carlos / platform Public

Migrated from github.com/carlosframework/platform issue #181, opened 2026-08-12. GitHub issues are closed for this repo; see AGENTS.md, "Work is tracked on amadan, not GitHub".

Still outstanding: A capability 422 swallows an already-successful base attach, and cert expiry for catch-all domains is never surfaced.

---

Two no-infra-rule gaps from Plan C's final review (PR #180), bundled as one "surface wildcard state" slice:

1. carlos domains attach -wildcard -catchall answers only {host, route, created} — the member must run domains list to learn whether the capability took. Worse, a capability 422 (e.g. CNAME gate) hides that the base attach SUCCEEDED (claim created, route live, serial bumped). The attach response should echo the capability outcome (wildcard/catchall/delegation_status after the write), and the CLI should say "attached; wildcard pending: <what's left>" instead of a bare fatal.

1. The wildcard cert's obtained/expiry state exists on the *.<host> alias row (hostCertExpiry reads wildcard-<parent>.pem) but is never surfaced through the API — a domain whose wildcard parent the edge dropped (cap, collision, >253 challenge name) keeps a live catch-all route + "delegated" stamp while subdomains fail TLS, observable only in box logs. Surface the cert state in domains list so degraded-not-broken is visible.

Origin: docs/superpowers/plans/2026-08-13-claim-derived-wildcards.md final review (Fable), Minor #3 + #5 and the C5 deferred echo note.