DEVBOOT-0 continuation: two-client build proof on srv1/srv2, then serve gunbc build

[gunbai-bot]

Standing

DEVBOOT is demonstrated and accepted on the branch pending exact-head CI. #8049 landed the mechanism on published main (69d07ed69d3a08a6d881a4ed8f3f45e0ec82e8aa); this PR closes the acceptance gaps and records the modeled two-client fleet proof as a harvested receipt, not a hand-transcribed one.

Summary

• gunbc build gunbc is the stable client command; producer reuse and execution evidence (executed_exit, executed_stdout) are written into each .devboot-receipt.
• Modeled serve path (devboot_serve_once_entry on srv3) is the producer; host timer shell is honestly scaffolded.
• Fleet proof receipt is derived by harvest_modeled_fleet_proof over committed host observations (devboot_fleet_proof_harvest_bundle): client receipt prose, modeled-serve.log, and git for-each-ref store output. Carries both tested_commit (corpus provenance) and tested_tree (918953e9…, build-content identity joining client subjects and request commit).
• vertical_receipt.dag projects the same commit/tree/token/digest identities from the harvested proof (no abbreviated parallel head).
• Producer compile_count is recorded at the serve seam (ServeProduced.compile_count; 1 after cargo, 0 on skip-if-produced).

Fleet proof (2026-08-09, independently verified)

Observation	Value
tested_commit	69d07ed69d3a08a6d881a4ed8f3f45e0ec82e8aa
tested_tree	918953e9eb1ccbc60e6b91f64d5612a0fffd4871
request identity	fnv1a64-dfd0b4abb44e30e7
artifact digest	976728c5… (both hosts)
producer compiles	1 SERVED among modeled serve loop
srv1 / srv2 reuse	false / true
execution	both executed_exit: 0, same stdout fingerprint

Test plan

• devboot_serve_witness_test.dag
• devboot_build_product_witness_test.dag (execution + reuse arms)
• devboot_fleet_proof_harvest_witness_test.dag (harvest + vertical join)
• CI floor on session/keen-moth-104 at current head

[gunbai-bot]

review 50821 — addressed in 0d7545127a5

1. produce.dag unmarked WitnessBin.Run (HAND-SHELL GATE) — Fixed. All 37 producer shell sites now route through devboot_witness_run with counted RetainedWitnessRun rows in transport.dag (produce-specific rows added for git add, rustc, unpack-file, mv, ldd, execute-artifact, object-exists/size, etc.). produce.dag has zero direct gunbc.WitnessBin.Run calls; the live devboot_produce_entry path is enrolled under the same reason+dissolve-on discipline as build.dag.

2. read_request_source_tree exit-128 → fabricated absence — Fixed. SourceTreeAbsent is now reserved for git_ref_missing_exit_code and stderr shapes that mean missing ref/path (does not exist in, invalid object name, Not a valid object name). Repository-unusable failures — stderr not a git repository, or exit git_repository_unusable_exit_code without those missing-content markers — land on SourceTreeResolveFailed with exit code + stderr attached, so serve no longer reports "the request carried no source tree" when the store is unreachable.

3. Literal 128 fork — Fixed. build.dag imports git_repository_unusable_exit_code from extdeps.git and branches on that authority instead of a hand-written constant.

Proceeding to the two-client proof on these typed paths next.

[gunbai-bot]

review 50830 — fixed in fbfcc16bbee

Verified against current session/keen-moth-104 HEAD. Both entry points now match the devboot_produce_entry / devboot_materialize_entry boundary:

Entry	Typed outcome	Prose	Exit
devboot_build_entry	BuildOutcome via devboot_build	render_build_outcome → receipt_path	build_outcome_exit → ProcessExit
devboot_serve_entry	ServeReport via devboot_serve_request	render_serve_report → receipt_path	serve_report_exit → ProcessExit

Receipt write failures route through shared receipt_write_refusal from gunbc.devboot.produce. Neither entry returns String; a successful BUILT/SERVED path now yields ExitSuccess.

Same commit is on session/proud-ferret-255 (23ab0b5ba1a) for #8049.