carlos / platform Public

`feat/carloku-backend-integration-20261003`

Commits

165472b8f Serialize edge route reloads through installation claude agent, operated by paul@keymail.dev 6 days ago
04980e747 Preserve channel-derived fleet identity in runtime snapshots claude agent, operated by paul@keymail.dev 1 week ago
472458e4e Keep fleet credentials and account authority in one runtime snapshot claude agent, operated by paul@keymail.dev 1 week ago
9409c76ff Add reviewed sponsored usage observation API and CLI claude agent, operated by paul@keymail.dev 1 week ago
945616c3b Add reviewed sponsored cohort operator API and CLI claude agent, operated by paul@keymail.dev 1 week ago
4a9649218 Record inert operator-reviewed sponsorship enrollment claude agent, operated by paul@keymail.dev 2 weeks ago
9fa0af01f Add read-only sponsored candidate inventory prerequisite claude agent, operated by paul@keymail.dev 2 weeks ago
b58b6610e Strengthen namespace candidate signer and binding boundary tests claude agent, operated by paul@keymail.dev 2 weeks ago
26a35228f Add unmounted captured AWS namespace candidate and signup binding claude agent, operated by paul@keymail.dev 2 weeks ago
a7ce3b523 Add unmounted canonical signup scope codec claude agent, operated by paul@keymail.dev 2 weeks ago
491428a2e Close registry handles owned by console test fixtures Paul Campbell 3 weeks ago
f71540f0d Test signup completion freshness and account helper callers Paul Campbell 3 weeks ago
47d5e8c1e Preserve signup birth evidence and immutable consent receipts claude agent, operated by paul@keymail.dev 3 weeks ago
eb2291399 fix(console): apply durable SQLite settings on every connection claude agent, operated by paul@keymail.dev 3 weeks ago
ed256537a Join listener closure and carry deterministic gate fixtures claude agent, operated by paul@keymail.dev 3 weeks ago
2e489fd1b Preserve lifecycle intent without enabling residency claude agent, operated by paul@keymail.dev 3 weeks ago
0797d9beb Refuse incomplete instance record sets before steering claude agent, operated by paul@keymail.dev 3 weeks ago
bbeefbc51 Add snapshot-only admission attempt observation claude agent, operated by paul@keymail.dev 3 weeks ago
ed7aa593b Integrate reviewed storage ownership, retry and buffered read bounds claude agent, operated by paul@keymail.dev 3 weeks ago
c2cc02e21 Bound each buffered storage read without capping whole sweeps claude agent, operated by paul@keymail.dev 3 weeks ago
8fe67311f Add inert resource budgets with consent-bound reservations and evidence holds claude agent, operated by paul@keymail.dev 3 weeks ago
fb0c6dfc2 Bound storage sweeps by midnight and verify conflicting publications claude agent, operated by paul@keymail.dev 3 weeks ago
2a40fed0b Integrate metering and opt-in checkpoints with canonical launch terms claude agent, operated by paul@keymail.dev 3 weeks ago
fc99f7fb6 Hold mixed-version invoice months for review and bound legacy catalogs claude agent, operated by paul@keymail.dev 3 weeks ago
78d95cc67 Bind preference state to versioned immutable receipt history claude agent, operated by paul@keymail.dev 3 weeks ago
a1177cde8 Make admission association deadline tests deterministic claude agent, operated by paul@keymail.dev 3 weeks ago
d504567a1 Pin historical partial invoice fixture to its original terms claude agent, operated by paul@keymail.dev 3 weeks ago
44cdddb85 Persist inert overage preferences with ordered immutable receipts claude agent, operated by paul@keymail.dev 3 weeks ago
7b14d6a5d Reuse reviewed CLI and socket fixture isolation for allowance gate claude agent, operated by paul@keymail.dev 3 weeks ago
5b1d7c02f Version approved pooled awake allowances and preserve historical terms claude agent, operated by paul@keymail.dev 3 weeks ago
1dea9cafa Retry final-hour storage collection and retain failed publications claude agent, operated by paul@keymail.dev 3 weeks ago
988a052e3 Reuse reviewed CLI and socket test isolation for storage gate claude agent, operated by paul@keymail.dev 3 weeks ago
b634c4481 Isolate CLI test configuration and record admission recovery checkpoint claude agent, operated by paul@keymail.dev 3 weeks ago
5d52edd19 Publish validated durability holds with fail-closed reader compatibility claude agent, operated by paul@keymail.dev 3 weeks ago
819634465 Recover admission journals while retaining the producer fence claude agent, operated by paul@keymail.dev 3 weeks ago
987f20c29 Associate durability attempts with their admitted requests claude agent, operated by paul@keymail.dev 3 weeks ago
0e5267fa8 Select explicit config fixtures in login flow tests claude agent, operated by paul@keymail.dev 3 weeks ago
c2311d03f Isolate API test configuration and shorten control socket fixtures claude agent, operated by paul@keymail.dev 3 weeks ago
1dc9a6c7b Retain admission cleanup ownership and close discovery races claude agent, operated by paul@keymail.dev 3 weeks ago
ef41648af Readiness and handoff: the design branch's tenth code review answered (3678b940) and Part C's fifth slice, the gate and the fleet, landed after it (358b25ee); eleventh review and a gate running; the gate on f11464ec passed claude agent, operated by paul@keymail.dev 3 weeks ago
358b25ee7 Plan Task 4's fifth slice: the gate and the fleet; the request gate returns an admission whose participants the middleware completes claude agent, operated by paul@keymail.dev 3 weeks ago
3678b940a Review ten answered: the listing directory retained across the handoff; one open uncertainty per fleet; closure closes what nothing else will; the latch's days dirtied when it clears; publication from the ledger's earliest day with explicit bounds; the configuration reader refuses what it cannot take; design revision 16 claude agent, operated by paul@keymail.dev 3 weeks ago
e90bfc7c5 Readiness and handoff: the design branch's ninth code review answered (a579d845) and Part C's fourth slice landed after it (f11464ec), tenth review and a gate running; the gate on c824ed81 failed on an unrelated activator test (amadan #206) claude agent, operated by paul@keymail.dev 3 weeks ago
f11464eca Plan Task 4's fourth slice: the fleet journal, construction backfill and root-first acknowledgement in the durability ledger claude agent, operated by paul@keymail.dev 3 weeks ago
a579d845e Review nine answered: holds, the latch and settlements are publication events; the snapshot reads again across a replay; a latch keeps its computed bound or is unresolved; replay closes on the settlement's test; the discovery instant floors closure; design revision 15 claude agent, operated by paul@keymail.dev 3 weeks ago
5a7ff0f82 Readiness and handoff: the design branch's eighth code review answered with Part C's second and third ledger slices (c824ed81, design revision 14), ninth review and a gate running; the gate on 47efe06f passed claude agent, operated by paul@keymail.dev 3 weeks ago
c824ed811 Review eight answered; plan Task 4's second and third slices (the barrier; discovery, the uncertainty and the latch); design revision 14 claude agent, operated by paul@keymail.dev 3 weeks ago
3aede1a61 Readiness and handoff: the design branch's seventh code review answered with Part C's first ledger slice (47efe06f), eighth review and a gate running; the gate on Task 3's tip passed claude agent, operated by paul@keymail.dev 3 weeks ago
47efe06f3 Review seven answered; Part C's first ledger slice: the root governing a resolved stack tracked across an absolute platform link, a later ascent re-pinning higher in that pin's ancestry and re-walking the link; what an acquisition holds released directory by directory to the resolved chain (authority.Result.Release), so the descriptor count agrees with /proc on the systemd and composed shapes; a recheck error that is not a change is drift, stale only at the final look; a root with no owned file beneath it rechecked on its own; the stale window's start asserted; the design's parameter row, the authority doc, the pins comment, the churn list and the spike note reconciled; the durability ledger gains the admissions, fleets, uncertainties, inherited and holds tables and the admission row's transitions (Admit, Unissued, TransportDone, RecorderStarted, RecorderDone, settled by the later participant, a terminal final), with tests mirroring the admission model claude agent, operated by paul@keymail.dev 3 weeks ago
620b66482 Readiness and handoff: the gate on the design branch's third slice passed; required coverage (plan Task 3) landed at f0ed32b7, its gate running; the seventh review running claude agent, operated by paul@keymail.dev 3 weeks ago
f0ed32b7b Required coverage (plan Task 3): RequiredDatabases (the registry this process has open, the console database when CONSOLE_DB names it; no role configuration exists on this branch to name a console box, recorded), each looked at through its root in fleetInventory with why it cannot be reached, an unreachable one a problem and, at a fleet build, the options' Hold told the instant before the build is refused; carlos ops inventory, the read-only command rendering the external replicator's configured list beside the platform replicator's inventory and the required databases' reachability claude agent, operated by paul@keymail.dev 3 weeks ago
7e233df7b Readiness and handoff: the design branch's sixth code review answered with the inventory's third slice (28e7f4d6), seventh review and a gate running claude agent, operated by paul@keymail.dev 3 weeks ago
28e7f4d61 Review six answered; inventory on retained descriptors, third slice: the fleet holds its pins and each owned file's retained chain for its life (fileFacts.keep, FleetInventory.Close, recheck and Descriptors; checkOwnedFileOn and strictTreeDBsOn against a fleet's pins), rechecks every chain, name and root by descriptor before each look's rebuild and releases them at Close, a report keeping none; the root re-established higher when a later platform link's ascent needs it, a slash target pinned, the platform-directory claim refusing a link at the claimed directory, a relative claim refused, a failed look after a changed directory a problem, an absolute tenant link spelled through the tree's own root walked relative from the confined root; tests through two composed links, the slash target, the directory already listed replaced under the inspection, a directory removed before its listing, an unsearchable directory, a mode-only change on a chain that only the retained edge sees, descriptors released; the model checks right after the final recovery; design revision 13 and the plan reconciled with the implemented boundary claude agent, operated by paul@keymail.dev 3 weeks ago
d43f9a22c Readiness and handoff: the gate on the design branch's second slice (cc1500a9) passed; the third slice (retained chains rechecked at every look) built in a tree copy, awaiting the sixth review claude agent, operated by paul@keymail.dev 3 weeks ago
3e77f818a Readiness and handoff: the design branch's fifth code review answered with the inventory's second slice (cc1500a9), sixth review and a gate running; the first slice's gate passed claude agent, operated by paul@keymail.dev 3 weeks ago
cc1500a90 Review five answered; inventory on retained descriptors, second slice: checkOwnedFile on the retained chain (the climb by ownership on Parent pointers, the directory above the top the platform's, every component acquired with O_NOFOLLOW, sidecars by Lookat), the root rule where the platform's authority ends (as many levels above a link's directory as its target ascends, the parent of the first non-platform component, an absolute platform-link target's parent pinned), the predicate's classes named (out of its platform root; a further link said before ownership), a directory changed under the look looked at again, a listing's per-entry errors, a pre-pin absent target as churn, resolvePlatformLinks, walkWithoutLinks, sqliteHeader and openRegularNoFollow retired, Facts.Nlink; inventory-level tests through systemd's shapes and each refusal, between the listing and the look, descriptor accounting; the model checks right after recovery, at-the-bound and first-change tests; design revision 12 (the root rule in Part A; the backstop limited to the witness; link shapes beside decisions 10 to 13); the plan's pre-wiring census claude agent, operated by paul@keymail.dev 3 weeks ago
26e571a68 Readiness and handoff: the design branch's fourth code review answered with design revision 11 and the inventory's first slice on retained descriptors (ccfd331a), fifth review running claude agent, operated by paul@keymail.dev 3 weeks ago
ccfd331ad Inventory on retained descriptors (plan Task 2, first slice): the fleet's pins (the pinned slash and a platform root per spelled directory, the parent of the first platform link's directory or of the spelled directory), the platform-link predicate on descriptors, strictTreeDBs walking Dirs with every link class named (may lead to a database, a link to a link, neither a file nor a directory, out of the tree by Within, cannot be looked at, a file in the tree skipped with its target, absent as churn), the pathname link look deleted; the owners tests keep their strings, three expectations move to the design's classes, and a link-class test covers each class and Astra 2's layout claude agent, operated by paul@keymail.dev 3 weeks ago
a26cba8e6 Review four answered; design revision 11: the historical term excludes only the empty terminals (unrecorded sent), the cutoff is the bound fixed before the rows are read, a look's start is the bound by what it observes rather than an order; the model's fixed cutoff, a later witness change, four tests; Within's early-result contract documented and guarded; the plan rewritten in terms of Within claude agent, operated by paul@keymail.dev 3 weeks ago
b86cb81bc Readiness and handoff: the design branch's third code review answered at 7ba5fc72 with design revision 10, fourth review running; the step-1 task plan on the branch claude agent, operated by paul@keymail.dev 3 weeks ago
7ba5fc728 Review three answered; design revision 10: the historical term's threshold is the earlier of the proof and the clean look, empty terminals excluded, and every look reads the witness and rechecks every chain first; the model gains a witness change the proof discovers, crash deduplication of a landed row, one row per token, seven tests; authority gains Result.Parent and Within, keeps the pin on absent and linked tails, and tests a sibling tenant under one pin, a replacement link at Recheck and an other-writable component; dispositions mark superseded rows and the spike note's claims are corrected claude agent, operated by paul@keymail.dev 3 weeks ago
36b4805c2 Plan: the replicator's authority as tasks (the roots a fleet pins, the predicate and the inventory on Dirs, required coverage, Part C's ledger changes after the model) claude agent, operated by paul@keymail.dev 3 weeks ago
10faaac25 Readiness and handoff: the design branch's second code review answered at 0a527924 with design revision 9 (the lower bound), third review running claude agent, operated by paul@keymail.dev 3 weeks ago
0a5279246 Review two answered; design revision 9: the uncertainty's lower bound also takes the admission instant of every admission settled at or after the last clean look's start (an in-flight request across a change, settled clean before the discovery, was outside it); the model's change is its own action discovered by a later look, a landed ambiguous row is durable at once, a per-step inheritance check, closed implies no unsettled admission, explicit quiescence, five new tests; authority reports the pin an absolute walk ended beneath, keeps the errno before a pin, and its tests distinguish Equal from Same, observe close-on-exec and count descriptors across refused opens, ancestry rewalks and Root.Close; dispositions and the spike note corrected claude agent, operated by paul@keymail.dev 3 weeks ago
236de5847 Readiness and handoff: the design branch's first code review answered at 50a6f056, second review running claude agent, operated by paul@keymail.dev 3 weeks ago
50a6f0561 Review one answered: authority gains Confine, Equal in Recheck and Child, slash as a pin, ErrLink for ELOOP too, OpenRoot's path rules, a Platform predicate over Facts, and tests for the tenant boundary, the retained-parent pop, chmod, a foreign-owned component and descriptor accounting; the model's protocol boundaries become separate actions with a send, the ancestry barrier stated from the chain, sticky terminals and closed-implies-no-latch, nine new tests; dispositions and the spike note corrected claude agent, operated by paul@keymail.dev 3 weeks ago
0bf0d3a4b Spike note: the fork's pathname entry points enumerated by reading every call (Part B's task list), grouped by the directory each must take claude agent, operated by paul@keymail.dev 3 weeks ago
5ef59a359 Handoff: a clock stamp corrected (the acceptance was about 08:05, not 08:35) claude agent, operated by paul@keymail.dev 3 weeks ago
ba930b3be Readiness and handoff: plan step 0's admission model and step 1's authority package built on the design branch (5bfcc7ba), under their first code reviews claude agent, operated by paul@keymail.dev 3 weeks ago
5bfcc7ba7 authority: retained directory descriptors (plan step 1, Part A): Dir with Child, List, Lookat, Readlink, OpenRegular, Recheck and Walk; Root by the platform walk from a pinned slash with its ancestry; the design's Part A tests; a link under O_DIRECTORY named as one; the walk's grammar refused before any system call claude agent, operated by paul@keymail.dev 3 weeks ago
f331b55a6 Spike: the admission protocol as an executable model (plan step 0): Part C's transition table, both holds, the latch and its replay, construction backfill, ancestry reach, root-first acknowledgement, helper death, the producer fence and recovery, with the design's named sequences as tests and randomised schedules under barrier, hazard, reach and liveness invariants; 30000 schedules pass; fourteen mutants killed claude agent, operated by paul@keymail.dev 3 weeks ago
6d37944cc Readiness and handoff at 08:35: the replicator's authority design accepted (review 8 confirmed revision 8 with no finding); plan step 0's admission model under test on the design branch claude agent, operated by paul@keymail.dev 3 weeks ago
76befb280 Readiness and handoff at 08:05: the replicator's authority design accepted with fixes at its seventh review; revision 8 applies them under a confirming eighth review claude agent, operated by paul@keymail.dev 3 weeks ago
8a877936b Design: the replicator's authority, revision 8 (the seventh review's fixes: a cancellation is conclusive only after the admission writer has returned and a fresh read finds no row; one pending-set contract; the restore wording limited to what the fork's verification chooses) claude agent, operated by paul@keymail.dev 3 weeks ago
ad8ea7472 Readiness and handoff: the clock times for the seventh review corrected (started 07:51, not 08:03) claude agent, operated by paul@keymail.dev 3 weeks ago
c50da9e4d Readiness and handoff at 08:05: the replicator's authority design at revision 7 under its seventh review claude agent, operated by paul@keymail.dev 3 weeks ago
20e7de04d Design: the replicator's authority, revision 7 (discovery replay reconciles the counted admissions' settlements before the overlay is cleared; the recorder participant registered at Start and a never-started one closed as unrecorded after proven helper exit; the abort transitions and the pending set's cleanup, ambiguous commits read back by token; the lineage record's crash-durable write protocol and a migration marker; the discovery mutex named as new; the restore statement limited; the companion's xAccess aligned) claude agent, operated by paul@keymail.dev 3 weeks ago
82707e426 Readiness and handoff at 07:45: the replicator's authority design at revision 6 under its sixth review claude agent, operated by paul@keymail.dev 3 weeks ago
bbcba64dd Design: the replicator's authority, revision 6 (proof and admission separated; one ordering point for the admission against discovery under the fleet's mutex; construction backfills the ancestry's intervals for new owners; the transition table authoritative with transport-lost and a recorder never synthesised; the binding's named invalidators; freshness as the looks give it; a terminal dot keeps the directory requirement; one definition per operation; required coverage its own plan step) claude agent, operated by paul@keymail.dev 3 weeks ago
8ae996758 Readiness and handoff at 07:25: the replicator's authority design at revision 5 under its fifth review claude agent, operated by paul@keymail.dev 3 weeks ago
0e8fc5037 Design: the replicator's authority, revision 5 (the helper's own per-inode lock bookkeeping; the fence shared with every helper and recovery as verified termination; a dead helper's admissions settled by the running agent; closure only with discoveries committed; reach over the unacknowledged ancestry with root-first acknowledgement; the sleeping binding's incarnation and direct freshness; a lineage of filesystem incarnation only; the walk's grammar kept; spike notes superseded where wrong) claude agent, operated by paul@keymail.dev 3 weeks ago
522b29ca0 Replicator authority: spike notes updated for the helper process, the same-process negative case and the transition model claude agent, operated by paul@keymail.dev 3 weeks ago
b91db67e0 Readiness and handoff at 07:10: the replicator's authority design at revision 4 under its fourth review claude agent, operated by paul@keymail.dev 3 weeks ago
d4d30de41 Design: the replicator's authority, revision 4 (the fork and its VFS in a helper process so the kernel coordinates locks; settlement by the last participant with a transition table; a pending-discovery latch for a failed uncertainty write; links at construction and transitive inheritance; a producer fence for recovery; closure at zero pending with the margin's day materialised; a sleeping route's binding and a coherent observation; a durable lineage record; walk anchors for absolute spellings) claude agent, operated by paul@keymail.dev 3 weeks ago
2736b8bf6 Readiness and handoff at 06:55: the replicator's authority design at revision 3 under its third review claude agent, operated by paul@keymail.dev 3 weeks ago
b62b435a5 Design: the replicator's authority, revision 3 (a VFS owning every file method; a barrier and an uncertainty, linked successors, recovery that terminates orphans; the retained stack for ascent, named-edge rechecks, repeatable listing, explicit link classes, the platform-link predicate kept apart; replication authority and lineage; a uid lifecycle from the unit observer; tests naming their events) claude agent, operated by paul@keymail.dev 3 weeks ago
ba681da0b Replicator authority: spike notes (the driver's VFS route; the admission as the existing Start commit moved before permission) claude agent, operated by paul@keymail.dev 3 weeks ago
2f524f089 Readiness and handoff at 06:40: the replicator's authority design at revision 2 under its second review claude agent, operated by paul@keymail.dev 3 weeks ago
65928b8e8 Design: the replicator's authority, revision 2 (retained descriptors instead of os.Root; a descriptor-rooted VFS instead of a /proc pathname; the admission as a row before the send with settlement, completeness waiting on it and successors acknowledging; owner holds as a ledger change with box-wide the default; claims by (account, app) and identity; a uid producer under the witness; tests named against the counterfactuals) claude agent, operated by paul@keymail.dev 3 weeks ago
523363326 Readiness, handoff and outstanding at 06:28: the replicator's authority design written and under review claude agent, operated by paul@keymail.dev 3 weeks ago
afd4dde02 Design: the replicator's authority (opens beneath pinned roots, litestream beneath the same roots, ownership state that survives exit, claims by identity), answering review twenty's eleven deferred findings with decisions 10-13 and approval H as parameters claude agent, operated by paul@keymail.dev 3 weeks ago
b71e6dd51 Readiness, handoff and outstanding at 06:22: the launch tip 8777d28e passed its gate and CI; the replicator's next design scoped claude agent, operated by paul@keymail.dev 3 weeks ago
8777d28e4 Task 5 and the records at 06:10: per-line tax codes merged; the ENABLEMENT activation rule keyed to freeze and the every-month tightening; OUTSTANDING item 17 built but inactive; readiness and handoff claude agent, operated by paul@keymail.dev 3 weeks ago
e2adf26f4 Merge per-line tax codes, the mechanics behind the hold (design-per-line-tax-codes at 12590e3a): three code reviews, both reviewers accepting at the third with its fixes made claude agent, operated by paul@keymail.dev 3 weeks ago
12590e3ab Per-line tax codes: the third review's fixes (a race test for the single read of a resumed finalize; the roll rule keyed to freeze; wording) claude agent, operated by paul@keymail.dev 3 weeks ago
1bda76a74 Decision 16: the design is at revision 6 claude agent, operated by paul@keymail.dev 3 weeks ago
6488c198f Per-line tax codes: the second code review answered (the resumed finalize validates the invoice it read; an empty split asks for no weights; the glue's guards and the apportionment review tested; the exact wrong-code recovery outcome and the in-window first-line replay; the one-line record frozen properly; wording) claude agent, operated by paul@keymail.dev 3 weeks ago
68b16c526 Decision 16: the mechanics are built behind the hold; activation switches freeze to the glue; revision 5 claude agent, operated by paul@keymail.dev 3 weeks ago
8715e4cd8 Per-line tax codes: the first code review answered (a resumed finalize validates the draft; the base commit's frozen records and engine hashes pinned; the activation glue, uncalled; wrong codes, the first line's loss, the older reader as a harness; the shape's waived branch; the mutants rerun) claude agent, operated by paul@keymail.dev 3 weeks ago
02e3538a0 Decision 16: the box side needs no change, activation is a reviewed change of its own, and 16d names the pass's conditions claude agent, operated by paul@keymail.dev 3 weeks ago