carlos / platform Public

The moves rollout publishes control/moves-protocol.json ({"min":1,"min_release":"<version>"}) create-only, before any protected production rehearsal (spec §11, joint N12).

Today nothing in carlos writes it: internal/moves/floor.go only reads it. The runbook (moves Phase 1 Plan 7) therefore writes it by hand with aws s3api put-object --if-none-match '*' from an operator shell. That needs an AWS CLI recent enough for --if-none-match, and nothing checks that the version named is one every box runs.

Ask: an operator verb, for example carlos system floor publish --min-release vX.Y.Z, that:

• refuses unless every box and the console report a tagged release at or above min_release, using the edges file's moves_floor_min_release and prev_allowed_for;
• writes the object create-only and refuses if it already exists;
• prints what it wrote.

Lowering a published floor stays a manual per-box step, as today.