carlos / platform Public

Follow-up from the dev cohort-1 claim trial runbook (#250; claim-dev-cohort1-runbook, step 7a).

Now: on main, carlos system claims fence-credentials reads only a --source file, which must be a root-owned regular file with mode 0600 or 0400. So in the trial, the fence writer's plaintext sits in a staging file on the box between the SSM decrypt and the install. For the trial, platform-1e ruled (2026-10-17) to keep it that way, with the file tightened:

• it lives on tmpfs under /run;
• it is created with install -m 0600 from stdin;
• a trap deletes it whatever happens;
• a stat confirms it's gone.

Before any production cohort, add --source -, so the tool can read the credentials straight from stdin and never write a file. This sits alongside two other deferred trial gaps: the independent writer (Plan 15 boundary) and key rotation.

The change needs a release, a roll and copy review of any new help text. Unclaimed.