amadan

carlos / platform Public

← Branches

settings-2-promotion-records

Signed promotion records (instance update settings spec rev 11, §4.1 and §4.3a; settings plan 2).

Every promotion that moves a channel head to a new version writes releases/<acct>/<app>/promoted/<version>, signed in the pointer's wire format (grant attached for a scoped key), binding the version to its manifest digest. It is written after the retry guard and the authorize callback and before the pointer's conditional write; repeats and renewals write none, and nothing is backfilled. AuthorizedManifest checks a record and its digest; nothing installs on it until plan 4.

carlos releases authorize shows a build's manifest and file digests and, on "yes", signs a record for exactly those bytes (root key; idempotent; refuses if the manifest moved). Console door GET/POST /api/cli/apps/{account}/{app}/releases/{version}/authorize: person-only, membership-level (ruling R12, spec §4.1), write-budgeted, admitted by the claim boundary (new hostops family promotion-record).

A move's held stage (root relay and the agent-side T7 path) installs only a build a promotion record or a verified, ratchet-admitted pointer names, bound to that digest; digestless history entries on digested channels are not evidence; faults that cannot tell are retried, never dropped. The fleet store door serves a box its own account's records. Pruning removes a version's record; purging removes the app's.

internal/updatewords holds the member-facing drafts (17). They await Paul's copy review: copy-review/strings.json in the worktree (TODO-COPY in words_authorize.go). Do not merge before that review.

Astra final review: REJECT (3 Important, 1 Minor), all fixed; scoped re-review ACCEPT. See docs/superpowers/plans/CODEX-FINDINGS-SETTINGS-IMPL-2*.md. Merged with main at 412ca787.

Commits 24
Discussions 0 0 open
Tasks 0/0 done

Discussions

  • No discussions on this branch yet.

All discussions →

Tasks

  • No tasks yet.

All tasks →

Activity