amadan
Related: #259 (carlos run), #260 (instances create --from), #261 (adoption door after the nested-layout rollout). All three serve platform-run instances only, and all three depend on #126 being rolled out (#247).
Schedule the adoption door (instance-moves §9, G9) after the nested-layout rollout: every controld titogo instance converts to platform-run Feature Request open
Claimed by claude~paul@keymail.dev 2 weeks ago
Ask: schedule the adoption door, docs-instance-moves-design §9 "Bringing an instance under a record" (gap G9), to follow the #126 nested-layout rollout (#247 steps 2–5). Tito will use it to convert every controld-run titogo instance (about 71 titogo@<host> units on carlos-tito-ie) to platform-run.
Decision (Paul, 2026-10-08)
> "I definitely don't think that we should be doing anything to support old style instances ... the Tito Go ones should all be converted to platform-run."
That answers open question 6 of titogo's docs/superpowers/specs/2026-09-24-moves-on-the-platform-design.md: all of them adopt in place in Ireland, as housekeeping, not only the ones that ask to move. Nothing new gets built for controld instances. The titogo half of the conversion is that design's §4: stop, snapshot, import, carry env, swap, repoint, retire, with automatic rollback before the swap.
Why the order matters
The ~71 controld instances are safe today only because /data/titogo is 0700 titogo and out of reach of the flat exec uid (#126's finding). Adopting them onto flat exec would expose every one of them, so adoption must wait until the box is nested.
What Tito needs from the door (from titogo's §4)
- Import of a stopped snapshot:
POST …/instanceswithimport: {sha256, bytes}, a presigned PUT, then…/import/stopped. Lands in the home region. …/import/abort: delete the record and restore the addr row, for an automatic rollback whenverifyfails before the swap.- The addr row replaced by the exec row on success, with the instance woken and
verifyanswering. - Per-host env carried into the instance's own environment (including
TITO_ADMIN_TOKEN).
Titogo-side work this unblocks (ours, not the platform's)
- Sandboxes stop being created through controld (
ensureSandbox). - Import mirrors write through the instance rather than into its file (titogo design §7). A mirrored host is refused adoption until then.
- controld gains
retire(titogo design §4 step 7).
Companion requests filed today: carlos run and carlos instances create --from. Both are for platform instances only.
Another case for this door's acceptance: carlos/platform#264. stripeyste.go.tito.io needed a named-environment binding today, and instances set-environment couldn't reach it because it is a controld host with no instance record. An adopted host should keep its route's environment binding (stripeyste, demo, connect→relay, platform.ie→router), and set-environment should work on it afterwards.
Picked up on branch design-run-and-seeded-instances. The import door is specified in docs/superpowers/specs/2026-10-08-seeded-instances-design.md §5 (c66792a3), sharing its seed-snapshot step with #260.
Changes from the 09-24 §9 design, all Paul's rulings of 2026-10-08:
- the upload streams through the console (the F8 rule), not a presigned PUT;
- the swap accepts an addr row filed under the deployment's operator account when the app name matches, and refiles it under the app's account, which fixes G17 for every converted host;
- any member or an
instanceservice credential may call it.
The schedule (spec §10):
- build both doors now; they refuse on flat boxes;
- roll the nested layout to Tito's boxes (#247 steps 2-5);
- titogo builds its half;
- convert one canary host, abort it once on purpose, convert it again;
- convert the rest, with Paul's go.
Astra accepts both specs: carlos run at rev 4 (round 4) and seeded instances at rev 7 (round 7), branch design-run-and-seeded-instances @ 9a6a64f5. Rounds of findings: 20, 13, 4, 2, 1, 1, 0. Every accepted change is in each spec's disposition tables. Implementation plans are being written next.
Seeded instances (carlos instances create --from and carlos instances import, #260 and #261) landed on main as f97898f. It was squashed from seeded-instances at d078e435, which was current with main and green in CI. It is not released or rolled.
It ships dark. seeds.ProtocolVersion is 1, but every seed door stays shut until an operator publishes the seeds floor with carlos system seeds-floor publish. Publish it at or above the first release carrying this code. Do not publish it until Paul's open decisions are settled:
- data sealed with the source's instance key, for both
--fromand imports; - the deviations: the async
--fromdoor and import upload, aborting an import whose integrity check fails, and the reservation order; - verify being GET-only, against what titogo's conversion tool sends;
- the rollout gates: an operator way out of a held rollback, noncurrent-version expiry on the data buckets, S3 permissions for the console and box roles, and one console per deployment.
Reviews and approvals.
- Eight plans, with every task reviewed.
- An Astra review of the whole series: 3 P1 and 4 P2, all fixed.
- Each main merge was reviewed by Astra until it came back sound. That covered the instance key retired on rollback, claim activation refusing over unfinished seed state, and rollback liveness with #292's stop proofs.
- Paul approved all the copy (SD-N1 to SD-N140).
- The root-read census was ruled by the Plan 14 controller: census-ruling-seeded-instances and census-ruling-292fix.
Carried to #250. The claim census collector must set CensusReport.Seeds. Until it does, every activation through Backfill.Publish refuses. Part 3 F2 to F4 must also cover the seeds floor.
Next. Dev-box checks after the next roll, then the decisions above, then the floor.