carlos / platform Public

Built it, on branch status-instances. CI green.

carlos status --instances carlos status --instances --account bac

BOX HOST ACCOUNT APP CPU MEM annie-welding amadan.net bah amadan-hub 0.017 351MB annie-welding jam.bac.oncarlos.com bac jam 0.000 26MB (awake instances only — a hibernating instance has no process to measure)

Console-backed, so it needs no AWS credentials — which was the whole point. Nothing new is measured or stored, exactly as you said: the metrics loop already writes per-unit cpu and mem every 60s, LoadMetrics already sweeps them for the browser page, and unitOwner already knows how to attribute a sampled cgroup to a route's account. The only missing piece was a door.

GET /api/cli/status/instances, gated cliUser → IsOperator → byte-identical 404, the shape economics backhaul and email pause use. Registered with an empty role set, so no service credential of any role reaches it: the answer names every account's instances on every box, and there is no app-scoped reading of that question. Added to closedDoors with that reason.

One implementation note: rather than write a second matcher, I split unitOwner's rule out as routeForUnit and shared it. This listing needs the route's HOST and not only its owner, and a private second notion of which route a cgroup belongs to is how a listing ends up disagreeing with the economics pass about whose the cost is.

One column from your sketch is missing: AWAKE. I could not build it honestly. Nothing in the tree publishes a process start time — not metrics.UnitSample, not status.BoxMetrics, not the route — so the only available answer is "first seen in the 48-hour sweep", which under-reports anything older than that and resets on any agent restart or history gap. Given that residency is exactly what you were investigating (jam resident 24h at 26MB and 0.000 cores), a column that quietly under-reports it seemed worse than one that is missing. A real one needs a start-time field on the box's own sample; say if you want that and I will add it.

Two things the output says out loud rather than leaving to inference: a unit matching no route is labelled (platform) — the console's own unit, the agent, system units — rather than dropped, because an operator asking what is on the box wants the box's own overhead in the picture; and the hibernating-instance caveat prints under every answer, so a short list is never read as the whole tenancy.

Your --usage sibling is not built. It is a different door onto LoadEconomics, and worth doing, but it is the month-to-date meter table rather than "right now" and I would rather it landed as its own change than widened this one.

Triage, 2026-09-05. status-instances reviewed. CI green. Verdict: merge with fixes. No data leak found. One attribution bug and one test that asserts nothing.

Confirmed sound, since this is a door onto every account's tenancy and that is the part worth being sure about:

• Gate order matches the shape economics backhaul uses, byte for byte: cliRoute (bearer, service refusal) → cliUser → IsOperator → http.NotFound. No CSRF or requireFreshAuth applies to a bearer door, consistent with every other operator CLI verb.
• The empty role set genuinely excludes every service credential — svcrole.Set{}.Permits returns false for all roles including "" — and closedDoors walks it.
• --account filtering is server-side, so the client never receives other accounts' rows.
• The routeForUnit split is behaviour-preserving for unitOwner: same first-match iteration, same return on hit and miss. No misbilling risk, which was the thing I most wanted to rule out about sharing that matcher.

The attribution bug is the one to fix before this lands. The route join is box-local — openPassRegistry opens the console's own box registry — while the metrics sweep it reads is fleet-wide. On a multi-box deployment every unit sampled on another box matches no route, falls through to (platform), and is charged to bab. So the answer to "who is using what right now" would report a whole box's tenants as platform overhead.

Inert today, because both deployments are single-box — and sweepUsage already documents this exact trap with the structural fix tracked as #137. But the new file's own SCOPE comment claims the opposite, and this door's whole purpose is to be the thing an operator trusts instead of reading the bucket. The comment should say what is true, and the caveat belongs in the CLI output beside the hibernating line you already print.

The --account test is vacuous. No test in internal/console writes anything under metrics/boxes/, so LoadMetrics returns zero boxes and the assertion loop never runs — deleting the filter would still pass. One fixture box with two units would pin the filter, the join, and the (platform) label at once.

Smaller: the "cannot be told from a door that does not exist" claim is overstated — a POST to the path returns 405 with an Allow header from the mux, before any auth, to anyone. Pre-existing for every method-scoped cliRoute including email pause, so I would correct the claim rather than re-architect, but the test asserts a property the door does not have. Also --account is sqid-only while the rest of the CLI takes sqid-or-name, so a name silently answers "no awake instances".

Merge-order warning: this branch and deploy-build-probe (#13) both rewrite the same closed-door assertion from 17 to 18. Whichever lands second conflicts, and the mechanical resolution is red — it has to become 19 with both reasons listed.

Your AWAKE column: the reasoning for leaving it out is right, and the fix is small enough to name. Nothing publishes a process start time, but the activator already holds spawnVersion per child and has no accessor — the same gap #13 runs into from the other side. One start-time field on the box's own sample would serve both. Worth doing as its own change.