carlos / platform Public

Found in the dev cohort-1 claim trial on 2026-10-18 (#250; runbook step 4).

What happened:

• claimtrial.dev.carlosframework.com was created in pool cohort1, so only leo-climbing serves it.
• curl --resolve ...:443:<leo> failed at TLS with tlsv1 alert internal error. Leo's journal showed TLS handshake error ... acme: not available here.

Why:

• Only the box holding the housekeeper lease orders certificates. On dev that's sophie-knitting.
• Every other edge serves only the certificates mirrored from control/certs/ (internal/edge/certsync.go).
• The issuer orders a certificate for an exactly named route only when a TLS hello for that name reaches it (see #277). Nothing reached sophie, so no certificate existed.
• The trial workaround was one handshake-only openssl s_client to sophie with that SNI. It got a Let's Encrypt certificate published to control/certs/, and leo then mirrored it.

What a real tenant would see: if DNS sends visitors to a box that isn't the issuer, the first visitor to a new host homed only there gets a TLS failure, and so does every visitor after them. Nothing ever triggers the order on the issuer. That fits any pooled or region-only host whose traffic never touches the issuer box.

Fix ideas:

• The issuer pre-orders a certificate for every exactly named route in the deployment as soon as the route appears, not only on first TLS hello.
• Or a non-issuer edge, seeing a TLS hello for a host it serves but has no certificate for, asks the issuer to order one.

Unclaimed.