amadan
housekeeper/issuer observability: which box holds, and who may publish certs Issue open
Migrated from github.com/carlosframework/platform issue #244, opened 2026-08-20. GitHub issues are closed for this repo; see AGENTS.md, "Work is tracked on amadan, not GitHub".
Still outstanding: No readout of which box holds the housekeeper lease, and a bare carlos edge is an ungated cert publisher.
---
From the multi-region stage 1-2 branch. Two related gaps:
- No readout of which box holds the housekeeper lease (= the cert issuer + releases pruner). Today the only evidence is one agent-journal line on one box. First question of any cert incident and of the DR runbook. Cheap fix: a held bool + box label on the status heartbeat, surfacing in the fleet/status pages.
- Who may publish `control/certs/
is enforced by composition, not by any single check**: a standalonecarlos edge` (run without the agent, so nil gate) on a bucket-backed box is ungated AND publishes — a second uncoordinated publisher if an operator ever runs the edge role bare on a multi-edge deployment. Same story as the pubkey-less-but-electable box recorded in the rollout notes. Ruling wanted: either the edge refuses to publish without a gate wired (breaking bare-edge single-box use), or the rollout notes' operational rule ("don't run bare edges on multi-edge deployments") is the accepted answer and gets documented where operators look.
Both are pre-stage-5 items (they only matter once a second platform box exists).