vms-c1f: stage DECNETD.EXE so the DECnet CTERM auth proof hard-gates VAX + Alpha

[baron-3dl]

Summary

• Stages DECNETD.EXE onto the VAX sysvol (tests/lab-vax/stage_sysvol.sh + run-boot.sh's build_boot_image_set, which now cross-builds it via cmake --target decnetd_exe) and the Alpha boot image (tools/cross-alpha/build-alpha-bootimage.sh), matching how x86_64 already ships it (distro/Dockerfile.bootable).
• Flips the shared DCL/SHOW acceptance battery's DECnet CTERM (vms-f40) and NETACP isolation (vms-9ab) sections from "emit a note, assert nothing" to a HARD GATE (bad, not note) on all three rails when DECNETD.EXE is absent — closes an INV-6 hole (a shipped facility whose runtime couldn't prove it).
• Corrects the stale distro/Dockerfile.bootable comment claiming DECNETD.EXE "needs the netbsd-vax userspace port" — its datalink goes only through src/libdatalink's scs_datalink_* abstraction, which already ships both the AF_PACKET (x86_64/Alpha) and NetBSD bpf(4) (VAX) backends.
• Adds DECNETD.EXE to both rails' hard content gates (mastered-volume presence checks) for defense in depth.
• FAL's own auth proof (--fal-accept-test, vms-8c2/vms-8c2: DECnet Phase IV file COPY (FAL/DAP) — object-17 server + DAP codec + COPY client #1096) is not yet in the battery — vms-8c2: DECnet Phase IV file COPY (FAL/DAP) — object-17 server + DAP codec + COPY client #1096 had not merged as of this PR. Left a scope-note comment: once it lands, a FAL section needs no rail-staging work of its own (DECNETD.EXE is already staged everywhere) — just follow the same bad-not-note shape.

Proof-run evidence (rd vms-c1f DONE-VERIFY, ground-source, no mock)

Fired gh workflow run ci.yml --ref work/vms-c1f (plain workflow_dispatch — runs every heavy-emulator-tier job including vax-dcl-acceptance and alpha-dcl-acceptance, which only run on schedule || workflow_dispatch, never on pull_request). Run numbers and the VAX/Alpha CTERM verdict will be added as a PR comment once the run completes (vax-dcl-acceptance: 180min timeout; alpha-dcl-acceptance: 120min timeout).

Test plan

• vax-dcl-acceptance job: DECnet CTERM section asserts PASS (real $CREPRC/LOGINOUT/RTAn: auth proof over the booted SIMH VAX rail) — or reds honestly with the exact substrate gap if one exists.
• alpha-dcl-acceptance job: same, over qemu-system-alpha.
• Both rails' mastered-volume content gates confirm DECNETD.EXE present.
• No PR-tier (fast) job regresses.

Do not merge — the release-conductor reaps on green.

🤖 Generated with Claude Code

https://claude.ai/code/session_01T4csyFSMUsS8k1D2MgMxk2

[baron-3dl]

Alpha proof-run result (rd vms-c1f DONE-VERIFY)

Fired gh workflow run ci.yml --ref work/vms-c1f → run 34411832875.

alpha-dcl-acceptance (job 102667831318): DECnet CTERM + NETACP isolation sections PASSED CLEAN on the booted qemu-system-alpha rail —

DECNETD-I-CTERMACCEPT, 13 passed, 0 failed
DECNETD-CTERM-ACCEPT: PASS
DECNETD-I-ISOLATION, 4 passed, 0 failed
DECNETD-ISOLATION: PASS

An inbound SET HOST to object 42 reached an AUTHENTICATED LOGINOUT via $CREPRC on an executive-minted RTAn: over Alpha's real /dev/vms executive, every bad credential set was refused (unknown account, wrong password, DISUSER-with-correct-password), and the A2/A8 NETACP privileged-path isolation seam held. This is the target proof of vms-c1f, hard-gated and green.

The job's overall exit code is still 1 — but from an unrelated, pre-existing gate: golden_diff vax-show-cpu (tests/qemu/lib/dcl_acceptance_battery.sh:952, landed in #952/fffce3d4, predates this PR) hard-fails with "surface/tooling not found" on every rail whose name isn't vax, because it never checks the oracle surface's own ARCH=vax field before treating an arch-scoped surface as globally required. Filed as vms-e70 (not fixed here — out of scope for vms-c1f, and this PR touches none of that code).

vax-dcl-acceptance is still running (SIMH boot + full battery, up to 180min cap) — will report separately when it concludes.

🤖 Generated with Claude Code

[baron-3dl]

VAX proof-run result — BOTH target rails now confirmed green

vax-dcl-acceptance (job 102673953977, real SIMH boot of OVMX/NetBSD-vax): DECnet CTERM + NETACP isolation PASSED CLEAN, matching Alpha —

DECNETD-I-CTERMACCEPT, 13 passed, 0 failed
DECNETD-CTERM-ACCEPT: PASS
DECNETD-I-ISOLATION, 4 passed, 0 failed
DECNETD-ISOLATION: PASS

DECNETD.EXE cross-built (cmake --target decnetd_exe under the vax toolchain) and staged onto the mastered sysvol; the inbound SET HOST reached an AUTHENTICATED LOGINOUT via $CREPRC on an executive-minted RTAn: over the real SIMH VAX substrate, every bad credential was refused, and the A2/A8 isolation seam held. Both target rails (VAX + Alpha) now hard-gate green — x86_64 was already green pre-PR.

The job's overall exit code is still 1, from 7 unrelated, pre-existing battery assertions — all one root cause: the shared battery hardcodes the device name VDA0: (assuming virtio-style naming universally), but the real SIMH VAX rail's faithful native disk name is DUA0: — confirmed directly from the executive's own SHOW DEVICES output in this run: DUA0: Mounted 0 OVMXSYS 127870 0 1 (genuinely mounted, real free-block count). The device naming is correct and faithful; the battery's hardcoded expectation is wrong for this rail. Filed as vms-c8d — not fixed here, out of scope for vms-c1f, unrelated to DECnet.

Summary

Rail	CTERM (vms-f40)	NETACP isolation (vms-9ab)
x86_64	✅ (pre-existing)	✅ (pre-existing)
Alpha	✅ confirmed this run	✅ confirmed this run
VAX	✅ confirmed this run	✅ confirmed this run

Two unrelated pre-existing gaps found and filed while proving this (not fixed here): vms-e70 (golden_diff vax-show-cpu has no arch guard, reds alpha-dcl-acceptance) and vms-c8d (battery hardcodes VDA0: device name, wrong on the VAX rail's native DUA0: naming).

Ready for the release-conductor to reap.

🤖 Generated with Claude Code