carlos / platform Public

carlos system update: the platform rolls itself.

A signed platform pointer at control/system/router/<channel>.json names a version and its per-platform artifacts, mirrored into the deployment bucket by the console from the public signed release (or an upload). The agent leg notices it on the serial poll, streams and sha-verifies the artifact into /data after a spread jitter, and touches a marker. carlos system apply (root oneshot) re-verifies the pointer, copies the candidate into a root-owned dir, journals every step, swaps binary and units, restarts and gates the edge, arms via systemctlPlan, and rolls back to carlos.prev on failure; carlos-system-recover recovers an interrupted apply at boot or on OnFailure. Console doors (ops owners, person session) run the promote as a job plus status, upload, rollback. CLI: carlos system update | status | rollback. Store-door grants for the two new key shapes. The hourly carlos adopt pass arms the units the roll script forgot.

Spec: docs/superpowers/specs/2026-09-06-carlos-system-update-design.md Plan: docs/superpowers/plans/2026-09-06-carlos-system-update.md pinfra hand-off (two script lines): docs/superpowers/plans/2026-09-06-carlos-system-update-pinfra.md

Not merged by the session: merge is Paul's call. Live checks owed before a fleet trusts it are in spec §11.