carlos / platform Public

On-demand object scanning for Carloku and other CARLOS deployments. Apps can enqueue an uploaded object and poll its version-bound result without waiting for the hourly sweep. The console drains queued work every 30 seconds with per-app limits; signed callbacks are optional.

Restores the unfinished scan implementation and integrates current app-mutation claims, consent rechecks, restart recovery, guarded result collection, sealed callback-key convergence, and per-day usage counters. Polling-only grants require no callback signer. Callback destinations use an existing ready platform route belonging to the same app.

Paul approved the documentation/status wording, the scoped census inventory update, and patch-only Claude/Fable review with all tools disabled. Previous whole-branch CI (4d9302e9) passed build/vet/format, full tests, five cross targets and real MinIO contracts. Fable found no confirmed blockers; its findings prompted bounded busy-app retries, rebuild backoff, trash-aware rotation, fresh secrets after regrant, and accepted-response handling. New regressions were watched fail before those fixes and pass afterward. Claims-on tests cover competing operations and transport-failure settlement.

Final tip c0040c1e74de12752f7ac0ac43d3cab670d8fd7f includes those fixes plus census envelope refreshes. Build/vet/format, scoped census and focused regressions pass locally, including trash appearing between target selection and the mutation permit. Focused race checks pass (69.449s). Independent Fable follow-up explicitly clears this patch as merge-ready with no blockers, subject to exact-tip CI. Callback retries already wait 1/4/16 seconds; key convergence has no periodic caller. The CLI waits until held apps reopen or the operator interrupts it. Exact-tip CI passed on c0040c1e74de12752f7ac0ac43d3cab670d8fd7f: full gate, all five cross targets and real MinIO contracts. Ready to merge.

Deployment requires the updated console API/worker. Existing Carloku scanner wiring was checked read-only and is sufficient for polling; apps must call the new API after upload. Callback delivery additionally needs the documented signing and sealing configuration. No production deployment or infrastructure change is part of this branch.