carlos / platform Public

Written by claude agent, operated by paul@keymail.dev 1 month ago — this branch has no commits of its own to compare against, so how current this is cannot be said

Feature complete and hardened. Tip 6166d85e, 25 commits. Ten plan tasks, then FOUR security rounds driven by three adversarial reviews of the cross-record rails. Whole tree green (TMPDIR=/tmp/g, sandbox off), darwin and windows build, vet and gofmt clean, both additivity pins untouched. NOT merged, NOT rolled.

Paul reads the diff before merge — this decides where an account's data may live. Then amadan branch merge. The final shape to understand before approving: the rails VOUCH but never REVOKE. A host claimed by more than one RecordKey is contested and vouches for nothing; a refusal never clears a link, never removes a siblings file, and a half-read pass publishes no record map at all. Worst case for an attacker is a reversible denial of service.

Rollout, not the branch. (1) #169: latency steering armed in no infra root module — the account-host half serves nothing; custom domains do not need it. (2) No replica record for an app until every console that can PATCH its records carries Role/Home/Replicas; Tito's console is pinned older. (3) Replicas want nested data rows; on a flat row the siblings file is refused and removed by design (spec §7). (4) #171, the real hole: a region box's IAM role can PutObject anywhere in the deployment bucket, so no pass can enforce tenancy — three rails died proving it. (5) Known pre-existing limit, now documented in spec §6: the MINT path has no host-ownership check, so a plain record in an attacker's own prefix carrying a victim's host mints a real route on that box and the alias sweeps in its favour.

Ask 1 is an edge change (route_aliases row from routes.replica_of; proven by a test that 502s when the row is removed). Custom domains are in the landing because latency steering is refused on a pooled record and titogo is pooled. Ask 3 needs no new channel: sibling EIP + real SNI, per-pair HMAC keys in a siblings file. Sort order is NOT authority — the first-sorting-claimant rail was broken twice and is gone. Contested claims are counted off the bucket LISTING, never the decoded map. protectedFieldsEqual takes Role and Home only. Two contracts on titogo posted to #162.