot-once apply") - } - - let boot_exit = srv3_boot_once_cd_gated(approval: workflow_approval_from_durable_grant(grant: grant)) - let apply_succeeded = process_exit_succeeded(exit: boot_exit) - if !apply_succeeded { - return exit_failure(reason: "srv3-install-reconcile-apply: boot-once-cd apply failed") - } - - let sleep_exit = srv3_reconciliation_to_process_exit( - r: srv3_boot_once_read_back_sleep_apply(), - failure_prefix: "srv3-install-reconcile-apply: read-back sleep: ", - ) - if !process_exit_succeeded(exit: sleep_exit) { - return sleep_exit - } - - let post_observe_r = srv3_host_effect_observe_read_apply() - let post_observe_stdout = match srv3_shell_stdout_from_apply(r: post_observe_r) { - Present { value: out } => out - Absent => - return match srv3_reconciliation_failure_reason(r: post_observe_r) { - Present { value: why } => exit_failure(reason: concat("srv3-install-reconcile-apply: post-observe: ", why)) - Absent => exit_failure(reason: "srv3-install-reconcile-apply: post-observe: host_effect_apply failed") - } - } - let post_observed_at = match parse_observed_at_from_stdout(stdout: post_observe_stdout) { - Present { value: t } => t as Timestamp - Absent => - return exit_failure(reason: "srv3-install-reconcile-apply: post-observe missing surface=observed_at=") - } - let post_observation = parse_srv3_install_debug_observation( - stdout: post_observe_stdout, - intent: intent, - ) - let read_back_ok = boot_once_apply_read_back_ok( - pre: pre_observation, - post: post_observation, - apply_succeeded: apply_succeeded, - ) - let step_receipt = effect_step_receipt_for_boot_once( - observation: post_observation, - diagnostic: pre_result.diagnostic, - plan: pre_result.temporal_plan, - read_back_ok: read_back_ok, - observed_at: post_observed_at, - applied: EffectApplied { effect_id: "srv3-boot-once-cd" as NonEmptyStr }, - ) - let post_grant = consumed_grant_after_boot_once() - let post_result = reconcile_srv3_os_install( - intent: intent, - observation: post_observation, - disk: srv3_install_reconcile_default_disk, - observed_at: post_observed_at, - grant: post_grant, - prior: PriorReceipt { receipt: step_receipt }, - ) - let lease = srv3_held_lease_from_serve(serve: post_observation.actuator_serve) - let dry_receipt = srv3_install_reconcile_full_receipt( - result: post_result, - intent: intent, - observation: post_observation, - grant: post_grant, - prior: PriorReceipt { receipt: step_receipt }, - lease: lease, - git_branch: "live-apply" as NonEmptyStr, - git_commit: "live-apply" as NonEmptyStr, - ) - let apply_receipt = srv3_install_reconcile_apply_receipt( - pre_result: pre_result, - post_result: post_result, - pre_grant: grant, - post_grant: post_grant, - step_receipt: step_receipt, - apply_succeeded: apply_succeeded, - read_back_ok: read_back_ok, - ) - let echo_exit = srv3_emit_typed_receipt( - receipt: srv3_typed_receipt_from_lines(lines: [apply_receipt, dry_receipt]), - ) - if !process_exit_succeeded(exit: echo_exit) { - return echo_exit - } - if !read_back_ok { - return exit_failure(reason: "srv3-install-reconcile-apply: read-back failed after boot-once-cd") - } - ExitSuccess -} diff --git a/dag/gunbc/srv3_os_install_reconcile_dry_run.dag b/dag/gunbc/srv3_os_install_reconcile_dry_run.dag deleted file mode 100644 index a86925ff0f4..00000000000 --- a/dag/gunbc/srv3_os_install_reconcile_dry_run.dag +++ /dev/null @@ -1,77 +0,0 @@ -module gunbc.srv3_os_install_reconcile_dry_run - - -data srv3_os_install_reconcile_dry_run_shell_runner_scaffold: Disposition = Scaffold { - dissolves_to: SingleAuthority, - bind: DeclarationRef { - module_path: "gunbc.srv3_host_effect_script", - decl_name: "srv3_host_effect_script_dissolution_trigger", - field: WholeDeclaration, - } -} - -fn parse_reconcile_git_branch(stdout: String) -> NonEmptyStr { - let parts = split(s: stdout, delimiter: "surface=git branch=") - if parts.length() <= 1 { - "unknown" as NonEmptyStr - } else { - let tail = parts.skip(n: 1).first() - let token = split(s: tail, delimiter: " commit=").first() - token as NonEmptyStr - } -} - -fn parse_reconcile_git_commit(stdout: String) -> NonEmptyStr { - let parts = split(s: stdout, delimiter: " commit=") - if parts.length() <= 1 { - "unknown" as NonEmptyStr - } else { - let tail = parts.skip(n: 1).first() - let token = split(s: tail, delimiter: "\n").first() - token as NonEmptyStr - } -} - -func srv3_os_install_reconcile_dry_run() -> ProcessExit { - let intent = srv3_os_install_attempt_intent - let observe_r = srv3_host_effect_observe_read_apply() - let observe_stdout = match srv3_shell_stdout_from_apply(r: observe_r) { - Present { value: out } => out - Absent => - return match srv3_reconciliation_failure_reason(r: observe_r) { - Present { value: why } => exit_failure(reason: concat("srv3-install-reconcile-observe: ", why)) - Absent => exit_failure(reason: "srv3-install-reconcile-observe: host_effect_apply failed") - } - } - let observation = parse_srv3_install_debug_observation( - stdout: observe_stdout, - intent: intent, - ) - let grant = GrantAbsent - let prior = NoPriorReceipt - let result = reconcile_srv3_os_install( - intent: intent, - observation: observation, - disk: srv3_install_reconcile_default_disk, - observed_at: srv3_install_reconcile_dry_run_observed_at, - grant: grant, - prior: prior, - ) - let lease = srv3_held_lease_from_serve(serve: observation.actuator_serve) - let git_branch = parse_reconcile_git_branch(stdout: observe_stdout) - let git_commit = parse_reconcile_git_commit(stdout: observe_stdout) - let receipt = srv3_install_reconcile_full_receipt( - result: result, - intent: intent, - observation: observation, - grant: grant, - prior: prior, - lease: lease, - git_branch: git_branch, - git_commit: git_commit, - ) - let action = srv3_install_reconcile_action_line(result: result) - srv3_emit_typed_receipt( - receipt: srv3_typed_receipt_from_lines(lines: [receipt, action]), - ) -} diff --git a/dag/gunbc/srv3_os_install_reconcile_receipt.dag b/dag/gunbc/srv3_os_install_reconcile_receipt.dag deleted file mode 100644 index 342577dd76e..00000000000 --- a/dag/gunbc/srv3_os_install_reconcile_receipt.dag +++ /dev/null @@ -1,532 +0,0 @@ -module gunbc.srv3_os_install_reconcile_receipt - -import std.types { String, NonEmptyStr, ContentHash, Timestamp, Bool, Int } -import std.temporal_effect { - EffectStepReceipt, - AppliedEffectRef, - NoEffectApplied, - EffectApplied, - HeldLease, - HeldLeaseObservedState, - LeaseAbsent, - LeaseRunningExpected, - LeaseRunningStale, - LeasePortForeign, - LeaseInaccessible, - DurableApprovalGrant, - GrantAbsent, - GrantActive, - GrantConsumed, - PriorStepReceipt, - NoPriorReceipt, - PriorReceipt, - NextStepPlan, - PlanNoop, - PlanApply, - PlanRefuse, - PlanAwaitApproval, - PlanDrainThenStart, -} -import gunbc.srv3_os_install_reconcile_types { - Srv3InstallReconcileResult, - DeductionRuntimeHint, - srv3_install_effect_attempt_intent, - srv3_boot_once_cd_step_id, - srv3_boot_once_approval_grant_path, -} -import gunbc.os_install_deduction { - OsInstallPreflightVerdict, - OsInstallRuntimeDiagnosticVerdict, -} -import gunbc.srv3_os_install_diagnostic { - OsInstallAttemptIntent, - Srv3InstallDebugObservation, - Srv3InstallDiagnostic, - NbdServeObservation, - NbdServeProcessObservation, - NbdServePortObservation, - BmcSessionTokenObservation, - IsoServeReadinessObservation, - ServeUnknown, - ServeObserved, - NbdkitAbsent, - WebsocatAbsent, - ServeProcessesPresent, - ServePortAbsent, - ServePortConflict, - ServePortListening, - IsoMissing, - IsoPresent, - TokenMissing, - TokenPresent, - RedfishBootObservation, - VirtualMediaSessionObservation, - AttachedToExpectedServe, - NoAttachedServe, - VirtualMediaSessionUnknown, - WebsocketUpgradeAccepted, - WebsocketUnavailable, - srv3_install_diagnostic_wire, - srv3_install_diagnostic_recommended_action_wire, - classify_router_lease_table, - Srv3OsLeasePresent, - Srv3OsLeaseAbsent, - OnlyBmcLeasePresent, - WrongHostnameLeasePresent, -} -import extdeps.bmc.types { BootOverrideDisabled, BootTargetNone, BootOverrideOnce, BootTargetCd } -import gunbc.srv3_os_install_actuate_workflow { srv3_boot_once_cd_escalation } - -fn bash_var_ref(name: String) -> String { - concat("$", concat("{", concat(name, "}"))) -} - -fn srv3_install_record_boot_once_approval_script() -> String { - let header = concat( - "set -euo pipefail\nmkdir -p /var/lib/gunbc/logs/approvals\nGRANTED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)\nEXPIRES_AT=$(date -u -d '+24 hours' +%Y-%m-%dT%H:%M:%SZ)\nprintf '%s\\n' \"Srv3InstallApprovalGrant: escalation_id=", - srv3_boot_once_cd_escalation.escalation_id as String, - ) - let intent = concat( - " intent_hash=", - srv3_install_effect_attempt_intent.intent_hash as String, - ) - let grantee = concat( - " granted_by=operator granted_at=", - bash_var_ref(name: "GRANTED_AT"), - ) - let expiry = concat(" expires_at=", bash_var_ref(name: "EXPIRES_AT")) - let redirect = concat("\" > ", srv3_boot_once_approval_grant_path) - let trailer = concat( - "\necho \"Srv3InstallApprovalGrantRecorded: path=", - concat(srv3_boot_once_approval_grant_path, "\"\n"), - ) - concat(concat(concat(concat(concat(header, intent), concat(grantee, expiry)), redirect), trailer)) -} - -fn durable_grant_is_active(grant: DurableApprovalGrant) -> Bool { - match grant { - GrantActive { escalation_id: _, intent_hash: _, granted_by: _, granted_at: _, expires_at: _ } => true - _ => false - } -} - -fn bool_wire(value: Bool) -> String { - if value { - "true" - } else { - "false" - } -} -fn effect_step_receipt_for_boot_once( - observation: Srv3InstallDebugObservation, - diagnostic: Srv3InstallDiagnostic, - plan: NextStepPlan, - read_back_ok: Bool, - observed_at: Timestamp, - applied: AppliedEffectRef, -) -> EffectStepReceipt { - EffectStepReceipt { - attempt_id: srv3_install_effect_attempt_intent.attempt_id, - step_id: srv3_boot_once_cd_step_id, - observation_digest: reconcile_iso_hash_observed(observation: observation) as ContentHash, - verdict_label: srv3_install_diagnostic_wire(verdict: diagnostic) as NonEmptyStr, - plan_label: next_step_plan_wire(plan: plan) as NonEmptyStr, - applied: applied, - read_back_ok: read_back_ok, - recorded_at: observed_at, - } -} - -fn os_install_preflight_verdict_wire(verdict: OsInstallPreflightVerdict) -> String { - match verdict { - CompleteForUnattended => "CompleteForUnattended" - NotUnattendedByPolicy => "NotUnattendedByPolicy" - RequiresStoragePolicy => "RequiresStoragePolicy" - RequiresDiskObservation => "RequiresDiskObservation" - IncompleteSeedDelivery => "IncompleteSeedDelivery" - AutoinstallIncompleteNotBootable => "AutoinstallIncompleteNotBootable" - } -} - -fn os_install_runtime_verdict_wire(verdict: OsInstallRuntimeDiagnosticVerdict) -> String { - match verdict { - RuntimeReadyToBoot => "ReadyToBoot" - KvmFirmwareIdleObserved => "KvmFirmwareIdleObserved" - RuntimeBootOverrideConsumedNoInstallEvidence => "BootOverrideConsumedNoInstallEvidence" - InstallerAwaitingStorage => "InstallerAwaitingStorage" - InstallerRunning => "InstallerRunning" - RuntimeInstallerHung => "InstallerHung" - KvmSuggestsOsBooted => "KvmSuggestsOsBooted" - RuntimeOsInstalled => "OsInstalled" - } -} - -fn next_step_plan_wire(plan: NextStepPlan) -> String { - match plan { - PlanNoop { step_id: s } => concat("PlanNoop(", concat(s as String, ")")) - PlanApply { step_id: s } => concat("PlanApply(", concat(s as String, ")")) - PlanRefuse { step_id: s, reason: r } => - concat("PlanRefuse(", concat(s as String, concat(", ", concat(r as String, ")")))) - PlanAwaitApproval { escalation_id: e } => - concat("PlanAwaitApproval(", concat(e as String, ")")) - PlanDrainThenStart { step_id: s, lease_key: k } => - concat("PlanDrainThenStart(", concat(s as String, concat(", ", concat(k as String, ")")))) - } -} - -fn deduction_runtime_hint_wire(hint: DeductionRuntimeHint) -> String { - match hint { - DeductionRuntimeAbsent => "absent" - DeductionRuntimePresent { verdict: v } => os_install_runtime_verdict_wire(verdict: v) - } -} - -fn srv3_install_reconcile_receipt_line(result: Srv3InstallReconcileResult) -> String { - concat( - concat( - concat( - concat("Srv3InstallReconcileReceipt: preflight=", os_install_preflight_verdict_wire(verdict: result.preflight)), - concat(" diagnostic=", srv3_install_diagnostic_wire(verdict: result.diagnostic)), - ), - concat(" deduction_runtime=", deduction_runtime_hint_wire(hint: result.deduction_runtime)), - ), - concat( - concat(" pending_step=", result.pending_step_id as String), - concat(" temporal=", next_step_plan_wire(plan: result.temporal_plan)), - ), - ) -} - -fn srv3_install_reconcile_action_line(result: Srv3InstallReconcileResult) -> String { - concat( - "Srv3InstallReconcileAction: ", - srv3_install_diagnostic_recommended_action_wire(verdict: result.diagnostic), - ) -} - -fn reconcile_nbd_serve_lease_wire(lease: HeldLease) -> String { - match lease.observed { - LeaseAbsent => "NbdServeLeaseAbsent" - LeaseRunningExpected => "NbdServeLeaseRunningExpected" - LeaseRunningStale => "NbdServeLeaseStale" - LeasePortForeign => "NbdServeLeaseForeign" - LeaseInaccessible => "NbdServeLeaseInaccessible" - } -} - -fn reconcile_serve_process_wire(proc: NbdServeProcessObservation) -> String { - match proc { - ServeProcessesPresent => "present" - NbdkitAbsent => "absent" - WebsocatAbsent => "websocat_absent" - } -} - -fn reconcile_serve_port_wire(port: NbdServePortObservation) -> String { - match port { - ServePortListening { owner_matches_expected: ok, port: p } => - if ok { - concat("expected:", to_string(p)) - } else { - concat("foreign:", to_string(p)) - } - ServePortAbsent => "absent" - ServePortConflict => "conflict" - } -} - -fn reconcile_serve_session_wire(sess: BmcSessionTokenObservation) -> String { - match sess { - TokenPresent => "present" - TokenMissing => "missing" - } -} - -fn reconcile_serve_iso_wire(iso: IsoServeReadinessObservation) -> String { - match iso { - IsoPresent { observed_content_hash: h } => h as String - IsoMissing => "missing" - } -} - -fn reconcile_serve_detail_wire(serve: NbdServeObservation) -> String { - match serve { - ServeUnknown => "unknown" - ServeObserved { process: proc, port: port, session: sess, iso: iso } => - concat( - concat( - concat(concat("nbdkit=", reconcile_serve_process_wire(proc: proc)), concat(" port=", reconcile_serve_port_wire(port: port))), - concat(" token=", reconcile_serve_session_wire(sess: sess)), - ), - concat(" iso=", reconcile_serve_iso_wire(iso: iso)), - ) - } -} - -fn reconcile_redfish_boot_wire(observation: Srv3InstallDebugObservation) -> String { - concat( - concat( - concat("power=", observation.redfish_boot.power_state as String), - concat( - " boot_enabled=", - observation.redfish_boot.boot_override_enabled as String, - ), - ), - concat( - concat(" boot_target=", observation.redfish_boot.boot_override_target as String), - concat(" boot_progress=", observation.redfish_boot.boot_progress as String), - ), - ) -} - -fn reconcile_sol_state_wire(observation: Srv3InstallDebugObservation) -> String { - match observation.sol { - Absent => "absent" - Present { value: sol } => - if sol.contains_autoinstall { - "autoinstall_seen" - } else { - if sol.contains_subiquity { - "subiquity_seen" - } else { - if sol.contains_grub { - "grub_seen" - } else { - if sol.contains_firmware_menu { - "firmware_menu" - } else { - if sol.capture_available { - "silent" - } else { - "unavailable" - } - } - } - } - } - } -} - -fn reconcile_virtual_media_observation_wire( - observation: Srv3InstallDebugObservation, -) -> String { - match observation.actuator_serve { - ServeUnknown => "Unknown" - ServeObserved { process: _, port: _, session: _, iso: _ } => - match observation.bmc_websocket { - WebsocketUnavailable => "AttachFailed" - WebsocketUpgradeAccepted => - match observation.virtual_media_session { - AttachedToExpectedServe => "AttachedExpectedIso" - NoAttachedServe => "AttachFailed" - VirtualMediaSessionUnknown => "EndpointAccepted" - } - _ => "Unknown" - } - } -} - -fn reconcile_router_lease_wire( - observation: Srv3InstallDebugObservation, - intent: OsInstallAttemptIntent, -) -> String { - match observation.router_lease_table { - Absent => "RouterLeaseUnknownOperatorRequired" - Present { value: table } => - match classify_router_lease_table(table: table, fleet_slot: intent.target_host) { - Srv3OsLeasePresent => "DynamicSrv3LeasePresent" - OnlyBmcLeasePresent => "OnlyBmcLeasePresent" - Srv3OsLeaseAbsent => "RouterLeaseAbsent" - WrongHostnameLeasePresent => "WrongHostnameLeasePresent" - } - } -} - -fn reconcile_boot_override_consumed_wire(observation: Srv3InstallDebugObservation) -> String { - match observation.redfish_boot.boot_override_enabled { - BootOverrideDisabled => - match observation.redfish_boot.boot_override_target { - BootTargetNone => "true" - _ => "false" - } - _ => "false" - } -} - -fn reconcile_kvm_attestation_wire(hint: DeductionRuntimeHint) -> String { - deduction_runtime_hint_wire(hint: hint) -} - -fn reconcile_lease_state_wire(lease: HeldLease) -> String { - match lease.observed { - LeaseAbsent => "LeaseAbsent" - LeaseRunningExpected => "LeaseRunningExpected" - LeaseRunningStale => "LeaseRunningStale" - LeasePortForeign => "LeasePortForeign" - LeaseInaccessible => "LeaseInaccessible" - } -} - -fn reconcile_approval_state_wire(grant: DurableApprovalGrant) -> String { - match grant { - GrantAbsent => "GrantAbsent" - GrantActive { escalation_id: e, intent_hash: _, granted_by: _, granted_at: _, expires_at: _ } => - concat("GrantActive(", concat(e as String, ")")) - GrantConsumed { escalation_id: e, intent_hash: _, consumed_by_step: s } => - concat("GrantConsumed(", concat(e as String, concat(",", concat(s as String, ")")))) - } -} - -fn reconcile_prior_step_wire(prior: PriorStepReceipt) -> String { - match prior { - NoPriorReceipt => "none" - PriorReceipt { receipt: r } => r.step_id as String - } -} - -fn reconcile_refusal_reason_wire(plan: NextStepPlan) -> String { - match plan { - PlanRefuse { step_id: _, reason: r } => r as String - _ => "" - } -} - -fn reconcile_iso_hash_observed(observation: Srv3InstallDebugObservation) -> String { - match observation.actuator_serve { - ServeObserved { process: _, port: _, session: _, iso: iso } => - match iso { - IsoPresent { observed_content_hash: h } => h as String - IsoMissing => "missing" - } - ServeUnknown => "unknown" - } -} - -fn srv3_install_reconcile_full_receipt( - result: Srv3InstallReconcileResult, - intent: OsInstallAttemptIntent, - observation: Srv3InstallDebugObservation, - grant: DurableApprovalGrant, - prior: PriorStepReceipt, - lease: HeldLease, - git_branch: NonEmptyStr, - git_commit: NonEmptyStr, -) -> String { - let identity = concat( - concat( - concat("Srv3InstallReconcileReceipt: attempt_id=", srv3_install_effect_attempt_intent.attempt_id as String), - concat(" intent_hash=", srv3_install_effect_attempt_intent.intent_hash as String), - ), - concat( - concat(" branch=", git_branch as String), - concat(" commit=", git_commit as String), - ), - ) - let intent_fields = concat( - concat(" actuator_host=", intent.actuator_host as String), - concat(" iso_path=", intent.iso_path as String), - ) - let hash_fields = concat( - concat(" iso_hash_expected=", intent.iso_content_hash as String), - concat(" iso_hash_observed=", reconcile_iso_hash_observed(observation: observation)), - ) - let verdict_fields = concat( - concat(" preflight_verdict=", os_install_preflight_verdict_wire(verdict: result.preflight)), - concat(" diagnostic=", srv3_install_diagnostic_wire(verdict: result.diagnostic)), - ) - let serve_fields = concat( - concat(" serve_lease_state=", reconcile_nbd_serve_lease_wire(lease: lease)), - concat(" serve_detail=", reconcile_serve_detail_wire(serve: observation.actuator_serve)), - ) - let media_fields = concat( - concat( - " virtual_media_observation=", - reconcile_virtual_media_observation_wire(observation: observation), - ), - concat(" redfish_boot_state=", reconcile_redfish_boot_wire(observation: observation)), - ) - let observe_fields = concat( - concat(" kvm_attestation=", reconcile_kvm_attestation_wire(hint: result.deduction_runtime)), - concat(" sol_state=", reconcile_sol_state_wire(observation: observation)), - ) - let router_fields = concat( - concat( - " router_lease_state=", - reconcile_router_lease_wire(observation: observation, intent: intent), - ), - concat( - " boot_override_consumed=", - reconcile_boot_override_consumed_wire(observation: observation), - ), - ) - let temporal_fields = concat( - concat(" temporal_prior_step=", reconcile_prior_step_wire(prior: prior)), - concat(" lease_state=", reconcile_lease_state_wire(lease: lease)), - ) - let approval_fields = concat( - concat(" approval_state=", reconcile_approval_state_wire(grant: grant)), - concat(" next_plan=", next_step_plan_wire(plan: result.temporal_plan)), - ) - let refusal_suffix = match reconcile_refusal_reason_wire(plan: result.temporal_plan) { - "" => "" - r => concat(" refusal_reason=", r) - } - concat( - concat(concat(concat(identity, intent_fields), hash_fields), verdict_fields), - concat( - concat(concat(concat(serve_fields, media_fields), observe_fields), router_fields), - concat(concat(temporal_fields, approval_fields), refusal_suffix), - ), - ) -} - -fn srv3_install_reconcile_apply_receipt( - pre_result: Srv3InstallReconcileResult, - post_result: Srv3InstallReconcileResult, - pre_grant: DurableApprovalGrant, - post_grant: DurableApprovalGrant, - step_receipt: EffectStepReceipt, - apply_succeeded: Bool, - read_back_ok: Bool, -) -> String { - let identity = concat( - concat( - "Srv3InstallReconcileApplyReceipt: attempt_id=", - srv3_install_effect_attempt_intent.attempt_id as String, - ), - concat( - concat(" boot_attempt_id=", srv3_install_effect_attempt_intent.attempt_id as String), - concat(" step_id=", srv3_boot_once_cd_step_id as String), - ), - ) - let diagnostics = concat( - concat(" pre_diagnostic=", srv3_install_diagnostic_wire(verdict: pre_result.diagnostic)), - concat(" post_diagnostic=", srv3_install_diagnostic_wire(verdict: post_result.diagnostic)), - ) - let plan_flags = concat( - concat(" pre_plan=", next_step_plan_wire(plan: pre_result.temporal_plan)), - concat(" apply_succeeded=", bool_wire(value: apply_succeeded)), - ) - let approval = concat( - concat(" read_back_ok=", bool_wire(value: read_back_ok)), - concat( - concat(" approval_state=", reconcile_approval_state_wire(grant: post_grant)), - concat(" pre_approval_state=", reconcile_approval_state_wire(grant: pre_grant)), - ), - ) - let step = concat( - concat(" step_read_back_ok=", bool_wire(value: step_receipt.read_back_ok)), - concat( - " step_applied=", - match step_receipt.applied { - EffectApplied { effect_id: e } => e as String - NoEffectApplied => "none" - }, - ), - ) - let tail = concat( - concat(" post_plan=", next_step_plan_wire(plan: post_result.temporal_plan)), - concat(" recorded_at=", step_receipt.recorded_at), - ) - concat(concat(concat(concat(identity, diagnostics), concat(plan_flags, approval)), concat(step, tail))) -} diff --git a/dag/gunbc/srv3_os_install_reconcile_record_approval.dag b/dag/gunbc/srv3_os_install_reconcile_record_approval.dag deleted file mode 100644 index a920f8a62a6..00000000000 --- a/dag/gunbc/srv3_os_install_reconcile_record_approval.dag +++ /dev/null @@ -1,18 +0,0 @@ -module gunbc.srv3_os_install_reconcile_record_approval - - -data srv3_os_install_reconcile_record_approval_shell_runner_scaffold: Disposition = Scaffold { - dissolves_to: SingleAuthority, - bind: DeclarationRef { - module_path: "gunbc.srv3_host_effect_script", - decl_name: "srv3_host_effect_script_dissolution_trigger", - field: WholeDeclaration, - } -} - -func srv3_os_install_record_boot_once_approval() -> ProcessExit { - srv3_reconciliation_to_process_exit( - r: srv3_durable_approval_grant_record_apply(), - failure_prefix: "srv3-install-record-approval: ", - ) -} diff --git a/dag/gunbc/srv3_os_install_reconcile_types.dag b/dag/gunbc/srv3_os_install_reconcile_types.dag deleted file mode 100644 index 1f3636e34e3..00000000000 --- a/dag/gunbc/srv3_os_install_reconcile_types.dag +++ /dev/null @@ -1,46 +0,0 @@ -module gunbc.srv3_os_install_reconcile_types - -import std.types { NonEmptyStr, Timestamp, String, ContentHash } -import std.temporal_effect { EffectAttemptIntent, NextStepPlan } -import std.measure { Second, second } -import gunbc.os_install_deduction { - TargetDiskState, - ForeignOsPresent, - OsInstallPreflightVerdict, - OsInstallPreflightPlan, - OsInstallRuntimeDiagnosticVerdict, -} -import gunbc.srv3_os_install_diagnostic { Srv3InstallDiagnostic } -import gunbc.srv3_seeded_install_media_artifact { srv3_seeded_install_media_content_hash } - -type DeductionRuntimeHint - = DeductionRuntimeAbsent - | DeductionRuntimePresent { verdict: OsInstallRuntimeDiagnosticVerdict } - -type Srv3InstallReconcileResult { - preflight: OsInstallPreflightVerdict - preflight_plan: OsInstallPreflightPlan - diagnostic: Srv3InstallDiagnostic - deduction_runtime: DeductionRuntimeHint - temporal_plan: NextStepPlan - pending_step_id: NonEmptyStr -} - -data srv3_boot_once_cd_step_id: NonEmptyStr = "boot-once-cd" as NonEmptyStr - -data srv3_boot_once_approval_grant_path: String = "/var/lib/gunbc/logs/approvals/srv3-boot-once-cd.grant" - -data srv3_boot_once_apply_read_back_sleep: Second = second(count: 45) - -data srv3_install_reconcile_default_disk: TargetDiskState = ForeignOsPresent - -data srv3_nbd_proxy_lease_key: NonEmptyStr = "srv3-nbd-proxy-10809" as NonEmptyStr - -data srv3_install_effect_attempt_intent: EffectAttemptIntent = EffectAttemptIntent { - attempt_id: "srv3-nbd-proxy-install" as NonEmptyStr, - intent_hash: srv3_seeded_install_media_content_hash, - target: "srv3" as NonEmptyStr, - created_at: "2026-07-03T00:00:00Z", -} - -data srv3_install_reconcile_dry_run_observed_at: Timestamp = "2026-07-03T00:00:00Z" diff --git a/dag/gunbc/srv3_sol_console_capture.dag b/dag/gunbc/srv3_sol_console_capture.dag deleted file mode 100644 index 2c692eab0bd..00000000000 --- a/dag/gunbc/srv3_sol_console_capture.dag +++ /dev/null @@ -1,29 +0,0 @@ -module gunbc.srv3_sol_console_capture - - -data srv3_sol_console_capture_scaffold: Disposition = Scaffold { - dissolves_to: SingleAuthority, - bind: DeclarationRef { - module_path: "extdeps.bmc.serial_console", - decl_name: "sol_console_capture_bash_emit_dissolution_trigger", - field: WholeDeclaration, - } -} - -func srv3_sol_console_capture() -> ProcessExit { - srv3_reconciliation_to_process_exit( - r: srv3_sol_console_capture_apply(), - failure_prefix: "sol-console-capture: ", - ) -} - -fn srv3_sol_console_capture_log_path_is_declared() -> Bool { - string_contains(s: srv3_sol_console_log_path as String, pattern: "srv3-install-sol-console") -} - -fn srv3_sol_console_capture_carries_dissolution_trigger() -> Bool { - match sol_console_capture_bash_emit_dissolution_trigger { - Scaffold { dissolves_to: _, bind: _ } => true - Terminal { reason: _ } => false - } -} diff --git a/dag/gunbc/srv3_sol_console_intent.dag b/dag/gunbc/srv3_sol_console_intent.dag deleted file mode 100644 index 00532fb3072..00000000000 --- a/dag/gunbc/srv3_sol_console_intent.dag +++ /dev/null @@ -1,14 +0,0 @@ -module gunbc.srv3_sol_console_intent - -import extdeps.bmc.serial_console { - SolConsoleCaptureIntent, - ObmcConsoleCli, -} -import extdeps.boards.asrock_rack { asrock_srv3_live_bmc_host } -import gunbc.srv3_actuate_shell_paths { srv3_sol_console_log_path } - -data srv3_sol_console_capture_intent: SolConsoleCaptureIntent = SolConsoleCaptureIntent { - bmc_host: asrock_srv3_live_bmc_host, - transport: ObmcConsoleCli, - output_path: srv3_sol_console_log_path, -} diff --git a/dag/test/claim/srv3_host_effect_apply_witness_test.dag b/dag/test/claim/srv3_host_effect_apply_witness_test.dag index c39d06b4d4d..da9308d522d 100644 --- a/dag/test/claim/srv3_host_effect_apply_witness_test.dag +++ b/dag/test/claim/srv3_host_effect_apply_witness_test.dag @@ -11,49 +11,6 @@ fn srv3_bmc_target() -> NodeControlPlane { BmcController { node: srv3_os_install_actuator_host } } -fn srv3_host_effect_script_resolves(effect: HostEffect) -> Bool { - match srv3_host_effect_script_for(effect: effect) { - Present { value: script } => script.body != "" - Absent => false - } -} - -fn witness_non_srv3_effect_script_for_absent() -> Bool { - match srv3_host_effect_script_for(effect: ShellCommand { script: "true" }) { - Absent => true - Present { value: _ } => false - } -} - -fn witness_srv3_typed_realize_effects_script_for_absent() -> Bool { - match srv3_host_effect_script_for(effect: DurableApprovalGrantRead) { - Absent => true - Present { value: _ } => false - } - && match srv3_host_effect_script_for(effect: Srv3BootOnceReadBackSleep) { - Absent => true - Present { value: _ } => false - } - && match srv3_host_effect_script_for( - effect: Srv3ReceiptEmit { lines: ["Srv3InstallReconcileReceipt: attempt_id=test"] }, - ) { - Absent => true - Present { value: _ } => false - } - && match srv3_host_effect_script_for(effect: Srv3SeededInstallMediaToolchainEnsure) { - Absent => true - Present { value: _ } => false - } - && match srv3_host_effect_script_for(effect: Srv3BmcwebSessionLogin) { - Absent => true - Present { value: _ } => false - } - && match srv3_host_effect_script_for(effect: Srv3BmcwebTokenExtract) { - Absent => true - Present { value: _ } => false - } -} - fn witness_srv3_receipt_emit_apply_converges_in_process() -> Bool { match host_effect_apply( target: srv3_actuator_target(), @@ -74,17 +31,6 @@ fn witness_srv3_receipt_emit_apply_converges_in_process() -> Bool { } } -fn witness_typed_reconcile_effects_script_for_absent() -> Bool { - match srv3_host_effect_script_for(effect: Srv3InstallMediaFetch) { - Absent => true - Present { value: _ } => false - } - && match srv3_host_effect_script_for(effect: Srv3SeededInstallMediaRemaster) { - Absent => true - Present { value: _ } => false - } -} - fn witness_durable_approval_grant_read_refuses_when_grant_file_unreadable() -> Bool { match host_effect_apply( target: srv3_actuator_target(), @@ -270,13 +216,6 @@ fn witness_srv3_nbd_proxy_apply_observe_unimplemented_refuses_fail_closed() -> B } } -fn witness_srv3_nbd_proxy_serve_script_for_absent() -> Bool { - match srv3_host_effect_script_for(effect: srv3_nbd_proxy_serve_host_effect()) { - Absent => true - Present { value: _ } => false - } -} - fn witness_srv3_nbd_proxy_serve_session_binding_carries_lease() -> Bool { let effect = srv3_nbd_proxy_serve_host_effect() match effect { @@ -305,36 +244,6 @@ fn witness_srv3_nbd_proxy_on_bmc_refuses_typed() -> Bool { } } -fn witness_srv3_sibling_variants_still_resolve_after_apply_failure() -> Bool { - witness_srv3_apply_shell_failure_refuses_typed() - && srv3_host_effect_script_resolves(effect: DurableApprovalGrantRecord) - && srv3_host_effect_script_resolves(effect: Srv3SolConsoleCapture) - && srv3_host_effect_script_resolves(effect: Srv3InstallReconcileObserve { include_git_meta: false }) -} - -test fn srv3_host_effect_observe_script_resolves_via_script_for() -> Bool { - srv3_host_effect_script_resolves( - effect: Srv3InstallReconcileObserve { include_git_meta: true }, - ) - && match srv3_host_effect_script_for( - effect: Srv3InstallReconcileObserve { include_git_meta: true }, - ) { - Present { value: script } => - string_contains(s: script.body, pattern: "Srv3InstallObserveReceipt: surface=serve") - Absent => false - } -} - -test fn srv3_host_effect_mechanical_variants_resolve_via_script_for() -> Bool { - srv3_host_effect_script_resolves(effect: DurableApprovalGrantRecord) - && witness_srv3_typed_realize_effects_script_for_absent() - && witness_typed_reconcile_effects_script_for_absent() - && srv3_host_effect_script_resolves(effect: Srv3SolConsoleCapture) - && witness_bmcweb_session_login_argv_uses_curl_authority_not_serialize_bash() - && witness_srv3_nbd_proxy_serve_script_for_absent() - && witness_non_srv3_effect_script_for_absent() -} - test fn srv3_typed_receipt_emit_realizes_in_process_not_shell() -> Bool { witness_srv3_receipt_emit_apply_converges_in_process() } @@ -354,21 +263,10 @@ test fn srv3_nbd_proxy_serve_realize_layer_dissolves_via_host_effect_nbd_proxy_s && string_contains(s: host_effect_nbd_proxy_serve_dissolution_trigger, pattern: "P6 Part 2") } -test fn srv3_host_effect_script_dissolves_via_bash_emit_not_p5b_executor() -> Bool { - string_contains(s: srv3_host_effect_script_dissolution_trigger, pattern: "bash-emit") - && string_contains(s: srv3_host_effect_script_dissolution_trigger, pattern: "#5828") - && string_contains(s: srv3_host_effect_script_dissolution_trigger, pattern: "Wave 4 residue") - && string_contains(s: srv3_host_effect_script_dissolution_trigger, pattern: "NOT gated on shell_exec_via_bash executor deletion") -} - test fn srv3_host_effect_apply_holds() -> Bool { - srv3_host_effect_observe_script_resolves_via_script_for() - && srv3_host_effect_mechanical_variants_resolve_via_script_for() - && witness_srv3_typed_realize_effects_script_for_absent() - && witness_srv3_receipt_emit_apply_converges_in_process() + witness_srv3_receipt_emit_apply_converges_in_process() && srv3_typed_receipt_carrier_holds_lines() && shell_bash_runner_still_present_for_p5b() - && srv3_host_effect_script_dissolves_via_bash_emit_not_p5b_executor() && srv3_nbd_proxy_serve_realize_layer_dissolves_via_host_effect_nbd_proxy_serve() && witness_srv3_nbd_proxy_serve_session_binding_carries_lease() && witness_srv3_nbd_proxy_apply_foreign_port_refuses_at_apply_time() @@ -383,5 +281,5 @@ test fn srv3_host_effect_apply_holds() -> Bool { && witness_srv3_typed_reconcile_ssh_transport_refuses_typed() && witness_durable_approval_grant_read_refuses_when_grant_file_unreadable() && witness_bmcweb_token_extract_ssh_transport_refuses_typed() - && witness_srv3_sibling_variants_still_resolve_after_apply_failure() + && witness_bmcweb_session_login_argv_uses_curl_authority_not_serialize_bash() } diff --git a/dag/test/claim/srv3_host_effect_realize_witness_test.dag b/dag/test/claim/srv3_host_effect_realize_witness_test.dag index f167d663030..b5bba8bd189 100644 --- a/dag/test/claim/srv3_host_effect_realize_witness_test.dag +++ b/dag/test/claim/srv3_host_effect_realize_witness_test.dag @@ -2,11 +2,9 @@ module test.claim.srv3_host_effect_realize_witness import std.logic { Bool } import gunbc.host_effect { - Srv3InstallDiagnosticObserve, OsInstallActuatorToolchainEnsure, HostOs, BmcController, - host_effect_read_evidence, host_effect_identity_evidence, LocalShell, EmitArtifactThenThinRun, @@ -14,32 +12,12 @@ import gunbc.host_effect { ThinInvocation, } import gunbc.host_effect_realize { host_effect_apply } -import gunbc.srv3_os_install_diagnostic { srv3_os_install_attempt_intent } import gunbc.fleet_intent { srv1_host } import std.realization_reconcile { NotConverged } import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly } data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly -test fn srv3_diagnostic_observe_rejects_bmc_controller_target() -> Bool { - let intent = srv3_os_install_attempt_intent - match host_effect_apply( - target: BmcController { node: srv1_host }, - effect: Srv3InstallDiagnosticObserve { - bmc: intent.bmc_endpoint, - port: intent.serve_port, - iso_path: intent.iso_path, - iso_content_hash: intent.iso_content_hash, - }, - evidence: host_effect_read_evidence, - transport: LocalShell, - ) { - NotConverged { reason: why, applied: _ } => - string_contains(s: why, pattern: "Srv3InstallDiagnosticObserve") - _ => false - } -} - test fn os_install_actuator_toolchain_ensure_rejects_bmc_controller_target() -> Bool { match host_effect_apply( target: BmcController { node: srv1_host }, diff --git a/dag/test/claim/srv3_install_diagnostic_checklist_witness_test.dag b/dag/test/claim/srv3_install_diagnostic_checklist_witness_test.dag deleted file mode 100644 index a6b6bf63097..00000000000 --- a/dag/test/claim/srv3_install_diagnostic_checklist_witness_test.dag +++ /dev/null @@ -1,199 +0,0 @@ -module test.claim.srv3_install_diagnostic_checklist - -import std.logic { Bool } -import gunbc.srv3_os_install_diagnostic { - srv3_install_diagnostic_observe_script_for_intent, - srv3_install_diagnostic_observe_script_declares_five_surfaces, - srv3_os_install_attempt_intent, -} -import gunbc.srv3_install_diagnostic_observe_script { - srv3_install_diagnostic_observe_script_bash_emit_dissolution_trigger, -} -import gunbc.srv3_install_diagnostic_checklist { - srv3_install_diagnostic_checklist_entrypoint_is_declared, -} -import gunbc.srv3_os_install_diagnostic { - srv3_os_install_attempt_intent, - srv3_remote_bmc_probe_observation, - srv3_remote_bmc_probe_diagnostic_is_needs_serve_observation, - diagnose_srv3_install, - parse_srv3_install_debug_observation, - srv3_install_diagnostic_is_ready_to_boot, - InconclusiveNeedsServeObservation, - ServeDown, - ReadyToBoot, - ServeObserved, - ServePortAbsent, - TokenPresent, - IsoPresent, - WebsocketUpgradeAccepted, - WebsocketUnavailable, - NoAttachedServe, - NbdkitAbsent, - Srv3InstallDebugObservation, - RedfishBootObservation, - BootProgressNone, - SolConsoleContentObservation, -} -import gunbc.srv3_seeded_install_media_artifact { srv3_seeded_install_media_content_hash } -import gunbc.network_identity_subsumption { srv3_pre_install_lease_table } -import extdeps.bmc.types { BootOverrideDisabled, BootTargetNone, On } -import extdeps.bmc.webui.nbd_proxy_serve { srv3_nbd_proxy_local_port } -import std.measure { byte_size } -import std.disposition { Scaffold, Terminal, RealizationDispatch } -import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly } - -data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly - -test fn observe_script_covers_five_surfaces() -> Bool { - srv3_install_diagnostic_observe_script_declares_five_surfaces() - && string_contains(s: srv3_install_diagnostic_observe_script_for_intent(intent: srv3_os_install_attempt_intent), pattern: "pgrep -x nbdkit") - && string_contains(s: srv3_install_diagnostic_observe_script_for_intent(intent: srv3_os_install_attempt_intent), pattern: "sha256sum") - && string_contains(s: srv3_install_diagnostic_observe_script_for_intent(intent: srv3_os_install_attempt_intent), pattern: "port_owner=") - && string_contains(s: srv3_install_diagnostic_observe_script_for_intent(intent: srv3_os_install_attempt_intent), pattern: "/vm/0/0") -} - -test fn observe_script_websocket_http_code_not_concatenated_before_if() -> Bool { - let script = srv3_install_diagnostic_observe_script_for_intent(intent: srv3_os_install_attempt_intent) - !string_contains(s: script, pattern: "HTTP_CODE=if") - && !string_contains(s: script, pattern: "echo 000))") - && string_contains(s: script, pattern: "HTTP_CODE=$(curl") -} - -test fn remote_bmc_probe_needs_serve_observation() -> Bool { - srv3_remote_bmc_probe_diagnostic_is_needs_serve_observation() - && match diagnose_srv3_install( - intent: srv3_os_install_attempt_intent, - observation: srv3_remote_bmc_probe_observation, - ) { - InconclusiveNeedsServeObservation => true - _ => false - } -} - -test fn parse_stdout_disabled_boot_override_pre_boot_ready() -> Bool { - let hash = srv3_seeded_install_media_content_hash as String - let stdout = concat( - concat("Srv3InstallObserveReceipt: surface=serve nbdkit=present websocat=present port_owner=expected token=present iso=match iso_file_sha256=abc123 content_hash_observed=", hash), - "\nSrv3InstallObserveReceipt: surface=bmc_websocket http_code=101\nSrv3InstallObserveReceipt: surface=redfish power=On boot_enabled=Disabled boot_target=None\nSrv3InstallObserveReceipt: surface=sol status=silent\nSrv3InstallObserveReceipt: surface=router status=operator_required\n", - ) - match diagnose_srv3_install( - intent: srv3_os_install_attempt_intent, - observation: parse_srv3_install_debug_observation(stdout: stdout, intent: srv3_os_install_attempt_intent), - ) { - ReadyToBoot => true - _ => false - } -} - -test fn parse_stdout_elapsed_boot_once_ms_populates_observation() -> Bool { - let hash = srv3_seeded_install_media_content_hash as String - let stdout = concat( - concat("Srv3InstallObserveReceipt: surface=serve nbdkit=present websocat=present port_owner=expected token=present iso=match iso_file_sha256=abc123 content_hash_observed=", hash), - "\nSrv3InstallObserveReceipt: surface=bmc_websocket http_code=101\nSrv3InstallObserveReceipt: surface=redfish power=On boot_enabled=Disabled boot_target=None\nSrv3InstallObserveReceipt: surface=sol status=silent\nSrv3InstallObserveReceipt: surface=elapsed boot_once_ms=120000\n", - ) - match parse_srv3_install_debug_observation( - stdout: stdout, - intent: srv3_os_install_attempt_intent, - ).elapsed_since_boot_once_ms { - Present { value: v } => v == 120000 - Absent => false - } -} - -test fn parse_stdout_iso_hash_mismatch_is_serve_down() -> Bool { - let stdout = "Srv3InstallObserveReceipt: surface=serve nbdkit=present websocat=present port_owner=expected token=present iso=mismatch iso_file_sha256=abc123 content_hash_observed=stale-hash\nSrv3InstallObserveReceipt: surface=bmc_websocket http_code=101\nSrv3InstallObserveReceipt: surface=redfish power=On boot_enabled=Disabled boot_target=None\n" - match diagnose_srv3_install( - intent: srv3_os_install_attempt_intent, - observation: parse_srv3_install_debug_observation(stdout: stdout, intent: srv3_os_install_attempt_intent), - ) { - ServeDown => true - _ => false - } -} - -test fn parse_stdout_foreign_port_owner_is_serve_down() -> Bool { - let hash = srv3_seeded_install_media_content_hash as String - let stdout = concat( - concat("Srv3InstallObserveReceipt: surface=serve nbdkit=present websocat=present port_owner=foreign token=present iso=match iso_file_sha256=abc123 content_hash_observed=", hash), - "\nSrv3InstallObserveReceipt: surface=bmc_websocket http_code=101\n", - ) - match diagnose_srv3_install( - intent: srv3_os_install_attempt_intent, - observation: parse_srv3_install_debug_observation(stdout: stdout, intent: srv3_os_install_attempt_intent), - ) { - ServeDown => true - _ => false - } -} - -test fn serve_absent_observed_is_serve_down_not_ready() -> Bool { - let observation = Srv3InstallDebugObservation { - actuator_serve: ServeObserved { - process: NbdkitAbsent, - port: ServePortAbsent, - session: TokenPresent, - iso: IsoPresent { observed_content_hash: srv3_seeded_install_media_content_hash }, - }, - bmc_websocket: WebsocketUpgradeAccepted, - redfish_boot: RedfishBootObservation { - power_state: On, - boot_override_enabled: BootOverrideDisabled, - boot_override_target: BootTargetNone, - boot_progress: BootProgressNone, - }, - virtual_media_session: NoAttachedServe, - sol: Present { - value: SolConsoleContentObservation { - bytes_captured: byte_size(0), - duration_ms: 120000, - contains_grub: false, - contains_subiquity: false, - contains_autoinstall: false, - contains_firmware_menu: true, - contains_error: false, - capture_available: true, - } - }, - router_lease_table: Present { value: srv3_pre_install_lease_table }, - kvm: Absent, - elapsed_since_boot_once_ms: Present { value: 120000 }, - } - match diagnose_srv3_install(intent: srv3_os_install_attempt_intent, observation: observation) { - ServeDown => - !srv3_install_diagnostic_is_ready_to_boot( - verdict: diagnose_srv3_install(intent: srv3_os_install_attempt_intent, observation: observation), - ) - _ => false - } -} - -test fn parse_bmc_websocket_http_code_non_101_red_despite_serve_websocat_present() -> Bool { - let stdout = concat( - "Srv3InstallObserveReceipt: surface=serve nbdkit=present websocat=present port_owner=expected token=absent iso=missing", - "\nSrv3InstallObserveReceipt: surface=bmc_websocket http_code=000\n", - ) - let observation = parse_srv3_install_debug_observation( - stdout: stdout, - intent: srv3_os_install_attempt_intent, - ) - match observation.bmc_websocket { - WebsocketUnavailable => true - _ => false - } - && match observation.virtual_media_session { - NoAttachedServe => true - _ => false - } -} - -test fn observe_script_names_bash_emit_dissolution_scaffold() -> Bool { - match srv3_install_diagnostic_observe_script_bash_emit_dissolution_trigger { - Scaffold { dissolves_to: RealizationDispatch, bind: _ } => true - Terminal { reason: _ } => false - } -} - -test fn checklist_entrypoint_carries_dissolution_trigger() -> Bool { - srv3_install_diagnostic_checklist_entrypoint_is_declared() -} diff --git a/dag/test/claim/srv3_os_install_reconcile_witness_test.dag b/dag/test/claim/srv3_os_install_reconcile_witness_test.dag deleted file mode 100644 index 88cc97b7810..00000000000 --- a/dag/test/claim/srv3_os_install_reconcile_witness_test.dag +++ /dev/null @@ -1,273 +0,0 @@ -module test.claim.srv3_os_install_reconcile - - -data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly - -data witness_uefi_stuck_observation: Srv3InstallDebugObservation = Srv3InstallDebugObservation { - actuator_serve: ServeObserved { - process: ServeProcessesPresent, - port: ServePortListening { - port: extdeps.bmc.webui.nbd_proxy_serve.srv3_nbd_proxy_local_port, - owner_matches_expected: true, - }, - session: gunbc.srv3_os_install_diagnostic.TokenPresent, - iso: IsoPresent { observed_content_hash: srv3_seeded_install_media_content_hash }, - }, - bmc_websocket: WebsocketUpgradeAccepted, - redfish_boot: RedfishBootObservation { - power_state: On, - boot_override_enabled: BootOverrideDisabled, - boot_override_target: BootTargetNone, - boot_progress: BootProgressNone, - }, - virtual_media_session: AttachedToExpectedServe, - sol: Present { - value: SolConsoleContentObservation { - bytes_captured: byte_size(0), - duration_ms: 3600000, - contains_grub: false, - contains_subiquity: false, - contains_autoinstall: false, - contains_firmware_menu: true, - contains_error: false, - capture_available: true, - } - }, - router_lease_table: Present { value: srv3_pre_install_lease_table }, - kvm: Absent, - elapsed_since_boot_once_ms: Present { value: 3600000 }, -} - -data witness_router_unknown_observation: Srv3InstallDebugObservation = Srv3InstallDebugObservation { - actuator_serve: witness_uefi_stuck_observation.actuator_serve, - bmc_websocket: witness_uefi_stuck_observation.bmc_websocket, - redfish_boot: witness_uefi_stuck_observation.redfish_boot, - virtual_media_session: witness_uefi_stuck_observation.virtual_media_session, - sol: witness_uefi_stuck_observation.sol, - router_lease_table: Absent, - kvm: Absent, - elapsed_since_boot_once_ms: Present { value: 3600000 }, -} - -test fn reconcile_preflight_is_complete_for_unattended() -> Bool { - let result = reconcile_srv3_os_install_dry_run_fixture( - observation: witness_uefi_stuck_observation, - ) - match result.preflight { - CompleteForUnattended => true - _ => false - } -} - -test fn reconcile_uefi_stuck_maps_kvm_firmware_idle() -> Bool { - let result = reconcile_srv3_os_install_dry_run_fixture( - observation: witness_uefi_stuck_observation, - ) - match result.diagnostic { - BootOverrideConsumedNoInstallEvidence => true - _ => false - } - && match result.deduction_runtime { - DeductionRuntimePresent { verdict: KvmFirmwareIdleObserved } => true - _ => false - } -} - -test fn reconcile_uefi_stuck_plans_boot_once_awaiting_approval() -> Bool { - let result = reconcile_srv3_os_install_dry_run_fixture( - observation: witness_uefi_stuck_observation, - ) - result.pending_step_id == ("boot-once-cd" as NonEmptyStr) - && match result.temporal_plan { - PlanAwaitApproval { escalation_id: e } => - e == ("srv3-boot-once-cd" as NonEmptyStr) - _ => false - } -} - -test fn reconcile_receipt_line_names_preflight_and_deduction() -> Bool { - let line = srv3_install_reconcile_receipt_line( - result: reconcile_srv3_os_install_dry_run_fixture(observation: witness_uefi_stuck_observation), - ) - string_contains(s: line, pattern: "preflight=CompleteForUnattended") - && string_contains(s: line, pattern: "deduction_runtime=KvmFirmwareIdleObserved") - && string_contains(s: line, pattern: "Srv3InstallReconcileReceipt:") -} - -test fn reconcile_full_receipt_typed_router_and_virtual_media() -> Bool { - let observation = witness_uefi_stuck_observation - let result = reconcile_srv3_os_install_dry_run_fixture(observation: observation) - let lease = srv3_held_lease_from_serve(serve: observation.actuator_serve) - let receipt = srv3_install_reconcile_full_receipt( - result: result, - intent: srv3_os_install_attempt_intent, - observation: observation, - grant: GrantAbsent, - prior: NoPriorReceipt, - lease: lease, - git_branch: "witness" as NonEmptyStr, - git_commit: "witness" as NonEmptyStr, - ) - string_contains(s: receipt, pattern: "router_lease_state=OnlyBmcLeasePresent") - && string_contains(s: receipt, pattern: "virtual_media_observation=AttachedExpectedIso") - && string_contains(s: receipt, pattern: "serve_lease_state=NbdServeLeaseRunningExpected") - && string_contains(s: receipt, pattern: "boot_override_consumed=true") -} - -test fn reconcile_full_receipt_router_unknown_operator_required() -> Bool { - let observation = witness_router_unknown_observation - let result = reconcile_srv3_os_install_dry_run_fixture(observation: observation) - let lease = srv3_held_lease_from_serve(serve: observation.actuator_serve) - let receipt = srv3_install_reconcile_full_receipt( - result: result, - intent: srv3_os_install_attempt_intent, - observation: observation, - grant: GrantAbsent, - prior: NoPriorReceipt, - lease: lease, - git_branch: "witness" as NonEmptyStr, - git_commit: "witness" as NonEmptyStr, - ) - string_contains(s: receipt, pattern: "router_lease_state=RouterLeaseUnknownOperatorRequired") -} - -data witness_active_boot_once_grant: DurableApprovalGrant = GrantActive { - escalation_id: "srv3-boot-once-cd" as NonEmptyStr, - intent_hash: srv3_seeded_install_media_content_hash, - granted_by: "operator" as NonEmptyStr, - granted_at: "2026-07-03T00:00:00Z", - expires_at: "2026-07-04T00:00:00Z", -} - -test fn reconcile_active_grant_plans_boot_once_apply() -> Bool { - let lease = srv3_held_lease_from_serve(serve: witness_uefi_stuck_observation.actuator_serve) - match plan_boot_once_cd_step( - intent: srv3_install_effect_attempt_intent, - escalation_id: "srv3-boot-once-cd" as NonEmptyStr, - grant: witness_active_boot_once_grant, - lease: lease, - prior: NoPriorReceipt, - observed_at: "2026-07-03T01:00:00Z" as Timestamp, - ) { - PlanApply { step_id: s } => s == ("boot-once-cd" as NonEmptyStr) - _ => false - } -} - -data witness_post_boot_armed_observation: Srv3InstallDebugObservation = Srv3InstallDebugObservation { - actuator_serve: witness_uefi_stuck_observation.actuator_serve, - bmc_websocket: witness_uefi_stuck_observation.bmc_websocket, - redfish_boot: RedfishBootObservation { - power_state: On, - boot_override_enabled: BootOverrideOnce, - boot_override_target: BootTargetCd, - boot_progress: BootProgressNone, - }, - virtual_media_session: witness_uefi_stuck_observation.virtual_media_session, - sol: witness_uefi_stuck_observation.sol, - router_lease_table: witness_uefi_stuck_observation.router_lease_table, - kvm: Absent, - elapsed_since_boot_once_ms: Present { value: 60000 }, -} - -data witness_ready_to_boot_pre_observation: Srv3InstallDebugObservation = Srv3InstallDebugObservation { - actuator_serve: witness_uefi_stuck_observation.actuator_serve, - bmc_websocket: witness_uefi_stuck_observation.bmc_websocket, - redfish_boot: witness_uefi_stuck_observation.redfish_boot, - virtual_media_session: witness_uefi_stuck_observation.virtual_media_session, - sol: witness_uefi_stuck_observation.sol, - router_lease_table: witness_uefi_stuck_observation.router_lease_table, - kvm: Absent, - elapsed_since_boot_once_ms: Absent, -} - -data witness_ready_to_boot_post_consumed_observation: Srv3InstallDebugObservation = Srv3InstallDebugObservation { - actuator_serve: witness_ready_to_boot_pre_observation.actuator_serve, - bmc_websocket: witness_ready_to_boot_pre_observation.bmc_websocket, - redfish_boot: witness_ready_to_boot_pre_observation.redfish_boot, - virtual_media_session: witness_ready_to_boot_pre_observation.virtual_media_session, - sol: witness_ready_to_boot_pre_observation.sol, - router_lease_table: witness_ready_to_boot_pre_observation.router_lease_table, - kvm: Absent, - elapsed_since_boot_once_ms: Present { value: 45000 }, -} - -test fn reconcile_boot_once_read_back_ok_rejects_noop_when_already_consumed() -> Bool { - !boot_once_apply_read_back_ok( - pre: witness_uefi_stuck_observation, - post: witness_uefi_stuck_observation, - apply_succeeded: true, - ) -} - -test fn reconcile_boot_once_read_back_ok_rejects_armed_to_consumed_without_install_progress() -> Bool { - !boot_once_apply_read_back_ok( - pre: witness_post_boot_armed_observation, - post: witness_uefi_stuck_observation, - apply_succeeded: true, - ) -} - -test fn reconcile_boot_once_read_back_ok_rejects_elapsed_only_without_install_progress() -> Bool { - !boot_once_apply_read_back_ok( - pre: witness_ready_to_boot_pre_observation, - post: witness_ready_to_boot_post_consumed_observation, - apply_succeeded: true, - ) -} - -test fn reconcile_boot_once_read_back_ok_rejects_still_armed() -> Bool { - !boot_once_apply_read_back_ok( - pre: witness_uefi_stuck_observation, - post: witness_post_boot_armed_observation, - apply_succeeded: true, - ) -} - -test fn parse_observed_at_from_stdout_absent_without_surface() -> Bool { - match parse_observed_at_from_stdout(stdout: "Srv3InstallObserveReceipt: surface=serve\n") { - Absent => true - _ => false - } -} - -test fn parse_observed_at_from_stdout_present_on_surface_line() -> Bool { - match parse_observed_at_from_stdout( - stdout: "Srv3InstallObserveReceipt: surface=observed_at=2026-07-03T12:00:00Z\n", - ) { - Present { value: t } => t == "2026-07-03T12:00:00Z" - _ => false - } -} - -test fn reconcile_parse_durable_grant_file_accepts_matching_intent() -> Bool { - let intent_hash = srv3_seeded_install_media_content_hash as String - let contents = concat( - "Srv3InstallApprovalGrant: escalation_id=srv3-boot-once-cd intent_hash=", - concat( - intent_hash, - " granted_by=operator granted_at=2026-07-03T00:00:00Z expires_at=2026-07-04T00:00:00Z", - ), - ) - match parse_durable_approval_grant_file(contents: contents) { - GrantActive { escalation_id: e, intent_hash: h, granted_by: _, granted_at: _, expires_at: _ } => - e == ("srv3-boot-once-cd" as NonEmptyStr) && h == srv3_seeded_install_media_content_hash - _ => false - } -} - -test fn reconcile_parse_durable_grant_file_strips_trailing_newline_on_expires_at() -> Bool { - let intent_hash = srv3_seeded_install_media_content_hash as String - let contents = concat( - "Srv3InstallApprovalGrant: escalation_id=srv3-boot-once-cd intent_hash=", - concat( - intent_hash, - " granted_by=operator granted_at=2026-07-03T00:00:00Z expires_at=2026-07-04T00:00:00Z\n", - ), - ) - match parse_durable_approval_grant_file(contents: contents) { - GrantActive { escalation_id: _, intent_hash: _, granted_by: _, granted_at: _, expires_at: exp } => - exp == "2026-07-04T00:00:00Z" - _ => false - } -} diff --git a/dag/test/claim/srv3_sol_console_capture_witness_test.dag b/dag/test/claim/srv3_sol_console_capture_witness_test.dag deleted file mode 100644 index 2967194ad3b..00000000000 --- a/dag/test/claim/srv3_sol_console_capture_witness_test.dag +++ /dev/null @@ -1,33 +0,0 @@ -module test.claim.srv3_sol_console_capture - -import gunbc.srv3_sol_console_capture { - srv3_sol_console_capture_log_path_is_declared, - srv3_sol_console_capture_carries_dissolution_trigger, -} -import gunbc.srv3_sol_console_intent { srv3_sol_console_capture_intent } -import extdeps.bmc.serial_console { - ObmcConsoleCli, - RedfishSerialInterface, - IpmiSol, - extdeps_external_authority_anchor, - redfish_serial_interface_authority, - sol_console_transport_authority_for, -} -import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly } - -data live_tree_disposition: LiveTreeDisposition = SubstrateInputsOnly - -test fn srv3_sol_console_capture_intent_uses_obmc_cli() -> Bool { - match srv3_sol_console_capture_intent.transport { - ObmcConsoleCli => true - RedfishSerialInterface => false - IpmiSol => false - } - && srv3_sol_console_capture_log_path_is_declared() - && srv3_sol_console_capture_carries_dissolution_trigger() -} - -test fn sol_console_redfish_serial_transport_cites_dmtf_authority() -> Bool { - sol_console_transport_authority_for(transport: RedfishSerialInterface) == redfish_serial_interface_authority - && sol_console_transport_authority_for(transport: ObmcConsoleCli) == extdeps_external_authority_anchor -} diff --git a/src/v2/lens/meta_exec_confinement.dag b/src/v2/lens/meta_exec_confinement.dag index c5e55a0b049..b6110262f72 100644 --- a/src/v2/lens/meta_exec_confinement.dag +++ b/src/v2/lens/meta_exec_confinement.dag @@ -41,11 +41,6 @@ data meta_exec_confinement_exception_roster: List = [ reason: "runner memory-cap verification still invokes shell.Exec directly at the intent layer (pre-typed-transport site, per meta_exec_confinement_law)", dissolve_on: "the site migrates to typed host_effect_apply / emit(intent, Bash); row deletes (roster is shrink-only)" ), - frontier_row( - unit: "dag/gunbc/srv3_install_diagnostic_checklist.dag", - reason: "srv3 install diagnostic checklist still invokes shell.Exec directly at the intent layer (pre-typed-transport site, per meta_exec_confinement_law)", - dissolve_on: "the site migrates to typed host_effect_apply / emit(intent, Bash); row deletes (roster is shrink-only)" - ), frontier_row( unit: "dag/gunbc/tools/review.dag", reason: "review tooling still invokes shell.Exec directly at the intent layer (pre-typed-transport site, per meta_exec_confinement_law)", diff --git a/src/v2/test/claim/host_language_transport_script/corpus/wall_residue_live_test.dag b/src/v2/test/claim/host_language_transport_script/corpus/wall_residue_live_test.dag index 2b453827937..4b18d4c6d8a 100644 --- a/src/v2/test/claim/host_language_transport_script/corpus/wall_residue_live_test.dag +++ b/src/v2/test/claim/host_language_transport_script/corpus/wall_residue_live_test.dag @@ -37,12 +37,6 @@ test fn residue_host_runner_memory_cap_verify_clean() -> Bool { ) == 0 } -test fn residue_srv3_install_diagnostic_checklist_clean() -> Bool { - transport_script_live_literal_violation_count_for_path( - path: "dag/gunbc/srv3_install_diagnostic_checklist.dag" - ) == 0 -} - test fn residue_command_runner_clean() -> Bool { transport_script_live_literal_violation_count_for_path( path: "dag/gunbc/command_runner.dag" From 1d27c7ba89d48ec806f432c1c40a556943a5a3fd Mon Sep 17 00:00:00 2001 From: Brian Searls Date: Sat, 25 Jul 2026 18:11:55 +0000 Subject: [PATCH 4/4] =?UTF-8?q?WIP:=20srv3=20install/reconcile=20subgraph?= =?UTF-8?q?=20retirement=20(shell=E2=86=92dag=20wave-2,=20operator=20G?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- dag/gunbc/host_effect_realize.dag | 9 --------- 1 file changed, 9 deletions(-) diff --git a/dag/gunbc/host_effect_realize.dag b/dag/gunbc/host_effect_realize.dag index a3392e3b557..78b2fdaf66f 100644 --- a/dag/gunbc/host_effect_realize.dag +++ b/dag/gunbc/host_effect_realize.dag @@ -1790,15 +1790,6 @@ fn host_effect_apply_gated( ConvergeOnHost { node: _, host_converge: hc } => realize_converge_on_host(host_converge: hc, transport: transport, intent: intent) TypedReconcileOnHost { node: _, kind: k } => realize_srv3_typed_reconcile(kind: k, transport: transport, intent: intent) - Srv3DiagnosticObserveOnHost { node: _, bmc: b, port: p, iso_path: ip, intent_content_hash: h } => - realize_srv3_install_diagnostic_observe( - bmc: b, - port: p, - iso_path: ip, - intent_content_hash: h, - transport: transport, - effect_intent: intent, - ) OsInstallActuatorToolchainOnHost { node: _ } => realize_os_install_actuator_toolchain_ensure(effect_intent: intent) ProvisionBuildCacheOnHost { node: _, catalog_id: _ } =>