BMC stack C: #7373 policy reconciliation (HARD BLOCK: evidence relabeling, circular activation proof, static-digest detachment; split suitability / durability qualification / ordinary convergence) + #7375 access ensure (delete the eager legacy credential authority, preserve typed refusal causes, no

[briansrls]

Frozen carrier base

5dbab028bab51e4275dbf0c8a0f8457eb855d432 (sunny-crab-665 / #7421 stack A — review 44820 qualification-bypass close).

#7423 head: 8357fa493a on session/loyal-owl-29

Summary

BMC stack C: #7373 policy reconciliation + #7375 access ensure.

• Three-way fan-policy reconciliation: apply suitability → post-apply durability qualification → ordinary convergence
• Durability evidence from typed perturbation receipt (perturbation_capability recorded at perturbation time; receipt-only evidence API)
• Import graph acyclic for actuator integration: fleet_bmc_observation → bmc_fan_projection; peripheral instances (srv4_bmc_fan_projection_capability, reboot receipt) live in fleet_bmc_state
• bmc_fan_admitted_config_digest beside digest authority in fleet_bmc_observation (projection module no longer imports observation)
• Demand-derived ensure_access_token; typed access refusal causes preserved

Test plan

• CI floor on 8357fa493a against carrier 5dbab028ba
• bmc_firmware_thermal_witness_test.dag + combined actuator compile (stack B)

[gunbai-bot]

review 44934 — responses (9c32860)

1. state_durability_verdict / SynchronizedCommit — fixed

The arm no longer short-circuits to DurabilityDefinitionLinkageUnavailable without traversing the evidence lattice. SynchronizedCommit now runs state_durability_definition_linkage_refusal first; on Absent it calls state_durability_boundaries_evidence_verdict and maps StateDurabilityEvidenceAccepted → StateDurabilityQualified { DurableLifetimeQualification { … } }.

With only CallerAssertedDefinitionLinkage in the type today the linkage gate stays closed, so srv4 still refuses — but refusal is now the first gate, not a dead end that skips ~800 lines of evidence machinery. Witnesses green on HEAD:

• caller_asserted_definitions_cannot_buy_durable_qualification
• boundary_fold_accepts_evidence_without_qualifying_durability (evidence fold reaches StateDurabilityEvidenceAccepted without buying qualification when linkage is caller-asserted)
• srv4_durability_gate_preserves_typed_linkage_refusal_verdict (count=6 assertions)

2. bmc_fan_durability_refusal_reason → Refuse { reason: String } — partially fixed (stack-C boundary)

Added BmcFanPolicyDurabilityGate (BmcFanPolicyDurabilityQualified | BmcFanPolicyDurabilityVerdictRefused { verdict }). bmc_fan_policy_durability_gate retains the full StateDurabilityVerdict through policy classification; string projection via bmc_fan_durability_refusal_reason happens only at the upsert Refuse seam where the reconcile spine still requires reason: String.

srv4_durability_gate_preserves_typed_linkage_refusal_verdict asserts the gate carries DurabilityDefinitionLinkageUnavailable { count: 6 } before any string flattening. Dissolve-on: extend UpsertClassification / membership reconcile to carry typed refusal coproducts end-to-end (membership-diff reconcile spine lane).

3. ActivationUnverified / …ObservationRefused carrying reason: String — why not this PR

These are transport-layer observation refusal envelopes inside the evidence fold, not the outer StateDurabilityRefusal coproduct. The countable located causes for durability qualification are the StateDurabilityRefusal variants (DurabilityActivationUnverified, DurabilityObservationRefused, etc.) — the fold maps inner → outer without dropping variant identity. Replacing every transport reason: String with a closed coproduct is real work but belongs on the dissolve-on for mechanical Redfish/BMC observation typing (same lane as #7372 capability receipts), not stack C policy reconciliation.

4. realization_id / receipt_id as NonEmptyStr — why not this PR

The frontier note forbids bare ContentHash on definition linkage digests (callers could label-forge a subtree hash). realization_id and perturbation_receipt_id are correlation handles tying evidence rows to a perturbation event, not content-addressed definition witnesses. When SymbolIndex subtree hashing lands, definition linkages get an opaque constructor-only digest type; correlation IDs stay distinct identifiers (likely NonEmptyStr or a dedicated receipt brand). Conflating the two would widen the frontier note's scope beyond what this PR models.

5. redfish_thermal_query_verdict Bool flags — why not this PR

Pre-existing stack A surface (dag/extdeps/bmc/types.dag); not introduced or modified by stack C. The Bool inputs are transport success predicates over three Redfish endpoints; the verdict coproduct already names which complete surface was observed (RedfishDualThermalSurface | RedfishLegacyChassisThermal | RedfishThermalSubsystemSensorCollection | RedfishThermalQueryRefused). A typed per-surface-absence refusal (three coproduct arms instead of one hand-composed string) is tracked on the extdeps shape-transport-policy lane — out of scope for #7373/#7375.

— sent from loyal-owl-29

[gunbai-bot]

review 45015 — fixed (7ee23e6b)

Finding — local curve_decision_has_duty / curve_at_temperature_has_duty predicates (fixed)

Moved duty queries onto the canonical extdeps.bmc.types surface beside bmc_fan_duty_decision:

• bmc_fan_duty_decision_curve_duty / bmc_fan_duty_decision_sensor_failsafe_duty — variant accessors on BmcFanDutyDecision (no has_* → false collapse)
• bmc_fan_curve_curve_duty_at_temperature / bmc_fan_curve_sensor_unavailable_duty — validate → decide → accessor composition for witness call sites

Deleted the witness-local predicate helpers; thermal witnesses now match the canonical Percent? accessors directly.

Witnesses (green by execution): temp_soc_curve_explains_the_audible_step, fleet_curve_is_quiet_through_90c_and_emergency_full_before_continuous_limit, sensor_unavailable_uses_same_duty_but_retains_cause

— sent from loyal-owl-29

[gunbai-bot]

review 45026 — fixed

Finding — bmc_fan_policy_projection_topology_matches coproduct Bool predicate (fixed)

Added canonical accessors on BmcFanControllerShape in extdeps.bmc.types:

• BmcFanAggregatedControllerTopology + bmc_fan_controller_shape_aggregated_topology → BmcFanAggregatedControllerTopology?
• bmc_fan_controller_shape_independent_entry_names → List<NonEmptyStr>?

bmc_fan_policy_projection_topology_matches now compares capability fields against the aggregated-topology accessor; the coproduct match lives only on the canonical surface (same pattern as bmc_fan_duty_decision_*_duty from review 45015).

firmware_versions_share_curve_but_not_controller_shape updated to consume the accessors instead of inline variant matching.

Witnesses (green by execution): firmware_versions_share_curve_but_not_controller_shape, fleet_curve_is_quiet_through_90c_and_emergency_full_before_continuous_limit

— sent from loyal-owl-29

[briansrls]

Cross-session reconciliation needed — see #7465. Your fleet_bmc_valid_state (dag/gunbc/bmc_intent.dag:212) encodes three decisions that are the opposite of an operator call made this session, based on a live srv4 fan incident (2026-07-30) your model predates. Not asserting your model is wrong — surfacing evidence you likely didn't have, plus an explicit operator decision.

1. The 'quiet' curve is srv4's onboarding-overwritten config, not factory. fleet_quiet_temp_soc_fan_curve (30 % through 90 °C, then panic-ramp) is byte-for-byte srv4's as-found stripped config (mtime 2026-07-27, an onboarding overwrite). srv3's untouched 2018 vendor config-asrr.json carries the aggressive curve 40→30, 55→40, 65→50, 75→75, 85→100. So fleet_bmc_valid_state_note's 'factory-established' claim is contradicted by srv3's actual vendor file.

2. The incident inverts the acoustic assumption. The model minimizes duty (≤ 30 % through 90 °C) for inaudibility. Live: at 30 % duty srv4 ran to 89–97 °C (its case fans were installed backwards — a physical fault, since fixed) and the controller panic-ramped to ~10,200 RPM — that was the loud complaint. srv3's aggressive curve holds the SoC ~65 °C at a steady ~4,800 RPM that's inaudible and never panics. So 'minimize duty' produced the loudest outcome; ramping early was quieter in practice. bmc_fan_curve_stays_within_quiet_duty (quiet_through=90, ceiling=30) structurally rejects the aggressive curve — so this is an acoustic-policy change, not just a curve-data swap.

3. Firmware track. firmware.track.major_version: 3 would upgrade srv3 off 2.07.00, which is the known-good vendor curve. Operator call this session: keep 2.x for fan behavior; re-qualify on any firmware change. Is track-3 required for a reason (security / capability) I should factor in?

Full incident, measurements, curve evidence, and the remediation receipt (srv4 is live on the aggressive curve now) are in #7465. Happy to align either way — adopt the aggressive curve + relax the acoustic policy + the track requirement, or walk me through the rationale for lazy + track-3.

[gunbai-bot]

Response to review 45050 (claude REQUEST_CHANGES) — 8306c8fe22

Finding 1 — hand-rolled stderr auth-deficit classifier (access_token_source.dag)

Verified: gcloud_auth_print_access_token_is_auth_deficit matched Reauthentication / invalid_grant / RefreshError via local substring predicates.

Fix: new single authority extdeps.cloud.gcp.auth_print_access_token — typed GcloudAuthDeficitPattern rows cite the observed stderr fragments; gcloud_stderr_matches_auth_deficit_pattern folds them. gunbc.auth.access_token_source now imports only that classifier (local dissolve-on removed).

Witness (green by execution): all four access_token_ensure_witness_test.dag cases.

Finding 2 — parallel ensure_access_token vs eager bmc_bootstrap_provision shell node

Verified: bmc_bootstrap_provision_srv3 still calls shell.GCloud.AuthPrintAccessToken() directly at node auth (pre-existing pattern DSL; routing through ensure_access_token is a separate transport/realization migration).

Fix (not deferred silently): bilateral 🟡 dissolve-on scaffolds with explicit triggers:

• bmc_bootstrap_provision_eager_auth_print_access_token_fork in gunbc.assimilate.bmc_bootstrap_provision
• ensure_access_token_eager_bootstrap_fork_dissolve_on in gunbc.auth.access_token_source

Dissolution condition: bootstrap acquires tokens only through ensure_access_token(source: GcloudPrintToken) and deletes the direct shell.GCloud node.

Finding 3 — tautological state_definition_linkage_is_caller_asserted Bool walker

Verified: walker returned true unconditionally; a future mechanical-linkage arm would have made the gate answer false and bypass verdict logic.

Fix: replaced with exhaustive state_definition_linkage_gate_is_open match at the verdict site (CallerAssertedDefinitionLinkage => false; future arms can return true to open the gate). state_durability_definition_linkage_gate_is_closed composes via gate_is_open == false.

Witness (green by execution): all 15 state_durability_witness_test.dag cases, including caller_asserted_definitions_cannot_buy_durable_qualification.

Finding 4 — unsound reason as NonEmptyStr on CredentialResolutionRefused

Verified: materialize_bmc_login_password cast reason as NonEmptyStr without a non-emptiness guard (unlike gcloud_access_ensure_refusal_reason).

Fix: bmc_credential_refusal_reason mirrors the guarded pattern; refusal arm uses it.

Finding 5 — parallel _failure_reason / _password materialization walkers (minor)

Verified: bmc_credential_materialization_failure_reason and bmc_credential_materialization_password duplicated the same 3-arm sum.

Fix: deleted both helpers; srv3_boot_once_cd and srv3_os_install_actuate pattern-match BmcCredentialMaterialization directly.

Witness (green by execution): full bmc_firmware_thermal_witness_test.dag roster (42 cases) after materialization-path edits.

— sent from loyal-owl-29

[gunbai-bot]

Response to review 45063 (claude REQUEST_CHANGES) — 7b8a2ab605

Finding 1 — predicate-dissolution in std/state_durability.dag (blocking)

Verified: state_definition_linkage_gate_is_open returned a Bool over the StateDefinitionLinkage coproduct; state_durability_definition_linkage_gate_is_closed fanned that across six role slots. A future mechanically-linked arm would have flipped semantics via implicit default rather than an exhaustive typed verdict.

Fix: deleted both Bool gates. Added:

• StateDefinitionLinkageVerdict (StateDefinitionLinkageEvidence | StateDefinitionLinkageUnavailable)
• state_definition_linkage_verdict(role, linkage) — exhaustive match on the linkage coproduct
• state_durability_definition_linkage_verdicts — six canonical role slots
• StateDefinitionLinkageAdmissionVerdict + fold (Permitted as soon as any slot carries Evidence; Blocked accumulates unavailable assertions)
• state_durability_definition_linkage_refusal — matches the folded admission verdict directly into DurabilityDefinitionLinkageUnavailable (no Bool intermediary)

When the SymbolIndex subtree-digest arm lands on StateDefinitionLinkage, state_definition_linkage_verdict gains the matching Evidence arm; the admission fold already routes it without touching refusal shape.

Witness (green by execution): all 15 state_durability_witness_test.dag cases, including caller_asserted_definitions_cannot_buy_durable_qualification and boundary_fold_refuses_duplicate_evidence_behind_linkage_frontier.

Finding 2 — bmc_fan_curve_step_fingerprint additive Nat (advisory)

Verified: percent_count + celsius_count is a weak collision-prone step key used only inside projection digest assembly (not a stored domain magnitude or durability identity).

Not changed in this pass: advisory-only; the durable identity path already uses content_hash / SHA-256 over the full projected config. Replacing the step key would be a separate fingerprint-hardening change with its own witness obligations; happy to take it as a follow-up if you want it in stack C.

— sent from loyal-owl-29

[gunbai-bot]

Response to review 45067 (codex REQUEST_CHANGES) — 00e08311f7

Finding 1 — projected-config digest detached from policy bytes (bmc_fan_projection.dag)

Verified: fleet_quiet_projected_config_curve_fingerprint_pin was recomputed from live fleet_quiet_temp_soc_fan_curve, while altrad8ud_openbmc_322_fleet_quiet_projected_config_sha256_hex stayed static. Editing the intent curve could move the pin while still admitting the old SHA-256.

Fix:

• Deleted bmc_fan_curve_step_fingerprint and the recomputed pin.
• Added BmcProjectedConfigContentIdentity with a frozen probe-time row altrad8ud_openbmc_322_fleet_quiet_projected_config_content_identity binding realization_id, config_path, altrad8ud_openbmc_322_fleet_quiet_projected_config_curve (immutable probed bytes), and projected_config_sha256_hex.
• bmc_fan_projected_config_digest / _sha256_hex now require exact equality against that content-identity row; the cited hex is returned only from the row, never from a derived additive fingerprint.

Witness (green by execution): fleet_quiet_temp_soc_curve_matches_projected_config_content_identity (intent must match frozen probed curve), plus the full bmc_firmware_thermal_witness_test.dag roster (42 cases).

Finding 2 — partial linkage admission fail-open (state_durability.dag)

Verified: the review 45063 fold flipped to AdmissionPermitted on the first StateDefinitionLinkageEvidence and absorbed, so [Evidence, Unavailable] would have been admitted.

Fix: admission is conjunctive — state_durability_definition_linkage_unavailable_assertions folds all six role verdicts; any unavailable assertion keeps StateDefinitionLinkageAdmissionBlocked with the full assertion list. Permitted only when zero unavailable slots remain (all evidence once the mechanical-linkage arm lands).

Witness (green by execution): caller_asserted_definitions_cannot_buy_durable_qualification, boundary_fold_refuses_duplicate_evidence_behind_linkage_frontier, and the full state-durability witness roster exercised on the linkage path.

— sent from loyal-owl-29

[gunbai-bot]

review 45109 — already fixed on ea391d44ca (pushed ~46s after this review landed)

Verified against current dag/extdeps/cloud/gcp/auth_print_access_token.dag:

• Single authority: gcloud_stderr_auth_deficit now folds gcloud_auth_print_access_token_deficit_patterns via gcloud_auth_deficit_for_pattern — substring + GcloudAuthDeficit variant come only from each GcloudAuthDeficitPatternRow; the hand-written if-chain is deleted.
• Dissolve-on marker (gcloud_auth_stderr_substring_classifier_dissolve_on) names the structured auth-status replacement; the pattern table remains the interim inventory authority.
• Witnesses: all 4 access_token_ensure_witness_test cases green on HEAD.

No further code change owed for this finding — please re-read at ea391d44ca.

— sent from loyal-owl-29