amadan

carlos / platform Public

← Branches

design-deploy-credential

carlos/platform#229: a deploy service credential limited to rungs, so CI ships, promotes and rolls back through the console (audited, serial-bumped, adopted in seconds) with no more authority than a scoped release key. CI reads it from CARLOS_SERVICE_TOKEN with CARLOS_CONSOLE, and can run carlos deploy (R6).

What landed on the branch:

  • svcrole.Deploy and a rungs column (canary, edge, beta; never stable), minted from the CLI (carlos services create --role deploy --app X --rungs canary,edge) or the console form. Unreadable scopes fail closed.
  • 13 doors (spec §6). A scope check in the handlers and, authoritatively, inside the release primitives between the pointer read and the conditional write (G1, G2; the in-flight gap accepted as R5).
  • Each deploy promote is signed by a request-local scoped grant, so boxes still verify the rung limit. No root-signer fallback.
  • A randomized interleaving test with two mutants that each fail it; an older console refuses the credential at every door.
  • README and CLI docs: CI uses the console; direct-bucket mode is the operator's path.

Status: all 12 plan tasks done and reviewed; Astra's whole-branch review findings fixed and re-reviewed. Full gate green locally. Not merged or rolled: waiting for Paul.

Commits 28
Discussions 0 0 open
Tasks 0/0 done

Discussions

  • No discussions on this branch yet.

All discussions →

Tasks

  • No tasks yet.

All tasks →

Activity