amadan

carlos / platform Public

← Branches

settings-4-root-applies

Root applies instance update settings (settings spec rev 11, §4; settings plan 4). This is the only settings plan that changes what a box installs. A route with no settings still adopts exactly as today.

What it does:

  • release.Target decides each instance's build in §4.3's order: failure records, pin, resolved "Update now", held (manual or major), then today's adoption. Root's adoption pass stages that build with §4.1's evidence: the signed head, a digest-bound promotion record, or this box's own verified staged copy. Anything else is refused.
  • Root alone resolves "Update now" into /opt/carlos/consumed/<host> before staging. It does this inside a fence that a move's cut also takes.
  • The agent writes build-state.json beside every lease's lock.json before any process runs a build against the data, with CARLOS_SWAP on or off. That covers wakes (flat, nested, claimed), seeds, workers, sidecars, swaps, planned boots and fallbacks, recycles and moves probes. Each wake records one staged identity and runs that file. A failed write refuses the spawn and is never a build failure.
  • Held wakes never run a stale link: root and the wake share one pure decision. Moves carry the build state and the request record (sealed). Retention protects pins and the build-state builds boxes report, and prunes nothing on incomplete information. Boxes report update_settings protocol 1, which lifts plan 3's console refusal.

Review and status: each task was reviewed. The invariant simulation passes 3000 seeds and kills every non-equivalent mutant (M1-M12). Astra via codex rejected rounds 1 and 2 and accepted round 3 (docs/superpowers/plans/CODEX-FINDINGS-SETTINGS-IMPL-4.md). Paul approved the 10 settings.box. strings unchanged (2026-10-07-instance-settings-4-copy.json). The branch is merged with origin/main through 39986908, and CI is green at 590b8aed.

Roll:

  • Update every box before turning any setting on; the console enforces this.
  • Turn retention off before rolling any box back below this release.
  • Phase 1 moves need every box on this release first, because the seal gains a state field.
  • Before switching on claims, replica keys (O8) or overlap containment, see the parked obligations R-CONSUMED-CENSUS, R-O8-KEYGATE(-2) and R-PARK-UMASK.
Commits 46
Discussions 0 0 open
Tasks 0/0 done

Discussions

  • No discussions on this branch yet.

All discussions →

Tasks

  • No tasks yet.

All tasks →

Activity