amadan
docs: cohort-1 signing session opened, 5.1 done: roster rev 5, inputs staged
Signer i-0ea2852ef727929bb (sg-08c374c8c31ef448a, run-id cohort1-20261018T101832Z) is up with the release key in tmpfs, held for step 6. Every 5.1 dry run and apply passed; leo (cohort1), sophie (console) and dev-console are enrolled; box inputs staged on both boxes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+33
−2
docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md+33 −2
CI passed — run details
CI log
=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok amadan.net/carlos/platform.git/launchctx 0.012s
? amadan.net/carlos/platform.git/launchctx/controlname [no test files]
? amadan.net/carlos/platform.git/launchctx/wireid [no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok github.com/carlosframework/platform 314.320s
? github.com/carlosframework/platform/cmd/changelog [no test files]
ok github.com/carlosframework/platform/cmd/console 2.835s
ok github.com/carlosframework/platform/cmd/moveprobe 93.344s
ok github.com/carlosframework/platform/cmd/zddprobe 0.712s
ok github.com/carlosframework/platform/internal/activator 250.786s
ok github.com/carlosframework/platform/internal/agentsock 0.038s
ok github.com/carlosframework/platform/internal/alerting 0.009s
ok github.com/carlosframework/platform/internal/analytics 0.026s
ok github.com/carlosframework/platform/internal/appconfig 2.577s
ok github.com/carlosframework/platform/internal/apperr 0.108s
ok github.com/carlosframework/platform/internal/applog 0.195s
ok github.com/carlosframework/platform/internal/awsinv 0.004s
ok github.com/carlosframework/platform/internal/boxchoice 0.005s
ok github.com/carlosframework/platform/internal/boxid 0.663s
? github.com/carlosframework/platform/internal/boxid/boxidtest [no test files]
? github.com/carlosframework/platform/internal/boxid/internal/signtest [no test files]
ok github.com/carlosframework/platform/internal/boxvolumes 0.008s
ok github.com/carlosframework/platform/internal/caps 0.014s
ok github.com/carlosframework/platform/internal/certwarm 0.002s
ok github.com/carlosframework/platform/internal/cgroup 0.744s
ok github.com/carlosframework/platform/internal/changelog 0.342s
ok github.com/carlosframework/platform/internal/claimactivation 0.027s
ok github.com/carlosframework/platform/internal/clamd 0.063s
? github.com/carlosframework/platform/internal/cliflag [no test files]
ok github.com/carlosframework/platform/internal/console 406.582s
? github.com/carlosframework/platform/internal/controlname [no test files]
? github.com/carlosframework/platform/internal/controlsock [no test files]
ok github.com/carlosframework/platform/internal/dbdoor 6.255s
ok github.com/carlosframework/platform/internal/dbdoor/dbdoortest 0.011s
ok github.com/carlosframework/platform/internal/dbverify 0.004s
ok github.com/carlosframework/platform/internal/dnsrec 0.003s
ok github.com/carlosframework/platform/internal/docsite 0.007s
ok github.com/carlosframework/platform/internal/domains 2.509s
ok github.com/carlosframework/platform/internal/doorkey 0.006s
ok github.com/carlosframework/platform/internal/economics 0.004s
ok github.com/carlosframework/platform/internal/edge 44.865s
? github.com/carlosframework/platform/internal/edgeproof [no test files]
ok github.com/carlosframework/platform/internal/edgesfile 0.008s
ok github.com/carlosframework/platform/internal/fleetapi 0.138s
ok github.com/carlosframework/platform/internal/gate 1.665s
ok github.com/carlosframework/platform/internal/genselect 0.016s
ok github.com/carlosframework/platform/internal/geo 0.016s
ok github.com/carlosframework/platform/internal/geoip 0.036s
ok github.com/carlosframework/platform/internal/historyreadback 0.165s
ok github.com/carlosframework/platform/internal/host 175.771s
ok github.com/carlosframework/platform/internal/hostactors 0.728s
ok github.com/carlosframework/platform/internal/hostbox 2.731s
ok github.com/carlosframework/platform/internal/hostclaim 0.606s
ok github.com/carlosframework/platform/internal/hostevidence 0.006s
ok github.com/carlosframework/platform/internal/hostexec 4.818s
ok github.com/carlosframework/platform/internal/hostfence 0.033s
ok github.com/carlosframework/platform/internal/hostfiles 10.402s
ok github.com/carlosframework/platform/internal/hostfloor 0.014s
ok github.com/carlosframework/platform/internal/hostguard 1.001s
ok github.com/carlosframework/platform/internal/hostops 1.689s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.002s
ok github.com/carlosframework/platform/internal/hostquarantine 0.002s
ok github.com/carlosframework/platform/internal/hostrelocate 0.498s
ok github.com/carlosframework/platform/internal/hostresolve 0.170s
ok github.com/carlosframework/platform/internal/hostwrite 0.002s
ok github.com/carlosframework/platform/internal/infraview 0.003s
ok github.com/carlosframework/platform/internal/instancectl 5.212s
ok github.com/carlosframework/platform/internal/instanceexec 2.738s
ok github.com/carlosframework/platform/internal/instancefs 0.007s
ok github.com/carlosframework/platform/internal/instancekey 0.004s
ok github.com/carlosframework/platform/internal/instanceupdates 0.007s
ok github.com/carlosframework/platform/internal/layout 1.602s
ok github.com/carlosframework/platform/internal/lbhealth 0.004s
ok github.com/carlosframework/platform/internal/lease 9.819s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.007s
ok github.com/carlosframework/platform/internal/ledger 0.013s
ok github.com/carlosframework/platform/internal/mail 0.180s
ok github.com/carlosframework/platform/internal/maintenance 0.084s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.555s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.071s
ok github.com/carlosframework/platform/internal/metrics 0.005s
ok github.com/carlosframework/platform/internal/moves 21.068s
ok github.com/carlosframework/platform/internal/moves/archive 0.829s
ok github.com/carlosframework/platform/internal/objstore 0.189s
ok github.com/carlosframework/platform/internal/ops 0.167s
ok github.com/carlosframework/platform/internal/park 0.206s
ok github.com/carlosframework/platform/internal/privatefile 0.004s
ok github.com/carlosframework/platform/internal/provision 17.346s
ok github.com/carlosframework/platform/internal/publicrelease 0.007s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 5.452s
ok github.com/carlosframework/platform/internal/relay 7.217s
ok github.com/carlosframework/platform/internal/release 21.854s
ok github.com/carlosframework/platform/internal/rollout 3.661s
ok github.com/carlosframework/platform/internal/rolloutwords 0.004s
ok github.com/carlosframework/platform/internal/rootaws 0.008s
ok github.com/carlosframework/platform/internal/rootparticipation 0.058s
ok github.com/carlosframework/platform/internal/rootstate 0.027s
ok github.com/carlosframework/platform/internal/runs 0.577s
ok github.com/carlosframework/platform/internal/s3compat 0.005s
ok github.com/carlosframework/platform/internal/safefile 0.004s
ok github.com/carlosframework/platform/internal/schedule 2.518s
ok github.com/carlosframework/platform/internal/seeds 0.011s
ok github.com/carlosframework/platform/internal/sim/hostlife 8.962s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 4.267s
ok github.com/carlosframework/platform/internal/status 0.039s
ok github.com/carlosframework/platform/internal/steering 0.006s
ok github.com/carlosframework/platform/internal/stopevidence 0.171s
ok github.com/carlosframework/platform/internal/svcrole 0.002s
ok github.com/carlosframework/platform/internal/telemetry 0.004s
ok github.com/carlosframework/platform/internal/termfence 0.004s
ok github.com/carlosframework/platform/internal/tunnelclient 0.004s
ok github.com/carlosframework/platform/internal/unixdial 0.003s
ok github.com/carlosframework/platform/internal/updatewords 0.004s
ok github.com/carlosframework/platform/internal/usage 0.004s
ok github.com/carlosframework/platform/internal/version 0.001s
ok github.com/carlosframework/platform/internal/vet 1.549s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 48824482 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
minio: cached, digest verified
mc: cached, digest verified
minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
buckets and scoped user ready
=== RUN TestDeliveredContractMinio
=== RUN TestDeliveredContractMinio/put
=== RUN TestDeliveredContractMinio/get_round-trips_the_body
=== RUN TestDeliveredContractMinio/list_shows_the_key
=== RUN TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN TestDeliveredContractMinio/delete_removes_it
=== RUN TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
--- PASS: TestDeliveredContractMinio/put (0.00s)
--- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
--- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
--- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
--- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
--- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
--- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok github.com/carlosframework/platform/internal/objstore 0.022s
=== RUN TestT4StorageProbeMinio
2026/10/18 10:31:20 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DF991234FDFC5F, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.00s)
PASS
ok github.com/carlosframework/platform/internal/host 0.021s
minio contract: PASS
diff --git a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md| index 7a06626ab..e3d373294 100644 |
| --- a/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md |
| +++ b/docs/superpowers/plans/2026-10-16-claim-activation-dev-cohort1.md |
| @@ -26,8 +26,8 @@ Prepared on 2026-10-18 for platform-1e to present. v0.28.2 is published (tag on |
| | 1 | Step 2: delete the 267 objects under `apps/bab//` (the script on main) | Paul's go; Paul runs it | not run | |
| | 2 | Step 4: `CARLOS_POOLS=cohort1` on leo and the disposable app `claimtrial` | approved 2026-10-16; apply after platform-d8 answers | not applied (`CARLOS_POOLS` unset on leo, no `claimtrial` in the bucket) | |
| | 3 | 5.0a: pointer digests on for all of `bab` on dev (eight apps, nine pointers), then ship and promote the prebuilt console `7c1beb2d` to `canary/console` | one go for both; outside any roll | 1a PASS, 1b listed, 1c PASS, 1d STOP and OPEN rows, 1e as expected, prebuilt console PASS | |
| -| 4 | Open the signing session: create the signer host and its role policy, with read on `apps/bab/console/*` and write on exactly `control/system/router/releases/v0.28.2.json` (`signing-host.md`) | one go for host and policy together | ready; IDs `SG`, `I` and `<run-id>` are created then | |
| -| 5 | 5.1 roster and enrollment | Paul's go | ready once 4 is done; the console enrollment token is generated at approval | |
| +| 4 | Open the signing session: create the signer host and its role policy, with read on `apps/bab/console/*` and write on exactly `control/system/router/releases/v0.28.2.json` (`signing-host.md`) | one go for host and policy together | DONE 2026-10-18: `SG` `sg-08c374c8c31ef448a`, `I` `i-0ea2852ef727929bb`, run-id `cohort1-20261018T101832Z`, session start 10:19:37Z | |
| +| 5 | 5.1 roster and enrollment | Paul's go | DONE 2026-10-18: roster revision 5 (leo, sophie, `dev-console`), inputs staged on both boxes; token generated on the signer, never printed | |
| | 6 | Step 6: sign the policy, publish the identity, arm leo, re-run P9, install the protected console, arm sophie, start the guarded console | Paul's go; restarts the dev console | P9 PASS today (09:13Z); re-run at 6.3 | |
| | 7 | Step 7: readers, floor, home, leo's key, console runtime | Paul's go; `home_region` becomes write-once | ready after 6 | |
| | 8 | Close the session: shred the key, terminate the signer, delete its role, profile and security group, CloudTrail check | none; always allowed | | |
| @@ -907,6 +907,37 @@ Expected: `staged` for each file. No private signing key is transferred. `policy |
| On failure: hold. A partly applied phase is resumed from the latest authenticated revision, never recreated. |
| +**Session opened and 5.1 done, 2026-10-18** (executor for the controller, on Paul's go for the whole signing session). |
| + |
| +Opening (`signing-host.md`, "Create"): |
| +- Created: role and inline policy `carlos-claim-signer` / `claim-signer` (extracted verbatim from `signing-host.md`; the `WriteIdentity` check printed `ok`), instance profile `carlos-claim-signer`, security group `sg-08c374c8c31ef448a` (no inbound, egress TCP 443 only), instance `i-0ea2852ef727929bb` (launched 10:18:32Z, SSM online 10:19:11Z), exchange run-id `cohort1-20261018T101832Z`. |
| +- On DOCS-T1, before upload: the v0.28.2 `SHA256SUMS.txt` signature printed "Signature Verified Successfully" with the README's pinned key. `carlos-linux-arm64` `7141e037...f492`, jq 1.7.1 `4dd2d8a0...b4a5`, `SHA256SUMS.txt` `9c29b3d3...` and `.sig` `0fdb8557...` all matched. `release.pub` was taken from leo's `CARLOS_RELEASE_PUBKEY`, identical on sophie, fingerprint `960d03ff`. |
| +- On the signer: both `sha256sum -c` lines `OK`, `carlos v0.28.2`, `jq-1.7.1`. Session start `2026-10-18T10:19:37Z`, recorded before the key fetch. Key at `/run/claim-signer/release.key`: `root 600 1 45`, tmpfs, no swap. |
| +- Console enrollment token generated on the signer at approval (`od -N16 /dev/urandom`), never printed. Format `^[0-9a-f]{32}$` ok, sha256 prefix `a611795b`. It lives only in the signer's `/root/claim-trial` and in the roster. |
| + |
| +How it ran: the signer has no attended shell. Each block went from DOCS-T1 as one SSM `send-command` that sources `/root/claim-trial/helpers.sh`, which holds this section's first helper block with `CARLOS=/usr/local/bin/carlos`, `KEY=/run/claim-signer/release.key` and no `AWS_PROFILE`. Each phase ran as a plain errexit statement with stdout to a file, which was printed with every `enrollment` value redacted. Run output carries the payload, enrollments included. |
| + |
| +5.1 results (every dry run, then its apply, succeeded): |
| + |
| +| Phase | Revision after | Write | Verdict | |
| +|---|---|---|---| |
| +| `initialize` | 1 | `control/host-actors.json`, empty roster | PASS | |
| +| `configure` | 2 | roster with region `ie` (namespace `platform`, pools `cohort1` and `console`) | PASS | |
| +| `invite-box` leo | 2 | `control/host-actor-invitations/leo-climbing.json` | PASS | |
| +| `enroll-box` leo | 3 | `leo-climbing`: pool `cohort1`, `i-046c7fe43620944bc`, state `active` | PASS | |
| +| `invite-box` sophie | 3 | `control/host-actor-invitations/sophie-knitting.json` | PASS | |
| +| `enroll-box` sophie | 4 | `sophie-knitting`: pool `console`, `i-05498eada6f0afd23`, state `active` | PASS | |
| +| `invite-console` | 4 | `control/host-console-invitations/dev-console.json`, compute `sophie-knitting` | PASS | |
| +| `enroll-console` | 5 | `dev-console`: namespaces `platform`, compute `sophie-knitting` | PASS | |
| + |
| +`invite-box` draws a fresh enrollment on every invocation, so the dry run's sha256 differs from the apply's; the apply's is what was written. The console's is fixed by the approved token, so its two values match. |
| + |
| +Final `refresh`: revision 5, etag `f3717d8d67f496ffd9525704c7a690b0`. `inspect.json` lists `leo-climbing` (pool `cohort1`, `i-046c7fe43620944bc`), `sophie-knitting` and `dev-console`; `holds` and `activations` are empty. Both enrollment files hold a 32-hex enrollment and the right instance ID. Outputs went through `claim-signer/cohort1-20261018T101832Z/out/` and were checked by sha256 on DOCS-T1: `inspect.json` `c9143bdf`, `roster.json` `6fc74d75`, `leo-climbing-enrollment.json` `800b181f`, `sophie-knitting-enrollment.json` `85380180`. |
| + |
| +Staging from DOCS-T1: `ok` for both directories, then `staged` for leo's `release.pub` and `leo-climbing-enrollment.json`, and for sophie's `release.pub`, `sophie-knitting-enrollment.json` and `console-id` (`dev-console`). A read-only check found each one root:root `600`, link count 1, its sha256 matching, in a root `700` `/root/claim-trial`. No host.env or flag was changed on any box. |
| + |
| +The signer stays up with the key in tmpfs for step 6. |
| + |
| ## Step 6. Arm leo's guard and start the guarded console |
| Inside the signing session, after 5.1. Waits for v0.28.2 on dev and for 5.0a. Everything this step adds is on main 7c1beb2d, published (v0.28.2, tag on 7c1beb2d): the `claims run` phases `sign-policy` and `publish-identity`, `claims run --out`, and `claims install-console`. Never hand-make any of their files. The builder findings from the review of that branch (the release-tag stamp, 5.0a, the fixed console path and the verbatim identity inputs) are drafted here for Paul after v0.28.2. |