carlos / platform Public

Picks the Eleven → Carloku migration back up, and gets Eleven actually running on Carloku.

The design was approved 2026-08-30 and then left on branch eleven, 269 commits behind main and never merged. This brings it onto main, corrects what had gone stale, reframes phase 1, and records what happened when we ran it.

What landed here

Three commits, all docs.

1 — Refresh against a week of main. Phase 5's "use 30 minutes, not 5, because at 5 it never sleeps" is void: #371 landed, and a scheduled tick no longer stamps lastActive, so cadence now comes from what the page needs. Gap 3 (per-app hibernation idle) demoted — still real, no longer blocking. Gap 6 closed: the runbook it asked us to rewrite had already been deleted in the open-source redaction pass, two days before the spec was written.

2 — Phase 1 starts on the shared fleet, not a box Eleven owns. Paul, 2026-09-05: "since Eleven is decentralised anyway". Account eleven (bdr) has no fleet, so its apps land on the shared Carloku fleet, which already runs. The tofu root, the AWS spend and the eleven/infrastructure repo all come off the critical path. Phase 1 splits: step A on the shared fleet, step B on the proving box for what step A cannot reach.

3 — Step A is done. proving.bdr.oncarlos.com serves Eleven's app shell over HTTPS, on a binary shipped through carlos, with no infrastructure created for it.

What we learned by doing it

The launch contract already matched, exactly. CARLOS spawns an app as exec.Command(bin, "--socket", rt.Socket, "--db", dbPath) (backend_exec.go:691). Eleven spawns its instances with the identical line (messenger/activator.go:1218), because CARLOS's activator was ported from Eleven's. lchat needed no code change whatsoever. Verified by running it, not by reading it: on an empty directory it boots, creates its SQLite db and answers 200 over the socket.

Proofs 1, 2 and 3 are closed (bar a person signing in). Release delivery: deploy shipped ffd3de0, promoted to edge, the reconcile pass materialised the route, the edge stamps x-carlos-version: ffd3de0. Manifest shape: instances enable pinned the app to bdr.oncarlos.com and the one-label rule held. The product genuinely runs: the box logs lchat listening on unix:/run/carlos/proving.bdr.oncarlos.com.sock, and the served page carries Eleven's own CSP — connect-src naming home.elevenmessenger.com — not a platform placeholder.

Hibernation worked unprompted. Setting up → serving → Asleep, on its own, with nothing configured for it.

Open question 3 is half-settled. The release shipped and the box adopted it with no Eleven signing key involved anywhere; the adopt path verifies signatures and accepted it. New releases are already on Carloku's authority. What remains is only what to do with binaries already signed with Eleven's key.

Two findings recorded in the spec. The admin link names the wrong host — lchat prints http://localhost:1747/admin#token=... because it only ever knew a socket, so an operator must hand-edit it; tedious across 31 hosts and a trap for anyone pasting it as printed. And the architecture defaults disagree: carlos ship/deploy default --target linux-arm64, Eleven's build-linux.sh defaults ARCH=amd64 and its committed binary is amd64, and nothing catches the mismatch until the box tries to exec.

What is next, after this lands

Ready now, no blockers:

• Sign in and make a space — the human half of proof 3. The admin link is in the box's log; the host has to be rewritten to the real one.
• The host inventory (spec open question 1) — which of the 31 hosts belongs to which app, and therefore how many apps there are. Pure design, needs no infrastructure, and phase 2 cannot be sequenced without it. The zone split is already known: 23 *.11ch.at, 5 *.luan.chat, 2 *.elevenmessenger.com, 1 chat.paulca.com.
• The in.<host> disposition (proof 5) — hooks are two labels under the zone, which ValidHost refuses, so they are neither a #223 sidecar nor an instance record. Phase 1 is where this gets decided, and nothing depends on the answer yet.
• File the six surviving platform gaps as discussions. The spec lists them; none have been filed.

Blocked, and not on this branch's critical path:

• Sidecars (proof 4) wait on PR #223 — still unmerged, no sidecar package on main, untouched since 2026-08-18.
• Step B, the proving box, waits on the eleven/infrastructure tofu root. Only needed for the proofs step A cannot reach.

Docs-only; go build ./... and gofmt -l . clean, CI green at 86918a1.