Phase A: bind release identity to the serve process, compare it at readiness

.gitattributes

@@ -11,8 +11,6 @@
 .githooks/generated-artifact-merge merge=generated-artifact
 .githooks/pre-commit merge=generated-artifact
 .githooks/pre-push merge=generated-artifact
-.github/live-deploy-srv1-apply.sh merge=generated-artifact
-.github/live-deploy-srv1-retract.sh merge=generated-artifact
 .github/workflows/ci.yml merge=generated-artifact
 .github/workflows/falsifier.yml merge=generated-artifact
 .gitignore merge=generated-artifact

dag/extdeps/git/inspect.dag

@@ -13,6 +13,30 @@ data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
 
 data git_inspect_service_note: String = "Read-only repository-root, revision, and tree inspection operations are de-fused from the broad git.Core service so consumers pay only the upstream facts they inspect. Toplevel, HeadCommit, and ShowTree move here with their existing shapes; MergeBase and ListTreePathsAtRevision extend this same inspection authority for revision-addressed Rust-source observation. No second Git inspection surface remains in extdeps.git."
 
+// WorkingTreeStatus pins every flag Git's own manual says a script must pin. `--porcelain=v1` because the
+// manual states plain `--porcelain` may change and that a version should be given for scripting, so the
+// version is named rather than implied. `-z` because paths may contain spaces, quotes, or newlines and the
+// non-NUL form C-quotes them, which would make every consumer reimplement Git's quoting rules to recover a
+// filename. `--untracked-files=all` because the default `normal` collapses an untracked directory to the
+// directory name alone, and a consumer asking "does this tree contain files HEAD does not name" needs the
+// files, not a folded ancestor.
+//
+// The mock answers a CLEAN tree because the runner contract hands each job a fresh checkout; a mocked
+// observation must report the state the contract guarantees rather than fabricate a dirty one.
+//
+// IgnoredFiles is a SECOND operation rather than an `--ignored=matching` flag on the first, and the reason is
+// measured, not stylistic. `git status --porcelain=v1 -z --untracked-files=all --ignored=matching` reports a
+// directory that itself matches an ignore pattern as one folded entry — `!! ign/` — and never names the file
+// inside it. That is the same folded-ancestor loss `--untracked-files=all` exists to avoid, and it is fatal
+// here specifically, because a consumer asking "which ignored files would the source sync copy" must filter
+// each path against the deployed-scope authority and must name the offending path in its refusal; a folded
+// directory can do neither. `git ls-files --others --ignored --exclude-standard -z` answers with real file
+// paths (`ign/f.dag`), which is the granularity the question needs. Verified by execution against git 2.43.0
+// on a constructed repository, both spellings side by side.
+//
+// `--exclude-standard` is pinned because without it the command applies no ignore rules at all and would
+// return every untracked path — the opposite of the question. The output is a bare NUL-separated path list,
+// so unlike porcelain v1 it carries no status codes and no rename-source continuation to track.
 service git.Inspect {
   operation Toplevel {
     input {}
@@ -42,6 +66,42 @@ service git.Inspect {
     }
   }
 
+  operation WorkingTreeStatus {
+    input {}
+    output {
+      entries_nul: String from "stdout"
+      success: Bool from "exit_success"
+      stderr: String from "stderr"
+    }
+    readonly
+    transport shell { argv: ["git", "status", "--porcelain=v1", "-z", "--untracked-files=all"] }
+    exit {
+      0 => Unit
+      128 => String "Not a git repository"
+    }
+    mock_response {
+      0 => { entries_nul: "", success: true, stderr: "" } "hermetic checkout is clean: the runner contract hands the job a fresh checkout, so the empty entry list is the state a mocked observation must report rather than a fabricated dirty one"
+    }
+  }
+
+  operation IgnoredFiles {
+    input {}
+    output {
+      paths_nul: String from "stdout"
+      success: Bool from "exit_success"
+      stderr: String from "stderr"
+    }
+    readonly
+    transport shell { argv: ["git", "ls-files", "--others", "--ignored", "--exclude-standard", "-z"] }
+    exit {
+      0 => Unit
+      128 => String "Not a git repository"
+    }
+    mock_response {
+      0 => { paths_nul: "", success: true, stderr: "" } "hermetic checkout carries no ignored files: the runner contract hands the job a fresh checkout, so the empty path list is the state a mocked observation must report rather than a fabricated one"
+    }
+  }
+
   operation MergeBase {
     input { left: GitRef, right: GitRef }
     output {

dag/extdeps/git/mock_corpus.dag

@@ -23,6 +23,20 @@ data git_inspect_mock_case_merge_base: PublishedMockCase = PublishedMockCase {
   case_id: 0
 }
 
+data git_inspect_mock_case_working_tree_status: PublishedMockCase = PublishedMockCase {
+  operation_key: "git.Inspect.WorkingTreeStatus",
+  service: "git.Inspect",
+  operation: "WorkingTreeStatus",
+  case_id: 0
+}
+
+data git_inspect_mock_case_ignored_files: PublishedMockCase = PublishedMockCase {
+  operation_key: "git.Inspect.IgnoredFiles",
+  service: "git.Inspect",
+  operation: "IgnoredFiles",
+  case_id: 0
+}
+
 data git_inspect_mock_case_list_tree_paths_at_revision: PublishedMockCase = PublishedMockCase {
   operation_key: "git.Inspect.ListTreePathsAtRevision",
   service: "git.Inspect",
@@ -134,6 +148,8 @@ data git_published_mock_corpus: List<PublishedMockCase> = [
   git_core_mock_case_remote_branches,
   git_inspect_mock_case_merge_base,
   git_inspect_mock_case_list_tree_paths_at_revision,
+  git_inspect_mock_case_working_tree_status,
+  git_inspect_mock_case_ignored_files,
   git_core_mock_case_ls_files,
   git_core_mock_case_diff,
   git_core_mock_case_diff_unified0,

dag/gunbc/fleet_converge_cli.dag

@@ -71,7 +71,7 @@ fn converge_cli_applied_knob_count(intent: HostEffectIntent, fallback: Int) -> I
     Srv3BootOnceReadBackSleep => fallback
     Srv3ReceiptEmit { lines: _ } => fallback
     HostIdentityShortHostnameRead => fallback
-    LiveDeployApply { spec: _ } => fallback
+    LiveDeployApply { spec: _, candidate: _ } => fallback
     LiveDeployRetract { spec: _ } => fallback
     LiveDeployEnsureDependency { dep: _ } => fallback
     LiveDeployDigestReadback { port: _ } => fallback

dag/gunbc/generated_artifact.dag

@@ -22,16 +22,14 @@ type GeneratedArtifact
   | Stage0CratePartitionGeneratedDagArtifact
   | Stage0EmitPlanGeneratedDagArtifact
   | V1InterpreterDispatchGeneratedRsArtifact
-  | LiveDeployApplyScriptArtifact
-  | LiveDeployRetractScriptArtifact
   | AutoinstallUserDataArtifact { spec: HostAutoinstall }
   | ProxyDhcpDnsmasqArtifact { spec: InstallServerSpec }
   | PlanArtifact { plan: Plan }
 
 data generated_artifact_registry: List<GeneratedArtifact> = concat(
   concat(
     concat(
-      [CiYamlArtifact, FalsifierYamlArtifact, GitignoreArtifact, GitattributesArtifact, RoadmapArtifact, DesignArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0EmitPlanGeneratedDagArtifact, V1InterpreterDispatchGeneratedRsArtifact, LiveDeployApplyScriptArtifact, LiveDeployRetractScriptArtifact],
+      [CiYamlArtifact, FalsifierYamlArtifact, GitignoreArtifact, GitattributesArtifact, RoadmapArtifact, DesignArtifact, GithooksPrePushArtifact, GithooksPreCommitArtifact, GeneratedArtifactMergeDriverArtifact, RunnerDeployArtifact, Stage0CrateLayoutGeneratedDagArtifact, Stage0CrateLayoutGeneratedRsArtifact, Stage0CratePartitionGeneratedDagArtifact, Stage0EmitPlanGeneratedDagArtifact, V1InterpreterDispatchGeneratedRsArtifact],
       map(fleet_autoinstall_specs, s => AutoinstallUserDataArtifact { spec: s })
     ),
     map(fleet_install_server_specs, s => ProxyDhcpDnsmasqArtifact { spec: s })
@@ -66,8 +64,6 @@ fn artifact_path(a: GeneratedArtifact) -> String {
     Stage0CratePartitionGeneratedDagArtifact => "dag/gunbc/stage0_crate_partition_generated.dag"
     Stage0EmitPlanGeneratedDagArtifact => "dag/gunbc/stage0_emit_plan_generated.dag"
     V1InterpreterDispatchGeneratedRsArtifact => "src/v1/stage0/src/v1_interpreter_dispatch_generated.rs"
-    LiveDeployApplyScriptArtifact => ".github/live-deploy-srv1-apply.sh"
-    LiveDeployRetractScriptArtifact => ".github/live-deploy-srv1-retract.sh"
     AutoinstallUserDataArtifact { spec } => concat(concat("provisioning/", spec.host), "/user-data")
     ProxyDhcpDnsmasqArtifact { spec } => concat(concat("provisioning/", spec.host), "/dnsmasq.conf")
     PlanArtifact { plan } => plan_path(p: plan)
@@ -92,8 +88,6 @@ fn artifact_commit_policy(a: GeneratedArtifact) -> CommitPolicy {
     Stage0CratePartitionGeneratedDagArtifact => CommitRequired { consumer: GitProtocol }
     Stage0EmitPlanGeneratedDagArtifact => CommitRequired { consumer: GitProtocol }
     V1InterpreterDispatchGeneratedRsArtifact => CommitRequired { consumer: GitProtocol }
-    LiveDeployApplyScriptArtifact => CommitRequired { consumer: HostReconciler }
-    LiveDeployRetractScriptArtifact => CommitRequired { consumer: HostReconciler }
     AutoinstallUserDataArtifact { spec: _ } => NotCommitted
     ProxyDhcpDnsmasqArtifact { spec: _ } => NotCommitted
   }
@@ -133,8 +127,6 @@ fn artifact_eq(a: GeneratedArtifact, b: GeneratedArtifact) -> Bool {
     Stage0CratePartitionGeneratedDagArtifact => match b { Stage0CratePartitionGeneratedDagArtifact => true  _ => false }
     Stage0EmitPlanGeneratedDagArtifact => match b { Stage0EmitPlanGeneratedDagArtifact => true  _ => false }
     V1InterpreterDispatchGeneratedRsArtifact => match b { V1InterpreterDispatchGeneratedRsArtifact => true  _ => false }
-    LiveDeployApplyScriptArtifact => match b { LiveDeployApplyScriptArtifact => true  _ => false }
-    LiveDeployRetractScriptArtifact => match b { LiveDeployRetractScriptArtifact => true  _ => false }
     AutoinstallUserDataArtifact { spec } => match b { AutoinstallUserDataArtifact { spec: spec2 } => spec.host == spec2.host  _ => false }
     ProxyDhcpDnsmasqArtifact { spec } => match b { ProxyDhcpDnsmasqArtifact { spec: spec2 } => spec.host == spec2.host  _ => false }
     PlanArtifact { plan } => match b { PlanArtifact { plan: plan2 } => plan.slug == plan2.slug  _ => false }

dag/gunbc/generated_artifact_emit.dag

@@ -10,7 +10,6 @@ import gunbc.generated_artifact {
   Stage0CratePartitionGeneratedDagArtifact,
   Stage0EmitPlanGeneratedDagArtifact,
   V1InterpreterDispatchGeneratedRsArtifact,
-  LiveDeployApplyScriptArtifact, LiveDeployRetractScriptArtifact,
   artifact_path
 }
 import gunbc.ci_yaml_emit { expected_ci_yml }
@@ -45,10 +44,6 @@ import gunbc.v1_interpreter_dispatch_emit {
   V1InterpreterDispatchGenerated,
   V1InterpreterDispatchGenerationRefused,
 }
-import gunbc.live_deploy.emit {
-  expected_live_deploy_apply_script,
-  expected_live_deploy_retract_script
-}
 
 type ArtifactGenerationOutcome
   = ArtifactGenerated { content: String }
@@ -85,8 +80,6 @@ fn artifact_generate(a: GeneratedArtifact) -> ArtifactGenerationOutcome {
       V1InterpreterDispatchGenerationRefused { reason } =>
         ArtifactGenerationRefused { reason: reason }
     }
-    LiveDeployApplyScriptArtifact => artifact_generated(content: expected_live_deploy_apply_script())
-    LiveDeployRetractScriptArtifact => artifact_generated(content: expected_live_deploy_retract_script())
     AutoinstallUserDataArtifact { spec } => artifact_generated(content: autoinstall_user_data(payload: spec.payload))
     ProxyDhcpDnsmasqArtifact { spec } => artifact_generated(content: install_server_dnsmasq_conf(spec: spec))
     PlanArtifact { plan } => artifact_generated(content: expected_plan_md(p: plan))
@@ -118,8 +111,6 @@ fn artifact_extra_valid(a: GeneratedArtifact, generated: ArtifactGenerationOutco
       ArtifactGenerated { content: _ } => true
       ArtifactGenerationRefused { reason: _ } => false
     }
-    LiveDeployApplyScriptArtifact => true
-    LiveDeployRetractScriptArtifact => true
     AutoinstallUserDataArtifact { spec: _ } => true
     ProxyDhcpDnsmasqArtifact { spec: _ } => true
     PlanArtifact { plan: _ } => true

dag/gunbc/host_effect.dag

@@ -17,6 +17,7 @@ import extdeps.bmc.webui.nbd_proxy_serve { NbdProxyServeTransportIntent }
 import gunbc.fleet_intent { ComputeHost }
 import gunbc.host_converge { HostConverge }
 import gunbc.live_deploy.spec { DeploymentSpec, DeploymentDependencyStep }
+import gunbc.live_deploy.candidate { CandidateRelease }
 import std.effects {
   EffectShape,
   KeySource,
@@ -50,7 +51,7 @@ type HostEffect =
   | Srv3BootOnceReadBackSleep
   | Srv3ReceiptEmit { lines: List<String> }
   | HostIdentityShortHostnameRead
-  | LiveDeployApply { spec: DeploymentSpec }
+  | LiveDeployApply { spec: DeploymentSpec, candidate: CandidateRelease }
   | LiveDeployRetract { spec: DeploymentSpec }
   | LiveDeployEnsureDependency { dep: DeploymentDependencyStep }
   | LiveDeployDigestReadback { port: Int }