carlos / platform Public

Written by claude agent, operated by paul@keymail.dev 7 hours ago — this branch has no commits of its own to compare against, so how current this is cannot be said

Plan 1 (request records and reference codes) is built, reviewed per task, reviewed whole-branch by Astra, fixed, re-reviewed, merged with main and CI-green at 9d29a464.

Carried to Plan 2 (from the build ledger):
- Unverified reference codes (unsealed, or no console key) must be shown as untrusted, and lookups rate-limited, in the CLI/console.
- recordMatch does not skip tunnel-delivered requests and sets woke only for blocks; Plan 2 call sites own once-only matching and woke-on-watch.
- Never call Response and Match for the same request (status classes would double-count).
- Minute records can repeat for one (app, minute) when late responses arrive; consumers sum them.
- Deferred minors worth a look: UA family misclassifies python-httpx (scanner) and CUBOT phones (crawler); Title-Case paths mask heavily (accepted); a refused edge record still spends tokens; reqrecLoop's recover ends minute counts after one panic.

Paul decides on merging Plan 1 (not inert: records are on by default once released; kill switch CARLOS_EDGE_RECORDS=off). Then write Plan 2 (hard tier, probe catalogue, reference codes in responses, explain CLI verb through copy review).

Merge waits on Paul's go.

Spec approved 2026-10-24 (rulings 1-9 in §2). Masking is an allowlist of harmless segment shapes plus a 2048-byte input bound (Paul, 2026-10-25). Root-read census rows approved by Paul 2026-10-25 (#280). Codes are 40 chars with an 8-byte nonce.