carlos / platform Public

`moves-phase1`

Commits

e9d7e7638 Merge origin/main (76b1400f, changelog v0.25.0) into moves-phase1 claude agent, operated by paul@keymail.dev 2 weeks ago
cdb002ee8 Merge origin/main (289043db, changelog) into moves-phase1 claude agent, operated by paul@keymail.dev 2 weeks ago
9872b46af Final fix 1: T7 re-verifies the live link under the publication's lock claude agent, operated by paul@keymail.dev 2 weeks ago
5efb1617a Final fix 3: held refusals get their own namespace claude agent, operated by paul@keymail.dev 2 weeks ago
af4319460 Final fix 2: Ready refuses a database grown past the size the target priced claude agent, operated by paul@keymail.dev 2 weeks ago
13a42e9f0 Final fix 4: refuse S3's mutable "null" version id in staging claude agent, operated by paul@keymail.dev 2 weeks ago
b65dcedbb D3-held fix round 1: bind inside the publication with a re-hash at the swap; move-scoped held refusals claude agent, operated by paul@keymail.dev 2 weeks ago
c634951b7 D3-held: the held stage applies D3's proof check as adoption does, and fails closed claude agent, operated by paul@keymail.dev 2 weeks ago
5d7595226 copy gate fix round 5: error text through helpers and string fields, the scan base from git merge-base claude agent, operated by paul@keymail.dev 2 weeks ago
804623c23 Merge origin/main (3407d114, claim C5/C7) into moves-phase1 claude agent, operated by paul@keymail.dev 2 weeks ago
e801e3138 Merge origin/main (cbc0922e, claim Plans 8/8b) into moves-phase1 claude agent, operated by paul@keymail.dev 2 weeks ago
f7a245309 copy gate fix round 4: no error text in a placeholder, field-read limits propagate, multi-value field writes, closure aliases, shadowed receivers claude agent, operated by paul@keymail.dev 2 weeks ago
e742cd310 copy gate fix round 3: the checker fails closed claude agent, operated by paul@keymail.dev 2 weeks ago
227e3a3f3 leasetest: the fake S3 server validates PUT bodies as real S3 does claude agent, operated by paul@keymail.dev 2 weeks ago
c65b3189c host: a round promotes or requests a cut only when its own published source report passed (Task 14 fix round 3) claude agent, operated by paul@keymail.dev 2 weeks ago
0e26010fe copy gate fix round 2: a local is a sentence only if every assignment is, helpers and parameters are checked to their returns and call sites, mapping helpers, notes out of the row text claude agent, operated by paul@keymail.dev 2 weeks ago
8358c0a09 copy gate fix round 1: testdata out of the file inventory, sinks must take readable sentences, whole-sentence matching, placeholder text from one expression claude agent, operated by paul@keymail.dev 2 weeks ago
951888980 moves: S1 sends the declared readiness path verbatim; archive and budget errors reach reports only as recorded sentences (Task 14 fix round 2) claude agent, operated by paul@keymail.dev 2 weeks ago
a3a70d455 moves: readiness takes only evidence that holds: the logical DB size, no report on an archive retry, the checked release, S1 from the instance itself (Task 14 fix round 1) claude agent, operated by paul@keymail.dev 2 weeks ago
c2312e732 copy gate for the moves series: the pinned inventory, the ship check (§20) claude agent, operated by paul@keymail.dev 2 weeks ago
214539f46 hostbox, genselect: name moves.ReplicaSource as a twin of the generation prefix rule (F28(d)) claude agent, operated by paul@keymail.dev 2 weeks ago
05fdae5e1 host: preparing and ready rounds on the per-operation staging layout, under the staging lease (§7.3) claude agent, operated by paul@keymail.dev 2 weeks ago
81184b910 activator: per-host gates serialise a host's group; the global lock guards only the map (Task 7b fix round 3) claude agent, operated by paul@keymail.dev 2 weeks ago
b1c27d87a moves: ReplicaSource, MirrorPrefixKeep, the archive's entries in the T11 budget; edge: ServeUncached (§7.3) claude agent, operated by paul@keymail.dev 2 weeks ago
5832a73fa activator: a strict handle owns its host's group until its cleanup succeeds (Task 7b fix round 2) claude agent, operated by paul@keymail.dev 2 weeks ago
dfeee6273 moves: S2 runs PrepareStrict's own preflight, held publication rechecks its authority under the frozen holds, failed strict cleanup is retried (Task 7b fix round 1) claude agent, operated by paul@keymail.dev 2 weeks ago
f0e760a4a moves: one activation guard, both locks, every rename and finish; contention defers, never activates unlocked (Task 13 fix round 3) claude agent, operated by paul@keymail.dev 2 weeks ago
e7eedf626 appconfig.RenderHeld, release.MaterializeHeld, strict spawns under a move (§9.1, §9.2, §5.3) claude agent, operated by paul@keymail.dev 2 weeks ago
d15c62ff5 moves: every activation and every forward finish checks under floor.lock with the holds frozen; refused steps put the root passes back (Task 13 fix round 2) claude agent, operated by paul@keymail.dev 2 weeks ago
c35b9b056 moves: the floor holds across staging, forward recovery, concurrent refreshes and a crash (Task 13 fix round 1) claude agent, operated by paul@keymail.dev 2 weeks ago
3a64ac1a5 moves: the protocol floor armed on disk and enforced at executable selection; edges file publishes moves_protocol, the armed floor and prev_release (§11) claude agent, operated by paul@keymail.dev 2 weeks ago
924d3132c moves/archive: Verify and Extract share one set of stream rules (Task 7 fix round 2) claude agent, operated by paul@keymail.dev 2 weeks ago
e068c5370 moves/archive: no hard links, no marker subtree, scoped durability after modes (Task 7 fix round 1) claude agent, operated by paul@keymail.dev 2 weeks ago
2830956ff moves: report timestamps are bounded in the future too (Task 11 fix round 2) claude agent, operated by paul@keymail.dev 2 weeks ago
3fca22d13 moves: Ready re-checks the budget's evidence itself (Task 11 fix round 1) claude agent, operated by paul@keymail.dev 2 weeks ago
ce959e105 console: the gate copy tables are functions, not package variables (Task 4 fix round 3) claude agent, operated by paul@keymail.dev 2 weeks ago
91d0326f6 moves/archive: the deterministic tar+zstd files archive, sealed by the config keypair (§8) claude agent, operated by paul@keymail.dev 2 weeks ago
a81caec40 registry: Upsert never changes hold_op on conflict; fingerprints see it (Task 12 fix round 1) claude agent, operated by paul@keymail.dev 2 weeks ago
95e3d459c moves: readiness reports T1 to T12, S1, S2, the measured T11 budget and the promotion rule (§7.3) claude agent, operated by paul@keymail.dev 2 weeks ago
6b3fd9358 moves: T3 rejects a target-only layout variable off the flat layout; test diagnostics name keys, never values (Task 9 fix round 1) claude agent, operated by paul@keymail.dev 2 weeks ago
82c58a8c3 console: the Phase 1 move door speaks its own gate sentences (Task 4 fix round 2) claude agent, operated by paul@keymail.dev 2 weeks ago
8437004cc registry: hold_op, SetHold and the conditional ReleaseHold (moves §5.2) claude agent, operated by paul@keymail.dev 2 weeks ago
32509bba8 moves: the HMAC launch report and T3's comparison; activator: LaunchEnvironment (§7.3) claude agent, operated by paul@keymail.dev 2 weeks ago
58e6c49ed moves: the T11 budget refuses negative, NaN and infinite inputs (Task 10 fix round 1) claude agent, operated by paul@keymail.dev 2 weeks ago
71026be5c moves: DecodeTimers refuses any snapshot version but 1; golden digests pin the canonical bytes (Task 8 fix round 1) claude agent, operated by paul@keymail.dev 2 weeks ago
430298dbe moves: the T11 budget arithmetic, ported from the model (§7.3, §7.4) claude agent, operated by paul@keymail.dev 2 weeks ago
b797a1d02 moves: the timers snapshot and the canonical digest (§9.4) claude agent, operated by paul@keymail.dev 2 weeks ago
336e14e0d moves: staging mirror fails closed on a missing version id and never follows a redirect; the guard rejects a negative or overflowing skew (Task 6 fix round 1) claude agent, operated by paul@keymail.dev 2 weeks ago
6070cdff9 console: move door fix round 1 (Task 4 review) claude agent, operated by paul@keymail.dev 2 weeks ago
87eb74762 moves: the staging-work lease (45 min TTL) and the SafeUntil guard; lease: AcquireTTL and the single-signature staging mirror (§7.3) claude agent, operated by paul@keymail.dev 2 weeks ago
f504d9262 moves: per-operation staging keys; lease: copies record their destination version ids (§7.3) claude agent, operated by paul@keymail.dev 2 weeks ago
2cfd51fe9 moves plans: C5 adoption is the #232 backfill only (claim Plan 5 rev 2) claude agent, operated by paul@keymail.dev 2 weeks ago
5b3847e82 console: the move request door is operator-only and CASes the claim to moving (§7.1, §12, K2) claude agent, operated by paul@keymail.dev 2 weeks ago
c6bfe4a56 hostclaim: BeginMove, Touch, ReleaseMove and the replay rule (moves K2, K8, K12) claude agent, operated by paul@keymail.dev 2 weeks ago
20df68018 provision: the move journal of spec §7.2; MoveStart beside MoveRequest, guarded transitions beside the legacy ones claude agent, operated by paul@keymail.dev 2 weeks ago
59f612f26 moves: operation ids, the Check result type and the protocol floor types (spec §3, §11) claude agent, operated by paul@keymail.dev 2 weeks ago
b8c547f79 moves: the serve() wiring test checks the config identity and call order claude agent, operated by paul@keymail.dev 2 weeks ago
b09e1d34d moves: the Phase 1 switch, off by default (index D13) claude agent, operated by paul@keymail.dev 2 weeks ago
c17f39d5a Merge origin/main (84c80eba, build fix) into moves-phase1 claude agent, operated by paul@keymail.dev 2 weeks ago
a6c4402fb Merge origin/main into moves-phase1 claude agent, operated by paul@keymail.dev 2 weeks ago
fbdad3813 plans: Plan 1 rev 7 (the round-6 Plan 1 review's 9 findings): reader fields in Task 4 and Task 12 before 7b in the build order; boxidtest without the import cycle; preparing-stage authority from the claim and SourceReport.Release, with the hardened-box relay test; the carlos.prev.allowed verdict compared by cmp in ExecStart (no % or $), judged in Go by ReleaseAtOrAbove and withheld under a hold; activationAllowed covers every activating downgrade; Open requires EOF after the final chunk; shadowing collected where the carried .env overrides the rendered config; commit boundaries aligned; index D3, D4 and the cache rule corrected claude agent, operated by paul@keymail.dev 2 weeks ago
be14f2dd0 plans: claim Plan 6 is on main (d649d8d4): Plan 1 imports provision.MoveInputs and defines nothing shared; Plans 2 and 3 import InstallManifest and ErrAttemptOver; build target main at d649d8d4 or later; C1-C4 marked landed in the contract table; main line numbers re-checked at d649d8d4 claude agent, operated by paul@keymail.dev 2 weeks ago
296807a2a plans: Plan 1 rev 6 (the round-5 Plan 1 review's 14 findings): no undefined or duplicate identifiers in the task sequence (floor.go and check.go in Task 1, InstanceStoreEnv in provision, MoveGuardedCut(g)); the root staging relay validates every request component and asks heldStageAuthority before any filesystem effect; the floor is armed on disk by root before staging and enforced at executable selection by the units (prev_ok over carlos.prev.version), with the door admitting only boxes whose edges files show the armed floor and a prev_release at or above it; the dormant boundary is the floor object, not the switch; StageBlocked reused; production-shaped fleet fixtures via boxidtest; the source bound to the claim's executor; multipart receipts carry versions; Ready matches input identities; RequireReleasedMove for the abort replay; no dir-store lease fallback; Verify releases its producer; commit file sets complete claude agent, operated by paul@keymail.dev 2 weeks ago
e1d7c3f1b spec rev 7.22 (joint round 19, R19-1): the prepared files manifest is placed under and bound to the installation's prepared destination generation (g-<move id>, or g-<rollback id> for a dirty return), never holder.generation, which stays the source's until admission; install.json keys named (snapshot_txid for N); Plan 2 Task 10 local step (6) and Task 8 match; index C8 claude agent, operated by paul@keymail.dev 2 weeks ago
0a4cadd10 plans: install.json carries claim Plan 6's snake_case keys (v, op, host, n or snapshot_txid, snapshot_*, anchor_*, integrity_check, db_sha256, built_at); Plan 2 Task 8 expects and tests them; spec §7.6 to name them at the round-19 touch claude agent, operated by paul@keymail.dev 2 weeks ago
b78b3278c plans: shared contract types with claim Plan 6 Task 6 (feat/hostclaim-box bf63e250): moves.InstallManifest, moves.ErrAttemptOver and provision.MoveInputs are imported, not redefined, when their contract file is on main; shapes verified identical; index table claude agent, operated by paul@keymail.dev 2 weeks ago
80647eeb9 plans: Plan 1 rev 5 (the round-4 Plan 1 review's 15 findings): selectMoveBoxes composes every input of eligibleBoxes/chooseBox; moves.Check in Task 1; the guard hands the signer its own timestamp; ReplicaSource normalizes the claim location; the hold-prev marker covers the units' direct carlos.prev exec; T7 relays through the root stage pass and the floor file moves under /data; s3Mirror stays unversioned; Verify hashes the decoded tar and drains to Open's verdict; valid claim fixtures and a plain-PUT leasetest server; advisory CARLOS_PURGE; ServeUncached for S1; LoadMergedHostVersions and SourceReport.Archive; the store binding, not the policy; inventory M-C1..M-C22; D9 and Task 14 reconciled with D13 claude agent, operated by paul@keymail.dev 2 weeks ago
819c8d067 spec rev 7.21 (joint round 18): the prepared files manifest mirrors claim rev 6.30 (73b1b9dc; R18-1), "before its flip" is before the record enters landing through the flip CAS (R18-2), M-C22 promises retained data and pending recovery, not zero loss (R18-4); Plan 2 Task 10 local step (6); index C8 names the prepared-manifest build claude agent, operated by paul@keymail.dev 2 weeks ago
d09077470 plans: the Plan 1 review findings (round 3), committed unedited claude agent, operated by paul@keymail.dev 2 weeks ago
644fd1770 plans: Plan 1 rev 4 (the Plan 1 review's 14 findings): the switch lands first and off keeps the legacy path; MoveGuard from Task 2; SigV4 signing by hand; plain mirroring kept; the source copy bound to the claim's generation; one guarded write path; archive Verify and exact modes; agentOwnedVars composition; hold_op before the floor; chooseBox and the one-box refusal; RenderHeld, MaterializeHeld and strict spawns in Plan 1 claude agent, operated by paul@keymail.dev 2 weeks ago
cc30c2bf5 spec rev 7.20 (claim rev 6.28: the fence reference, the pre-flip source conversion to relocating, L13 files manifest, one-box scope); model: fence-converts-moving and wFenceConvertsMoving; plans: contract owners, D15, D16 claude agent, operated by paul@keymail.dev 2 weeks ago
d5716bf4b spec rev 7.19 (P7 cold-only, region HA L14 to L17 folded, L18 stated as a limit); plans rev 3 (review round 2, 25 findings and the round-1 partials) claude agent, operated by paul@keymail.dev 2 weeks ago
da2832aa6 plans: moves Phase 1 review round 1 (Astra on 616f2499): all 32 findings fixed, findings committed unedited claude agent, operated by paul@keymail.dev 2 weeks ago
6b1a52af7 plans: moves Phase 1 self-review fixes (private storage from the manifest, console edges struct name, ErrNoCgroup, create-only Put, local park destination, operator test helper) claude agent, operated by paul@keymail.dev 2 weeks ago
616f24991 plans: moves Phase 1 implementation plans 0 to 7 (spec rev 7.18 a4711728, main 67547f5) claude agent, operated by paul@keymail.dev 2 weeks ago
a47117287 spec: move-any-app rev 7.18, joint round 17's two P3s claude agent, operated by paul@keymail.dev 2 weeks ago
9c417aaa6 hostlife model: rev 7.18, joint round 17 (R17-1) claude agent, operated by paul@keymail.dev 2 weeks ago
39904c84f spec: move-any-app rev 7.17, joint round 16, claim rev 6.24 and 6.25 claude agent, operated by paul@keymail.dev 2 weeks ago
b9e977832 hostlife model: rev 7.17, joint round 16 and claim rev 6.24 claude agent, operated by paul@keymail.dev 2 weeks ago
6f2a93c91 spec: move-any-app rev 7.16, joint round 15 and claim rev 6.23 claude agent, operated by paul@keymail.dev 2 weeks ago
6bfae1530 hostlife model: rev 7.16, joint round 15 and claim rev 6.23 claude agent, operated by paul@keymail.dev 2 weeks ago
63fc6a711 spec: move-any-app rev 7.15, joint round 14 claude agent, operated by paul@keymail.dev 2 weeks ago
f6fb05799 hostlife model: rev 7.15, joint round 14 claude agent, operated by paul@keymail.dev 2 weeks ago
a43892802 spec: move-any-app rev 7.14, joint round 13 and claim rev 6.22 claude agent, operated by paul@keymail.dev 2 weeks ago
4ebfa0a53 hostlife model: rev 7.14, joint round 13 and claim rev 6.22 claude agent, operated by paul@keymail.dev 2 weeks ago
1f511c422 spec: move-any-app rev 7.13, joint round 12 and claim rev 6.14 claude agent, operated by paul@keymail.dev 2 weeks ago
42af7bfc4 hostlife model: the legacy host's pre-release processes carry adoption's session claude agent, operated by paul@keymail.dev 2 weeks ago
8cdc8bbbe hostlife model: two faults the 100,000-seed baseline found on rev 7.13 claude agent, operated by paul@keymail.dev 2 weeks ago
a2dc9b2a9 hostlife model: rev 7.13, joint round 12 and claim rev 6.14 claude agent, operated by paul@keymail.dev 2 weeks ago
dd3e35f6f spec: move-any-app rev 7.12: joint round 11, holder.admissions and PublishGeneration (claim rev 6.12), every number rerun (#175) claude agent, operated by paul@keymail.dev 2 weeks ago
af9b89ed5 sim: hostlife: an empty dead generation still gets its park-generation chore claude agent, operated by paul@keymail.dev 2 weeks ago
18d977ae9 sim: hostlife: clean-return coverage speaks for two sessions; per-region coverage in PublishGeneration; a probe's failing restore ends its attempt claude agent, operated by paul@keymail.dev 2 weeks ago
b6ed9f6fc sim: hostlife: claim rev 6.12, holder.admissions, PublishGeneration, Coverage, the origin's absent marker, the final recovery admission, a probe attempt's window (rev 7.12) claude agent, operated by paul@keymail.dev 2 weeks ago
ec9824368 spec: move-any-app rev 7.11: joint round 10, the admitting CAS before the start (claim rev 6.10), every number rerun (#175) claude agent, operated by paul@keymail.dev 2 weeks ago
bd1587a14 sim: hostlife: mutate.sh learns the rare-at-depth outcome; hostguard, stale-hold-release and strict-spawn are caught at 30,000 claude agent, operated by paul@keymail.dev 2 weeks ago
8cbd85585 sim: hostlife: an adopted host's writer_box is the box running its pre-release process claude agent, operated by paul@keymail.dev 2 weeks ago
d076b6568 sim: hostlife: a clean return behind a declared-lost target declares the source's cut session too claude agent, operated by paul@keymail.dev 2 weeks ago
d1c7b839b sim: hostlife: a rollback whose target was declared lost declares what the seal held (INV-15's exception) claude agent, operated by paul@keymail.dev 2 weeks ago
428fee136 sim: hostlife: claim rev 6.10, the admitting CAS before the app start, a session per agent process, unfinished generations with live baselines, the library's admission shape, startup PUTs in the ledger, declarations as the only exemptions, the uncovered return (rev 7.11) claude agent, operated by paul@keymail.dev 2 weeks ago
33ce0a9c6 spec: move-any-app rev 7.10: joint round 9, no local database reuse (claim rev 6.9), every number rerun (#175) claude agent, operated by paul@keymail.dev 2 weeks ago