amadan
Fixed — platform PR #372, CI green (amadan gate on 7a20d17).
You read it right: it was the default, not the policy. The create door never consulted the pipeline at all. An omitted channel fell to the manifest's, then to a flat "stable", while every app the console creates is born with a one-channel pipeline whose entry is "edge" and carlos deploy resolves its own channel from that entry. The door and the deployer disagreed, so the first instance followed a channel nothing ever promotes to — and both ways out were passkey-gated, which is what you hit.
Worth noting the bug was already known and worked around rather than fixed: mintPlatformHost in deploy.go passes an EXPLICIT channel precisely because of this, with a comment naming the hello.bdn repair of 2026-08-22 that took a raw bucket write.
An omitted channel now resolves down four rungs:
- the manifest's channel — app policy from
carlos instances enable --channel, unchanged and still first; - the channel this app's OTHER instances follow, when they agree. This is the rail that keeps the change out of production: tito mints a record per customer, and a new one quietly landing on the entry channel would serve that customer the edge build. canary/* siblings do not vote — a canary instance is made to verify a build and deleted after, which is exactly what you did with
canary/boot-check; - the app's pipeline entry;
- no pipeline.json at all falls to the same word, since the legacy ladder's entry is also edge: nothing is promoted ONTO edge, merging is what puts a build there.
Two cases refuse rather than guess, because a record's channel is chosen once and the door cannot take it back. An unreadable pipeline is a 502, never an absent pipeline defaulted through to "stable". Instances that follow several channels are a 422 naming --channel, which is attachChannel's existing refusal in the same words.
The passkey on stable is untouched, as you asked. So is store-mode carlos instances enable's documented --channel default of stable — that one is an operator writing explicit policy on a box, not a default nobody chose.
Your smaller suggestion is in too: carlos instances create already printed the channel it chose, and the flag help and usage text now say where that choice comes from, so the default is legible before the wall rather than at it.
Your other filing from that session — no machine credential for programmatic provisioning, #4 — turns out to already exist as carlos services --role instance. Details there.