carlos / platform Public

What

Group the registry-direct verbs under one namespace, carlos box: carlos box add, carlos box remove, carlos box route, carlos box routes (today's bare carlos instances). Keep the old spellings as aliases for a release, printing a one-line pointer to the new name.

Why

On 2026-09-10 a tenant was told to "run these on the platform host":

carlos route --host ips.bdn.oncarlos.com --environment sharedportal-ips

They have no shell on a box, and the verb they needed was carlos instances set-environment, through the console. carlos route opens the box's own registry file, with no console and no identity, and nothing in its name says so. The same is true of add, remove and the bare form of instances, and carlos instances is the worst case: its sub-verbs go through the console and its bare form reads local disk, under one word.

The immediate fix (branch worktree-box-local-guard) makes the four verbs refuse when the registry file is missing and no --registry was given, naming the console-side verb instead, and rewrites the carlos env help that pointed at carlos route. That stops the failure. It does not make the grouping honest.

carlos system is not the place. Its verbs are deployment-owner verbs that run from anywhere through the console, and the console already answers non-operators with a 403. The axis that separates these four is place, not role.

Cost

• main.go dispatch and usage, docs/site/cli.md headings (the docsite gate checks every dispatch entry has one)
• every printed hint that spells carlos route --host ... (internal/caps/converge.go, internal/host/caps_pass.go, cli.go refusals, AGENTS.md)
• tests that drive the binary with "route", "add", "remove"
• pinfra scripts and runbooks that type these verbs on boxes

Open question

Whether adopt, agent, bootstrap, ops and system apply belong under the same word, or stay in the "what systemd runs" group. They are on-box too, but nobody types them.