Enroll extdeps.session_dashboard as a scope carrier (unreds main)

[gunbai-bot]

What was red

extdeps_scope_placement_gate_passes (batch 1) refused on main for 10 consecutive ci runs, from #7573 through #7608. It was the sole failure in every one of those runs — the ci job carried no other FAIL, so nothing else was hiding behind it.

Because the required check is ci, this blocked every open PR in the fleet, not just the lane that caused it.

Root cause

dag/extdeps/session_dashboard.dag was added by #7573 and enrolled in none of the three frontier populations that gunbc.extdeps_scope_frontier extdeps_scope_frontier_law requires — not scope_carrier_paths, not scope_machinery_exempt_paths, and (correctly) not the frozen legacy manifest, which is not an admission channel for a new file.

tools.extdeps_scope_placement_gate scope_placement_gate_verdict therefore refused via scope_placement_refused_paths.

How it reached main without its own PR refusing it: the gate landed in #7571 at 8a4e43f62c3 (2026-08-01 17:09:02 -0400) and #7573 merged at ea1c781097e eleven seconds later (17:09:13 -0400). #7573's CI ran against a base where the gate did not yet exist, so the wall never evaluated it. The first run that could see the file was the merge commit's own — on main.

The fix

Exactly the landing state the law prescribes for a new extdeps file — become a scope carrier:

• dag/extdeps/session_dashboard.dag declares extdeps_model_scope: ExternalModelScope, subject session_dashboard.Api (the service that is the modeled upstream interface), cited to the module's existing extdeps_external_authority_anchor.
• dag/gunbc/extdeps_scope_frontier.dag scope_carrier_paths gains the row.

The authored shape matches extdeps.github.actions_environment, which #7623 landed independently and correctly — same imports, same ExternalSubjectRef/DeclarationRef structure. That module is not part of this defect; it declared its scope and took its roster row in its own PR.

Verified by execution, not inspection

Against the merged tree, each arm of scope_placement_gate_verdict:

arm	result
scope_placement_refused_paths (added ∖ rostered)	empty
manifest_freeze_holds (manifest row naming a post-freeze add)	none
manifest_remove_only_exit (this change adds a manifest line)	manifest untouched → ManifestUntouched
carrier content check (carrier_content_declares_scope)	all 4 carriers byte-declare it
roster disjointness	holds

Not fixed here — a real design wrinkle, reported separately

scope_placement_added_paths diffs legacy_manifest_freeze_sha..HEAD, not the merge base. So the placement arm judges every extdeps file added since the freeze anchor by anyone, not the files the change itself introduces — which is what extdeps_scope_frontier_law claims it does ("only paths the change itself introduces are judged"). Consequence: once one unrostered file merges, every branch inherits the refusal, and the party who learns is an unrelated lane.

The manifest-freeze arm genuinely needs freeze..HEAD (it must know the whole post-freeze added set). The placement arm does not. Splitting the two bases is the fix, but changing the base semantics of a merge-gating wall is a substantive change that deserves its own review rather than riding along with an urgent fleet unblock.

🤖 Generated with Claude Code

[gunbai-bot]

Superseded by #7556, which landed the same enrollment independently while this was in CI.

Main is green on extdeps_scope_placement_gate_passes again: #7556 added dag/extdeps/session_dashboard.dag to scope_carrier_paths along with its own four extdeps files, and all six files added since legacy_manifest_freeze_sha are now rostered — the refused set computed by scope_placement_refused_paths is empty.

#7556's version is also the better one and I took it wholesale rather than contest it: it declares a real data session_dashboard: SessionDashboard and points the DeclarationRef at that declaration, where this PR pointed decl_name at the session_dashboard.Api service. Naming an actual data declaration is the more faithful reading of the DESIGN section 3 cite-the-symbol rule.

This branch now carries an empty diff against main. The diagnosis in the description stands and is still worth reading — in particular the gate's base-selection wrinkle (it diffs legacy_manifest_freeze_sha..HEAD rather than the merge base, so one unrostered file reds every branch, not just the offending PR) and the fact that the gate returns a bare Bool(false) so its located diagnostic never reaches the CI ledger. Both are unfixed and belong in a follow-up.

[gunbai-bot]

Correcting one thing I said when closing this, since the review (artifact /api/reviews/46893/artifacts/stdout.log) surfaced evidence against it.

I claimed #7556's version was "the more faithful reading of the DESIGN section 3 cite-the-symbol rule" because it points decl_name at a real data declaration rather than at the session_dashboard.Api service. That overstated it. A dotted service decl_name is an established convention in this corpus — extdeps.bmc.http uses decl_name: "redfish.Http" for exactly that shape, which I verified. Both spellings were conventional, so #7556's is not better on those grounds; it is simply the one that landed first.

The outcome is unchanged — this branch is empty against main and stays closed — but the reasoning in my close comment was wrong and I would rather the record say so.

— sent from nimble-seal-512