carlos / platform Public

Root honours CARLOSS3ENDPOINT from host.env, a gap in the #267 hardening. Found by Fable's harness spec review for platform-d8, 2026-10-20.

• release.NewS3Store (internal/release/store.go:712) reads CARLOSS3ENDPOINT. That covers every carlos system claims command and root's relocate and adopt passes.
• hostenv.go:88 allows the key in host.env.
• rootaws.ScrubEnvironment (main.go:26) unsets AWSENDPOINTURL* and SSLCERTFILE for euid 0, but not CARLOSS3_ENDPOINT.

Why it matters: signed artifacts can't be forged through a redirected endpoint, but root's bucket reads and writes can be redirected, withheld or replayed by whoever can write host.env. On boxes where host.env is carlos-owned (bootstrap-box.sh:59; flagship today, and dev until the 2026-10-19 hand fix), that's the service user, and on flat layouts tenant code runs as that user.

Not to be removed: self-hosting without AWS (MinIO) legitimately needs an endpoint override (provider-neutral core).

Proposed fix:

1. Root processes accept CARLOSS3ENDPOINT only from a root-owned 0600 host.env read through systemd's EnvironmentFile. A process at euid 0 whose host.env isn't root-owned ignores it and alerts, like the other #267 overrides.
2. Land the infra fix that keeps host.env root-owned: platform-infrastructure#47 and carloku-infrastructure#12, both open and not applied.
3. Add a test that a non-root-owned host.env's endpoint is refused for root.

The harness uses a -tags harness endpoint file and never changes production.