carlos / platform Public

`fix/carloku-sidecar-replication-owner-20261003`

Commits

e7ae03fed Retain process leases for root-replicated sidecars claude agent, operated by paul@keymail.dev 3 weeks ago
ed7aa593b Integrate reviewed storage ownership, retry and buffered read bounds claude agent, operated by paul@keymail.dev 3 weeks ago
c2cc02e21 Bound each buffered storage read without capping whole sweeps claude agent, operated by paul@keymail.dev 3 weeks ago
8fe67311f Add inert resource budgets with consent-bound reservations and evidence holds claude agent, operated by paul@keymail.dev 3 weeks ago
fb0c6dfc2 Bound storage sweeps by midnight and verify conflicting publications claude agent, operated by paul@keymail.dev 3 weeks ago
2a40fed0b Integrate metering and opt-in checkpoints with canonical launch terms claude agent, operated by paul@keymail.dev 3 weeks ago
fc99f7fb6 Hold mixed-version invoice months for review and bound legacy catalogs claude agent, operated by paul@keymail.dev 3 weeks ago
78d95cc67 Bind preference state to versioned immutable receipt history claude agent, operated by paul@keymail.dev 3 weeks ago
a1177cde8 Make admission association deadline tests deterministic claude agent, operated by paul@keymail.dev 3 weeks ago
d504567a1 Pin historical partial invoice fixture to its original terms claude agent, operated by paul@keymail.dev 3 weeks ago
44cdddb85 Persist inert overage preferences with ordered immutable receipts claude agent, operated by paul@keymail.dev 3 weeks ago
7b14d6a5d Reuse reviewed CLI and socket fixture isolation for allowance gate claude agent, operated by paul@keymail.dev 3 weeks ago
5b1d7c02f Version approved pooled awake allowances and preserve historical terms claude agent, operated by paul@keymail.dev 3 weeks ago
1dea9cafa Retry final-hour storage collection and retain failed publications claude agent, operated by paul@keymail.dev 3 weeks ago
988a052e3 Reuse reviewed CLI and socket test isolation for storage gate claude agent, operated by paul@keymail.dev 3 weeks ago
b634c4481 Isolate CLI test configuration and record admission recovery checkpoint claude agent, operated by paul@keymail.dev 3 weeks ago
5d52edd19 Publish validated durability holds with fail-closed reader compatibility claude agent, operated by paul@keymail.dev 3 weeks ago
819634465 Recover admission journals while retaining the producer fence claude agent, operated by paul@keymail.dev 3 weeks ago
987f20c29 Associate durability attempts with their admitted requests claude agent, operated by paul@keymail.dev 3 weeks ago
0e5267fa8 Select explicit config fixtures in login flow tests claude agent, operated by paul@keymail.dev 3 weeks ago
c2311d03f Isolate API test configuration and shorten control socket fixtures claude agent, operated by paul@keymail.dev 3 weeks ago
1dc9a6c7b Retain admission cleanup ownership and close discovery races claude agent, operated by paul@keymail.dev 3 weeks ago
ef41648af Readiness and handoff: the design branch's tenth code review answered (3678b940) and Part C's fifth slice, the gate and the fleet, landed after it (358b25ee); eleventh review and a gate running; the gate on f11464ec passed claude agent, operated by paul@keymail.dev 3 weeks ago
358b25ee7 Plan Task 4's fifth slice: the gate and the fleet; the request gate returns an admission whose participants the middleware completes claude agent, operated by paul@keymail.dev 3 weeks ago
3678b940a Review ten answered: the listing directory retained across the handoff; one open uncertainty per fleet; closure closes what nothing else will; the latch's days dirtied when it clears; publication from the ledger's earliest day with explicit bounds; the configuration reader refuses what it cannot take; design revision 16 claude agent, operated by paul@keymail.dev 3 weeks ago
e90bfc7c5 Readiness and handoff: the design branch's ninth code review answered (a579d845) and Part C's fourth slice landed after it (f11464ec), tenth review and a gate running; the gate on c824ed81 failed on an unrelated activator test (amadan #206) claude agent, operated by paul@keymail.dev 3 weeks ago
f11464eca Plan Task 4's fourth slice: the fleet journal, construction backfill and root-first acknowledgement in the durability ledger claude agent, operated by paul@keymail.dev 3 weeks ago
a579d845e Review nine answered: holds, the latch and settlements are publication events; the snapshot reads again across a replay; a latch keeps its computed bound or is unresolved; replay closes on the settlement's test; the discovery instant floors closure; design revision 15 claude agent, operated by paul@keymail.dev 3 weeks ago
5a7ff0f82 Readiness and handoff: the design branch's eighth code review answered with Part C's second and third ledger slices (c824ed81, design revision 14), ninth review and a gate running; the gate on 47efe06f passed claude agent, operated by paul@keymail.dev 3 weeks ago
c824ed811 Review eight answered; plan Task 4's second and third slices (the barrier; discovery, the uncertainty and the latch); design revision 14 claude agent, operated by paul@keymail.dev 3 weeks ago
3aede1a61 Readiness and handoff: the design branch's seventh code review answered with Part C's first ledger slice (47efe06f), eighth review and a gate running; the gate on Task 3's tip passed claude agent, operated by paul@keymail.dev 3 weeks ago
47efe06f3 Review seven answered; Part C's first ledger slice: the root governing a resolved stack tracked across an absolute platform link, a later ascent re-pinning higher in that pin's ancestry and re-walking the link; what an acquisition holds released directory by directory to the resolved chain (authority.Result.Release), so the descriptor count agrees with /proc on the systemd and composed shapes; a recheck error that is not a change is drift, stale only at the final look; a root with no owned file beneath it rechecked on its own; the stale window's start asserted; the design's parameter row, the authority doc, the pins comment, the churn list and the spike note reconciled; the durability ledger gains the admissions, fleets, uncertainties, inherited and holds tables and the admission row's transitions (Admit, Unissued, TransportDone, RecorderStarted, RecorderDone, settled by the later participant, a terminal final), with tests mirroring the admission model claude agent, operated by paul@keymail.dev 3 weeks ago
620b66482 Readiness and handoff: the gate on the design branch's third slice passed; required coverage (plan Task 3) landed at f0ed32b7, its gate running; the seventh review running claude agent, operated by paul@keymail.dev 3 weeks ago
f0ed32b7b Required coverage (plan Task 3): RequiredDatabases (the registry this process has open, the console database when CONSOLE_DB names it; no role configuration exists on this branch to name a console box, recorded), each looked at through its root in fleetInventory with why it cannot be reached, an unreachable one a problem and, at a fleet build, the options' Hold told the instant before the build is refused; carlos ops inventory, the read-only command rendering the external replicator's configured list beside the platform replicator's inventory and the required databases' reachability claude agent, operated by paul@keymail.dev 3 weeks ago
7e233df7b Readiness and handoff: the design branch's sixth code review answered with the inventory's third slice (28e7f4d6), seventh review and a gate running claude agent, operated by paul@keymail.dev 3 weeks ago
28e7f4d61 Review six answered; inventory on retained descriptors, third slice: the fleet holds its pins and each owned file's retained chain for its life (fileFacts.keep, FleetInventory.Close, recheck and Descriptors; checkOwnedFileOn and strictTreeDBsOn against a fleet's pins), rechecks every chain, name and root by descriptor before each look's rebuild and releases them at Close, a report keeping none; the root re-established higher when a later platform link's ascent needs it, a slash target pinned, the platform-directory claim refusing a link at the claimed directory, a relative claim refused, a failed look after a changed directory a problem, an absolute tenant link spelled through the tree's own root walked relative from the confined root; tests through two composed links, the slash target, the directory already listed replaced under the inspection, a directory removed before its listing, an unsearchable directory, a mode-only change on a chain that only the retained edge sees, descriptors released; the model checks right after the final recovery; design revision 13 and the plan reconciled with the implemented boundary claude agent, operated by paul@keymail.dev 3 weeks ago
d43f9a22c Readiness and handoff: the gate on the design branch's second slice (cc1500a9) passed; the third slice (retained chains rechecked at every look) built in a tree copy, awaiting the sixth review claude agent, operated by paul@keymail.dev 3 weeks ago
3e77f818a Readiness and handoff: the design branch's fifth code review answered with the inventory's second slice (cc1500a9), sixth review and a gate running; the first slice's gate passed claude agent, operated by paul@keymail.dev 3 weeks ago
cc1500a90 Review five answered; inventory on retained descriptors, second slice: checkOwnedFile on the retained chain (the climb by ownership on Parent pointers, the directory above the top the platform's, every component acquired with O_NOFOLLOW, sidecars by Lookat), the root rule where the platform's authority ends (as many levels above a link's directory as its target ascends, the parent of the first non-platform component, an absolute platform-link target's parent pinned), the predicate's classes named (out of its platform root; a further link said before ownership), a directory changed under the look looked at again, a listing's per-entry errors, a pre-pin absent target as churn, resolvePlatformLinks, walkWithoutLinks, sqliteHeader and openRegularNoFollow retired, Facts.Nlink; inventory-level tests through systemd's shapes and each refusal, between the listing and the look, descriptor accounting; the model checks right after recovery, at-the-bound and first-change tests; design revision 12 (the root rule in Part A; the backstop limited to the witness; link shapes beside decisions 10 to 13); the plan's pre-wiring census claude agent, operated by paul@keymail.dev 3 weeks ago
26e571a68 Readiness and handoff: the design branch's fourth code review answered with design revision 11 and the inventory's first slice on retained descriptors (ccfd331a), fifth review running claude agent, operated by paul@keymail.dev 3 weeks ago
ccfd331ad Inventory on retained descriptors (plan Task 2, first slice): the fleet's pins (the pinned slash and a platform root per spelled directory, the parent of the first platform link's directory or of the spelled directory), the platform-link predicate on descriptors, strictTreeDBs walking Dirs with every link class named (may lead to a database, a link to a link, neither a file nor a directory, out of the tree by Within, cannot be looked at, a file in the tree skipped with its target, absent as churn), the pathname link look deleted; the owners tests keep their strings, three expectations move to the design's classes, and a link-class test covers each class and Astra 2's layout claude agent, operated by paul@keymail.dev 3 weeks ago
a26cba8e6 Review four answered; design revision 11: the historical term excludes only the empty terminals (unrecorded sent), the cutoff is the bound fixed before the rows are read, a look's start is the bound by what it observes rather than an order; the model's fixed cutoff, a later witness change, four tests; Within's early-result contract documented and guarded; the plan rewritten in terms of Within claude agent, operated by paul@keymail.dev 3 weeks ago
b86cb81bc Readiness and handoff: the design branch's third code review answered at 7ba5fc72 with design revision 10, fourth review running; the step-1 task plan on the branch claude agent, operated by paul@keymail.dev 3 weeks ago
7ba5fc728 Review three answered; design revision 10: the historical term's threshold is the earlier of the proof and the clean look, empty terminals excluded, and every look reads the witness and rechecks every chain first; the model gains a witness change the proof discovers, crash deduplication of a landed row, one row per token, seven tests; authority gains Result.Parent and Within, keeps the pin on absent and linked tails, and tests a sibling tenant under one pin, a replacement link at Recheck and an other-writable component; dispositions mark superseded rows and the spike note's claims are corrected claude agent, operated by paul@keymail.dev 3 weeks ago
36b4805c2 Plan: the replicator's authority as tasks (the roots a fleet pins, the predicate and the inventory on Dirs, required coverage, Part C's ledger changes after the model) claude agent, operated by paul@keymail.dev 3 weeks ago
10faaac25 Readiness and handoff: the design branch's second code review answered at 0a527924 with design revision 9 (the lower bound), third review running claude agent, operated by paul@keymail.dev 3 weeks ago
0a5279246 Review two answered; design revision 9: the uncertainty's lower bound also takes the admission instant of every admission settled at or after the last clean look's start (an in-flight request across a change, settled clean before the discovery, was outside it); the model's change is its own action discovered by a later look, a landed ambiguous row is durable at once, a per-step inheritance check, closed implies no unsettled admission, explicit quiescence, five new tests; authority reports the pin an absolute walk ended beneath, keeps the errno before a pin, and its tests distinguish Equal from Same, observe close-on-exec and count descriptors across refused opens, ancestry rewalks and Root.Close; dispositions and the spike note corrected claude agent, operated by paul@keymail.dev 3 weeks ago
236de5847 Readiness and handoff: the design branch's first code review answered at 50a6f056, second review running claude agent, operated by paul@keymail.dev 3 weeks ago
50a6f0561 Review one answered: authority gains Confine, Equal in Recheck and Child, slash as a pin, ErrLink for ELOOP too, OpenRoot's path rules, a Platform predicate over Facts, and tests for the tenant boundary, the retained-parent pop, chmod, a foreign-owned component and descriptor accounting; the model's protocol boundaries become separate actions with a send, the ancestry barrier stated from the chain, sticky terminals and closed-implies-no-latch, nine new tests; dispositions and the spike note corrected claude agent, operated by paul@keymail.dev 3 weeks ago
0bf0d3a4b Spike note: the fork's pathname entry points enumerated by reading every call (Part B's task list), grouped by the directory each must take claude agent, operated by paul@keymail.dev 3 weeks ago
5ef59a359 Handoff: a clock stamp corrected (the acceptance was about 08:05, not 08:35) claude agent, operated by paul@keymail.dev 3 weeks ago
ba930b3be Readiness and handoff: plan step 0's admission model and step 1's authority package built on the design branch (5bfcc7ba), under their first code reviews claude agent, operated by paul@keymail.dev 3 weeks ago
5bfcc7ba7 authority: retained directory descriptors (plan step 1, Part A): Dir with Child, List, Lookat, Readlink, OpenRegular, Recheck and Walk; Root by the platform walk from a pinned slash with its ancestry; the design's Part A tests; a link under O_DIRECTORY named as one; the walk's grammar refused before any system call claude agent, operated by paul@keymail.dev 3 weeks ago
f331b55a6 Spike: the admission protocol as an executable model (plan step 0): Part C's transition table, both holds, the latch and its replay, construction backfill, ancestry reach, root-first acknowledgement, helper death, the producer fence and recovery, with the design's named sequences as tests and randomised schedules under barrier, hazard, reach and liveness invariants; 30000 schedules pass; fourteen mutants killed claude agent, operated by paul@keymail.dev 3 weeks ago
6d37944cc Readiness and handoff at 08:35: the replicator's authority design accepted (review 8 confirmed revision 8 with no finding); plan step 0's admission model under test on the design branch claude agent, operated by paul@keymail.dev 3 weeks ago
76befb280 Readiness and handoff at 08:05: the replicator's authority design accepted with fixes at its seventh review; revision 8 applies them under a confirming eighth review claude agent, operated by paul@keymail.dev 3 weeks ago
8a877936b Design: the replicator's authority, revision 8 (the seventh review's fixes: a cancellation is conclusive only after the admission writer has returned and a fresh read finds no row; one pending-set contract; the restore wording limited to what the fork's verification chooses) claude agent, operated by paul@keymail.dev 3 weeks ago
ad8ea7472 Readiness and handoff: the clock times for the seventh review corrected (started 07:51, not 08:03) claude agent, operated by paul@keymail.dev 3 weeks ago
c50da9e4d Readiness and handoff at 08:05: the replicator's authority design at revision 7 under its seventh review claude agent, operated by paul@keymail.dev 3 weeks ago
20e7de04d Design: the replicator's authority, revision 7 (discovery replay reconciles the counted admissions' settlements before the overlay is cleared; the recorder participant registered at Start and a never-started one closed as unrecorded after proven helper exit; the abort transitions and the pending set's cleanup, ambiguous commits read back by token; the lineage record's crash-durable write protocol and a migration marker; the discovery mutex named as new; the restore statement limited; the companion's xAccess aligned) claude agent, operated by paul@keymail.dev 3 weeks ago
82707e426 Readiness and handoff at 07:45: the replicator's authority design at revision 6 under its sixth review claude agent, operated by paul@keymail.dev 3 weeks ago
bbcba64dd Design: the replicator's authority, revision 6 (proof and admission separated; one ordering point for the admission against discovery under the fleet's mutex; construction backfills the ancestry's intervals for new owners; the transition table authoritative with transport-lost and a recorder never synthesised; the binding's named invalidators; freshness as the looks give it; a terminal dot keeps the directory requirement; one definition per operation; required coverage its own plan step) claude agent, operated by paul@keymail.dev 3 weeks ago
8ae996758 Readiness and handoff at 07:25: the replicator's authority design at revision 5 under its fifth review claude agent, operated by paul@keymail.dev 3 weeks ago
0e8fc5037 Design: the replicator's authority, revision 5 (the helper's own per-inode lock bookkeeping; the fence shared with every helper and recovery as verified termination; a dead helper's admissions settled by the running agent; closure only with discoveries committed; reach over the unacknowledged ancestry with root-first acknowledgement; the sleeping binding's incarnation and direct freshness; a lineage of filesystem incarnation only; the walk's grammar kept; spike notes superseded where wrong) claude agent, operated by paul@keymail.dev 3 weeks ago
522b29ca0 Replicator authority: spike notes updated for the helper process, the same-process negative case and the transition model claude agent, operated by paul@keymail.dev 3 weeks ago
b91db67e0 Readiness and handoff at 07:10: the replicator's authority design at revision 4 under its fourth review claude agent, operated by paul@keymail.dev 3 weeks ago
d4d30de41 Design: the replicator's authority, revision 4 (the fork and its VFS in a helper process so the kernel coordinates locks; settlement by the last participant with a transition table; a pending-discovery latch for a failed uncertainty write; links at construction and transitive inheritance; a producer fence for recovery; closure at zero pending with the margin's day materialised; a sleeping route's binding and a coherent observation; a durable lineage record; walk anchors for absolute spellings) claude agent, operated by paul@keymail.dev 3 weeks ago
2736b8bf6 Readiness and handoff at 06:55: the replicator's authority design at revision 3 under its third review claude agent, operated by paul@keymail.dev 3 weeks ago
b62b435a5 Design: the replicator's authority, revision 3 (a VFS owning every file method; a barrier and an uncertainty, linked successors, recovery that terminates orphans; the retained stack for ascent, named-edge rechecks, repeatable listing, explicit link classes, the platform-link predicate kept apart; replication authority and lineage; a uid lifecycle from the unit observer; tests naming their events) claude agent, operated by paul@keymail.dev 3 weeks ago
ba681da0b Replicator authority: spike notes (the driver's VFS route; the admission as the existing Start commit moved before permission) claude agent, operated by paul@keymail.dev 3 weeks ago
2f524f089 Readiness and handoff at 06:40: the replicator's authority design at revision 2 under its second review claude agent, operated by paul@keymail.dev 3 weeks ago
65928b8e8 Design: the replicator's authority, revision 2 (retained descriptors instead of os.Root; a descriptor-rooted VFS instead of a /proc pathname; the admission as a row before the send with settlement, completeness waiting on it and successors acknowledging; owner holds as a ledger change with box-wide the default; claims by (account, app) and identity; a uid producer under the witness; tests named against the counterfactuals) claude agent, operated by paul@keymail.dev 3 weeks ago
523363326 Readiness, handoff and outstanding at 06:28: the replicator's authority design written and under review claude agent, operated by paul@keymail.dev 3 weeks ago
afd4dde02 Design: the replicator's authority (opens beneath pinned roots, litestream beneath the same roots, ownership state that survives exit, claims by identity), answering review twenty's eleven deferred findings with decisions 10-13 and approval H as parameters claude agent, operated by paul@keymail.dev 3 weeks ago
b71e6dd51 Readiness, handoff and outstanding at 06:22: the launch tip 8777d28e passed its gate and CI; the replicator's next design scoped claude agent, operated by paul@keymail.dev 3 weeks ago
8777d28e4 Task 5 and the records at 06:10: per-line tax codes merged; the ENABLEMENT activation rule keyed to freeze and the every-month tightening; OUTSTANDING item 17 built but inactive; readiness and handoff claude agent, operated by paul@keymail.dev 3 weeks ago
e2adf26f4 Merge per-line tax codes, the mechanics behind the hold (design-per-line-tax-codes at 12590e3a): three code reviews, both reviewers accepting at the third with its fixes made claude agent, operated by paul@keymail.dev 3 weeks ago
12590e3ab Per-line tax codes: the third review's fixes (a race test for the single read of a resumed finalize; the roll rule keyed to freeze; wording) claude agent, operated by paul@keymail.dev 3 weeks ago
1bda76a74 Decision 16: the design is at revision 6 claude agent, operated by paul@keymail.dev 3 weeks ago
6488c198f Per-line tax codes: the second code review answered (the resumed finalize validates the invoice it read; an empty split asks for no weights; the glue's guards and the apportionment review tested; the exact wrong-code recovery outcome and the in-window first-line replay; the one-line record frozen properly; wording) claude agent, operated by paul@keymail.dev 3 weeks ago
68b16c526 Decision 16: the mechanics are built behind the hold; activation switches freeze to the glue; revision 5 claude agent, operated by paul@keymail.dev 3 weeks ago
8715e4cd8 Per-line tax codes: the first code review answered (a resumed finalize validates the draft; the base commit's frozen records and engine hashes pinned; the activation glue, uncalled; wrong codes, the first line's loss, the older reader as a harness; the shape's waived branch; the mutants rerun) claude agent, operated by paul@keymail.dev 3 weeks ago
02e3538a0 Decision 16: the box side needs no change, activation is a reviewed change of its own, and 16d names the pass's conditions claude agent, operated by paul@keymail.dev 3 weeks ago
891211b60 Readiness and handoff at 05:05: the per-line tax codes branch built and under its first code review claude agent, operated by paul@keymail.dev 3 weeks ago
61313bec8 Dispositions for per-line tax codes: the three design rounds and the build claude agent, operated by paul@keymail.dev 3 weeks ago
598a81e27 Per-line tax codes: the lost-answer test covers replay inside the window and recovery past it claude agent, operated by paul@keymail.dev 3 weeks ago
24387f8f6 Per-line tax codes, Task 4: the lifecycle of a two-code record and the older reader claude agent, operated by paul@keymail.dev 3 weeks ago
00f70d0ef Per-line tax codes, Task 3: attribution and apportionment, built behind the hold claude agent, operated by paul@keymail.dev 3 weeks ago
510bbb7d9 Per-line tax codes, Task 2: the tax shape, a line's own request and operation identity, the three metadata checks claude agent, operated by paul@keymail.dev 3 weeks ago
b04d84624 Per-line tax codes, Task 1: a line may carry its own tax code, and the allowance names its spans claude agent, operated by paul@keymail.dev 3 weeks ago
6d0d37192 Design: per-line tax codes, revision 4 (the month-end answer adds no daily-data requirement and partly covered months keep theirs under either; the waiver and the nonterminal-record qualifications) claude agent, operated by paul@keymail.dev 3 weeks ago
5429b6906 Per-line tax codes, Task 0: today's calculation bytes, digests and request hashes pinned as literals before any change claude agent, operated by paul@keymail.dev 3 weeks ago
e4d2110e5 Plan: per-line tax codes, the mechanics (seven tasks; Task 0 pins today's bytes before any change) claude agent, operated by paul@keymail.dev 3 weeks ago
1db5bcf02 Design: per-line tax codes, revision 3 (the daily-data requirement confined to two-code whole months under the split answer; the line identity checked on the POST answer and the draft; the transfer arithmetic in the month's own order; the roll rule's rollback note; the next pass's conditions) claude agent, operated by paul@keymail.dev 3 weeks ago
27419dcff Decision 16: the four refinements its design review found are choices too (16a-16d) claude agent, operated by paul@keymail.dev 3 weeks ago
663702659 Design: per-line tax codes, revision 2 (line identity in the invoice engine, eligibility before attribution, five meters to four axes, exact apportionment, the older worker's review and the roll rule, held months by the operator door, 16a-16d as the owner's) claude agent, operated by paul@keymail.dev 3 weeks ago
134ab7702 Readiness and handoff at 02:20: the launch tip 29ea6676 passed its gate and CI; the per-line tax codes design under review claude agent, operated by paul@keymail.dev 3 weeks ago
fe374c5e9 Design: per-line tax codes for a month in which the plan changed (OUTSTANDING 17; the mechanics either answer to decision 16 needs, the hold kept until the answer) claude agent, operated by paul@keymail.dev 3 weeks ago
29ea6676d Readiness, handoff and outstanding at 02:12: the operator CLI merged; the demo on 41881 rebuilt from the integrated branch claude agent, operated by paul@keymail.dev 3 weeks ago
1cd5a0d8f Merge the billing operator CLI (feat/carloku-billing-operator-cli-20261002 at fc7daebd): carlos billing, a client for the four operator doors; four reviews, the last two both accept with fixes answered claude agent, operated by paul@keymail.dev 3 weeks ago