carlos / platform Public

Fixes the five items in discussion #219 (2026-10-03 tenant-isolation audit). Each one is a case where something outlived the app or the membership it belonged to.

What changes

1. Purge leaves no credentials behind. PurgeAppRow deletes the app's cli_tokens rows (kind app and service) in the same transaction as the row. They are deleted rather than revoked because RenameAppIn and MoveApp refuse a name that still has any such row, revoked or not. Door keys are revoked, and the revision is bumped so the empty record outranks what boxes already admitted. The console purge door publishes the record right away. The auto-purge path (MaterializeApps) leaves it to the 12-hour re-sign. - The finding was partly wrong. MoveApp already refused stale destination tokens. What it missed was door keys. It now revokes the name's door keys on both sides. Keys carry their account's sqid, so they could never have followed the app anyway. The move door republishes both records.
2. Purge sweeps ledgers. release.PurgeApp also deletes everything under ledgers/<acct>/<app>/, before the marker. release.LedgerAppPrefix is now the one definition of that prefix; internal/ledger and the console's ledger list build on it. - Consumers that parse the shape. The edge's status cache served a stale copy on any store error, including not-found. Without a fix there, a purged public ledger would keep serving from every edge that had read it until the process restarted. The cache now drops a gone ledger object. A blip still serves stale, and status-page files keep the old rule. - TestLedgerServingStaleManifestHonored used to simulate an outage by deleting the directory. It now uses flakyStore.
3. Legacy app-token revoke requires membership. /auth/cli/tokens/revoke refuses a kind app token unless the minter is still a member of the token's account. The refusal comes before the passkey step and fails closed on a read error.
4. Invite accept is a POST. GET /invite/{token} now only renders a confirm card. The card checks the same three gates through the new read-only PendingInviteFor. POST /invite/{token} runs session, then CSRF, then AcceptInvite's gates, which play the owner check's part. Existing links land on the card. - No requireFreshAuth. Joining gives the joiner no power over anyone else, and step-up fails closed when Keymail cannot do it. That would block every invite. A person should confirm this choice.
5. Fleet names: no change. Fleet names are keys in the deployment bucket (fleets/<fleet>/…, read by edge/storedoor, host/agent and the economics pass) and in channel identities, so scoping them per account is a wire change. The 409 already says only "that name is taken", never by whom. It is the same whether the caller's own account holds the name or someone else's does. Probing and squatting are bounded by the per-day create budget (allowCreate). Nothing further can be done without breaking uniqueness.

Tests

Each new test failed before its fix:

• TestPurgeAppRowLeavesNoCredentialsForTheName
• TestPurgeAppRowKeepsALiveAppsCredentials
• TestMoveAppLeavesNoLiveDoorKeysForTheName
• TestDeleteNowSweepsLedgersAndDoorKeys (handler: ledgers swept, empty door-key record published)
• TestPurgeAppSweepsTheAppsLedgers
• TestLedgerServingStopsAfterPurge
• TestPersonalSettingsRefusesAnAppTokenRevokeAfterRemoval
• TestInviteAcceptCreatesMembership, now extended: the GET joins nothing, a POST without CSRF gets 403, and the link is single use

Gate results:

• gofmt and go vet are clean.
• go build passes, but needed GOFLAGS=-buildvcs=false locally because of a stray ~/.cache/tmp/.git.
• make test has failures that are all environmental: unix-socket paths too long under a long TMPDIR (activator, edge purge listener, instanceexec), and the root package exiting on the operator's own ~/.carlos/config. The root package fails the same way on clean main.

Deliberately not done

• No migration for tokens or door keys left by purges that happened before this change. A token bound to a name with no app row may be a legacy owners-table app, so cleaning those up needs a human decision.
• carlos accounts migrate does not move ledgers. That predates this change and is out of scope.